@blamejs/exceptd-skills 0.18.6 → 0.18.8

package/lib/prefetch.js

@@ -289,7 +289,8 @@ Outputs:
 
 async function timedFetch(url, headers = {}) {
   const ac = new AbortController();
-  const t = setTimeout(() => ac.abort(), REQUEST_TIMEOUT_MS);
+  let timedOut = false;
+  const t = setTimeout(() => { timedOut = true; ac.abort(); }, REQUEST_TIMEOUT_MS);
   try {
     const res = await fetch(url, {
       signal: ac.signal,
@@ -297,6 +298,11 @@ async function timedFetch(url, headers = {}) {
     });
     if (!res.ok) {
       const err = new Error(`HTTP ${res.status}`);
+      // The vendored retry classifier (vendor/blamejs/retry.js isRetryable)
+      // keys off err.statusCode — set it so a 429/5xx from KEV/NVD/EPSS/OSV
+      // routes through the job-queue backoff instead of being dropped on the
+      // first hiccup. err.status kept for callers that read it for messaging.
+      err.statusCode = res.status;
       err.status = res.status;
       throw err;
     }
@@ -304,6 +310,20 @@ async function timedFetch(url, headers = {}) {
     const lastModified = res.headers.get("last-modified") || null;
     const json = await res.json();
     return { json, etag, lastModified };
+  } catch (e) {
+    // A timeout surfaces as an AbortError with NO statusCode, which the retry
+    // classifier would not retry — so under heavy upstream load (NVD rate
+    // limiting + slow responses) timed-out fetches piled up as final errors and
+    // pushed the total past --max-errors, failing the whole scheduled refresh.
+    // Re-mark a timeout as a retryable network error (ETIMEDOUT) so the job
+    // queue backs off and retries instead of dropping it on the first slow
+    // response.
+    if (timedOut || (e && (e.name === "AbortError" || e.code === "ABORT_ERR"))) {
+      const te = new Error(`request timed out after ${REQUEST_TIMEOUT_MS}ms`);
+      te.code = "ETIMEDOUT";
+      throw te;
+    }
+    throw e;
   } finally {
     clearTimeout(t);
   }
@@ -913,5 +933,5 @@ module.exports = {
   // Not part of the operator-facing API — internal contract for tests
   // that need to exercise the lockfile path without spawning the full
   // prefetch network pipeline.
-  _internal: { withIndexLock, writeFileAtomic, loadIndex, saveIndex },
+  _internal: { withIndexLock, writeFileAtomic, loadIndex, saveIndex, timedFetch },
 };

package/lib/refresh-external.js

@@ -267,11 +267,42 @@ const KEV_SOURCE = {
     const report = await validateAllCves(ctx.cveCatalog, { concurrency: 4 });
     const diffs = [];
     let errors = 0;
+    // Mirror the cache path's implausibly-small-feed guard. The live KEV map is
+    // fetched once per process and its size is surfaced on every reachable
+    // result as fetched.sources.kev.total_entries. A feed that JSON-parses but
+    // is far below a real CISA snapshot (a partial CDN response, a momentarily
+    // near-empty feed) must not be trusted to de-list curated entries. When the
+    // size is known and below the floor we hold ALL de-listings for review,
+    // exactly as kevDiffFromCache does; when the size is unknown (no reachable
+    // KEV result carried it) we fall back to the per-entry curated-signal guard.
+    let liveFeedSize = null;
+    for (const r of report.results) {
+      const n = r && r.fetched && r.fetched.sources && r.fetched.sources.kev
+        && r.fetched.sources.kev.total_entries;
+      if (typeof n === "number") { liveFeedSize = n; break; }
+    }
+    const feedComplete = liveFeedSize === null || liveFeedSize >= KEV_FEED_MIN_PLAUSIBLE;
     for (const r of report.results) {
       if (r.status === "unreachable") errors++;
       for (const d of r.discrepancies || []) {
         if (d.field === "cisa_kev" || d.field === "cisa_kev_date") {
-          diffs.push({ id: r.cve_id, field: d.field, before: d.local, after: d.fetched, severity: d.severity });
+          const diff = { id: r.cve_id, field: d.field, before: d.local, after: d.fetched, severity: d.severity };
+          // Symmetric with the --from-cache path: a LIVE KEV de-listing
+          // (true→false) is held for review (applyDiff skips review_only)
+          // instead of auto-downgrading the entry when EITHER the entry carries
+          // strong human-curated exploitation signal OR the live feed is
+          // implausibly small. Without this the live path silently de-listed
+          // confirmed-exploitation CVEs the cache path would have held back, and
+          // a truncated-but-valid feed could de-list every non-curated entry.
+          if (d.field === "cisa_kev" && d.local === true && d.fetched === false &&
+              (!feedComplete || hasCuratedExploitSignal(ctx.cveCatalog && ctx.cveCatalog[r.cve_id]))) {
+            diff.review_only = true;
+            diff.kev_delist_review = true;
+            diff.note = !feedComplete
+              ? `KEV de-listing held for review: live feed returned only ${liveFeedSize} entries (< ${KEV_FEED_MIN_PLAUSIBLE}), likely incomplete. Confirm against a complete CISA KEV snapshot before de-listing ${r.cve_id}.`
+              : `KEV de-listing held for review: ${r.cve_id} carries curated exploitation signal; confirm a genuine CISA removal before downgrading.`;
+          }
+          diffs.push(diff);
         }
       }
     }

package/lib/refresh-network.js

@@ -42,6 +42,24 @@ const os = require("os");
 
 const ROOT = path.resolve(__dirname, "..");
 const PKG_NAME = "@blamejs/exceptd-skills";
+// Unscoped basename for the npm tarball filename: @scope/name -> name.
+const PKG_UNSCOPED = PKG_NAME.includes("/") ? PKG_NAME.split("/").pop() : PKG_NAME;
+// Strict semver — the ONLY registry-metadata field embedded in the fetch URL.
+// A value that passes this guard cannot carry a path separator, URL scheme, or
+// host, so the canonical tarball URL built from it has no metadata-controlled
+// destination component.
+const SEMVER_RE = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
+
+// The canonical npm tarball URL for this package@version, built entirely from
+// string literals plus a semver-guarded version. The fetch destination is no
+// longer derived from the metadata-supplied dist.tarball, so a tampered or
+// fixture-injected /latest response cannot steer the download at an internal or
+// attacker-controlled address — strictly stronger than host-allowlisting the
+// metadata URL. Content trust still rests on the SHA-512/SRI + shasum + Ed25519
+// checks downstream.
+function canonicalTarballUrl(version) {
+  return `https://registry.npmjs.org/${PKG_NAME}/-/${PKG_UNSCOPED}-${version}.tgz`;
+}
 const REQUEST_TIMEOUT_MS = 15000;
 
 function parseArgs(argv) {
@@ -72,7 +90,12 @@ function progress(line, json) {
   process.stderr.write(`[refresh-network] ${line}\n`);
 }
 
-function getJson(url, timeoutMs) {
+// Cap the registry metadata read so a hostile/misconfigured endpoint can't
+// stream unbounded JSON into RAM (the /latest response is a few KB; 16 MB is
+// generous headroom). Symmetric with getBuffer's tarball streaming cap.
+const JSON_RESPONSE_CAP_BYTES = 16 * 1024 * 1024;
+
+function getJsonOnce(url, timeoutMs) {
   return new Promise((resolve, reject) => {
     const u = new URL(url);
     const req = https.get({
@@ -82,23 +105,64 @@ function getJson(url, timeoutMs) {
     }, (res) => {
       if (res.statusCode !== 200) {
         res.resume();
-        return reject(new Error(`HTTP ${res.statusCode} from ${url}`));
+        const e = new Error(`HTTP ${res.statusCode} from ${url}`);
+        e.statusCode = res.statusCode; // let withRetry's classifier retry 429/5xx
+        return reject(e);
       }
       const chunks = [];
-      res.on("data", (c) => chunks.push(c));
+      let total = 0;
+      res.on("data", (c) => {
+        total += c.length;
+        if (total > JSON_RESPONSE_CAP_BYTES) {
+          req.destroy(new Error(`registry response exceeds ${JSON_RESPONSE_CAP_BYTES}-byte cap`));
+          return;
+        }
+        chunks.push(c);
+      });
       res.on("end", () => {
         try { resolve(JSON.parse(Buffer.concat(chunks).toString("utf8"))); }
         catch (e) { reject(new Error(`parse: ${e.message}`)); }
       });
     });
-    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("timeout", () => { const te = new Error("timeout"); te.code = "ETIMEDOUT"; req.destroy(te); });
     req.on("error", reject);
   });
 }
 
-function getBuffer(url, timeoutMs) {
+// Adopt the vendored blamejs retry primitive: a transient registry failure
+// (HTTP 429/5xx, ECONNRESET/ETIMEDOUT family) is retried with exponential
+// backoff + jitter instead of aborting the whole --network refresh on the
+// first network hiccup. Permanent conditions (parse error, size-cap) carry no
+// statusCode/code, so the classifier does not retry them.
+function getJson(url, timeoutMs) {
+  // Lazy require: a parseTar-only consumer (scripts/verify-shipped-tarball.js)
+  // loads this module in a context where vendor/ may not be present, and it
+  // never calls getJson — so retry must not be a load-time dependency.
+  const { withRetry } = require("../vendor/blamejs/retry.js");
+  return withRetry(() => getJsonOnce(url, timeoutMs), { maxAttempts: 3, baseDelayMs: 100, maxDelayMs: 2000, jitterFactor: 0.5 });
+}
+
+// The tarball URL is taken from the registry metadata (or, under
+// EXCEPTD_REGISTRY_FIXTURE, a local fixture file), so it is not a hardcoded
+// constant the way the /latest metadata URL is. Pin its host to the npm
+// registry the metadata was queried from, so a tampered metadata response or
+// fixture cannot steer the fetch at an internal or attacker-controlled address.
+// Content trust still rests on the SHA-512/SRI + shasum + Ed25519 checks below;
+// this is fetch-destination defense-in-depth.
+const ALLOWED_TARBALL_HOST = /(?:^|\.)npmjs\.org$|(?:^|\.)npmjs\.com$/;
+
+// Exported for in-process tests of the fetch-destination guard.
+function isAllowedTarballHost(url) {
+  try { return ALLOWED_TARBALL_HOST.test(new URL(url).hostname.toLowerCase()); }
+  catch { return false; }
+}
+
+function getBufferOnce(url, timeoutMs) {
   return new Promise((resolve, reject) => {
     const u = new URL(url);
+    if (!isAllowedTarballHost(url)) {
+      return reject(new Error(`refusing to fetch tarball from non-allowlisted host: ${u.hostname}`));
+    }
     const cap = (() => {
       const env = parseInt(process.env.EXCEPTD_TARBALL_SIZE_CAP_BYTES, 10);
       return Number.isFinite(env) && env > 0 ? env : 200 * 1024 * 1024;
@@ -110,7 +174,9 @@ function getBuffer(url, timeoutMs) {
     }, (res) => {
       if (res.statusCode !== 200) {
         res.resume();
-        return reject(new Error(`HTTP ${res.statusCode} from ${url}`));
+        const e = new Error(`HTTP ${res.statusCode} from ${url}`);
+        e.statusCode = res.statusCode; // retryable 429/5xx via withRetry
+        return reject(e);
       }
       const chunks = [];
       let total = 0;
@@ -126,11 +192,19 @@ function getBuffer(url, timeoutMs) {
       });
       res.on("end", () => resolve(Buffer.concat(chunks)));
     });
-    req.on("timeout", () => req.destroy(new Error("timeout")));
+    req.on("timeout", () => { const te = new Error("timeout"); te.code = "ETIMEDOUT"; req.destroy(te); });
     req.on("error", reject);
   });
 }
 
+// Wrap the tarball fetch in the same vendored retry primitive (BJS-01). The
+// host-allowlist rejection + size-cap carry no statusCode/code, so a permanent
+// refusal is not retried; a transient 5xx / reset / timeout is.
+function getBuffer(url, timeoutMs) {
+  const { withRetry } = require("../vendor/blamejs/retry.js"); // lazy — see getJson
+  return withRetry(() => getBufferOnce(url, timeoutMs), { maxAttempts: 3, baseDelayMs: 100, maxDelayMs: 2000, jitterFactor: 0.5 });
+}
+
 /**
  * Parse a tar buffer (uncompressed) and return [{ name, body }] entries.
  * Tiny implementation — supports the GNU ustar variant npm produces.
@@ -193,6 +267,56 @@ function verifyDetached(publicKeyObj, payload, sigB64) {
   } catch { return false; }
 }
 
+// Pinned npm registry signing keys (https://registry.npmjs.org/-/npm/v1/keys).
+// The registry signs `<pkg>@<version>:<integrity>` with an ECDSA P-256
+// (secp256r1 / ecdsa-sha2-nistp256) key; `dist.signatures[]` carries the
+// keyid + base64 signature. These keys are pinned in-tree on purpose: fetching
+// them over the network would mean authenticating the metadata response with a
+// key obtained from the same untrusted channel, which is circular. They also
+// rotate rarely and out-of-band. Values are SPKI DER, base64-encoded.
+const NPM_REGISTRY_KEYS = Object.freeze({
+  "SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA":
+    "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg==",
+  "SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U":
+    "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEY6Ya7W++7aUPzvMTrezH6Ycx3c+HOKYCcNGybJZSCJq/fd7Qa8uuAKtdIkUQtQiEKERhAmE5lMMJhP8OkDOa2g==",
+});
+
+// Verify the npm registry's signature over `<pkg>@<version>:<integrity>`.
+// Returns:
+//   { status: "valid", keyid }            — a pinned key verified the signature
+//   { status: "absent" }                  — no dist.signatures entries supplied
+//   { status: "unverifiable", reason }     — integrity missing (nothing to sign over)
+//   { status: "unknown-keyid", keyid }     — signature keyid is not a pinned npm key
+//   { status: "invalid", reason }          — a present, pinned-keyid signature did NOT verify
+//
+// The caller treats `valid` as an authenticity anchor over the WHOLE tarball
+// (including the unsigned data/ tree), `invalid`/`unknown-keyid` as a hard
+// refusal, and `absent`/`unverifiable` as warn-and-continue (so private or
+// pre-signing registries still work — the SHA-512/SHA-1 gates still apply).
+function verifyNpmRegistrySignature(pkg, version, integrity, signatures) {
+  if (!Array.isArray(signatures) || signatures.length === 0) return { status: "absent" };
+  if (typeof integrity !== "string" || integrity.length === 0) {
+    return { status: "unverifiable", reason: "dist.integrity missing — no canonical message to verify the registry signature over" };
+  }
+  const message = Buffer.from(`${pkg}@${version}:${integrity}`, "utf8");
+  for (const entry of signatures) {
+    if (!entry || typeof entry.keyid !== "string" || typeof entry.sig !== "string") continue;
+    const spkiB64 = NPM_REGISTRY_KEYS[entry.keyid];
+    if (!spkiB64) return { status: "unknown-keyid", keyid: entry.keyid };
+    let keyObj;
+    try {
+      keyObj = crypto.createPublicKey({ key: Buffer.from(spkiB64, "base64"), format: "der", type: "spki" });
+    } catch (e) {
+      return { status: "invalid", reason: `pinned npm key ${entry.keyid} failed to load: ${e.message}` };
+    }
+    let ok = false;
+    try { ok = crypto.verify("sha256", message, keyObj, Buffer.from(entry.sig, "base64")); }
+    catch (e) { return { status: "invalid", reason: `crypto.verify threw for keyid ${entry.keyid}: ${e.message}` }; }
+    if (ok) return { status: "valid", keyid: entry.keyid };
+  }
+  return { status: "invalid", reason: "no dist.signatures[] entry verified against the pinned npm registry key" };
+}
+
 // v0.12.14: CRLF/BOM normalization mirrors lib/verify.js's
 // normalize(). Duplicated here to keep refresh-network free of cross-module
 // runtime deps. ANY change here MUST be mirrored in lib/verify.js +
@@ -302,7 +426,7 @@ async function main() {
       // + dist.shasum, or just version to exercise the early-return path).
       meta = JSON.parse(fs.readFileSync(process.env.EXCEPTD_REGISTRY_FIXTURE, "utf8"));
     } else {
-      meta = await getJson(`https://registry.npmjs.org/${encodeURIComponent(PKG_NAME).replace("%40", "@").replace("%2F", "/")}/latest`, opts.timeoutMs);
+      meta = await getJson(`https://registry.npmjs.org/${encodeURIComponent(PKG_NAME).replace(/%40/g, "@").replace(/%2F/g, "/")}/latest`, opts.timeoutMs);
     }
   } catch (e) {
     emit({ ok: false, error: `registry unreachable: ${e.message}`, hint: "Network required. Air-gap workflow: run `exceptd refresh --prefetch` on a connected host, then `exceptd refresh --from-cache --apply` offline. Or set EXCEPTD_REGISTRY_FIXTURE for offline testing." }, opts.json);
@@ -340,11 +464,25 @@ async function main() {
     process.exitCode = 3; return;
   }
 
-  progress(`fetching ${tarballUrl} (${tarballShasum?.slice(0, 12) || "no shasum"})...`, opts.json);
+  // Build the fetch destination from constants + a semver-validated version
+  // rather than from the metadata-supplied dist.tarball, so the registry
+  // response cannot steer the download's host or path. The metadata URL is
+  // still cross-checked for visibility; a divergence is noted, not fatal,
+  // because the authenticity anchor is the SHA-512/shasum/Ed25519 chain below.
+  if (!SEMVER_RE.test(String(latestVersion))) {
+    emit({ ok: false, error: `registry metadata version is not valid semver: ${String(latestVersion).slice(0, 64)}` }, opts.json);
+    process.exitCode = 2; return;
+  }
+  const canonicalUrl = canonicalTarballUrl(latestVersion);
+  if (tarballUrl !== canonicalUrl) {
+    progress(`note: registry dist.tarball (${tarballUrl}) differs from canonical npm URL; fetching ${canonicalUrl}`, opts.json);
+  }
+
+  progress(`fetching ${canonicalUrl} (${tarballShasum?.slice(0, 12) || "no shasum"})...`, opts.json);
 
   let tgzBuf;
   try {
-    tgzBuf = await getBuffer(tarballUrl, opts.timeoutMs);
+    tgzBuf = await getBuffer(canonicalUrl, opts.timeoutMs);
   } catch (e) {
     emit({ ok: false, error: `tarball fetch failed: ${e.message}` }, opts.json);
     process.exitCode = 2; return;
@@ -357,12 +495,26 @@ async function main() {
     process.exitCode = 4; return;
   }
 
-  // v0.12.14: verify SHA-512 SRI first (collision-resistant
-  // beyond SHA-1 reach), then SHA-1 shasum for compatibility, then dist.
-  // signatures[] (npm registry's Ed25519 signing key). Each layer is
-  // defense-in-depth — registry compromise that produces a SHA-1 collision
-  // doesn't trivially produce a SHA-512 collision; an attacker who breaks
-  // both still has to forge the npm-signing-key signature on the tarball.
+  // Verify SHA-512 SRI first (collision-resistant beyond SHA-1 reach), then
+  // SHA-1 shasum for compatibility. Both are transport hashes drawn from the
+  // registry metadata response, so they only prove the downloaded tarball
+  // matches the hashes THAT RESPONSE declared — an attacker who can forge the
+  // metadata serves a tampered tarball plus matching SHA-512/SHA-1 and both
+  // pass. The npm registry's signature over `<pkg>@<version>:<integrity>`
+  // (verified further below, after the both-absent refusal) is the only layer
+  // an attacker forging the metadata cannot also forge, because it is made
+  // with npm's registry private key, which they do not hold.
+  //
+  // `integrityVerified` records whether at least one transport hash actually
+  // matched the downloaded bytes. The per-skill + manifest Ed25519 signatures
+  // below authenticate skills/ + manifest.json, but the swap loop ALSO
+  // replaces data/ and manifest-snapshot.json, which carry no per-content
+  // signature — a transport hash is their only integrity anchor. When the
+  // registry metadata supplies NEITHER dist.integrity (sha512 SRI) NOR a
+  // dist.shasum, both branches are skipped and those bytes would otherwise be
+  // swapped in with zero verification, so the both-absent case is refused
+  // below rather than falling through to an unauthenticated swap.
+  let integrityVerified = false;
   if (tarballIntegrity && /^sha512-/.test(tarballIntegrity)) {
     const expected = tarballIntegrity.slice("sha512-".length);
     const actual = crypto.createHash("sha512").update(tgzBuf).digest("base64");
@@ -370,9 +522,11 @@ async function main() {
       emit({ ok: false, error: `tarball SHA-512 integrity mismatch: dist.integrity=${tarballIntegrity}, actual=sha512-${actual}` }, opts.json);
       process.exitCode = 4; return;
     }
+    integrityVerified = true;
   } else if (tarballIntegrity) {
     // Non-sha512 SRI (e.g. sha384) — emit a warning but accept; SHA-1 path
-    // below still gates.
+    // below still gates. A non-sha512 SRI is not actually checked here, so it
+    // does not count toward integrityVerified.
     progress(`note: dist.integrity present but not sha512: ${tarballIntegrity.slice(0, 40)}`, opts.json);
   }
 
@@ -383,6 +537,51 @@ async function main() {
       emit({ ok: false, error: `tarball shasum mismatch: expected ${tarballShasum}, got ${actual}` }, opts.json);
       process.exitCode = 4; return;
     }
+    integrityVerified = true;
+  }
+
+  // Refuse the swap when no transport hash was verifiable. data/ and
+  // manifest-snapshot.json have no per-content signature, so absent both
+  // dist.integrity and dist.shasum there is no integrity anchor on those bytes
+  // and a tampered registry response (or a hostile EXCEPTD_REGISTRY_FIXTURE)
+  // could inject arbitrary catalog/playbook/index content. `npm update -g`
+  // runs the full provenance-verified path (sha512 SRI + npm Ed25519 registry
+  // signatures + sigstore attestations), so it is the correct fallback.
+  if (!integrityVerified) {
+    emit({
+      ok: false,
+      error: "registry metadata carries no verifiable transport integrity (dist.integrity sha512 SRI and dist.shasum both absent) — refusing to swap unsigned data/ + manifest-snapshot.json",
+      hint: "data/ and manifest-snapshot.json are not covered by the per-skill or manifest Ed25519 signature; a transport hash is their only integrity anchor. Run `npm update -g @blamejs/exceptd-skills` for the full provenance-verified path.",
+    }, opts.json);
+    process.exitCode = 4; return;
+  }
+
+  // Verify the npm registry's signature over `<pkg>@<version>:<integrity>`.
+  // This is the authenticity anchor the transport hashes above cannot be: the
+  // hashes come from the same (possibly forged) metadata response as the
+  // tarball URL, but this signature is made with npm's registry private key.
+  // It transitively authenticates the WHOLE tarball — including the data/ and
+  // manifest-snapshot.json bytes that carry no per-content Ed25519 signature.
+  //   - valid           → strongest anchor present; proceed.
+  //   - invalid / unknown-keyid → a present signature did not verify against a
+  //                       pinned npm key (or steers us to an unpinned key);
+  //                       this is the forged-metadata signal — refuse.
+  //   - absent / unverifiable   → registry supplied no signature (private or
+  //                       pre-signing registry); the SHA-512/SHA-1 gates above
+  //                       still applied, so warn-and-continue.
+  const regSig = verifyNpmRegistrySignature(PKG_NAME, latestVersion, tarballIntegrity, registrySignatures);
+  if (regSig.status === "invalid" || regSig.status === "unknown-keyid") {
+    emit({
+      ok: false,
+      error: `npm registry signature ${regSig.status} for ${PKG_NAME}@${latestVersion} — refusing to swap`,
+      reason: regSig.reason || null,
+      keyid: regSig.keyid || null,
+      hint: "dist.signatures is present but did not verify against the pinned npm registry key. A forged metadata response cannot reproduce this signature, so treat it as tampering. Run `npm update -g @blamejs/exceptd-skills` for the full provenance-verified path, or report at https://github.com/blamejs/exceptd-skills/issues.",
+    }, opts.json);
+    process.exitCode = 5; return;
+  }
+  if (regSig.status === "absent" || regSig.status === "unverifiable") {
+    progress(`note: npm registry signature ${regSig.status} (${regSig.reason || "no dist.signatures"}) — relying on transport-hash integrity only`, opts.json);
   }
 
   // Extract.
@@ -602,14 +801,16 @@ async function main() {
     process.exitCode = 5; return;
   }
 
-  // v0.12.14: the swap loop replaces `data/` + `manifest.json` +
-  // `manifest-snapshot.json` in addition to `skills/`. None of those files
-  // are covered by the per-skill Ed25519 signature (which signs only the
-  // skill body bytes). The only integrity check between the registry and
-  // those bytes is SHA-1 dist.shasum — collision-broken since 2017 and
-  // weaker than `npm install` itself which honors dist.integrity (SHA-512
-  // SRI) + dist.signatures (npm Ed25519 registry key) + dist.attestations
-  // (sigstore SLSA provenance).
+  // The swap loop replaces `data/` + `manifest.json` + `manifest-snapshot.json`
+  // in addition to `skills/`. None of those files are covered by the per-skill
+  // Ed25519 signature (which signs only the skill body bytes). Their integrity
+  // anchors are: the SHA-512 SRI + SHA-1 shasum transport hashes (checked
+  // above; both-absent is refused), AND — when the registry supplies it — the
+  // npm registry ECDSA-P256 signature over `<pkg>@<version>:<integrity>`
+  // (verifyNpmRegistrySignature above), which authenticates the whole tarball
+  // against npm's pinned signing key and cannot be reproduced by a forged
+  // metadata response. `npm update -g` additionally honors dist.attestations
+  // (sigstore SLSA provenance), which this data-only path does not consume.
   //
   // Defense-in-depth: refuse the swap if the manifest skills list doesn't
   // exactly match the skill payload entries present in the tarball. A
@@ -705,7 +906,9 @@ async function main() {
       files_written: written,
       backup_dir: path.relative(ROOT, backupDir),
       registry_signatures_present: registrySignatures.length,
-      message: `refreshed catalog from v${localVersion} → v${latestVersion} (${verifiedCount}/${skills.length} signatures verified). Backup at ${path.relative(ROOT, backupDir)} — safe to remove after verifying the new run.`,
+      registry_signature_status: regSig.status,
+      registry_signature_keyid: regSig.keyid || null,
+      message: `refreshed catalog from v${localVersion} → v${latestVersion} (${verifiedCount}/${skills.length} skill signatures verified, npm registry signature: ${regSig.status}). Backup at ${path.relative(ROOT, backupDir)} — safe to remove after verifying the new run.`,
     }, opts.json);
   } catch (e) {
     // v0.12.14: walk completedSteps in reverse to undo partial work.
@@ -759,4 +962,10 @@ module.exports = {
   // check.
   verifyTarballManifestSignature,
   canonicalManifestBytesForRefresh,
+  // Exported for in-process tests of the tarball fetch-destination allowlist.
+  isAllowedTarballHost,
+  // Exported for in-process tests of the npm registry signature verification
+  // over `<pkg>@<version>:<integrity>`.
+  verifyNpmRegistrySignature,
+  NPM_REGISTRY_KEYS,
 };

package/lib/schemas/cve-catalog.schema.json

@@ -41,6 +41,11 @@
       "minLength": 1,
       "description": "Vulnerability class (LPE, RCE-via-prompt-injection, RCE-supply-chain, etc.)."
     },
+    "attack_class": {
+      "type": "string",
+      "enum": ["kernel-lpe", "mcp-supply-chain", "ai-c2", "prompt-injection", "container-escape"],
+      "description": "Optional coarse chainable taxonomy the sbom -> deep-dive feeds_into rules quantify over (any matched_cve.attack_class == 'kernel-lpe'). Distinct from the free-form `type`: a small fixed set of deep-dive playbook attack classes a matched CVE routes to. Absent when a CVE does not map cleanly to one, so the chain correctly does not fire rather than misrouting."
+    },
     "cvss_score": {
       "type": "number",
       "minimum": 0.0,