@blamejs/exceptd-skills 0.18.6 → 0.18.8

package/lib/scoring.js

@@ -81,13 +81,73 @@ const ACTIVE_EXPLOITATION_LADDER = {
   none:        0,
 };
 
+/**
+ * Resolve the active_exploitation ladder multiplier for a factor value.
+ *
+ * The bare `ACTIVE_EXPLOITATION_LADDER[v] ?? 0` lookup silently mapped any
+ * out-of-vocabulary string ('exploited', 'in-the-wild', a future vocabulary
+ * value) AND any case/whitespace variant ('Confirmed', ' CONFIRMED ') to 0 —
+ * dropping up to the full active_exploitation weight (20 pts) from the RWEP
+ * with no diagnostic, while validateFactors() flagged the same string. This
+ * is the recurring "out-of-vocab token -> silent zero" class: the no-match
+ * path must surface an error, not a silent default (same remedy as the
+ * playbook-runner condition-evaluator hyphen fix).
+ *
+ * - Case-normalises the lookup so 'Confirmed' / ' CONFIRMED ' resolve to the
+ *   canonical ladder entry instead of zeroing.
+ * - null / undefined are the documented "treated as 'none'" default (mult 0,
+ *   recognised) — these are not typos.
+ * - A non-empty string NOT in the ladder, or a non-string non-nullish value,
+ *   is UNRECOGNISED: returns multiplier 0 AND emits a process warning so the
+ *   zeroed factor is observable in the bare-number call path. The structured
+ *   diagnostic for the collectWarnings path is produced by validateFactors().
+ *
+ * Returns { multiplier, recognised, normalised }.
+ */
+function resolveActiveExploitation(active_exploitation) {
+  if (active_exploitation === undefined || active_exploitation === null) {
+    // documented default: absent active_exploitation is scored as 'none'.
+    return { multiplier: ACTIVE_EXPLOITATION_LADDER.none, recognised: true, normalised: 'none' };
+  }
+  if (typeof active_exploitation === 'string') {
+    const norm = active_exploitation.trim().toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(ACTIVE_EXPLOITATION_LADDER, norm)) {
+      return { multiplier: ACTIVE_EXPLOITATION_LADDER[norm], recognised: true, normalised: norm };
+    }
+    return { multiplier: 0, recognised: false, normalised: norm };
+  }
+  return { multiplier: 0, recognised: false, normalised: null };
+}
+
+function activeExploitationMultiplier(active_exploitation) {
+  const r = resolveActiveExploitation(active_exploitation);
+  if (!r.recognised) {
+    // Observable diagnostic for the bare-number call path (scoreCustom without
+    // collectWarnings, which the production write-paths use). Routed through
+    // process.emitWarning so it lands on the standard Node diagnostic channel
+    // without changing the function's number return contract; deduped per
+    // distinct offending value so a batch curation run doesn't flood stderr.
+    const detail = active_exploitation === undefined || active_exploitation === null
+      ? String(active_exploitation)
+      : (typeof active_exploitation === 'string' ? JSON.stringify(active_exploitation) : `${typeof active_exploitation} ${JSON.stringify(active_exploitation)}`);
+    process.emitWarning(
+      `active_exploitation ${detail} is not in the recognised ladder (${Object.keys(ACTIVE_EXPLOITATION_LADDER).join(', ')}); contributing 0 active-exploitation weight`,
+      { type: 'RwepActiveExploitationUnrecognised', code: 'RWEP_AE_UNRECOGNISED' },
+    );
+  }
+  return r.multiplier;
+}
+
 // The canonical set of factor keys scoreCustom recognises. Used by
 // validateFactors to flag unknown keys.
 const RECOGNISED_FACTOR_KEYS = new Set([
   'cisa_kev', 'poc_available', 'ai_assisted_weapon', 'ai_discovered',
   'active_exploitation', 'blast_radius', 'patch_available',
   'live_patch_available', 'reboot_required',
-  // accepted alias for the catalog field name
+  // accepted aliases for the catalog field names: a factor bag built straight
+  // from a catalog entry carries `ai_assisted_weaponization` (the field the
+  // catalog declares) and `patch_required_reboot`, not the legacy short forms.
+  'ai_assisted_weaponization',
   'patch_required_reboot',
 ]);
 
@@ -119,17 +179,34 @@ function validateFactors(factors) {
   const boolFields = ['cisa_kev', 'poc_available', 'ai_assisted_weapon', 'ai_discovered',
                       'patch_available', 'live_patch_available', 'reboot_required'];
   for (const f of boolFields) {
-    if (factors[f] === undefined || factors[f] === null) {
+    // The catalog field `ai_assisted_weaponization` satisfies `ai_assisted_weapon`,
+    // and `patch_required_reboot` satisfies `reboot_required` — the same aliasing
+    // scoreCustom/deriveRwepFromFactors honor, so validateFactors must accept a
+    // block that supplies only the alias instead of flagging it "missing".
+    const present = (f === 'ai_assisted_weapon')
+      ? (factors.ai_assisted_weapon ?? factors.ai_assisted_weaponization)
+      : (f === 'reboot_required')
+        ? (factors.reboot_required ?? factors.patch_required_reboot)
+        : factors[f];
+    if (present === undefined || present === null) {
       warnings.push(`${f}: missing (treated as false; explicit value recommended)`);
-    } else if (typeof factors[f] !== 'boolean') {
-      warnings.push(`${f}: expected boolean, got ${typeof factors[f]} (${JSON.stringify(factors[f])})`);
+    } else if (typeof present !== 'boolean') {
+      warnings.push(`${f}: expected boolean, got ${typeof present} (${JSON.stringify(present)})`);
     }
   }
   const aeAllowed = ['none', 'unknown', 'suspected', 'theoretical', 'confirmed'];
-  if (factors.active_exploitation === undefined || factors.active_exploitation === null) {
+  const aeRaw = factors.active_exploitation;
+  if (aeRaw === undefined || aeRaw === null) {
     warnings.push("active_exploitation: missing (treated as 'none')");
-  } else if (!aeAllowed.includes(factors.active_exploitation)) {
-    warnings.push(`active_exploitation: expected one of ${aeAllowed.join(', ')}, got ${JSON.stringify(factors.active_exploitation)}`);
+  } else {
+    // Normalize (trim + lowercase) before the vocab check so validateFactors
+    // accepts exactly what scoreCustom/resolveActiveExploitation accept — a
+    // stray-cased 'Confirmed' / ' confirmed ' must not be flagged here while the
+    // scorer consumes it, or the two surfaces disagree.
+    const aeNorm = typeof aeRaw === 'string' ? aeRaw.trim().toLowerCase() : aeRaw;
+    if (!aeAllowed.includes(aeNorm)) {
+      warnings.push(`active_exploitation: expected one of ${aeAllowed.join(', ')}, got ${JSON.stringify(aeRaw)}`);
+    }
   }
   // NaN diagnostics. The prior message read "expected number,
   // got number (null)" because `JSON.stringify(NaN) === 'null'` and `typeof
@@ -180,6 +257,10 @@ function scoreCustom(factors, opts) {
     cisa_kev = false,
     poc_available = false,
     ai_assisted_weapon = false,
+    // The catalog field is `ai_assisted_weaponization`; accept it as an alias
+    // so a factor bag built directly from a catalog entry still counts the AI
+    // factor instead of silently dropping the +15 weight.
+    ai_assisted_weaponization = false,
     ai_discovered = false,
     active_exploitation = 'none',
     blast_radius = 0,
@@ -198,7 +279,7 @@ function scoreCustom(factors, opts) {
   let score = 0;
   score += cisa_kev ? RWEP_WEIGHTS.cisa_kev : 0;
   score += poc_available ? RWEP_WEIGHTS.poc_available : 0;
-  score += (ai_assisted_weapon || ai_discovered) ? RWEP_WEIGHTS.ai_factor : 0;
+  score += (ai_assisted_weapon || ai_assisted_weaponization || ai_discovered) ? RWEP_WEIGHTS.ai_factor : 0;
   // active_exploitation goes through the ladder rather
   // than two hand-written branches with `Math.floor(weight/2)`. The floor
   // was a no-op for even weights (20/2 = 10) but would have silently
@@ -206,7 +287,7 @@ function scoreCustom(factors, opts) {
   // weight to 21. The ladder + multiplication preserves the contribution
   // exactly, including the new `unknown → 0.25 × weight = 5` mapping that
   // aligns the catalog scorer with playbook-runner._activeExploitationLadder.
-  const aeMultiplier = ACTIVE_EXPLOITATION_LADDER[active_exploitation] ?? 0;
+  const aeMultiplier = activeExploitationMultiplier(active_exploitation);
   score += RWEP_WEIGHTS.active_exploitation * aeMultiplier;
   // v0.12.15: blast_radius numeric coercion must reject
   // NaN, Infinity, and strings explicitly. The prior `typeof === 'number'`
@@ -278,15 +359,38 @@ function deriveRwepFromFactors(factors) {
   if (values.length === 0) return 0;
   const aeAllowed = new Set(['none', 'unknown', 'suspected', 'theoretical', 'confirmed']);
   const hasBooleanOrLadder = values.some(
-    (v) => typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v)),
+    (v) => typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase())),
   );
   if (hasBooleanOrLadder) {
     return scoreCustom(factors);
   }
   // Shape B: catalog post-weight. Sum + clamp.
+  //
+  // blast_radius is the one Shape B field with a per-factor ceiling: it is a
+  // RAW 0..30 magnitude, not a post-weight contribution (see the dual-semantics
+  // note at the top of this file). Clamp it to [0, RWEP_WEIGHTS.blast_radius]
+  // before summing — exactly as scoreCustom does — so an out-of-range stored
+  // value (a unit error such as 300, or a negative) cannot silently inflate or
+  // zero the result by being absorbed only by the final aggregate clamp. Both
+  // paths now produce the same score for the same factors, so the validate()
+  // recompute-vs-stored divergence gate stays meaningful instead of flagging a
+  // self-inconsistency the two scorers introduced. Every other Shape B value is
+  // already a bounded post-weight contribution, so only blast_radius needs the
+  // per-factor clamp.
   let sum = 0;
-  for (const v of values) {
-    if (typeof v === 'number' && Number.isFinite(v)) sum += v;
+  for (const [k, v] of Object.entries(factors)) {
+    if (typeof v !== 'number' || !Number.isFinite(v)) continue;
+    // reboot_required and patch_required_reboot are aliases for the SAME
+    // post-weight contribution (scoreCustom collapses them). A block carrying
+    // both must count it once; summing both double-counts the reboot weight,
+    // inflating the derived RWEP past the formula AND past the stored score the
+    // validate() divergence gate compares against.
+    if (k === 'patch_required_reboot' && Object.prototype.hasOwnProperty.call(factors, 'reboot_required')) continue;
+    if (k === 'blast_radius') {
+      sum += Math.max(0, Math.min(RWEP_WEIGHTS.blast_radius, v));
+    } else {
+      sum += v;
+    }
   }
   return Math.max(0, Math.min(100, sum));
 }
@@ -333,7 +437,11 @@ function compare(cveId, catalog, opts) {
   // delta is null (not NaN) when there is no CVSS to compare against, so the
   // emitted result serializes cleanly and never claims a numeric divergence
   // that does not exist.
-  const delta = cvssAbsent ? null : rwep - cvssEquivalent;
+  // Guard the RWEP side exactly like CVSS above: an absent or non-finite
+  // rwep_score must not flow into `rwep - cvssEquivalent` — NaN poisons the
+  // delta, fails every band, and falls through to a false "broadly aligned".
+  const rwepValid = (typeof rwep === 'number' && Number.isFinite(rwep));
+  const delta = (cvssAbsent || !rwepValid) ? null : rwep - cvssEquivalent;
 
   // narrow the "broadly aligned" band from ±20 to ±10. The old
   // ±20 band swallowed the Copy Fail RWEP-vs-CVSS divergence (delta = 12)
@@ -347,7 +455,9 @@ function compare(cveId, catalog, opts) {
   // aligned" — coincidence-passing per the field-present-not-populated
   // pitfall. Now the operator sees a specific signal pointing at the
   // catalog gap rather than a false sense of alignment.
-  if ((rwep == null || rwep === 0) && (cvss == null || cvss === 0)) {
+  if (!rwepValid) {
+    explanation = 'RWEP score absent or non-numeric for this CVE — no usable RWEP signal to compare. Backfill rwep_score / rwep_factors in the catalog.';
+  } else if ((rwep == null || rwep === 0) && (cvss == null || cvss === 0)) {
     explanation = 'No scoring signal — both RWEP and CVSS are zero/null. Investigate the catalog entry; this CVE has no usable risk score.';
   } else if (cvssAbsent) {
     // RWEP carries a real signal but there is no CVSS to compare it against.
@@ -356,12 +466,17 @@ function compare(cveId, catalog, opts) {
     explanation = 'CVSS absent — RWEP is the only usable score for this CVE; no CVSS comparison is possible. Backfill cvss_score in the catalog to enable the comparison.';
   } else if (delta > 10) {
     explanation = `RWEP significantly higher than CVSS equivalent. Factors driving delta: `;
+    // The explanation must list every factor scoreCustom actually counts, via
+    // the same aliases/normalization — otherwise a CVE whose RWEP is driven by
+    // ai_assisted_weaponization (not ai_discovered), a stray-cased 'Confirmed',
+    // or the patch_required_reboot alias shows a higher RWEP with no stated
+    // reason for the delta.
     const driving = [];
     if (entry.cisa_kev) driving.push('CISA KEV (+25)');
     if (entry.poc_available) driving.push('public PoC (+20)');
-    if (entry.ai_discovered) driving.push('AI-discovered (+15 weaponization)');
-    if (entry.active_exploitation === 'confirmed') driving.push('confirmed exploitation (+20)');
-    if (entry.patch_required_reboot && !entry.live_patch_available) driving.push('reboot required (+5)');
+    if (entry.ai_discovered || entry.ai_assisted_weaponization) driving.push('AI-discovered (+15 weaponization)');
+    if (String(entry.active_exploitation || '').trim().toLowerCase() === 'confirmed') driving.push('confirmed exploitation (+20)');
+    if ((entry.reboot_required || entry.patch_required_reboot) && !entry.live_patch_available) driving.push('reboot required (+5)');
     explanation += driving.join(', ');
     explanation += '. Framework patch SLAs calibrated to CVSS are insufficient for this CVE.';
   } else if (delta < -10) {
@@ -379,9 +494,9 @@ function compare(cveId, catalog, opts) {
   const out = {
     cve_id: cveId,
     cvss: cvss,
-    rwep: rwep,
+    rwep: rwepValid ? rwep : null,
     cvss_framework_sla: timeline(cvssEquivalent),
-    rwep_actual_sla: timeline(rwep),
+    rwep_actual_sla: rwepValid ? timeline(rwep) : { hours: null, label: 'RWEP score unavailable' },
     delta,
     explanation,
   };
@@ -485,7 +600,7 @@ function validate(catalog) {
     // one judgment-set factor with no deriving source field.
     if (shape === 'B') {
       const f = entry.rwep_factors;
-      const aeMultiplier = ACTIVE_EXPLOITATION_LADDER[entry.active_exploitation] ?? 0;
+      const aeMultiplier = resolveActiveExploitation(entry.active_exploitation).multiplier;
       const implied = {
         cisa_kev: entry.cisa_kev === true ? RWEP_WEIGHTS.cisa_kev : 0,
         poc_available: entry.poc_available === true ? RWEP_WEIGHTS.poc_available : 0,
@@ -521,7 +636,10 @@ function validate(catalog) {
       blast_radius: entry.rwep_factors ? entry.rwep_factors.blast_radius : 0,
       patch_available: entry.patch_available,
       live_patch_available: entry.live_patch_available,
-      reboot_required: entry.patch_required_reboot
+      // Mirror the reboot alias scoreCustom itself honors (reboot_required OR
+      // patch_required_reboot): passing only patch_required_reboot would drop a
+      // top-level reboot_required field and compute a divergent expected RWEP.
+      reboot_required: entry.reboot_required || entry.patch_required_reboot
     });
     if (Math.abs(calculatedRwep - entry.rwep_score) > 5) {
       errors.push(`${cveId}: rwep_score ${entry.rwep_score} diverges from calculated ${calculatedRwep} by more than 5 — verify factors`);
@@ -612,6 +730,8 @@ module.exports = {
   validateFactors,
   deriveRwepFromFactors,
   parseCvss31Vector,
+  resolveActiveExploitation,
+  activeExploitationMultiplier,
   RWEP_WEIGHTS,
   ACTIVE_EXPLOITATION_LADDER,
   RECOGNISED_FACTOR_KEYS,

package/lib/sign.js

@@ -52,9 +52,12 @@
  *   .keys/private.pem on Windows, restrictWindowsAcl() shells to icacls
  *   to strip inherited entries and grant Full Control only to the current
  *   user. If icacls is unavailable (Server Core, exotic shells), the call
- *   warns to stderr but does not fail keypair generation — generating the
- *   key was the load-bearing step; ACL tightening is best-effort hardening
- *   on top.
+ *   warns to stderr and generateKeypair() returns { aclHardened: false }.
+ *   The CLI dispatch then exits non-zero so automation (bootstrap.js,
+ *   doctor --fix) does not treat an unhardened key as a clean generation —
+ *   set EXCEPTD_ALLOW_WEAK_KEY_ACL=1 to accept the weaker ACL on a
+ *   single-user host. (The key write itself still succeeds; the non-zero
+ *   exit signals "key present but not ACL-hardened," not "no key.")
  *
  * Signing ceremony:
  *   1. node lib/sign.js generate-keypair    — generate keypair (one time, per deployment)
@@ -78,6 +81,12 @@ const path = require('path');
 const crypto = require('crypto');
 const { execFileSync } = require('child_process');
 const { safeExit } = require('./exit-codes');
+// Reuse the EXACT validator lib/verify.js applies at load time, so the signer
+// and the verifier can never disagree about what a well-formed manifest is.
+// Requiring verify.js is side-effect-free (its CLI block is guarded by
+// `require.main === module`) and verify.js does not require sign.js, so there
+// is no circular dependency.
+const { validateAgainstSchema } = require('./verify');
 
 const ROOT = path.join(__dirname, '..');
 const MANIFEST_PATH = path.join(ROOT, 'manifest.json');
@@ -85,6 +94,7 @@ const KEYS_DIR = path.join(ROOT, '.keys');
 const PUBLIC_KEYS_DIR = path.join(ROOT, 'keys');
 const PRIVATE_KEY_PATH = path.join(KEYS_DIR, 'private.pem');
 const PUBLIC_KEY_PATH = path.join(PUBLIC_KEYS_DIR, 'public.pem');
+const MANIFEST_SCHEMA_PATH = path.join(__dirname, 'schemas', 'manifest.schema.json');
 
 // --- public API ---
 
@@ -96,28 +106,6 @@ const PUBLIC_KEY_PATH = path.join(PUBLIC_KEYS_DIR, 'public.pem');
  * @param {{ rotate: boolean }} options
  */
 function generateKeypair({ rotate = false } = {}) {
-  if (fs.existsSync(PRIVATE_KEY_PATH) && !rotate) {
-    console.error('[sign] Private key already exists at .keys/private.pem');
-    console.error('[sign] Use --rotate to generate a new keypair and invalidate existing signatures.');
-    process.exit(1);
-  }
-
-  // Refuse to silently overwrite an existing public key when no private key
-  // is present. This is the v0.11.x signature-regression class: a host with
-  // a working pubkey but missing privkey running generate-keypair would
-  // produce a fresh pubkey divergent from every shipped signature. Operators
-  // running `exceptd doctor --fix` on a stock install would replace the
-  // shipped keys/public.pem with one whose private half exists only on
-  // their machine — every subsequent verify against shipped signatures fails.
-  // Force the operator to be explicit via --rotate (which signals intent to
-  // re-sign).
-  if (fs.existsSync(PUBLIC_KEY_PATH) && !rotate) {
-    console.error('[sign] Public key already exists at keys/public.pem but no matching private key.');
-    console.error('[sign] Refusing to overwrite the public key — that would orphan every existing signature.');
-    console.error('[sign] If you are setting up a fresh signing identity, pass --rotate to confirm. After --rotate you must re-sign all skills with sign-all.');
-    process.exit(1);
-  }
-
   fs.mkdirSync(KEYS_DIR, { recursive: true, mode: 0o700 });
   fs.mkdirSync(PUBLIC_KEYS_DIR, { recursive: true });
 
@@ -126,8 +114,49 @@ function generateKeypair({ rotate = false } = {}) {
     publicKeyEncoding: { type: 'spki', format: 'pem' }
   });
 
-  fs.writeFileSync(PRIVATE_KEY_PATH, privateKey, { encoding: 'utf8', mode: 0o600 });
-  fs.writeFileSync(PUBLIC_KEY_PATH, publicKey, { encoding: 'utf8', mode: 0o644 });
+  // Atomic create-exclusive (flag 'wx' = O_CREAT|O_EXCL): the open itself
+  // refuses an existing key — there is no separate existsSync to race against,
+  // and exclusive-create won't follow a symlink/file an attacker preplanted at
+  // the key path. EEXIST translates to the same operator-facing refusals the
+  // bootstrap has always surfaced; --rotate is a deliberate re-key (flag 'w').
+  // The public-key refusal is the v0.11.x signature-regression guard: a host
+  // with a working pubkey but no privkey must NOT silently regenerate the
+  // pubkey (that orphans every shipped signature) — force --rotate to confirm.
+  const openFlag = rotate ? 'w' : 'wx';
+  let privFd;
+  try {
+    privFd = fs.openSync(PRIVATE_KEY_PATH, openFlag, 0o600);
+  } catch (e) {
+    if (e.code === 'EEXIST') {
+      console.error('[sign] Private key already exists at .keys/private.pem');
+      console.error('[sign] Use --rotate to generate a new keypair and invalidate existing signatures.');
+      process.exit(1);
+    }
+    throw e;
+  }
+  let pubFd;
+  try {
+    pubFd = fs.openSync(PUBLIC_KEY_PATH, openFlag, 0o644);
+  } catch (e) {
+    fs.closeSync(privFd);
+    // A pubkey clash after we exclusively created the privkey must not leave a
+    // half-written signing identity behind.
+    try { fs.unlinkSync(PRIVATE_KEY_PATH); } catch { /* best effort */ }
+    if (e.code === 'EEXIST') {
+      console.error('[sign] Public key already exists at keys/public.pem but no matching private key.');
+      console.error('[sign] Refusing to overwrite the public key — that would orphan every existing signature.');
+      console.error('[sign] If you are setting up a fresh signing identity, pass --rotate to confirm. After --rotate you must re-sign all skills with sign-all.');
+      process.exit(1);
+    }
+    throw e;
+  }
+  try {
+    fs.writeSync(privFd, privateKey);
+    fs.writeSync(pubFd, publicKey);
+  } finally {
+    fs.closeSync(privFd);
+    fs.closeSync(pubFd);
+  }
 
   // on win32, fs.writeFileSync `mode` does not produce
   // a POSIX-style restrictive ACL. Tighten via icacls so other desktop
@@ -174,6 +203,9 @@ function generateKeypair({ rotate = false } = {}) {
 function signAll() {
   const privateKey = loadPrivateKey();
   const manifest = loadManifest();
+  // Schema-validate BEFORE any mutation/write — refuse to sign a manifest
+  // the verifier would reject. Matches lib/verify.js signAll().
+  validateManifestSchema(manifest, 'sign-all');
   // Validate every entry's path before doing any I/O. Reject the whole
   // manifest on the first traversal attempt — we never want to sign
   // half a manifest then exit non-zero with a partial mutation.
@@ -230,6 +262,9 @@ function signAll() {
 function signOne(skillName) {
   const privateKey = loadPrivateKey();
   const manifest = loadManifest();
+  // Schema-validate BEFORE any mutation/write — refuse to sign a manifest
+  // the verifier would reject. Matches lib/verify.js signAll().
+  validateManifestSchema(manifest, 'sign');
   const skill = manifest.skills.find(s => s.name === skillName);
   if (!skill) { console.error(`Skill not found: ${skillName}`); process.exit(1); }
 
@@ -329,6 +364,33 @@ function loadManifest() {
   return JSON.parse(fs.readFileSync(MANIFEST_PATH, 'utf8'));
 }
 
+/**
+ * Validate the manifest against lib/schemas/manifest.schema.json BEFORE
+ * signing, mirroring lib/verify.js signAll() (which throws on schema
+ * violation before re-signing). Without this the signer is the WEAKER
+ * check: a manifest that is path-safe but schema-invalid (unknown
+ * per-skill field, malformed version, bad atlas_ref, missing required
+ * field) gets a valid manifest_signature here, then lib/verify.js
+ * loadManifestValidated() THROWS on the same schema at install time and
+ * refuses to verify any skill. The producer must never emit an artifact
+ * the consumer rejects, so the signer is held to at least the verifier's
+ * bar. The validator itself is imported from lib/verify.js so the two
+ * halves can never drift to different rules.
+ *
+ * @param {object} manifest parsed manifest.json
+ * @param {string} who 'sign-all' | 'sign' — surfaced in the error
+ * @throws on any schema violation
+ */
+function validateManifestSchema(manifest, who) {
+  const schema = JSON.parse(fs.readFileSync(MANIFEST_SCHEMA_PATH, 'utf8'));
+  const errors = validateAgainstSchema(manifest, schema, 'manifest');
+  if (errors.length > 0) {
+    const detail = errors.slice(0, 10).map(e => '  - ' + e).join('\n');
+    const more = errors.length > 10 ? `\n  ...and ${errors.length - 10} more` : '';
+    throw new Error(`[sign] manifest.json failed schema validation before ${who} — refusing to sign:\n${detail}${more}`);
+  }
+}
+
 /**
  * canonical byte form of the manifest, used for both
  * signing (lib/sign.js) and verification (lib/verify.js).
@@ -460,9 +522,24 @@ if (require.main === module) {
   const arg = process.argv[3];
 
   switch (cmd) {
-    case 'generate-keypair':
-      generateKeypair({ rotate: process.argv.includes('--rotate') });
+    case 'generate-keypair': {
+      const { aclHardened } = generateKeypair({ rotate: process.argv.includes('--rotate') });
+      // On win32 a failed icacls hardening leaves the private key inheriting
+      // the parent ACL — potentially readable by other desktop users. Make
+      // that detectable to automation (bootstrap.js, doctor --fix) instead of
+      // burying it in a mid-banner line under a 0 exit: fail loud unless the
+      // operator opts into the weaker ACL on a host where it is acceptable.
+      // exitCode (not process.exit) so the buffered stdout banner drains.
+      if (process.platform === 'win32' && aclHardened === false) {
+        if (process.env.EXCEPTD_ALLOW_WEAK_KEY_ACL === '1') {
+          console.warn('[sign] WARN: private-key ACL was NOT hardened; continuing because EXCEPTD_ALLOW_WEAK_KEY_ACL=1.');
+        } else {
+          console.error('[sign] ERROR: private key written but Windows ACL hardening FAILED — the key may be readable by other desktop users on this machine. Strip inheritance manually (icacls .keys\\private.pem /inheritance:r /grant:r "%USERNAME%":F), or set EXCEPTD_ALLOW_WEAK_KEY_ACL=1 to accept the weaker ACL on a single-user host.');
+          safeExit(1);
+        }
+      }
       break;
+    }
     case 'sign-all':
       signAll();
       break;
@@ -502,6 +579,7 @@ module.exports = {
   signOne,
   normalize,
   validateSkillPath,
+  validateManifestSchema,
   canonicalManifestBytes,
   signCanonicalManifest,
   restrictWindowsAcl,

package/lib/source-advisories.js

@@ -49,6 +49,7 @@
 
 const path = require('path');
 const fs = require('fs');
+const { withRetry } = require('../vendor/blamejs/retry.js');
 
 const TODAY = new Date().toISOString().slice(0, 10);
 
@@ -338,13 +339,30 @@ async function fetchFeed(feed, ctx) {
     return { ok: true, body: fs.readFileSync(p, 'utf8') };
   }
   if (typeof fetch !== 'function') return { ok: false, error: 'fetch() not available — Node 18+ required' };
-  try {
+  // Adopt the vendored blamejs retry primitive (BJS-02): a transient feed
+  // failure (HTTP 429/5xx, timeout/abort, network reset) is retried with
+  // backoff + jitter instead of dropping the feed on the first hiccup. A
+  // permanent 4xx is not retried. Each attempt gets a fresh abort timer.
+  const attempt = async () => {
     const ac = new AbortController();
     const timer = setTimeout(() => ac.abort(), 8000);
-    const r = await fetch(feed.url, { signal: ac.signal, headers: { 'User-Agent': 'exceptd-advisories-poller/0.13.1 (+https://exceptd.com)' } });
-    clearTimeout(timer);
-    if (!r.ok) return { ok: false, error: `HTTP ${r.status}` };
-    return { ok: true, body: await r.text() };
+    try {
+      const r = await fetch(feed.url, { signal: ac.signal, headers: { 'User-Agent': 'exceptd-advisories-poller/0.13.1 (+https://exceptd.com)' } });
+      if (!r.ok) { const e = new Error(`HTTP ${r.status}`); e.statusCode = r.status; throw e; }
+      return await r.text();
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  const retryable = (err) => {
+    if (err && typeof err.statusCode === 'number') return err.statusCode === 429 || err.statusCode >= 500;
+    if (err && (err.name === 'AbortError' || err.name === 'TimeoutError')) return true;
+    const code = err && (err.code || (err.cause && err.cause.code));
+    return !!code && /^(ECONNRESET|ECONNREFUSED|ECONNABORTED|ETIMEDOUT|EPIPE|EAGAIN|ENOTFOUND|ENETUNREACH|UND_ERR)/.test(String(code));
+  };
+  try {
+    const body = await withRetry(attempt, { maxAttempts: 3, baseDelayMs: 100, maxDelayMs: 2000, jitterFactor: 0.5, isRetryable: retryable });
+    return { ok: true, body };
   } catch (e) {
     return { ok: false, error: e.message || String(e) };
   }

package/lib/source-ghsa.js

@@ -33,6 +33,16 @@ const GHSA_PATH = "/advisories?per_page=50&type=reviewed&sort=published&directio
 const REQUEST_TIMEOUT_MS = 10000;
 const USER_AGENT = "exceptd-security/source-ghsa (+https://exceptd.com)";
 
+// Cap the streamed response so a hijacked DNS / compromised CDN / MITM serving
+// api.github.com can't stream unbounded bytes into RAM. A 50-advisory page is
+// well under a MB; 16 MB is generous headroom. Symmetric with the JSON cap
+// getJsonOnce enforces in lib/refresh-network.js and the OSV poller's cap.
+// Tunable via EXCEPTD_GHSA_RESPONSE_CAP_BYTES for future API growth.
+function ghsaResponseCapBytes() {
+  const env = parseInt(process.env.EXCEPTD_GHSA_RESPONSE_CAP_BYTES, 10);
+  return Number.isFinite(env) && env > 0 ? env : 16 * 1024 * 1024;
+}
+
 /**
  * Field-dropped watch set — fields the buildDiff regression-detector
  * watches when the upstream still has an entry but a previously-populated
@@ -123,8 +133,22 @@ function ghsaRequestOnce({ path, headers, timeoutMs }) {
         return resolve({ ok: false, error: `GHSA returned HTTP ${status}`, source: "offline" });
       }
       const chunks = [];
-      res.on("data", (c) => chunks.push(c));
+      let total = 0;
+      const cap = ghsaResponseCapBytes();
+      let capped = false;
+      res.on("data", (c) => {
+        total += c.length;
+        if (total > cap) {
+          capped = true;
+          req.destroy(new Error(`GHSA response exceeds ${cap}-byte cap during streaming download`));
+          return;
+        }
+        chunks.push(c);
+      });
       res.on("end", () => {
+        // If the cap fired, req.destroy already routed through req.on("error");
+        // don't also resolve here (avoids a double-settle on the promise).
+        if (capped) return;
         try {
           const body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
           const advisories = Array.isArray(body) ? body : (body ? [body] : []);

package/lib/source-osv.js

@@ -47,6 +47,17 @@ const OSV_HOST = "api.osv.dev";
 const REQUEST_TIMEOUT_MS = 10000;
 const USER_AGENT = "exceptd-security/source-osv (+https://exceptd.com)";
 
+// Cap the streamed response so a hostile or misconfigured endpoint (a hijacked
+// DNS / compromised CDN / OSV_HOST_OVERRIDE pointed at a malicious server)
+// can't stream unbounded bytes into RAM. A real /v1/vulns/{id} or /v1/query
+// response is a few KB; 16 MB is generous headroom. Symmetric with the JSON
+// cap getJsonOnce enforces in lib/refresh-network.js. Tunable via
+// EXCEPTD_OSV_RESPONSE_CAP_BYTES for future API growth.
+function osvResponseCapBytes() {
+  const env = parseInt(process.env.EXCEPTD_OSV_RESPONSE_CAP_BYTES, 10);
+  return Number.isFinite(env) && env > 0 ? env : 16 * 1024 * 1024;
+}
+
 // Identifier namespaces OSV uses as PRIMARY keys. GHSA-* is intentionally
 // NOT in this list — `seedSingleAdvisory` in lib/refresh-external.js routes
 // CVE-* and GHSA-* through `source-ghsa` because GHSA carries richer field
@@ -214,8 +225,22 @@ function osvRequestOnce({ method, reqPath, body, timeoutMs }) {
         return resolve({ ok: false, error, status, source: "offline" });
       }
       const chunks = [];
-      res.on("data", (c) => chunks.push(c));
+      let total = 0;
+      const cap = osvResponseCapBytes();
+      let capped = false;
+      res.on("data", (c) => {
+        total += c.length;
+        if (total > cap) {
+          capped = true;
+          req.destroy(new Error(`OSV response exceeds ${cap}-byte cap during streaming download`));
+          return;
+        }
+        chunks.push(c);
+      });
       res.on("end", () => {
+        // If the cap fired, req.destroy already routed through req.on("error");
+        // don't also resolve here (avoids a double-settle on the promise).
+        if (capped) return;
         try {
           const parsed = JSON.parse(Buffer.concat(chunks).toString("utf8"));
           resolve({ ok: true, record: parsed, source: "osv-api" });

package/lib/upstream-check.js

@@ -55,7 +55,7 @@ async function fetchLatestPublished({ timeoutMs = REQUEST_TIMEOUT_MS, pkgName =
   }
 
   return new Promise((resolve) => {
-    const path = `/${encodeURIComponent(pkgName).replace("%40", "@").replace("%2F", "/")}`;
+    const path = `/${encodeURIComponent(pkgName).replace(/%40/g, "@").replace(/%2F/g, "/")}`;
     const req = https.get({
       host: REGISTRY_HOST,
       path,