@blamejs/exceptd-skills 0.18.6 → 0.18.8

package/lib/validate-cve-catalog.js

@@ -43,10 +43,15 @@ const FRAMEWORK_GAPS_PATH = path.join(REPO_ROOT, 'data', 'framework-control-gaps
 // one of these, the entry must carry an `iocs` block per AGENTS.md Hard Rule
 // #14. Surfaced as a warning by default so drafts and pre-IoC entries don't
 // break patch-class compatibility; promoted to an error under --strict.
+// The host-based entries anchor on scheme + host so a lookalike that merely
+// embeds the host as a label (`exploit-db.com.attacker.example`,
+// `not-exploit-db.com`, `evil.com/?ref=packetstormsecurity.com`) is no longer
+// misclassified as a public-exploit source. Verified zero classification
+// change across the live catalog's verification URLs.
 const PUBLIC_EXPLOIT_URL_PATTERNS = [
-  /github\.com\/.+\/(exploits?|poc|pocs)\b/i,
-  /\bexploit-?db\.com\b/i,
-  /\bpacketstormsecurity\.com\b/i,
+  /^https?:\/\/(?:[\w-]+\.)*github\.com\/.+\/(?:exploits?|pocs?)\b/i,
+  /^https?:\/\/(?:[\w-]+\.)*exploit-?db\.com(?:[/:?#]|$)/i,
+  /^https?:\/\/(?:[\w-]+\.)*packetstormsecurity\.com(?:[/:?#]|$)/i,
   /\bmetasploit\b/i,
   /\/poc\//i,
   /-poc\b/i,
@@ -215,6 +220,17 @@ function isUsableDate(value) {
   }
   const d = new Date(value + 'T00:00:00Z');
   if (Number.isNaN(d.getTime())) return { ok: false, reason: 'unparseable' };
+  // Reject impossible calendar dates (Feb 30, Apr 31, Feb 29 in a non-leap
+  // year). `new Date('2026-02-30T00:00:00Z')` does NOT throw — it silently
+  // rolls over to March 2 and reports a valid getTime() — so a malformed KEV
+  // deadline would pass this, the only date-validity guard. Require the parsed
+  // Y-M-D to round-trip back to the input components.
+  const [yStr, mStr, dStr] = value.split('-');
+  if (d.getUTCFullYear() !== Number(yStr) ||
+      d.getUTCMonth() + 1 !== Number(mStr) ||
+      d.getUTCDate() !== Number(dStr)) {
+    return { ok: false, reason: `impossible calendar date ${value}` };
+  }
   const year = Number(value.slice(0, 4));
   if (year < MIN_VALID_YEAR || year > MAX_VALID_YEAR) {
     return {
@@ -262,7 +278,17 @@ function additionalChecks(key, entry, ctx) {
     },
   ];
   for (const { field, set, file } of REF_FIELDS) {
-    if (!set) continue; // catalog absent — skip silently (defense-in-depth)
+    if (!set) {
+      // A reference catalog is part of a valid tree, so its absence is not a
+      // "defense-in-depth skip" — it means the ref family CANNOT be validated,
+      // and an orphaned id would ship unchecked. Surface it (promoted to a hard
+      // error under --strict, like an unresolved ref) for any entry that
+      // actually carries the field, rather than passing silently.
+      if (entry[field] && (Array.isArray(entry[field]) ? entry[field].length > 0 : typeof entry[field] === 'object' && Object.keys(entry[field]).length > 0)) {
+        warnings.push(`${key}: cannot validate ${field} — ${file} catalog is absent, so its ids go unchecked (an error under --strict).`);
+      }
+      continue;
+    }
     const refs = entry[field];
     // Most ref fields are arrays of id strings (atlas_refs, cwe_refs, ...),
     // but framework_control_gaps is a map keyed BY control id. An

package/lib/validate-indexes.js

@@ -36,6 +36,122 @@ function sha256(buf) {
   return crypto.createHash("sha256").update(buf).digest("hex");
 }
 
+/**
+ * Confirm every derived index OUTPUT exists, is a real file, and parses as
+ * JSON. Returns an array of human-readable issue strings (empty = all good).
+ * Source-hash drift alone does NOT catch a deleted/truncated/corrupted output,
+ * so this runs in addition to the source-hash comparison.
+ */
+function verifyOutputs(idxDir, outputs) {
+  const issues = [];
+  // O_NOFOLLOW + a single descriptor: the open atomically refuses a symlinked
+  // index path (ELOOP) and every subsequent stat/read rides the same fd, so
+  // there is no existsSync->lstat->readFileSync TOCTOU on the path. Where
+  // O_NOFOLLOW is unavailable the flag degrades to 0 (plain open).
+  const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
+  for (const file of outputs) {
+    const abs = path.join(idxDir, file);
+    let fd;
+    try {
+      fd = fs.openSync(abs, fs.constants.O_RDONLY | O_NOFOLLOW);
+    } catch (e) {
+      if (e.code === "ELOOP") {
+        issues.push(`derived index file is a symbolic link: data/_indexes/${file}`);
+      } else if (e.code === "ENOENT") {
+        issues.push(`derived index file missing: data/_indexes/${file} — run npm run build-indexes`);
+      } else {
+        issues.push(`derived index file unreadable: data/_indexes/${file} (${e.message})`);
+      }
+      continue;
+    }
+    try {
+      // readFileSync(fd) loops read() to EOF — a single readSync may return
+      // fewer than st.size bytes (short read on a network/FUSE-backed fd),
+      // leaving the tail NUL-filled and truncating the JSON. Reading via the
+      // open fd keeps the open→fstat ordering TOCTOU-free.
+      JSON.parse(fs.readFileSync(fd, "utf8"));
+    } catch (e) {
+      issues.push(`derived index file does not parse: data/_indexes/${file} (${e.message})`);
+    } finally {
+      fs.closeSync(fd);
+    }
+  }
+  return issues;
+}
+
+/**
+ * Compare a live source set against the recorded source_hashes table and return
+ * { drift, missing } message arrays. Pure (no I/O of its own beyond the injected
+ * absFn + fs reads of the named sources) so it is unit-testable for the
+ * fail-closed edge cases:
+ *   - a source that vanished between discovery and hashing (TOCTOU) is REPORTED
+ *     missing, never an unhandled ENOENT crash;
+ *   - a non-string recorded hash (corrupted _meta.json) is REPORTED as drift,
+ *     never a TypeError from .slice() of a non-string.
+ *
+ * @param {Set<string>|string[]} liveSources  source paths discovered live
+ * @param {Record<string,string>} recorded    the _meta.json source_hashes table
+ * @param {(p:string)=>string} absFn          resolves a source path to absolute
+ * @returns {{ drift: string[], missing: string[] }}
+ */
+function checkSourceHashes(liveSources, recorded, absFn) {
+  const drift = [];
+  const missing = [];
+  const recordedKeys = new Set(Object.keys(recorded || {}));
+  for (const p of liveSources) {
+    if (!recordedKeys.has(p)) {
+      missing.push(`new source not in index: ${p}`);
+      continue;
+    }
+    const abs = absFn(p);
+    // F16 — also check listed-but-symlinked sources. A source can disappear or
+    // be swapped between discovery and hashing (TOCTOU); resolve its type and
+    // read it defensively so a vanished or newly-symlinked file is REPORTED as
+    // missing, never an unhandled ENOENT that crashes the whole validation.
+    // Open through a single O_NOFOLLOW descriptor and hash the bytes from THAT
+    // descriptor — no path stat-then-read, so there is no check-then-use window.
+    // O_NOFOLLOW refuses a symlinked leaf at open (ELOOP) on POSIX; an absent
+    // file (ENOENT) is reported missing instead of crashing; the fstat type
+    // check refuses a dir/junction/fifo on every platform.
+    let live;
+    {
+      let fd;
+      try { fd = fs.openSync(abs, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0)); }
+      catch (e) {
+        if (e.code === 'ENOENT') missing.push(`source file disappeared between discovery and hashing: ${p}`);
+        else if (e.code === 'ELOOP') missing.push(`source ${p} is a symbolic link — refusing to follow`);
+        else missing.push(`source ${p} could not be opened: ${e.code || e.message}`);
+        continue;
+      }
+      try {
+        if (!fs.fstatSync(fd).isFile()) {
+          missing.push(`source ${p} is not a regular file (symlink / dir / fifo) — refusing`);
+          continue;
+        }
+        live = sha256(fs.readFileSync(fd));
+      } catch (e) {
+        missing.push(`source ${p} could not be read: ${e.code || e.message}`);
+        continue;
+      } finally { fs.closeSync(fd); }
+    }
+    const recordedHash = recorded[p];
+    if (typeof recordedHash !== 'string') {
+      // A null/non-string recorded hash means a corrupted _meta.json
+      // source_hashes map — report it as drift rather than crashing on
+      // .slice() of a non-string (fail-closed, not fail-open).
+      drift.push(`hash drift: ${p} (recorded entry is not a string: ${JSON.stringify(recordedHash)}, live ${live.slice(0, 12)}…)`);
+    } else if (live !== recordedHash) {
+      drift.push(`hash drift: ${p} (recorded ${recordedHash.slice(0, 12)}…, live ${live.slice(0, 12)}…)`);
+    }
+  }
+  for (const p of recordedKeys) {
+    if (!(liveSources instanceof Set ? liveSources.has(p) : liveSources.includes(p))) {
+      missing.push(`stale source in index (file removed): ${p}`);
+    }
+  }
+  return { drift, missing };
+}
+
 function main() {
   if (!fs.existsSync(META)) {
     console.error("[validate-indexes] data/_indexes/_meta.json missing — run `npm run build-indexes`.");
@@ -92,39 +208,29 @@ function main() {
   }
   for (const s of manifest.skills) liveSources.add(s.path);
 
-  const drift = [];
-  const missing = [];
-  const recordedKeys = new Set(Object.keys(recorded));
+  const { drift, missing } = checkSourceHashes(liveSources, recorded, ABS);
 
-  for (const p of liveSources) {
-    if (!recordedKeys.has(p)) {
-      missing.push(`new source not in index: ${p}`);
-      continue;
-    }
-    const abs = ABS(p);
-    // F16 — also check listed-but-symlinked sources. lstatSync on a missing
-    // file throws; mirror the existsSync semantics by guarding it.
-    if (fs.existsSync(abs)) {
-      const st = fs.lstatSync(abs);
-      if (st.isSymbolicLink()) {
-        missing.push(`source ${p} is a symbolic link — refusing to follow`);
-        continue;
-      }
-    }
-    const live = sha256(fs.readFileSync(abs));
-    if (live !== recorded[p]) {
-      drift.push(`hash drift: ${p} (recorded ${recorded[p].slice(0, 12)}…, live ${live.slice(0, 12)}…)`);
-    }
-  }
-  for (const p of recordedKeys) {
-    if (!liveSources.has(p)) {
-      missing.push(`stale source in index (file removed): ${p}`);
-    }
+  // Verify the derived index OUTPUTS themselves exist and parse. Source-hash
+  // drift alone does not catch a deleted/truncated/corrupted OUTPUT: a clean
+  // source tree with a missing index file would otherwise pass as "current".
+  // _meta.outputs is the canonical list build-indexes records; an absent list
+  // FAILS (rather than silently skipping the check) so an old _meta can't pass.
+  // Absent `outputs` list (an older build that predates this field) is itself a
+  // staleness condition — fold it into the unified STALE report rather than
+  // early-returning, so a concurrent source-hash drift still surfaces too.
+  const outputs = Array.isArray(meta.outputs) ? meta.outputs : null;
+  if (!outputs || outputs.length === 0) {
+    missing.push(
+      "data/_indexes/_meta.json has no `outputs` list — rebuild with " +
+      "`npm run build-indexes` so derived-index integrity can be confirmed"
+    );
+  } else {
+    for (const issue of verifyOutputs(IDX_DIR, outputs)) missing.push(issue);
   }
 
   const issues = [...drift, ...missing];
   if (issues.length === 0) {
-    console.log(`[validate-indexes] indexes current — ${recordedKeys.size} sources hashed at ${meta.generated_at}.`);
+    console.log(`[validate-indexes] indexes current — ${Object.keys(recorded).length} sources hashed at ${meta.generated_at}.`);
     return;
   }
 
@@ -136,4 +242,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { main };
+module.exports = { main, verifyOutputs, checkSourceHashes };

package/lib/validate-playbooks.js

@@ -248,7 +248,11 @@ function loadContext() {
   const cve = readJson(CVE_PATH);
   const cwe = readJson(CWE_PATH);
   const d3 = readJson(D3FEND_PATH);
-  const attack = readJsonIfExists(ATTACK_PATH);
+  // Required, like the other ref catalogs (cwe / d3fend). It is committed and
+  // always present; loading it optionally let attack_ref validation skip
+  // silently when it was absent — the asymmetry that allowed an unresolvable
+  // attack_ref to ship. Its absence must fail loud.
+  const attack = readJson(ATTACK_PATH);
 
   // Closed controlled-vocabulary enums sourced from the schema so the
   // hard-error enum checks in checkCrossRefs stay in lockstep with the
@@ -266,11 +270,16 @@ function loadContext() {
         .jurisdiction_obligations.items.properties.clock_starts.enum || null;
     frameworksEnum =
       schema.properties.domain.properties.frameworks_in_scope.items.enum || null;
-  } catch {
-    // If the schema shape changes, fall back to no closed-vocab enforcement
-    // here (the generic validator still emits warnings).
-    clockStartsEnum = null;
-    frameworksEnum = null;
+  } catch (e) {
+    // The playbook schema is a committed, required file. Swallowing a read error
+    // here silently disabled the clock_starts / frameworks_in_scope closed-vocab
+    // checks, so a typo in those fields could ship. Fail loud instead.
+    throw new Error(`validate-playbooks: cannot read playbook schema ${SCHEMA_PATH} — ${e && e.message}. The closed-vocabulary checks must not silently disable.`);
+  }
+  // A successful parse with the wrong shape (enum path moved/renamed) would also
+  // leave the enums null and disable the checks. Treat that as fatal too.
+  if (!Array.isArray(clockStartsEnum) || !Array.isArray(frameworksEnum)) {
+    throw new Error(`validate-playbooks: playbook schema ${SCHEMA_PATH} did not yield the clock_starts / frameworks_in_scope enums (shape changed). Refusing to validate with the closed-vocab checks silently disabled — fix the schema path expressions in loadContext().`);
   }
 
   return {
@@ -521,7 +530,10 @@ function checkCrossRefs(playbook, ctx, playbookIds) {
   // here at error severity.
   if (meta.air_gap_mode === true) {
     const look = phases.look || {};
-    const netSourceRe = /(https?:\/\/|gh api|gh release|curl |wget |fetch )/;
+    // Case-insensitive + word-bounded so `HTTPS://`, `Curl`, and `fetch(` (no
+    // trailing space) still flag a network source — otherwise an artifact could
+    // ship under air_gap_mode with no offline alternative and run incomplete.
+    const netSourceRe = /(https?:\/\/|\bgh (?:api|release)\b|\bcurl\b|\bwget\b|\bfetch\b)/i;
     for (const [i, art] of (look.artifacts || []).entries()) {
       if (!art || typeof art !== 'object') continue;
       if (typeof art.source === 'string' && netSourceRe.test(art.source)) {

package/lib/validate-vendor.js

@@ -37,15 +37,23 @@ function main() {
   const prov = JSON.parse(fs.readFileSync(PROV, "utf8"));
   const issues = [];
 
-  // License file.
-  if (prov.license_file && prov.license_sha256) {
-    const p = path.join(ROOT, "vendor", "blamejs", prov.license_file);
-    if (!fs.existsSync(p)) {
-      issues.push(`missing license file: ${prov.license_file}`);
+  // License file. A recorded license_file with NO license_sha256 is an
+  // unverifiable integrity claim, not a skip: stripping the hash from the
+  // manifest must not silently disable the LICENSE-text check (the
+  // absent-field-fails-open class). Only a manifest that records no
+  // license_file at all is exempt.
+  if (prov.license_file) {
+    if (!prov.license_sha256) {
+      issues.push(`license_file recorded (${prov.license_file}) without license_sha256 — integrity unverifiable`);
     } else {
-      const live = sha256(fs.readFileSync(p));
-      if (live !== prov.license_sha256) {
-        issues.push(`LICENSE drift: recorded ${prov.license_sha256.slice(0, 12)}…, live ${live.slice(0, 12)}…`);
+      const p = path.join(ROOT, "vendor", "blamejs", prov.license_file);
+      if (!fs.existsSync(p)) {
+        issues.push(`missing license file: ${prov.license_file}`);
+      } else {
+        const live = sha256(fs.readFileSync(p));
+        if (live !== prov.license_sha256) {
+          issues.push(`LICENSE drift: recorded ${prov.license_sha256.slice(0, 12)}…, live ${live.slice(0, 12)}…`);
+        }
       }
     }
   }
@@ -57,10 +65,43 @@ function main() {
       issues.push(`missing vendored file: ${info.vendored_path}`);
       continue;
     }
+    // A files[] entry recorded without vendored_sha256 is an unverifiable
+    // integrity claim — surface it as a clean issue rather than crashing on
+    // `undefined.slice()` while formatting a drift message (the absent-field
+    // class, symmetric with the license path above).
+    if (!info.vendored_sha256) {
+      issues.push(`${info.vendored_path} recorded without vendored_sha256 — integrity unverifiable`);
+      continue;
+    }
     const live = sha256(fs.readFileSync(p));
     if (live !== info.vendored_sha256) {
       issues.push(`drift in ${info.vendored_path}: recorded ${info.vendored_sha256.slice(0, 12)}…, live ${live.slice(0, 12)}…`);
     }
+    // Offline upstream-pin cross-check. The vendored_sha256 compare above is
+    // self-attesting — it only proves the file matches its OWN recorded hash,
+    // never that the bytes match blamejs@<pin> upstream. The full upstream
+    // verification (scripts/validate-vendor-online.js) needs the network and
+    // is not a predeploy gate, so a hand-edited upstream_sha256_at_pin
+    // advertising a pin that never existed otherwise passes every
+    // automatically-run gate.
+    //
+    // For a file recorded with NO strip rules, the vendored bytes are
+    // byte-identical to upstream by definition, so upstream_sha256_at_pin MUST
+    // equal vendored_sha256. A divergence is a forged or internally
+    // inconsistent pin claim, and it is provable OFFLINE — no fetch required.
+    // This closes the upstream side of the integrity check for every
+    // unmodified vendored file (the common case) inside the existing gate.
+    const stripped = Array.isArray(info.stripped) ? info.stripped : [];
+    if (stripped.length === 0) {
+      if (!info.upstream_sha256_at_pin) {
+        issues.push(`${info.vendored_path} has no strip rules but records no upstream_sha256_at_pin — upstream pin claim unverifiable`);
+      } else if (info.upstream_sha256_at_pin !== info.vendored_sha256) {
+        issues.push(
+          `${info.vendored_path} records no strip rules, so its upstream_sha256_at_pin must equal vendored_sha256, ` +
+            `but upstream_sha256_at_pin is ${String(info.upstream_sha256_at_pin).slice(0, 12)}… vs vendored ${info.vendored_sha256.slice(0, 12)}… — forged or inconsistent upstream pin`
+        );
+      }
+    }
     // Smoke-check the vendored module loads.
     try {
       require(p);
@@ -69,6 +110,26 @@ function main() {
     }
   }
 
+  // On-disk inventory cross-check (BJS-04): the loop above is one-directional
+  // (manifest → disk). A .js file PRESENT in vendor/blamejs/ but ABSENT from
+  // _PROVENANCE.json would ship in the tarball and be require()'d by lib code
+  // while NOTHING verifies its integrity — an unregistered or smuggled-in
+  // vendored module. Flag every on-disk .js that the manifest does not record.
+  const registered = new Set(
+    Object.values(prov.files || {}).map((info) => path.basename(info.vendored_path))
+  );
+  const vendorDir = path.join(ROOT, "vendor", "blamejs");
+  try {
+    for (const f of fs.readdirSync(vendorDir)) {
+      if (!f.endsWith(".js")) continue;
+      if (!registered.has(f)) {
+        issues.push(`unregistered vendored file: vendor/blamejs/${f} is on disk but absent from _PROVENANCE.json — its integrity is not verified`);
+      }
+    }
+  } catch (err) {
+    issues.push(`cannot read vendor/blamejs/ for the inventory cross-check: ${err.message}`);
+  }
+
   if (issues.length === 0) {
     const fileCount = Object.keys(prov.files || {}).length;
     console.log(`[validate-vendor] vendor tree current — ${fileCount} file(s) validated against pin ${prov.pinned_commit?.slice(0, 12) || "?"}.`);

package/lib/verify.js

@@ -369,8 +369,11 @@ function verifyManifestSignature(manifest) {
   // Previously the pin only fired at the CLI tail of `node lib/verify.js`,
   // letting a coordinated attacker who swapped keys/public.pem authenticate
   // against the attacker key without any divergence surfaced through the
-  // library API. Honors KEYS_ROTATED=1 for legitimate rotations; missing
-  // pin file remains warn-and-continue (legacy compat).
+  // library API. Honors KEYS_ROTATED=1 for legitimate rotations. A MISSING pin
+  // file is now rejected too: keys/EXPECTED_FINGERPRINT ships in the tarball and
+  // is committed to the repo, so its absence is not a legacy state — it is the
+  // signature a key-substitution attack leaves when it strips the pin to hide a
+  // swapped keys/public.pem.
   const liveFp = publicKeyFingerprint(publicKey);
   const pinResult = checkExpectedFingerprint(liveFp);
   if (pinResult.status === 'mismatch' && !pinResult.rotationOverride) {
@@ -382,6 +385,17 @@ function verifyManifestSignature(manifest) {
       actual: pinResult.actual,
     };
   }
+  if (pinResult.status === 'no-pin') {
+    // A missing pin fails closed unconditionally — there is nothing to override.
+    // KEYS_ROTATED only applies to a fingerprint MISMATCH (a new key + a new
+    // pin); a legitimate rotation updates the pin in place, it never removes it,
+    // so an absent pin is treated as tampering and restoring it is the only fix.
+    return {
+      status: 'invalid',
+      reason: `key-pin absent: keys/EXPECTED_FINGERPRINT is missing, so a swapped keys/public.pem cannot be detected. The pin ships in the tarball and is committed — restore it from the package or version control.`,
+      pin_absent: true,
+    };
+  }
   let signatureBytes;
   try {
     signatureBytes = Buffer.from(sig.signature_base64, 'base64');
@@ -451,10 +465,13 @@ function loadManifestValidated() {
       { code: 'EXCEPTD_MANIFEST_UNSIGNED' }
     );
   } else if (sigResult.status === 'no-key') {
-    // Surfaced separately so the warning matches the missing-key path
-    // that verifyAll() already handles — don't fail here, the verifyAll
-    // entry point will emit a no_key result of its own.
-    console.warn(`[verify] WARN: cannot verify manifest_signature — ${sigResult.reason}.`);
+    // The documented contract is "return a VERIFIED manifest or throw" — never
+    // an unverified one. verifyAll()/verifyOne() short-circuit on a missing key
+    // BEFORE reaching here, so this fires only for a direct
+    // loadManifestValidated() caller, which must not silently receive an
+    // unauthenticated manifest: an attacker who deletes keys/public.pem could
+    // otherwise smuggle a rewritten manifest past a library consumer.
+    throw new Error(`[verify] manifest_signature verification FAILED — ${sigResult.reason}. Cannot verify the manifest without keys/public.pem; refusing to return an unauthenticated manifest.`);
   }
   return manifest;
 }