@blamejs/exceptd-skills 0.18.7 → 0.18.9

package/lib/validate-cve-catalog.js

@@ -278,7 +278,17 @@ function additionalChecks(key, entry, ctx) {
     },
   ];
   for (const { field, set, file } of REF_FIELDS) {
-    if (!set) continue; // catalog absent — skip silently (defense-in-depth)
+    if (!set) {
+      // A reference catalog is part of a valid tree, so its absence is not a
+      // "defense-in-depth skip" — it means the ref family CANNOT be validated,
+      // and an orphaned id would ship unchecked. Surface it (promoted to a hard
+      // error under --strict, like an unresolved ref) for any entry that
+      // actually carries the field, rather than passing silently.
+      if (entry[field] && (Array.isArray(entry[field]) ? entry[field].length > 0 : typeof entry[field] === 'object' && Object.keys(entry[field]).length > 0)) {
+        warnings.push(`${key}: cannot validate ${field} — ${file} catalog is absent, so its ids go unchecked (an error under --strict).`);
+      }
+      continue;
+    }
     const refs = entry[field];
     // Most ref fields are arrays of id strings (atlas_refs, cwe_refs, ...),
     // but framework_control_gaps is a map keyed BY control id. An

package/lib/validate-indexes.js

@@ -79,6 +79,79 @@ function verifyOutputs(idxDir, outputs) {
   return issues;
 }
 
+/**
+ * Compare a live source set against the recorded source_hashes table and return
+ * { drift, missing } message arrays. Pure (no I/O of its own beyond the injected
+ * absFn + fs reads of the named sources) so it is unit-testable for the
+ * fail-closed edge cases:
+ *   - a source that vanished between discovery and hashing (TOCTOU) is REPORTED
+ *     missing, never an unhandled ENOENT crash;
+ *   - a non-string recorded hash (corrupted _meta.json) is REPORTED as drift,
+ *     never a TypeError from .slice() of a non-string.
+ *
+ * @param {Set<string>|string[]} liveSources  source paths discovered live
+ * @param {Record<string,string>} recorded    the _meta.json source_hashes table
+ * @param {(p:string)=>string} absFn          resolves a source path to absolute
+ * @returns {{ drift: string[], missing: string[] }}
+ */
+function checkSourceHashes(liveSources, recorded, absFn) {
+  const drift = [];
+  const missing = [];
+  const recordedKeys = new Set(Object.keys(recorded || {}));
+  for (const p of liveSources) {
+    if (!recordedKeys.has(p)) {
+      missing.push(`new source not in index: ${p}`);
+      continue;
+    }
+    const abs = absFn(p);
+    // F16 — also check listed-but-symlinked sources. A source can disappear or
+    // be swapped between discovery and hashing (TOCTOU); resolve its type and
+    // read it defensively so a vanished or newly-symlinked file is REPORTED as
+    // missing, never an unhandled ENOENT that crashes the whole validation.
+    // Open through a single O_NOFOLLOW descriptor and hash the bytes from THAT
+    // descriptor — no path stat-then-read, so there is no check-then-use window.
+    // O_NOFOLLOW refuses a symlinked leaf at open (ELOOP) on POSIX; an absent
+    // file (ENOENT) is reported missing instead of crashing; the fstat type
+    // check refuses a dir/junction/fifo on every platform.
+    let live;
+    {
+      let fd;
+      try { fd = fs.openSync(abs, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW || 0)); }
+      catch (e) {
+        if (e.code === 'ENOENT') missing.push(`source file disappeared between discovery and hashing: ${p}`);
+        else if (e.code === 'ELOOP') missing.push(`source ${p} is a symbolic link — refusing to follow`);
+        else missing.push(`source ${p} could not be opened: ${e.code || e.message}`);
+        continue;
+      }
+      try {
+        if (!fs.fstatSync(fd).isFile()) {
+          missing.push(`source ${p} is not a regular file (symlink / dir / fifo) — refusing`);
+          continue;
+        }
+        live = sha256(fs.readFileSync(fd));
+      } catch (e) {
+        missing.push(`source ${p} could not be read: ${e.code || e.message}`);
+        continue;
+      } finally { fs.closeSync(fd); }
+    }
+    const recordedHash = recorded[p];
+    if (typeof recordedHash !== 'string') {
+      // A null/non-string recorded hash means a corrupted _meta.json
+      // source_hashes map — report it as drift rather than crashing on
+      // .slice() of a non-string (fail-closed, not fail-open).
+      drift.push(`hash drift: ${p} (recorded entry is not a string: ${JSON.stringify(recordedHash)}, live ${live.slice(0, 12)}…)`);
+    } else if (live !== recordedHash) {
+      drift.push(`hash drift: ${p} (recorded ${recordedHash.slice(0, 12)}…, live ${live.slice(0, 12)}…)`);
+    }
+  }
+  for (const p of recordedKeys) {
+    if (!(liveSources instanceof Set ? liveSources.has(p) : liveSources.includes(p))) {
+      missing.push(`stale source in index (file removed): ${p}`);
+    }
+  }
+  return { drift, missing };
+}
+
 function main() {
   if (!fs.existsSync(META)) {
     console.error("[validate-indexes] data/_indexes/_meta.json missing — run `npm run build-indexes`.");
@@ -135,35 +208,7 @@ function main() {
   }
   for (const s of manifest.skills) liveSources.add(s.path);
 
-  const drift = [];
-  const missing = [];
-  const recordedKeys = new Set(Object.keys(recorded));
-
-  for (const p of liveSources) {
-    if (!recordedKeys.has(p)) {
-      missing.push(`new source not in index: ${p}`);
-      continue;
-    }
-    const abs = ABS(p);
-    // F16 — also check listed-but-symlinked sources. lstatSync on a missing
-    // file throws; mirror the existsSync semantics by guarding it.
-    if (fs.existsSync(abs)) {
-      const st = fs.lstatSync(abs);
-      if (st.isSymbolicLink()) {
-        missing.push(`source ${p} is a symbolic link — refusing to follow`);
-        continue;
-      }
-    }
-    const live = sha256(fs.readFileSync(abs));
-    if (live !== recorded[p]) {
-      drift.push(`hash drift: ${p} (recorded ${recorded[p].slice(0, 12)}…, live ${live.slice(0, 12)}…)`);
-    }
-  }
-  for (const p of recordedKeys) {
-    if (!liveSources.has(p)) {
-      missing.push(`stale source in index (file removed): ${p}`);
-    }
-  }
+  const { drift, missing } = checkSourceHashes(liveSources, recorded, ABS);
 
   // Verify the derived index OUTPUTS themselves exist and parse. Source-hash
   // drift alone does not catch a deleted/truncated/corrupted OUTPUT: a clean
@@ -185,7 +230,7 @@ function main() {
 
   const issues = [...drift, ...missing];
   if (issues.length === 0) {
-    console.log(`[validate-indexes] indexes current — ${recordedKeys.size} sources hashed at ${meta.generated_at}.`);
+    console.log(`[validate-indexes] indexes current — ${Object.keys(recorded).length} sources hashed at ${meta.generated_at}.`);
     return;
   }
 
@@ -197,4 +242,4 @@ function main() {
 
 if (require.main === module) main();
 
-module.exports = { main, verifyOutputs };
+module.exports = { main, verifyOutputs, checkSourceHashes };

package/lib/validate-playbooks.js

@@ -248,7 +248,11 @@ function loadContext() {
   const cve = readJson(CVE_PATH);
   const cwe = readJson(CWE_PATH);
   const d3 = readJson(D3FEND_PATH);
-  const attack = readJsonIfExists(ATTACK_PATH);
+  // Required, like the other ref catalogs (cwe / d3fend). It is committed and
+  // always present; loading it optionally let attack_ref validation skip
+  // silently when it was absent — the asymmetry that allowed an unresolvable
+  // attack_ref to ship. Its absence must fail loud.
+  const attack = readJson(ATTACK_PATH);
 
   // Closed controlled-vocabulary enums sourced from the schema so the
   // hard-error enum checks in checkCrossRefs stay in lockstep with the
@@ -266,11 +270,16 @@ function loadContext() {
         .jurisdiction_obligations.items.properties.clock_starts.enum || null;
     frameworksEnum =
       schema.properties.domain.properties.frameworks_in_scope.items.enum || null;
-  } catch {
-    // If the schema shape changes, fall back to no closed-vocab enforcement
-    // here (the generic validator still emits warnings).
-    clockStartsEnum = null;
-    frameworksEnum = null;
+  } catch (e) {
+    // The playbook schema is a committed, required file. Swallowing a read error
+    // here silently disabled the clock_starts / frameworks_in_scope closed-vocab
+    // checks, so a typo in those fields could ship. Fail loud instead.
+    throw new Error(`validate-playbooks: cannot read playbook schema ${SCHEMA_PATH} — ${e && e.message}. The closed-vocabulary checks must not silently disable.`);
+  }
+  // A successful parse with the wrong shape (enum path moved/renamed) would also
+  // leave the enums null and disable the checks. Treat that as fatal too.
+  if (!Array.isArray(clockStartsEnum) || !Array.isArray(frameworksEnum)) {
+    throw new Error(`validate-playbooks: playbook schema ${SCHEMA_PATH} did not yield the clock_starts / frameworks_in_scope enums (shape changed). Refusing to validate with the closed-vocab checks silently disabled — fix the schema path expressions in loadContext().`);
   }
 
   return {

package/lib/verify.js

@@ -369,8 +369,11 @@ function verifyManifestSignature(manifest) {
   // Previously the pin only fired at the CLI tail of `node lib/verify.js`,
   // letting a coordinated attacker who swapped keys/public.pem authenticate
   // against the attacker key without any divergence surfaced through the
-  // library API. Honors KEYS_ROTATED=1 for legitimate rotations; missing
-  // pin file remains warn-and-continue (legacy compat).
+  // library API. Honors KEYS_ROTATED=1 for legitimate rotations. A MISSING pin
+  // file is now rejected too: keys/EXPECTED_FINGERPRINT ships in the tarball and
+  // is committed to the repo, so its absence is not a legacy state — it is the
+  // signature a key-substitution attack leaves when it strips the pin to hide a
+  // swapped keys/public.pem.
   const liveFp = publicKeyFingerprint(publicKey);
   const pinResult = checkExpectedFingerprint(liveFp);
   if (pinResult.status === 'mismatch' && !pinResult.rotationOverride) {
@@ -382,6 +385,17 @@ function verifyManifestSignature(manifest) {
       actual: pinResult.actual,
     };
   }
+  if (pinResult.status === 'no-pin') {
+    // A missing pin fails closed unconditionally — there is nothing to override.
+    // KEYS_ROTATED only applies to a fingerprint MISMATCH (a new key + a new
+    // pin); a legitimate rotation updates the pin in place, it never removes it,
+    // so an absent pin is treated as tampering and restoring it is the only fix.
+    return {
+      status: 'invalid',
+      reason: `key-pin absent: keys/EXPECTED_FINGERPRINT is missing, so a swapped keys/public.pem cannot be detected. The pin ships in the tarball and is committed — restore it from the package or version control.`,
+      pin_absent: true,
+    };
+  }
   let signatureBytes;
   try {
     signatureBytes = Buffer.from(sig.signature_base64, 'base64');
@@ -451,10 +465,13 @@ function loadManifestValidated() {
       { code: 'EXCEPTD_MANIFEST_UNSIGNED' }
     );
   } else if (sigResult.status === 'no-key') {
-    // Surfaced separately so the warning matches the missing-key path
-    // that verifyAll() already handles — don't fail here, the verifyAll
-    // entry point will emit a no_key result of its own.
-    console.warn(`[verify] WARN: cannot verify manifest_signature — ${sigResult.reason}.`);
+    // The documented contract is "return a VERIFIED manifest or throw" — never
+    // an unverified one. verifyAll()/verifyOne() short-circuit on a missing key
+    // BEFORE reaching here, so this fires only for a direct
+    // loadManifestValidated() caller, which must not silently receive an
+    // unauthenticated manifest: an attacker who deletes keys/public.pem could
+    // otherwise smuggle a rewritten manifest past a library consumer.
+    throw new Error(`[verify] manifest_signature verification FAILED — ${sigResult.reason}. Cannot verify the manifest without keys/public.pem; refusing to return an unauthenticated manifest.`);
   }
   return manifest;
 }