@blamejs/exceptd-skills 0.18.8 → 0.18.11

package/lib/cross-ref-api.js

@@ -119,6 +119,16 @@ function entries(catalog) {
   return Object.entries(catalog).filter(([k]) => !k.startsWith('_'));
 }
 
+// Auto-imported drafts carry conservative-default mechanical fields and
+// null analytical fields pending curation. byCve() excludes them by
+// default; every transitive enumeration that walks the same catalog
+// (byCwe / byTtp / bySkill) must apply the identical contract so a draft
+// never surfaces as a curated cross-reference. Keyed on `_auto_imported`
+// to match byCve's exact predicate, so all four entry points agree.
+function _isDraftEntry(c) {
+  return !!c && c._auto_imported === true;
+}
+
 // Single source of truth for the xref sub-maps the skill-correlation
 // queries read. These names MUST stay identical to the keys the index
 // builder emits into data/_indexes/xref.json; reading under a name the
@@ -179,7 +189,7 @@ function byCve(cveId, opts) {
   const catalog = loadCatalog('cve-catalog.json');
   const entry = catalog[cveId];
   if (!entry) return { found: false, cve_id: cveId };
-  if (!includeDrafts && entry._auto_imported === true) {
+  if (!includeDrafts && _isDraftEntry(entry)) {
     return { found: false, cve_id: cveId, _draft_excluded: true };
   }
 
@@ -235,24 +245,36 @@ function byCwe(cweId) {
   const xref = loadIndex('xref.json');
   const skills = skillsForCwe(xref, cweId).slice();
   const relatedCves = entries(loadCatalog('cve-catalog.json'))
-    .filter(([, c]) => Array.isArray(c.cwe_refs) && c.cwe_refs.includes(cweId))
+    .filter(([, c]) => !_isDraftEntry(c) && Array.isArray(c.cwe_refs) && c.cwe_refs.includes(cweId))
     .map(([id]) => id);
   return { found: true, cwe_id: cweId, entry, skills, related_cves: relatedCves };
 }
 
 function byTtp(ttpId) {
+  // TTP ids span two disjoint catalogs (ATLAS AML.* vs ATT&CK T*).
+  // Resolve the record from whichever owns the id — namespaces never
+  // collide, so order is irrelevant. Previously only atlas-ttps.json was
+  // consulted, so every ATT&CK technique reported found:false / entry:null
+  // even though skills + related_cves correctly unioned both spaces.
   const atlas = loadCatalog('atlas-ttps.json');
+  const attack = loadCatalog('attack-techniques.json');
   const xref = loadIndex('xref.json');
-  const entry = atlas[ttpId] || null;
+  const entry = atlas[ttpId] || attack[ttpId] || null;
   const skills = skillsForTtp(xref, ttpId).slice();
   const relatedCves = entries(loadCatalog('cve-catalog.json'))
     .filter(([, c]) =>
-      (Array.isArray(c.atlas_refs) && c.atlas_refs.includes(ttpId)) ||
-      (Array.isArray(c.attack_refs) && c.attack_refs.includes(ttpId))
+      !_isDraftEntry(c) && (
+        (Array.isArray(c.atlas_refs) && c.atlas_refs.includes(ttpId)) ||
+        (Array.isArray(c.attack_refs) && c.attack_refs.includes(ttpId))
+      )
     )
     .map(([id]) => id);
+  // D3FEND maps countermeasures to the techniques they defeat through the
+  // `counters_attack_techniques` field. The earlier `counters` field is
+  // empty across every catalog entry, so this correlation was structurally
+  // dead (a non-existent field .includes() is always false).
   const d3fend = entries(loadCatalog('d3fend-catalog.json'))
-    .filter(([, d]) => Array.isArray(d.counters) && d.counters.includes(ttpId))
+    .filter(([, d]) => Array.isArray(d.counters_attack_techniques) && d.counters_attack_techniques.includes(ttpId))
     .map(([id]) => id);
   return { found: !!entry, ttp_id: ttpId, entry, skills, related_cves: relatedCves, d3fend_countermeasures: d3fend };
 }
@@ -275,7 +297,7 @@ function bySkill(skillName) {
   // to this skill.
   const cveCatalog = loadCatalog('cve-catalog.json');
   const cveRefs = entries(cveCatalog)
-    .filter(([, c]) => (c.cwe_refs || []).some(cwe => skillsForCwe(xref, cwe).includes(skillName)))
+    .filter(([, c]) => !_isDraftEntry(c) && (c.cwe_refs || []).some(cwe => skillsForCwe(xref, cwe).includes(skillName)))
     .map(([cve]) => cve)
     .sort();
   return { skill: skillName, summary_card: card, cve_refs: cveRefs, ttp_refs: ttpRefs };

package/lib/cve-regression-watcher.js

@@ -187,8 +187,12 @@ function findRegressionCandidates(diffs, catalog, opts) {
   // Group historical-CVE refs by id so multi-feed surfacing collapses.
   const byHistoricalId = new Map();
   // Content-only candidates — surfaced by language/component pattern
-  // matching even when no CVE ID was extracted from the diff text.
-  const contentCandidates = [];
+  // matching even when no CVE ID was extracted from the diff text. Grouped
+  // by a stable key (the diff id when present, else a composite of the
+  // matched signal) so N duplicate rows for the same regression claim
+  // across feeds collapse to one candidate with a merged surfaced_by — the
+  // same group-by-merge-sources pattern the historical-CVE branch uses.
+  const byContentKey = new Map();
   for (const d of (diffs || [])) {
     if (!d || typeof d.id !== 'string') continue;
     // Title field name depends on input shape:
@@ -231,16 +235,25 @@ function findRegressionCandidates(diffs, catalog, opts) {
     }
     // No historical CVE-ID in this diff. If content signals fire, still
     // surface as a content-only candidate so an operator can triage.
+    // Group by a stable key so duplicate rows for the same claim across
+    // multiple feeds merge their surfaced_by — mirrors byHistoricalId.
+    // The diff id (a current-year / non-historical CVE id) is the cleanest
+    // key when present; ID-less prose rows key off the matched signal
+    // (regression phrase + researcher + sorted component tokens).
     if (hasRegressionSignal) {
+      const key = (typeof d.id === 'string' && d.id)
+        ? `id:${d.id}`
+        : `sig:${signals.regression_language || ''}|${signals.researcher || ''}|${(signals.components || []).slice().sort().join(',')}`;
+      if (!byContentKey.has(key)) byContentKey.set(key, { sources: new Set(), titles: [], signals: {} });
+      const slot = byContentKey.get(key);
+      if (Array.isArray(d.sources)) {
+        for (const s of d.sources) slot.sources.add(s);
+      } else if (typeof d.source === 'string') {
+        slot.sources.add(d.source);
+      }
       const titleStr = d.title || d.first_title || '';
-      contentCandidates.push({
-        historical_cve: null,
-        surfaced_by: Array.isArray(d.sources) ? d.sources.slice().sort() : (d.source ? [d.source] : []),
-        first_seen_titles: titleStr ? [titleStr] : [],
-        existing_regression_key: null,
-        action: 'content-only-investigate',
-        signals,
-      });
+      if (titleStr && !slot.titles.includes(titleStr)) slot.titles.push(titleStr);
+      Object.assign(slot.signals, signals);
     }
   }
 
@@ -267,6 +280,20 @@ function findRegressionCandidates(diffs, catalog, opts) {
   }
 
   candidates.sort((a, b) => a.historical_cve.localeCompare(b.historical_cve));
+  // Emit one content-only candidate per grouped key, with surfaced_by as
+  // the sorted union of every feed that surfaced the same regression claim
+  // and the title list capped at 5 (matching the historical branch).
+  const contentCandidates = [];
+  for (const slot of byContentKey.values()) {
+    contentCandidates.push({
+      historical_cve: null,
+      surfaced_by: Array.from(slot.sources).sort(),
+      first_seen_titles: slot.titles.slice(0, 5),
+      existing_regression_key: null,
+      action: 'content-only-investigate',
+      signals: slot.signals,
+    });
+  }
   candidates.push(...contentCandidates);
 
   return {
@@ -291,11 +318,16 @@ function findRegressionCandidates(diffs, catalog, opts) {
  * falls back to ctx.advisoriesDiffs when the advisories source ran on a
  * pre-v0.13.17 build that did not emit observations.
  *
- * Chaining is explicit — the watcher does not poll feeds itself.
- * lib/refresh-external.js#loadCtx wires the prior advisories run output
- * onto ctx.advisoriesObservations + ctx.advisoriesDiffs so order matters:
- * advisories must run before cve-regression-watcher in a multi-source
- * invocation.
+ * Chaining is explicit — the watcher does not poll feeds itself. The
+ * refresh orchestrator's sequential runner (lib/refresh-external.js#main)
+ * threads the resolved advisories fetchDiff() result onto
+ * ctx.advisoriesObservations + ctx.advisoriesDiffs immediately after the
+ * advisories source resolves and BEFORE the next source's fetchDiff is
+ * invoked, so order matters: advisories must run before
+ * cve-regression-watcher in a multi-source invocation. Under --swarm
+ * (Promise.all) the two sources cannot share ctx mid-flight, so the
+ * orchestrator runs the watcher in a second pass after the parallel batch
+ * resolves, reading observations from the resolved advisories outcome.
  */
 const REGRESSION_WATCHER_SOURCE = {
   name: 'cve-regression-watcher',

package/lib/framework-gap.js

@@ -93,16 +93,38 @@ const OPTIMAL = {
  * @returns {{ score: number, breakdown: object, label: string }}
  */
 function lagScore(frameworkId, controlGaps, globalFrameworks) {
-  const gaps = Object.values(controlGaps).filter(g =>
-    g.framework?.includes(frameworkId) && g.status === 'open'
-  );
+  const frameworkData = _findFrameworkData(frameworkId, globalFrameworks);
+
+  // global-frameworks uses short KEYS (EU_AI_ACT, NCSC_CAF) while
+  // framework-control-gaps stores human-readable framework strings ("EU
+  // Artificial Intelligence Act (2024/1689)"). A naive
+  // `g.framework.includes(frameworkId)` only accidentally matched the few
+  // frameworks whose key happens to be a substring of the catalog string
+  // (DORA, GDPR, NIS2); every other framework reported
+  // framework_specific_gaps:0. Resolve the framework's display name first,
+  // then match the catalog with the SAME normalized scheme gapReport() and
+  // the orchestrator use, so the two paths converge. g.framework may be a
+  // string or an array — iterate either form.
+  const normalize = (s) => String(s).toLowerCase().replace(/[\s_-]/g, '');
+  const idNorm = normalize(frameworkId);
+  const nameNorm = frameworkData?.full_name ? normalize(frameworkData.full_name) : null;
+  const gaps = Object.entries(controlGaps).filter(([key, g]) => {
+    if (key.startsWith('_')) return false;
+    if (g.status !== 'open' || !g.framework) return false;
+    const fwList = Array.isArray(g.framework) ? g.framework : [g.framework];
+    for (const fw of fwList) {
+      const fwNorm = normalize(fw);
+      if (nameNorm && fwNorm.includes(nameNorm)) return true;   // display-name match
+      if (fwNorm.includes(idNorm)) return true;                 // short-key substring
+    }
+    if (normalize(key).startsWith(idNorm)) return true;         // gap-key prefix
+    return false;
+  });
 
   const universalGaps = Object.values(controlGaps).filter(g =>
     g.framework === 'ALL' && g.status === 'open'
   );
 
-  const frameworkData = _findFrameworkData(frameworkId, globalFrameworks);
-
   const patchSlaScore = _scorePatchSla(frameworkData?.patch_sla);
   const notifSlaScore = _scoreNotifSla(frameworkData?.notification_sla);
   const aiCoverageScore = _scoreAiCoverage(frameworkData?.ai_coverage);

package/lib/gap-detectors.js

@@ -409,11 +409,16 @@ function operatorActionSlaFindings(loaded, opts = {}) {
 // sets internally when the caller doesn't supply them.
 //
 // The regex is permissive — any CWE-NNN / T1234[.456] / AML.TNNNN /
-// D3-XX / RFC-NNN token in a skill body or playbook JSON counts as a
+// D3[AF]-XX / RFC-NNN token in a skill body or playbook JSON counts as a
 // reference. We deliberately scan the FULL text, not just structured
 // fields, because skill bodies cite IDs in prose ("see CWE-79") as
-// often as in frontmatter.
-const REFERENCE_TOKEN_RE = /\b(?:CWE-\d+|T\d{4}(?:\.\d{3})?|AML\.T\d{4}(?:\.\d{3})?|D3-[A-Z]+(?:-[A-Z]+)*|RFC-\d+)\b/g;
+// often as in frontmatter. The D3FEND alternative covers all three
+// namespaces — D3- techniques, D3A- digital artifacts, and D3F-
+// fingerprints — with alphanumeric segments; the prior `D3-[A-Z]+`
+// pattern matched neither the D3A-/D3F- prefixes nor digit-bearing
+// segments, so a D3A-* citation in a skill body went unrecognized and
+// the entry it referenced was mis-flagged as an unused orphan.
+const REFERENCE_TOKEN_RE = /\b(?:CWE-\d+|T\d{4}(?:\.\d{3})?|AML\.T\d{4}(?:\.\d{3})?|D3[AF]?-[A-Z0-9]+(?:-[A-Z0-9]+)*|RFC-\d+)\b/g;
 
 function buildExternalRefs(rootPath) {
   // Lazy require — `path` + `fs` are already in scope at module level.

package/lib/lint-skills.js

@@ -433,9 +433,10 @@ function validateFrontmatter(fm, skillName) {
   }
 
   if ('last_threat_review' in fm) {
-    if (typeof fm.last_threat_review !== 'string' || !ISO_DATE_RE.test(fm.last_threat_review)) {
+    if (typeof fm.last_threat_review !== 'string' || !ISO_DATE_RE.test(fm.last_threat_review) ||
+        !Number.isFinite(Date.parse(fm.last_threat_review + 'T00:00:00Z'))) {
       errors.push(
-        `frontmatter.last_threat_review "${fm.last_threat_review}" is not an ISO date (YYYY-MM-DD)`,
+        `frontmatter.last_threat_review "${fm.last_threat_review}" is not a valid ISO date (YYYY-MM-DD). A structurally ISO but non-calendar value (e.g. 2026-13-99) is rejected so a malformed date cannot slip past the staleness gate.`,
       );
     } else {
       // v0.13.0: Hard Rule #8 forcing function — refuse skills whose

package/lib/playbook-runner.js

@@ -1179,7 +1179,6 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
   // Aliasing: playbooks ship rwep_factor values `public_poc` and
   // `ai_weaponization` for what F5 calls `poc_available` and `ai_factor`.
   // Both spellings resolve here.
-  const _activeExploitationLadder = scoring.ACTIVE_EXPLOITATION_LADDER;
   const _factorScale = (factorName, cve, blastScore) => {
     if (!cve) return 0;
     switch (factorName) {
@@ -1187,7 +1186,16 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
         return cve.cisa_kev === true ? 1 : 0;
       case 'active_exploitation': {
         const v = cve.active_exploitation || (cve.entry && cve.entry.active_exploitation);
-        return _activeExploitationLadder[v] ?? 0;
+        // Route through the shared scoring resolver instead of an inline
+        // `ladder[v] ?? 0` lookup so a stray-cased value ('Confirmed') scales
+        // identically to the catalog scorer AND an out-of-vocabulary value
+        // ('in-the-wild') surfaces the RWEP_AE_UNRECOGNISED warning rather than
+        // silently zeroing the active-exploitation weight. activeExploitationMultiplier
+        // (not the bare resolveActiveExploitation().multiplier) is used precisely so
+        // the no-match path is OBSERVABLE — the "out-of-vocab token must surface,
+        // not silently default" class. For every canonical catalog value the
+        // returned multiplier is identical to the prior inline lookup.
+        return scoring.activeExploitationMultiplier(v);
       }
       case 'poc_available':
       case 'public_poc': {
@@ -1435,6 +1443,15 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     // Prefixed with underscore to signal "for internal/render use".
     _detect_indicators: detectResult.indicators || [],
     _detect_classification: detectResult.classification,
+    // Non-underscore alias so catalog feeds_into / escalation conditions that
+    // reference the natural `analyze.classification` path resolve (the
+    // underscore-prefixed key was render-internal only, so those conditions
+    // resolved undefined and were silently dead — e.g. citation-hygiene →
+    // sbom, crypto-codebase → secrets). The underscore key stays for the
+    // SARIF/CSAF render consumers. On the detect-skip path run() re-sets
+    // analyze.classification to 'skipped', which is the same value
+    // detectResult.classification already carries there, so this is benign.
+    classification: detectResult.classification,
     vex: vexFilter ? {
       filter_applied: true,
       dropped_cve_count: vexDropped.length,
@@ -1473,7 +1490,20 @@ function analyze(playbookId, directiveId, detectResult, agentSignals = {}, runOp
     findingShape = {};
   }
   for (const ec of an.escalation_criteria || []) {
-    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [], finding: findingShape }, playbook)) {
+    if (evalCondition(ec.condition, { ...agentSignals, ...evalCtxRoot, rwep: adjustedRwep, blast_radius_score: blastRadiusScore, theater_verdict: theaterVerdict, compliance_theater_check: result.compliance_theater_check, jurisdiction_obligations: (playbook.phases && playbook.phases.govern && playbook.phases.govern.jurisdiction_obligations) || [], analyze: result, matched_cve: result.matched_cves || [],
+        // finding.* is two-sourced: the engine computes the CVE/severity-derived
+        // keys (severity, rwep_adjusted, matched_cve_*, blast_radius_score,
+        // active_exploitation, framework/control_id_first) via analyzeFindingShape,
+        // while the DESCRIPTIVE keys the catalog conditions gate on
+        // (finding.includes_*, finding.cve_class, finding.tool_surface, …) are
+        // host-AI-asserted — the agent knows whether the finding includes a
+        // cloud-role-assumption path. Merge agent-supplied finding sub-fields
+        // UNDER the engine shape so the descriptive keys survive while engine-owned
+        // keys still WIN on collision (a poisoning signals.finding.severity can't
+        // override the engine-computed severity). The !Array.isArray guard rejects
+        // an array (typeof [] === 'object') that would inject numeric-index noise;
+        // null is already excluded by the leading &&.
+        finding: { ...(agentSignals.finding && typeof agentSignals.finding === 'object' && !Array.isArray(agentSignals.finding) ? agentSignals.finding : {}), ...findingShape } }, playbook)) {
       escalations.push({ condition: ec.condition, action: ec.action, target_playbook: ec.target_playbook || null });
     }
   }
@@ -2057,7 +2087,12 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     // concerning case, so it scores 100; a clear verdict scores 0. (Earlier
     // this was inverted, so a feeds_into condition like `theater_score >= 50`
     // would have failed to fire exactly when a gap was found.)
-    theater_score: analyzeResult.compliance_theater_check?.verdict === 'theater' ? 100 : 0,
+    // 'present' is an allowlisted theater-equivalent verdict (the same
+    // gap-present set verdict_text uses at line 1426 and the allowlist comment
+    // names at line 1352-1353), so it must score 100 (gap detected = worse), not
+    // 0. Scoring only the 'theater' spelling left a 'present' verdict scored as
+    // clear — inverted for any future feeds_into condition gating on theater_score.
+    theater_score: (analyzeResult.compliance_theater_check?.verdict === 'theater' || analyzeResult.compliance_theater_check?.verdict === 'present') ? 100 : 0,
     // Top-level matched_cve array so the shipped sbom feeds_into quantifiers
     // (`any matched_cve.attack_class == 'kernel-lpe'`, … IN ['ai-c2', …]) re-root
     // at each matched CVE. Without it the quantifier head resolves null and the
@@ -2067,7 +2102,14 @@ function close(playbookId, directiveId, analyzeResult, validateResult, agentSign
     matched_cve: analyzeResult.matched_cves || [],
     analyze: analyzeResult,
     validate: validateResult,
-    finding: analyzeFindingShape(analyzeResult),
+    // finding.* is two-sourced: the engine computes the CVE/severity-derived keys
+    // via analyzeFindingShape; the DESCRIPTIVE keys the catalog feeds_into
+    // conditions gate on (finding.includes_*, cve_class, tool_surface,
+    // mcp_server_location, pipeline_credentials_in_scope, …) are host-AI-asserted.
+    // Merge the agent-supplied finding sub-fields UNDER the engine shape so the
+    // descriptive keys survive while engine-owned keys WIN on collision. Same
+    // shape + guards as the escalation ctx above.
+    finding: { ...(agentSignals.finding && typeof agentSignals.finding === 'object' && !Array.isArray(agentSignals.finding) ? agentSignals.finding : {}), ...analyzeFindingShape(analyzeResult) },
     // Surface evalCondition regex failures from the feeds_into chain into
     // the same accumulator. Without this the regex failure happens but
     // analyze.runtime_errors[] never sees it.
@@ -4130,6 +4172,19 @@ function evalCondition(expr, ctx, playbook) {
   if (m) {
     const [, lhs, op, quote, rhsRaw] = m;
     const lv = resolvePath(ctx, lhs);
+    // A DOTTED (multi-segment) LHS that resolves absent is a suspicious dead
+    // condition (authoring typo / wrong-shape ctx) — the same silent-false class
+    // the contains/includes/IN branches already surface. Surface it as
+    // condition_path_unresolved (observability only; the boolean result is
+    // unchanged). Use `== null` (not strict undefined): resolvePath returns
+    // `null` for a missing INTERMEDIATE parent and `undefined` for a missing
+    // LEAF, so a strict-undefined gate would miss `analyze.classification` when
+    // `analyze` itself is absent. Bare single-segment flags
+    // (agent_has_filesystem_read, operator-submitted signals) are legitimately
+    // absent and do NOT push. A present-but-null flag is a legitimate false:
+    // single-segment, so the dot guard already excludes it. pushPathUnresolved
+    // dedupes on the condition string and is per-kind capped, so it can't spam.
+    if (lhs.includes('.') && lv == null) pushPathUnresolved();
     let rv = rhsRaw;
     if (quote) {
       // Explicit quoted string literal — keep as-is.

package/lib/refresh-external.js

@@ -788,10 +788,12 @@ const { ADVISORIES_SOURCE } = require('./source-advisories');
 // detection method that surfaces poller-diff historical-CVE references as
 // candidate silent-regression cases (the MiniPlasma class — a 2026 PoC
 // drop that re-broke CVE-2020-17103 without any new ID being assigned).
-// Report-only; consumes diffs + extracted-CVE-id list from a prior
-// advisories run (loadCtx populates ctx.advisoriesDiffs +
-// ctx.advisoriesExtractedCveIds when advisories runs alongside the
-// watcher, or operators can chain explicitly via the source registry).
+// Report-only; consumes the prior advisories run's output. The main()
+// source loop threads the advisories fetchDiff() result onto
+// ctx.advisoriesObservations (preferred) + ctx.advisoriesDiffs (fallback)
+// after the advisories source resolves and before the watcher runs, so the
+// two must be invoked in that order (advisories first). Under --swarm the
+// watcher runs in a second pass after the parallel batch resolves.
 const { REGRESSION_WATCHER_SOURCE } = require('./cve-regression-watcher');
 
 const ALL_SOURCES = {
@@ -1795,9 +1797,53 @@ async function main() {
     return { src, diff };
   };
 
-  const outcomes = opts.swarm
-    ? await Promise.all(sources.map(runOne))
-    : await sequential(sources, runOne);
+  // NEW-CTRL-074 chaining. cve-regression-watcher consumes the advisories
+  // source's per-feed CVE observations (preferred — includes in-catalog
+  // historical IDs the annotate verdict needs) and falls back to its diffs.
+  // The orchestrator otherwise runs every source independently and only
+  // persists outputs into the report, never back onto ctx — so without this
+  // thread the watcher always sees empty input and emits zero candidates.
+  const threadAdvisoriesIntoCtx = (src, diff) => {
+    if (src && src.name === "advisories" && diff && !diff.air_gap_blocked) {
+      if (Array.isArray(diff.observations)) ctx.advisoriesObservations = diff.observations;
+      if (Array.isArray(diff.diffs)) ctx.advisoriesDiffs = diff.diffs;
+    }
+  };
+
+  let outcomes;
+  if (!opts.swarm) {
+    // Sequential: thread the advisories output onto ctx the instant it
+    // resolves, BEFORE the next source's fetchDiff(ctx) is invoked.
+    outcomes = [];
+    for (const src of sources) {
+      const outcome = await runOne(src);
+      if (!outcome.error) threadAdvisoriesIntoCtx(outcome.src, outcome.diff);
+      outcomes.push(outcome);
+    }
+  } else {
+    // --swarm: advisories and the watcher race when run via the same
+    // Promise.all, so chaining via shared ctx cannot work. Split the
+    // watcher into a second pass: run every other source in parallel,
+    // thread the resolved advisories observations onto ctx, then run the
+    // watcher. If advisories is NOT also selected, the watcher runs in the
+    // first batch like any other source (its empty-input contract is the
+    // operator's choice, not a silent race).
+    const hasAdvisories = sources.some((s) => s.name === "advisories");
+    const watcher = hasAdvisories
+      ? sources.find((s) => s.name === "cve-regression-watcher")
+      : null;
+    const firstBatch = watcher ? sources.filter((s) => s !== watcher) : sources;
+    outcomes = await Promise.all(firstBatch.map(runOne));
+    if (watcher) {
+      for (const o of outcomes) {
+        if (!o.error) threadAdvisoriesIntoCtx(o.src, o.diff);
+      }
+      const watcherOutcome = await runOne(watcher);
+      // Preserve the operator's declared source order in the report.
+      const idx = sources.indexOf(watcher);
+      outcomes.splice(idx, 0, watcherOutcome);
+    }
+  }
 
   // Cache-integrity refusals (sha256 mismatch, missing/partial _index.json,
   // unindexed payload) are thrown by readCachedJson with _exceptd_exit_code=4
@@ -1832,6 +1878,11 @@ async function main() {
       // marker through to the persisted report so stdout-parsing consumers
       // and the regression test can verify the network refusal happened.
       ...(diff.air_gap_blocked ? { air_gap_blocked: true } : {}),
+      // NEW-CTRL-074: persist the per-source _meta (the watcher stamps
+      // input_field_used here so the chaining is observable in the report)
+      // and the advisories observations[] the watcher consumes.
+      ...(diff._meta ? { _meta: diff._meta } : {}),
+      ...(Array.isArray(diff.observations) ? { observations: diff.observations } : {}),
     };
     if (opts.apply && diff.diffs.length > 0 && !src.report_only) {
       const r = await src.applyDiff(ctx, diff.diffs);

package/lib/refresh-network.js

@@ -152,9 +152,17 @@ function getJson(url, timeoutMs) {
 const ALLOWED_TARBALL_HOST = /(?:^|\.)npmjs\.org$|(?:^|\.)npmjs\.com$/;
 
 // Exported for in-process tests of the fetch-destination guard.
+// The guard parses the URL once and rejects any non-default port BEFORE the
+// hostname test, so validation and the subsequent https.get({host,path})
+// connect (which reuses u.host — port-inclusive) agree on the same value.
+// Without the port check a `registry.npmjs.org:9999` URL would pass the
+// hostname-only allowlist yet connect to the attacker-chosen port.
 function isAllowedTarballHost(url) {
-  try { return ALLOWED_TARBALL_HOST.test(new URL(url).hostname.toLowerCase()); }
-  catch { return false; }
+  try {
+    const u = new URL(url);
+    if (!(u.port === "" || u.port === "443")) return false;
+    return ALLOWED_TARBALL_HOST.test(u.hostname.toLowerCase());
+  } catch { return false; }
 }
 
 function getBufferOnce(url, timeoutMs) {
@@ -403,9 +411,14 @@ async function main() {
 
   // Air-gap refusal. --network needs egress to registry.npmjs.org for the
   // /latest metadata + tarball pull. Under air-gap there is no offline
-  // substitute (the test fixture path remains available for offline tests),
-  // so refuse before any network attempt and point at the offline workflow.
-  if (opts.airGap && !process.env.EXCEPTD_REGISTRY_FIXTURE) {
+  // substitute, so refuse before any network attempt and point at the
+  // offline workflow. The refusal is UNCONDITIONAL w.r.t.
+  // EXCEPTD_REGISTRY_FIXTURE: a present metadata fixture only stubs the
+  // /latest read, not the subsequent tarball fetch (getBuffer still hits
+  // canonicalUrl), so honoring the fixture under air-gap would let egress
+  // happen anyway while silently disabling an operator-facing control.
+  // Offline tests exercise the metadata+tarball path WITHOUT --air-gap.
+  if (opts.airGap) {
     emit({
       ok: false,
       source: "air-gap",
@@ -469,11 +482,14 @@ async function main() {
   // response cannot steer the download's host or path. The metadata URL is
   // still cross-checked for visibility; a divergence is noted, not fatal,
   // because the authenticity anchor is the SHA-512/shasum/Ed25519 chain below.
-  if (!SEMVER_RE.test(String(latestVersion))) {
-    emit({ ok: false, error: `registry metadata version is not valid semver: ${String(latestVersion).slice(0, 64)}` }, opts.json);
+  // Guard the SAME binding that the URL is built from (`safeVersion`), so the
+  // semver check is the only path by which a metadata value reaches the fetch.
+  const safeVersion = typeof latestVersion === "string" ? latestVersion : "";
+  if (!SEMVER_RE.test(safeVersion)) {
+    emit({ ok: false, error: `registry metadata version is not valid semver: ${safeVersion.slice(0, 64)}` }, opts.json);
     process.exitCode = 2; return;
   }
-  const canonicalUrl = canonicalTarballUrl(latestVersion);
+  const canonicalUrl = canonicalTarballUrl(safeVersion);
   if (tarballUrl !== canonicalUrl) {
     progress(`note: registry dist.tarball (${tarballUrl}) differs from canonical npm URL; fetching ${canonicalUrl}`, opts.json);
   }