@blamejs/exceptd-skills 0.18.9 → 0.18.12

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.18.12 — 2026-06-22
+
+A correctness pass across the CLI, the engine, scoring, the collectors, framework-gap reporting, signature verification, and the CWE-chain index.
+
+`ci`/`run --evidence-dir` now refuses a `<playbook>.json` entry that is not a JSON object (an array, scalar, or null) with the same object-shape error the single-file and stdin paths use, instead of binding it as empty evidence and reporting a clean `not_detected` PASS at exit 0 — a mis-shaped per-playbook submission no longer produces a false-clean gate result.
+
+`verifyManifestSignature` consults the `keys/EXPECTED_FINGERPRINT` key pin before the missing-signature path, so a swapped `keys/public.pem` whose `manifest_signature` was stripped is rejected through the library API rather than treated as a benign legacy state. Escalation and `feeds_into` ordering comparisons against a duration literal — e.g. the kernel playbook's `reboot_window > 24h` raise-severity chain — normalize both sides to hours and compare numerically instead of lexicographically (so a 48-hour window escalates and a 6-hour window does not); an ordering comparison that degrades to two non-numeric, non-duration strings now surfaces a `condition_type_mismatch` diagnostic instead of evaluating silently.
+
+`compare()`'s factor explanation lists the reboot (+5) driver whenever a reboot is required, regardless of live-patch availability, matching the score it actually computes; and a post-weight RWEP block that stores `active_exploitation` as a status string is read as a post-weight block (its weighted factors, including the AI factor, are no longer dropped or mis-flagged as a mixed shape).
+
+The secrets collector's `ssh-key-bad-perms` posture and the credential-store AWS doc-fixture demotion no longer false-positive on checked-in test-path fixtures or a duplicate profile name. A single-framework `framework-gap` report scopes its theater-risk list and matching-gap count to the requested framework instead of leaking controls from frameworks the operator did not ask about. `rfc --check` no longer falsely matches an unrelated title when the claimed title repeats a token. The CWE-chains index excludes auto-imported draft CVEs, matching the by-CVE half's curated-truth invariant. A null or non-object MCP server entry (config scan) or dispatch finding is skipped with a clear marker rather than dropping the file's other findings or throwing an opaque error.
+
+## 0.18.11 — 2026-06-22
+
+Regenerates the CycloneDX SBOM (`sbom.cdx.json`) so its recorded hash for `CHANGELOG.md` matches the shipped file.
+
+## 0.18.10 — 2026-06-20
+
+A large correctness pass across the condition engine, scoring, correlation, the collectors, the validators, the orchestrator, the refresh pipeline, and the CLI.
+
+Escalation and `feeds_into` conditions that reference host-asserted finding descriptors — `finding.includes_*`, `finding.cve_class`, `finding.tool_surface`, and the rest of that family — now evaluate. The engine merges an agent-supplied `finding` object underneath the engine-computed fields, so a host-AI assertion (e.g. "this finding includes a cloud-role-assumption path") survives into the condition while engine-owned fields like severity and RWEP still win on collision; previously the engine's finding shape replaced the agent's object wholesale and roughly three dozen catalog chains across eighteen playbooks could never fire. The SBOM playbook's EU CRA Art.14 actively-exploited escalation now fires when a matched CVE is actively exploited under an EU obligation (it compared a composite notification key against the obligation set and never matched). `analyze.classification` conditions resolve, so the identity-SSO playbook's incident chain that gates on detection classification fires. A comparison whose dotted left-hand side resolves to nothing surfaces a diagnostic instead of evaluating to an invisible false. A `present` compliance verdict scores as a detected gap in the `theater_score` exposed to chaining, matching the rest of the engine. The playbook RWEP scaler routes the active-exploitation factor through the shared resolver, so a stray-cased or out-of-vocabulary value warns rather than silently scoring zero.
+
+`compare()` no longer fabricates a "Low / next maintenance" CVSS SLA for a CVE that carries no CVSS. The post-weight RWEP factor sum excludes unrecognised or mistyped keys (with a warning) instead of letting them inflate the score.
+
+ATT&CK technique cross-references resolve (the technique catalog is loaded), and the D3FEND countermeasure correlation reads its populated field instead of an always-empty one. Per-framework gap counts are reported for every framework rather than collapsing to zero for most of them. The containers collector flags a multi-stage Dockerfile whose final stage runs as root. Auto-imported draft CVEs are excluded from the CWE/technique/skill correlations, matching the by-CVE lookup. D3FEND artifact ids are recognised by the reference scanner, and two artifact ids that carried a spurious trailing period are normalised — the D3FEND refresh now normalises the upstream id to the catalog key as well, so a later refresh matches the existing row instead of re-adding a period-suffixed duplicate.
+
+`scan`, `dispatch`, and `report` honour `--air-gap` by suppressing the TLS-reachability probe — previously only `EXCEPTD_AIR_GAP=1` did. `refresh --network` refuses under air-gap even when a registry fixture is set, and the tarball host allowlist validates the host it actually connects to. The CVE regression watcher receives advisory observations so it runs, and content-only regression candidates are de-duplicated and source-merged across feeds.
+
+The catalog, CVE, and playbook validators report a clear error on a missing `_meta` block, a null catalog entry, or a null playbook file instead of crashing mid-scan, and the catalog freshness gate rejects a malformed `last_updated` date rather than skipping it. The skill staleness gate rejects a structurally-ISO but non-calendar date (e.g. `2026-13-99`), and the playbook air-gap source detector flags API-verb-phrased network sources (`GET /…`, Microsoft Graph, Okta, Entra ID) in both the imperative validator and the schema.
+
+The feed tokenizer preserves a title or body field that contains an unescaped `<`, surfaces parse errors on the live RSS/Atom path instead of discarding them, and captures the correct alternate-link href on multi-link Atom entries. The framework-coverage lookup no longer matches every control when the framework id is empty or very short.
+
+`doctor --json` and `doctor --pretty` exit 0 on a warnings-only state, matching the human output (a CI consumer no longer sees a false failure). `ci --evidence-dir` applies the same symlink / no-follow / realpath defenses the multi-run evidence reader uses, and its containment check resolves the directory's real path before comparing, so a `<playbook>.json` under a symlinked parent (a symlinked mount, home, or temp directory) is read rather than refused as resolving outside the directory. An error envelope is still emitted under `--json-stdout-only`, and it is JSON even for an error raised before flag parsing (an unknown or removed verb) so a piped `| jq` consumer never receives human-formatted text on stdout; help and welcome output flushes before exit. The dispatch plan keeps an entry for every distinct finding that routes to a skill, so two findings that route to the same skill no longer collapse into one; the currency check reports a malformed `last_threat_review` as stale rather than fully current; and a null or non-object stage output yields a clear handoff error.
+
+The upstream catalog refresh does not stamp a catalog fresh or rewrite it when the fetch returned an error body or produced no change, writes the catalog atomically, and bounds redirect depth. Section and token-budget byte offsets are computed end-of-line-aware so they stay correct on a CRLF body, and index writes retry through a transient file lock on Windows. The RFC CLI parses a claimed title regardless of position and matches titles strictly, the citation resolver binds a cached record to the requested citation, and the upstream-check CLI surfaces an unexpected error as a structured envelope.
+
 ## 0.18.9 — 2026-06-20
 
 Internal: the refresh tarball pull and the vendor-source online check build their request URL entirely from constant and individually-validated bindings — a GitHub-name-shaped owner/repo, a hex commit id, a traversal-free path, and a strict-semver version — and the request is built from those validated bindings directly, so no unvalidated registry-metadata or provenance value reaches the outbound request. Behavior is unchanged; this tightens the data-flow into the fetchers.

package/bin/exceptd.js

@@ -538,6 +538,15 @@ function main() {
   if (argv.includes("--json-stdout-only")) {
     process.env.EXCEPTD_DEPRECATION_SHOWN = "1";
     process.env.EXCEPTD_UNSIGNED_WARNED = "1";
+    // Route the canonical error envelope (emitError) to STDOUT under this flag.
+    // Without it, --json-stdout-only sends all diagnostics to stderr and then
+    // suppresses non-"Error"-prefixed stderr — but emitError's ok:false body is
+    // neither stdout-bound nor "Error"-prefixed, so an error invocation produced
+    // NO diagnostic on stdout OR stderr (just an exit code). A `| jq` consumer
+    // reading stdout would see an empty document on every failure. Set a
+    // dedicated global so emitError can detect the flag and write its JSON
+    // envelope to stdout (where the consumer is already reading) instead.
+    global.__exceptdJsonStdoutOnly = true;
     const origStderrWrite = process.stderr.write.bind(process.stderr);
     process.stderr.write = (chunk, encoding, cb) => {
       // Let actual error frames through (uncaught exceptions need to surface
@@ -575,7 +584,7 @@ function main() {
 
   if (argv.length === 0) {
     printWelcome();
-    process.exit(0);
+    safeExit(EXIT_CODES.SUCCESS); return;
   }
   const cmd = argv[0];
   const rest = argv.slice(1);
@@ -601,14 +610,14 @@ function main() {
         return;
       }
       if (printPlaybookVerbHelp(verb)) {
-        process.exit(0);
+        safeExit(EXIT_CODES.SUCCESS); return;
       }
       // Verb not found — emit a one-line note pointing at the top-level
       // help so operators don't silently see the wrong content.
       process.stderr.write(`[exceptd help] no verb-specific help for "${verb}" — falling through to top-level help. Run \`exceptd help\` for the full verb list.\n`);
     }
     printHelp();
-    process.exit(0);
+    safeExit(EXIT_CODES.SUCCESS); return;
   }
   if (cmd === "version" || cmd === "--version" || cmd === "-v") {
     process.stdout.write(readPkgVersion() + "\n");
@@ -919,7 +928,12 @@ function emitError(msg, extra, pretty) {
   // Explicit --json / --pretty / --json-stdout-only also force JSON
   // regardless of TTY (e.g. an operator redirecting to a file).
   const body = Object.assign({ ok: false, error: msg }, extra || {});
-  const wantJson = !!global.__exceptdWantJson || !!process.env.EXCEPTD_RAW_JSON;
+  // --json-stdout-only routes the envelope to stdout (below), so the envelope
+  // MUST be JSON. For a top-level error raised before flag parsing sets
+  // __exceptdWantJson (an unknown/removed verb), the stdout-only flag is the
+  // only signal present — fold it into the JSON selection so a human string is
+  // never written to the machine-readable stdout channel (breaking `| jq`).
+  const wantJson = !!global.__exceptdWantJson || !!process.env.EXCEPTD_RAW_JSON || !!global.__exceptdJsonStdoutOnly;
   const stderrIsTty = process.stderr.isTTY === true;
   let s;
   if (wantJson || !stderrIsTty) {
@@ -934,7 +948,16 @@ function emitError(msg, extra, pretty) {
     }
     s = lines.join("\n");
   }
-  process.stderr.write(s + "\n");
+  // Under --json-stdout-only, route the JSON error envelope to STDOUT (where the
+  // consumer is already reading machine-readable output) instead of the
+  // suppressed stderr channel — otherwise the error would surface on neither
+  // stream. The flag forces JSON (global.__exceptdWantJson is set via
+  // args._jsonMode), so `s` here is already the JSON envelope, not human text.
+  if (global.__exceptdJsonStdoutOnly) {
+    process.stdout.write(s + "\n");
+  } else {
+    process.stderr.write(s + "\n");
+  }
   process.exitCode = EXIT_CODES.GENERIC_FAILURE;
 }
 
@@ -1252,7 +1275,7 @@ function dispatchPlaybook(cmd, argv) {
   // get usage text instead of an error about missing arguments.
   if (argv.includes("--help") || argv.includes("-h")) {
     printPlaybookVerbHelp(cmd);
-    process.exit(0);
+    safeExit(EXIT_CODES.SUCCESS); return;
   }
 
   const args = parseArgs(argv, {
@@ -4191,6 +4214,151 @@ function buildJurisdictionClockRollup(results) {
   return [...m.values()];
 }
 
+// Shared, hardened reader for `--evidence-dir <dir>`. Both `run` (cmdRunMulti)
+// and `ci` (cmdCi) accept --evidence-dir; the symlink / junction / O_NOFOLLOW /
+// realpath-containment / playbook-id defenses must apply identically to both.
+// Previously cmdCi read entries with a bare fs.readFileSync, so a `<pb>.json`
+// symlink/junction inside the dir bypassed every containment check that `run`
+// applies. Factor the read into one helper so the class is fixed once and a
+// future third caller can't regress.
+//
+// Returns { ok: true, bundle } on success, or
+// { ok: false, error: <msg>, extra: <obj|null> } on the first refusal — the
+// caller routes the error through its own emitError() so the verb-prefixed
+// message ("run: ..." vs "ci: ...") is preserved. The directory's existence /
+// type and the empty-string guard are the caller's responsibility (the two
+// verbs surface those with verb-specific wording).
+function readEvidenceDir(dir, verb) {
+  const bundle = {};
+  const resolvedDir = path.resolve(dir);
+  // Resolve the directory's realpath ONCE so the per-entry containment gate
+  // below compares like-for-like. On macOS the tmpdir — and many operator
+  // directories anywhere — live under a symlinked ancestor (e.g. /var ->
+  // /private/var, or a symlinked mount/home). Without resolving the base, a
+  // legitimate <pb-id>.json whose realpath is /private/var/.../f fails a
+  // `startsWith(resolvedDir)` test against /var/.../ and every evidence file is
+  // wrongly refused. Resolving the base keeps the junction/symlink-escape
+  // defense (an entry whose target leaves the resolved dir still fails) while
+  // accepting files that merely sit under a symlinked parent.
+  let realResolvedDir;
+  try { realResolvedDir = fs.realpathSync(resolvedDir); }
+  catch { realResolvedDir = resolvedDir; }
+  // Only `<playbook-id>.json` entries are honored. Reject anything where the
+  // filename strip leaves traversal segments — npm refuses to write such
+  // filenames so the realistic risk is an operator symlink/junction inside the
+  // dir, but the filter is cheap.
+  for (const f of fs.readdirSync(dir).filter(x => x.endsWith(".json"))) {
+    const pbId = f.replace(/\.json$/, "");
+    // Reuse the shared playbook-id validator so the --evidence-dir entry
+    // filter agrees with the runtime playbook-id allowlist. Rejects
+    // dots / underscores / uppercase that no real playbook id uses, which would
+    // otherwise silently absorb a typo'd filename as a "valid" entry that
+    // loadPlaybook then refused mid-loop.
+    const pbCheck = validateIdComponent(pbId, "playbook");
+    if (!pbCheck.ok) {
+      return {
+        ok: false,
+        error: `${verb}: --evidence-dir entry ${JSON.stringify(f)} has invalid playbook-id segment (${pbCheck.reason}).`,
+        extra: { entry: f, expected_shape: "<playbook-id>.json (lowercase, starts with letter, no dots)" },
+      };
+    }
+    const entryPath = path.resolve(path.join(resolvedDir, f));
+    if (!entryPath.startsWith(resolvedDir + path.sep)) {
+      return { ok: false, error: `${verb}: --evidence-dir entry ${f} resolves outside the directory; refusing.`, extra: null };
+    }
+    // The path.resolve check above only catches `..` traversal in the joined
+    // path; reading the path would still follow symlinks, so a
+    // `<pb-id>.json -> /etc/shadow` symlink inside the dir would slurp the
+    // target. Rather than lstat/realpath the PATH and then re-open it (a
+    // check-then-use TOCTOU window), open a single O_NOFOLLOW descriptor FIRST
+    // and make every subsequent decision about that exact descriptor.
+    // O_NOFOLLOW refuses a symlinked leaf at open (ELOOP) on POSIX; on Windows
+    // it is a no-op, so the fstat type check + lstat + realpath gate below carry
+    // the junction/symlink defense. Opening before any path stat means the bytes
+    // read come from the inode we validated, not a path that could be re-pointed
+    // between check and read.
+    let efd;
+    try {
+      const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
+      efd = fs.openSync(entryPath, fs.constants.O_RDONLY | O_NOFOLLOW);
+    } catch (e) {
+      const why = e.code === "ELOOP"
+        ? "symbolic link refused (symlinks bypass the directory-confinement check)"
+        : e.message;
+      return { ok: false, error: `${verb}: --evidence-dir entry ${f}: open failed: ${why}`, extra: { entry: f } };
+    }
+    try {
+      const st = fs.fstatSync(efd);
+      if (!st.isFile()) {
+        return { ok: false, error: `${verb}: --evidence-dir entry ${f} is not a regular file; refusing (symlink / junction / dir / fifo bypass the directory-confinement check).`, extra: { entry: f } };
+      }
+      // Hardlink defense in depth: no clean cross-platform refusal exists —
+      // hardlinks are indistinguishable from regular files at the inode level.
+      // Surface a stderr warning when nlink > 1 so the operator is aware a
+      // second name may point at the same file. Not a refusal — legitimate use
+      // cases (atomic rename, package-manager dedup) produce nlink > 1 without
+      // malicious intent.
+      if (st.nlink > 1) {
+        process.stderr.write(`[exceptd ${verb} --evidence-dir] WARNING: ${f} has nlink=${st.nlink}; a hardlink to this file exists elsewhere on the filesystem. Hardlinks cannot be refused cross-platform — confirm the file content is what you expect.\n`);
+      }
+      // Read the bytes from `efd` FIRST — the descriptor was opened O_NOFOLLOW
+      // and fstat-confirmed a regular file, so this reads the exact inode we
+      // validated. Reading before the realpath gate (rather than checking the
+      // path then reading) means there is no check-then-use window at all; the
+      // containment gate below decides whether to USE the bytes, and discards
+      // them otherwise.
+      const raw = fs.readFileSync(efd, "utf8");
+      // Symlink refusal. O_NOFOLLOW already rejects a symlinked leaf at open on
+      // POSIX (ELOOP), but it is a no-op on Windows, where the open follows the
+      // link. Detect and refuse a symlink explicitly via lstat — regardless of
+      // where it points — so a symlinked entry is never accepted. This runs
+      // AFTER the descriptor read (the bytes are dropped on refusal), so there
+      // is no path-check-before-read TOCTOU window.
+      let lst;
+      try { lst = fs.lstatSync(entryPath); }
+      catch (e) {
+        return { ok: false, error: `${verb}: --evidence-dir entry ${f}: lstat failed: ${e.message}`, extra: null };
+      }
+      if (lst.isSymbolicLink()) {
+        return { ok: false, error: `${verb}: --evidence-dir entry ${f} is a symbolic link; refusing (symlinks bypass the directory-confinement check).`, extra: { entry: f } };
+      }
+      // Windows directory junctions are reparse-point dirs that
+      // lstat().isSymbolicLink() returns FALSE for, and O_NOFOLLOW is a no-op
+      // there; realpath resolves the entry and confirms it still lives under the
+      // resolved evidence-dir. A target that escapes the dir is refused and the
+      // already-read bytes are dropped unused.
+      let realEntry;
+      try { realEntry = fs.realpathSync(entryPath); }
+      catch (e) {
+        return { ok: false, error: `${verb}: --evidence-dir entry ${f}: realpath failed: ${e.message}`, extra: null };
+      }
+      if (!realEntry.startsWith(realResolvedDir + path.sep)) {
+        return {
+          ok: false,
+          error: `${verb}: --evidence-dir entry ${f} resolves outside the directory (junction / reparse-point / symlink target). Refusing.`,
+          extra: { entry: f, resolved_to: realEntry },
+        };
+      }
+      // Apply the SAME object-shape guard the single-file / stdin path uses
+      // (asEvidenceObject): a `<pb>.json` that parses to an array, scalar, or
+      // null is not a valid evidence document. Without this an mis-shaped entry
+      // was bound verbatim and ran downstream as empty evidence, yielding a
+      // false-clean `not_detected` PASS at exit 0 — the exact hole the
+      // single-file guard closes.
+      bundle[pbId] = asEvidenceObject(JSON.parse(raw));
+    } catch (e) {
+      // A JSON parse error or the asEvidenceObject shape refusal lands here;
+      // surface it with the entry name so the operator sees the real reason
+      // (e.g. "evidence must be a JSON object"). The explicit symlink/junction
+      // refusals above return directly and never reach this catch.
+      return { ok: false, error: `${verb}: --evidence-dir entry ${f}: ${e.message}`, extra: { entry: f } };
+    } finally {
+      try { fs.closeSync(efd); } catch { /* already closed / invalid fd */ }
+    }
+  }
+  return { ok: true, bundle };
+}
+
 function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
   const sessionId = runOpts.session_id || require("crypto").randomBytes(8).toString("hex");
   runOpts.session_id = sessionId;
@@ -4228,110 +4396,12 @@ function cmdRunMulti(runner, ids, args, runOpts, pretty, meta) {
     if (!fs.existsSync(dir)) {
       return emitError(`run: --evidence-dir ${dir} does not exist.`, null, pretty);
     }
-    const resolvedDir = path.resolve(dir);
-    // v0.12.12: only `<playbook-id>.json` entries are honored. Reject
-    // anything where the filename strip leaves traversal segments — npm
-    // refuses to write such filenames so the realistic risk is an operator
-    // symlink/junction inside the dir, but the filter is cheap.
-    for (const f of fs.readdirSync(dir).filter(x => x.endsWith(".json"))) {
-      const pbId = f.replace(/\.json$/, "");
-      // Reuse the shared playbook-id validator so the --evidence-dir entry
-      // filter agrees with the runtime playbook-id allowlist. Previously
-      // accepted dots / underscores / uppercase that no real playbook id
-      // uses, which would silently absorb a typo'd filename as a "valid"
-      // entry that loadPlaybook then refused mid-loop.
-      const pbCheck = validateIdComponent(pbId, "playbook");
-      if (!pbCheck.ok) {
-        return emitError(
-          `run: --evidence-dir entry ${JSON.stringify(f)} has invalid playbook-id segment (${pbCheck.reason}).`,
-          { entry: f, expected_shape: "<playbook-id>.json (lowercase, starts with letter, no dots)" },
-          pretty
-        );
-      }
-      const entryPath = path.resolve(path.join(resolvedDir, f));
-      if (!entryPath.startsWith(resolvedDir + path.sep)) {
-        return emitError(`run: --evidence-dir entry ${f} resolves outside the directory; refusing.`, null, pretty);
-      }
-      // The path.resolve check above only catches `..` traversal in the
-      // joined path; reading the path would still follow symlinks, so a
-      // `<pb-id>.json -> /etc/shadow` symlink inside the dir would slurp the
-      // target. Rather than lstat/realpath the PATH and then re-open it
-      // (a check-then-use TOCTOU window), open a single O_NOFOLLOW descriptor
-      // FIRST and make every subsequent decision about that exact descriptor.
-      // O_NOFOLLOW refuses a symlinked leaf at open (ELOOP) on POSIX; on
-      // Windows it is a no-op, so the fstat type check + realpath gate below
-      // carry the junction/symlink defense. Opening before any path stat means
-      // the bytes read come from the inode we validated, not a path that could
-      // be re-pointed between check and read.
-      let efd;
-      try {
-        const O_NOFOLLOW = fs.constants.O_NOFOLLOW || 0;
-        efd = fs.openSync(entryPath, fs.constants.O_RDONLY | O_NOFOLLOW);
-      } catch (e) {
-        const why = e.code === "ELOOP"
-          ? "symbolic link refused (symlinks bypass the directory-confinement check)"
-          : e.message;
-        return emitError(`run: --evidence-dir entry ${f}: open failed: ${why}`, { entry: f }, pretty);
-      }
-      try {
-        const st = fs.fstatSync(efd);
-        if (!st.isFile()) {
-          return emitError(`run: --evidence-dir entry ${f} is not a regular file; refusing (symlink / junction / dir / fifo bypass the directory-confinement check).`, { entry: f }, pretty);
-        }
-        // Hardlink defense in depth: no clean cross-platform refusal exists —
-        // hardlinks are indistinguishable from regular files at the inode
-        // level. Surface a stderr warning when nlink > 1 so the operator is
-        // aware a second name may point at the same file. Not a refusal —
-        // legitimate use cases (atomic rename, package-manager dedup) produce
-        // nlink > 1 without malicious intent.
-        if (st.nlink > 1) {
-          process.stderr.write(`[exceptd run --evidence-dir] WARNING: ${f} has nlink=${st.nlink}; a hardlink to this file exists elsewhere on the filesystem. Hardlinks cannot be refused cross-platform — confirm the file content is what you expect.\n`);
-        }
-        // Read the bytes from `efd` FIRST — the descriptor was opened
-        // O_NOFOLLOW and fstat-confirmed a regular file, so this reads the exact
-        // inode we validated. Reading before the realpath gate (rather than
-        // checking the path then reading) means there is no check-then-use
-        // window at all; the containment gate below decides whether to USE the
-        // bytes, and discards them otherwise.
-        const raw = fs.readFileSync(efd, "utf8");
-        // Symlink refusal. O_NOFOLLOW already rejects a symlinked leaf at open on
-        // POSIX (ELOOP), but it is a no-op on Windows, where the open follows the
-        // link. Detect and refuse a symlink explicitly via lstat — regardless of
-        // where it points — so a symlinked entry is never accepted. This runs
-        // AFTER the descriptor read (the bytes are dropped on refusal), so there
-        // is no path-check-before-read TOCTOU window.
-        let lst;
-        try { lst = fs.lstatSync(entryPath); }
-        catch (e) {
-          return emitError(`run: --evidence-dir entry ${f}: lstat failed: ${e.message}`, null, pretty);
-        }
-        if (lst.isSymbolicLink()) {
-          return emitError(`run: --evidence-dir entry ${f} is a symbolic link; refusing (symlinks bypass the directory-confinement check).`, { entry: f }, pretty);
-        }
-        // Windows directory junctions are reparse-point dirs that
-        // lstat().isSymbolicLink() returns FALSE for, and O_NOFOLLOW is a
-        // no-op there; realpath resolves the entry and confirms it still lives
-        // under the resolved evidence-dir. A target that escapes the dir is
-        // refused and the already-read bytes are dropped unused.
-        let realEntry;
-        try { realEntry = fs.realpathSync(entryPath); }
-        catch (e) {
-          return emitError(`run: --evidence-dir entry ${f}: realpath failed: ${e.message}`, null, pretty);
-        }
-        if (realEntry !== entryPath && !realEntry.startsWith(resolvedDir + path.sep)) {
-          return emitError(
-            `run: --evidence-dir entry ${f} resolves outside the directory (junction / reparse-point / symlink target). Refusing.`,
-            { entry: f, resolved_to: realEntry },
-            pretty
-          );
-        }
-        bundle[pbId] = JSON.parse(raw);
-      } catch (e) {
-        return emitError(`run: failed to read --evidence-dir entry ${f}: ${e.message}`, null, pretty);
-      } finally {
-        try { fs.closeSync(efd); } catch { /* already closed / invalid fd */ }
-      }
-    }
+    // Hardened read (symlink / junction / O_NOFOLLOW / realpath-containment /
+    // playbook-id gate) lives in the shared readEvidenceDir() helper so `run`
+    // and `ci` apply identical defenses.
+    const er = readEvidenceDir(dir, "run");
+    if (!er.ok) return emitError(er.error, er.extra, pretty);
+    Object.assign(bundle, er.bundle);
   }
 
   const results = [];
@@ -7815,7 +7885,15 @@ function cmdDoctor(runner, args, runOpts, pretty) {
 
   if (wantJson) {
     emit(out, indent);
-    if (!allGreen) process.exitCode = EXIT_CODES.GENERIC_FAILURE;
+    // Exit-code predicate must match the human path (gates on errorList only):
+    // warnings alone do NOT force exit 1. The body still carries all_green,
+    // warnings_count, and warning_checks for consumers that want the full
+    // picture; only the exit code stops conflating a warn-only nudge (missing
+    // private key on a consumer install, registry-behind) with a hard error.
+    // A genuine signature-verification failure sets ok:false WITHOUT
+    // severity:"warn", so bucketChecks routes it to errorList and it still
+    // forces exit 1 here.
+    if (errorList.length > 0) process.exitCode = EXIT_CODES.GENERIC_FAILURE;
     return;
   }
 
@@ -9044,18 +9122,25 @@ function cmdCi(runner, args, runOpts, pretty) {
     try { bundle = readEvidence(args.evidence); }
     catch (e) { return emitError(`ci: failed to read --evidence: ${e.message}`, null, pretty); }
   }
+  if (args["evidence-dir"] === "") {
+    return emitError("ci: --evidence-dir was given an empty value; pass an existing directory, or omit --evidence-dir", { verb: "ci", flag: "evidence-dir" }, pretty);
+  }
   if (args["evidence-dir"]) {
     const dir = args["evidence-dir"];
+    if (typeof dir !== "string") {
+      return emitError("ci: --evidence-dir must be a string.", null, pretty);
+    }
     if (!fs.existsSync(dir)) {
       return emitError(`ci: --evidence-dir ${dir} does not exist.`, null, pretty);
     }
-    for (const f of fs.readdirSync(dir).filter(x => x.endsWith(".json"))) {
-      try {
-        bundle[f.replace(/\.json$/, "")] = JSON.parse(fs.readFileSync(path.join(dir, f), "utf8"));
-      } catch (e) {
-        return emitError(`ci: failed to parse evidence-dir entry ${f}: ${e.message}`, null, pretty);
-      }
-    }
+    // Hardened read (symlink / junction / O_NOFOLLOW / realpath-containment /
+    // playbook-id gate) lives in the shared readEvidenceDir() helper so `ci`
+    // and `run` apply identical defenses. Previously `ci` read entries with a
+    // bare fs.readFileSync, so a `<pb>.json` symlink/junction inside the dir
+    // bypassed every containment check `run` applies.
+    const er = readEvidenceDir(dir, "ci");
+    if (!er.ok) return emitError(er.error, er.extra, pretty);
+    Object.assign(bundle, er.bundle);
   }
 
   // Flat-submission tolerance for a single positional playbook. `ci` keys its
@@ -9579,4 +9664,5 @@ module.exports = {
   _diffArtifacts: diffArtifacts,
   _diffSignalOverrides: diffSignalOverrides,
   _resolveSelfAttestation: resolveSelfAttestation,
+  _readEvidenceDir: readEvidenceDir,
 };

package/data/_indexes/_meta.json

@@ -1,16 +1,16 @@
 {
   "schema_version": "1.1.0",
-  "generated_at": "2026-06-21T01:54:07.230Z",
+  "generated_at": "2026-06-22T06:27:15.592Z",
   "generator": "scripts/build-indexes.js",
   "source_count": 64,
   "source_hashes": {
-    "manifest.json": "f077895655b0127a2e31c8fd34db26fda9f20e663b07d01f2f1cc6132068bc89",
+    "manifest.json": "d897efd048acdde209213af36857c5385c036a650096531408ca978590e38226",
     "README.md": "e7b854e7db9a364a1b368b5084b4f0c2a8282f0459ce39800ac1d1dabdc06074",
     "data/atlas-ttps.json": "5bc59e23d6c2defa54168de161a0825299b9cc4a49c6b26df2dae70b4f42eedf",
     "data/attack-techniques.json": "53c6f248760eecb11a0354f74ab467a5814e95075a686b9b3bf18c34e2f7435e",
     "data/cve-catalog.json": "06ca53e69071dfe94867c10717f3ff2962c50341defcaf050f1a96236b5be51c",
     "data/cwe-catalog.json": "359263361fa52069e2856cc352d8f1c757d614ea840db6ef3ff5e696185ca220",
-    "data/d3fend-catalog.json": "349d14b2777342d38e5f8b0149a9ebd7703ee59f67a9efee200d1e19313088ac",
+    "data/d3fend-catalog.json": "b5c1e83d216ba8ece6be1368d807d1636f3d77622fd4e9148e9ba2f5fd44ee0d",
     "data/dlp-controls.json": "d2406c482dddd30e49203879999dc4b3a7fd4d0494d6a61d86b91ee76415df19",
     "data/exploit-availability.json": "ec2656f0d9a893610e27b43eb6035fe9b18e057c9f6dfaac7e7d4959bbcbb795",
     "data/framework-control-gaps.json": "760c2275803c6da3665ce538c5176bde6f041b68cc3d4808b8de961dfcdee6b8",

package/data/_indexes/frequency.json

@@ -3707,8 +3707,8 @@
       "D3A-BOC",
       "D3A-BOM",
       "D3A-BOO",
-      "D3A-C4.",
-      "D3A-C5.",
+      "D3A-C4",
+      "D3A-C5",
       "D3A-CA",
       "D3A-CAR",
       "D3A-CBC",

package/data/d3fend-catalog.json

@@ -6062,8 +6062,8 @@
     "_auto_imported": true,
     "_intake_method": "mitre-d3fend-owl"
   },
-  "D3A-C4.": {
-    "id": "D3A-C4.",
+  "D3A-C4": {
+    "id": "D3A-C4",
     "name": "C4.5",
     "tactic": "Defensive",
     "description": "C4.5 is an algorithm that is strongly based off ID3.",
@@ -6077,13 +6077,13 @@
     "requires": [],
     "inventories": [],
     "kb_reference": null,
-    "reference_url": "https://d3fend.mitre.org/technique/D3A-C4./",
+    "reference_url": "https://d3fend.mitre.org/technique/D3A-C4/",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
     "_intake_method": "mitre-d3fend-owl"
   },
-  "D3A-C5.": {
-    "id": "D3A-C5.",
+  "D3A-C5": {
+    "id": "D3A-C5",
     "name": "C5.0",
     "tactic": "Defensive",
     "description": "C5.0 is the next version of C4.5, which in turn is the upgrade from ID3.",
@@ -6097,7 +6097,7 @@
     "requires": [],
     "inventories": [],
     "kb_reference": null,
-    "reference_url": "https://d3fend.mitre.org/technique/D3A-C5./",
+    "reference_url": "https://d3fend.mitre.org/technique/D3A-C5/",
     "last_verified": "2026-05-19",
     "_auto_imported": true,
     "_intake_method": "mitre-d3fend-owl"

package/data/playbooks/identity-sso-compromise.json

@@ -46,7 +46,7 @@
     "feeds_into": [
       {
         "playbook_id": "idp-incident",
-        "condition": "phases.detect.classification == 'detected'"
+        "condition": "analyze.classification == 'detected'"
       },
       {
         "playbook_id": "cred-stores",
@@ -642,7 +642,7 @@
       ],
       "escalation_criteria": [
         {
-          "condition": "phases.detect.classification == 'detected'",
+          "condition": "analyze.classification == 'detected'",
           "action": "trigger_playbook",
           "target_playbook": "idp-incident"
         },

package/data/playbooks/sbom.json

@@ -1247,7 +1247,7 @@
           "action": "notify_legal"
         },
         {
-          "condition": "any actively_exploited_match AND jurisdiction_obligations contains 'EU/EU CRA Art.14 24h'",
+          "condition": "any matched_cve.active_exploitation == 'confirmed' AND jurisdiction_obligations contains 'EU'",
           "action": "notify_legal"
         }
       ]

package/lib/citation-resolve.js

@@ -87,6 +87,17 @@ function cacheGet(kind, id) {
     if (!Number.isFinite(ts)) return null;
     const age = Date.now() - ts;
     if (age < -60_000 || age > CACHE_TTL_MS) return null;
+    // Bind the record to the requested key — a digest proves self-consistency,
+    // not that this is the record FOR the looked-up id/kind. A digest-valid
+    // record written under one filename but carrying a different internal
+    // id/kind would otherwise be served for the wrong lookup (a swapped-file
+    // poisoning that the self-digest cannot catch). Mismatch → cache miss.
+    if (record.kind !== kind) return null;
+    if (kind === "cve") {
+      if (typeof record.id !== "string" || record.id.toUpperCase() !== String(id).toUpperCase()) return null;
+    } else if (kind === "rfc") {
+      if (Number(record.number) !== Number(id)) return null;
+    }
     delete record._digest; // internal integrity field — never surface it
     return record;
   } catch { return null; }

package/lib/collectors/containers.js

@@ -191,6 +191,19 @@ function scanDockerfile(content, rel) {
           hits["dockerfile-from-latest"].push({ file: rel, line: i + 1, snippet: trimmed.slice(0, 120) });
         }
       }
+      // USER does NOT carry across Docker build stages: each stage starts
+      // from its base image's default user (root) until its own USER
+      // directive. A `FROM <prior-stage-alias>` is the one exception — it
+      // inherits the parent stage's USER, so it must NOT reset. Any other
+      // FROM (registry image, or `scratch`) begins a fresh stage and resets
+      // the per-stage USER tracking, so the runs-as-root predicate reflects
+      // only the FINAL stage. Evaluate internal-vs-external against the
+      // ARG-resolved `ref` and BEFORE the current alias is recorded.
+      const isInternalStageRef = stageAliases.has(ref.toLowerCase());
+      if (!isInternalStageRef) {
+        sawNonRootUser = false;
+        sawAnyUser = false;
+      }
       // Record this stage's alias so later `FROM <alias>` lines are recognized
       // as internal references.
       if (alias) stageAliases.add(alias.toLowerCase());