@blamejs/exceptd-skills 0.18.9 → 0.18.12

package/lib/refresh-external.js

@@ -788,10 +788,12 @@ const { ADVISORIES_SOURCE } = require('./source-advisories');
 // detection method that surfaces poller-diff historical-CVE references as
 // candidate silent-regression cases (the MiniPlasma class — a 2026 PoC
 // drop that re-broke CVE-2020-17103 without any new ID being assigned).
-// Report-only; consumes diffs + extracted-CVE-id list from a prior
-// advisories run (loadCtx populates ctx.advisoriesDiffs +
-// ctx.advisoriesExtractedCveIds when advisories runs alongside the
-// watcher, or operators can chain explicitly via the source registry).
+// Report-only; consumes the prior advisories run's output. The main()
+// source loop threads the advisories fetchDiff() result onto
+// ctx.advisoriesObservations (preferred) + ctx.advisoriesDiffs (fallback)
+// after the advisories source resolves and before the watcher runs, so the
+// two must be invoked in that order (advisories first). Under --swarm the
+// watcher runs in a second pass after the parallel batch resolves.
 const { REGRESSION_WATCHER_SOURCE } = require('./cve-regression-watcher');
 
 const ALL_SOURCES = {
@@ -1795,9 +1797,53 @@ async function main() {
     return { src, diff };
   };
 
-  const outcomes = opts.swarm
-    ? await Promise.all(sources.map(runOne))
-    : await sequential(sources, runOne);
+  // NEW-CTRL-074 chaining. cve-regression-watcher consumes the advisories
+  // source's per-feed CVE observations (preferred — includes in-catalog
+  // historical IDs the annotate verdict needs) and falls back to its diffs.
+  // The orchestrator otherwise runs every source independently and only
+  // persists outputs into the report, never back onto ctx — so without this
+  // thread the watcher always sees empty input and emits zero candidates.
+  const threadAdvisoriesIntoCtx = (src, diff) => {
+    if (src && src.name === "advisories" && diff && !diff.air_gap_blocked) {
+      if (Array.isArray(diff.observations)) ctx.advisoriesObservations = diff.observations;
+      if (Array.isArray(diff.diffs)) ctx.advisoriesDiffs = diff.diffs;
+    }
+  };
+
+  let outcomes;
+  if (!opts.swarm) {
+    // Sequential: thread the advisories output onto ctx the instant it
+    // resolves, BEFORE the next source's fetchDiff(ctx) is invoked.
+    outcomes = [];
+    for (const src of sources) {
+      const outcome = await runOne(src);
+      if (!outcome.error) threadAdvisoriesIntoCtx(outcome.src, outcome.diff);
+      outcomes.push(outcome);
+    }
+  } else {
+    // --swarm: advisories and the watcher race when run via the same
+    // Promise.all, so chaining via shared ctx cannot work. Split the
+    // watcher into a second pass: run every other source in parallel,
+    // thread the resolved advisories observations onto ctx, then run the
+    // watcher. If advisories is NOT also selected, the watcher runs in the
+    // first batch like any other source (its empty-input contract is the
+    // operator's choice, not a silent race).
+    const hasAdvisories = sources.some((s) => s.name === "advisories");
+    const watcher = hasAdvisories
+      ? sources.find((s) => s.name === "cve-regression-watcher")
+      : null;
+    const firstBatch = watcher ? sources.filter((s) => s !== watcher) : sources;
+    outcomes = await Promise.all(firstBatch.map(runOne));
+    if (watcher) {
+      for (const o of outcomes) {
+        if (!o.error) threadAdvisoriesIntoCtx(o.src, o.diff);
+      }
+      const watcherOutcome = await runOne(watcher);
+      // Preserve the operator's declared source order in the report.
+      const idx = sources.indexOf(watcher);
+      outcomes.splice(idx, 0, watcherOutcome);
+    }
+  }
 
   // Cache-integrity refusals (sha256 mismatch, missing/partial _index.json,
   // unindexed payload) are thrown by readCachedJson with _exceptd_exit_code=4
@@ -1832,6 +1878,11 @@ async function main() {
       // marker through to the persisted report so stdout-parsing consumers
       // and the regression test can verify the network refusal happened.
       ...(diff.air_gap_blocked ? { air_gap_blocked: true } : {}),
+      // NEW-CTRL-074: persist the per-source _meta (the watcher stamps
+      // input_field_used here so the chaining is observable in the report)
+      // and the advisories observations[] the watcher consumes.
+      ...(diff._meta ? { _meta: diff._meta } : {}),
+      ...(Array.isArray(diff.observations) ? { observations: diff.observations } : {}),
     };
     if (opts.apply && diff.diffs.length > 0 && !src.report_only) {
       const r = await src.applyDiff(ctx, diff.diffs);

package/lib/refresh-network.js

@@ -152,9 +152,17 @@ function getJson(url, timeoutMs) {
 const ALLOWED_TARBALL_HOST = /(?:^|\.)npmjs\.org$|(?:^|\.)npmjs\.com$/;
 
 // Exported for in-process tests of the fetch-destination guard.
+// The guard parses the URL once and rejects any non-default port BEFORE the
+// hostname test, so validation and the subsequent https.get({host,path})
+// connect (which reuses u.host — port-inclusive) agree on the same value.
+// Without the port check a `registry.npmjs.org:9999` URL would pass the
+// hostname-only allowlist yet connect to the attacker-chosen port.
 function isAllowedTarballHost(url) {
-  try { return ALLOWED_TARBALL_HOST.test(new URL(url).hostname.toLowerCase()); }
-  catch { return false; }
+  try {
+    const u = new URL(url);
+    if (!(u.port === "" || u.port === "443")) return false;
+    return ALLOWED_TARBALL_HOST.test(u.hostname.toLowerCase());
+  } catch { return false; }
 }
 
 function getBufferOnce(url, timeoutMs) {
@@ -403,9 +411,14 @@ async function main() {
 
   // Air-gap refusal. --network needs egress to registry.npmjs.org for the
   // /latest metadata + tarball pull. Under air-gap there is no offline
-  // substitute (the test fixture path remains available for offline tests),
-  // so refuse before any network attempt and point at the offline workflow.
-  if (opts.airGap && !process.env.EXCEPTD_REGISTRY_FIXTURE) {
+  // substitute, so refuse before any network attempt and point at the
+  // offline workflow. The refusal is UNCONDITIONAL w.r.t.
+  // EXCEPTD_REGISTRY_FIXTURE: a present metadata fixture only stubs the
+  // /latest read, not the subsequent tarball fetch (getBuffer still hits
+  // canonicalUrl), so honoring the fixture under air-gap would let egress
+  // happen anyway while silently disabling an operator-facing control.
+  // Offline tests exercise the metadata+tarball path WITHOUT --air-gap.
+  if (opts.airGap) {
     emit({
       ok: false,
       source: "air-gap",

package/lib/rfc-cli.js

@@ -13,7 +13,90 @@
 
 const { resolveRfc } = require("./citation-resolve.js");
 
-(async () => {
+// Stopwords that don't disambiguate one RFC title from another. A claimed title
+// run preceded by one of these in the index title is still a clean match; a run
+// preceded by a CONTENT word (e.g. "datagram" before "transport layer security")
+// is the tail of a more-specific title and must NOT be accepted as a match.
+const TITLE_STOPWORDS = new Set(["the", "a", "an", "of", "for", "to", "in", "on", "and", "or"]);
+
+function normTitle(s) {
+  return String(s).toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
+}
+
+/**
+ * Decide whether a claimed RFC title matches the authoritative index title.
+ *
+ * Replaces the old lenient bidirectional substring test (`a.includes(b) ||
+ * b.includes(a)`), which let "TLS" match the DTLS title (substring of "dtls")
+ * and let "Transport Layer Security" match the DTLS title (tail-of-phrase).
+ * The comparison is now whole-word and phrase-aware:
+ *
+ *   1. Every claimed token must appear as a WHOLE word in the index title
+ *      (so "tls" never matches inside "dtls").
+ *   2. The claimed token sequence must appear as a CONTIGUOUS run in the index
+ *      title, OR the claim must cover enough of the index title (containment
+ *      ratio floor) to be unambiguous.
+ *   3. A contiguous run that is immediately preceded by a distinguishing
+ *      CONTENT word in the index title is rejected — it is the tail of a
+ *      more-specific title (the "datagram transport layer security" trap).
+ *
+ * Returns true / false. Only called when both a claim and an index title exist.
+ */
+function titleMatches(claimed, indexTitle) {
+  const claimTokens = normTitle(claimed).split(" ").filter(Boolean);
+  const titleTokens = normTitle(indexTitle).split(" ").filter(Boolean);
+  if (claimTokens.length === 0 || titleTokens.length === 0) return false;
+
+  // (1) Whole-word containment: every claimed token must be a standalone token
+  //     in the index title. Kills the tls-inside-dtls substring false positive.
+  const titleSet = new Set(titleTokens);
+  for (const t of claimTokens) {
+    if (!titleSet.has(t)) return false;
+  }
+
+  // Find every contiguous run of the claim inside the index title.
+  const runStarts = [];
+  for (let i = 0; i + claimTokens.length <= titleTokens.length; i++) {
+    let hit = true;
+    for (let j = 0; j < claimTokens.length; j++) {
+      if (titleTokens[i + j] !== claimTokens[j]) { hit = false; break; }
+    }
+    if (hit) runStarts.push(i);
+  }
+
+  if (runStarts.length > 0) {
+    // A single-token claim that is a whole word in the title is unambiguous on
+    // its own — the whole-word check above already excluded the substring trap
+    // (e.g. "tls" is NOT a token inside "dtls"), so "TLS" correctly matches the
+    // 8446 title (standalone "tls" token) but not the 9147 DTLS title.
+    if (claimTokens.length === 1) return true;
+    // (3) For a MULTI-token run, accept only if at least one occurrence is NOT
+    //     preceded by a distinguishing content word — i.e. it begins the title
+    //     or is preceded only by a stopword. A run preceded solely by a content
+    //     qualifier (e.g. "datagram" before "transport layer security") is the
+    //     tail of a more-specific title and must not be accepted as a match.
+    for (const start of runStarts) {
+      if (start === 0) return true;
+      const prev = titleTokens[start - 1];
+      if (TITLE_STOPWORDS.has(prev)) return true;
+    }
+    return false;
+  }
+
+  // No contiguous run, but all tokens present out of order. Accept only when the
+  // claim covers a strong majority of the index title's tokens (containment
+  // ratio floor) — a few scattered tokens against a long title is ambiguous,
+  // not a match. Count DISTINCT claim tokens that appear in the title: counting
+  // non-distinct tokens lets a repeated-token claim (e.g. "security security
+  // security security") inflate the ratio past the floor and falsely match an
+  // unrelated title.
+  const distinct = new Set(claimTokens);
+  const present = [...distinct].filter((t) => titleSet.has(t)).length;
+  const ratio = present / titleTokens.length;
+  return ratio >= 0.8;
+}
+
+async function main() {
   const argv = process.argv.slice(2);
   const flags = new Set(argv.filter((a) => a.startsWith("--")));
   // Reject unknown flags (same contract as the in-process verbs). `--check`
@@ -29,17 +112,22 @@ const { resolveRfc } = require("./citation-resolve.js");
     process.exitCode = 1;
     return;
   }
-  const positionals = argv.filter((a) => !a.startsWith("--"));
+  // --check "<claimed title>" consumes the FOLLOWING token as its value. Exclude
+  // that value token by INDEX from the positional pool before selecting id, so
+  // the RFC number resolves correctly regardless of flag order
+  // (`rfc --check "Some Title" 9404` reads id=9404, not id="Some Title").
+  const checkIdx = argv.indexOf("--check");
+  const checkValueIdx = (checkIdx !== -1 && argv[checkIdx + 1] && !argv[checkIdx + 1].startsWith("--")) ? checkIdx + 1 : -1;
+  const positionals = argv.filter((a, i) => !a.startsWith("--") && i !== checkValueIdx);
   const id = positionals[0];
   const pretty = flags.has("--pretty");
   const json = flags.has("--json") || pretty;
 
-  // --check "<claimed title>" : the next non-flag token after the number.
+  // The claimed title is exactly the excluded value token (kept in lockstep with
+  // checkValueIdx so the two never diverge); a trailing `--check` with no value
+  // leaves it null.
   let claimedTitle = null;
-  const checkIdx = argv.indexOf("--check");
-  if (checkIdx !== -1 && argv[checkIdx + 1] && !argv[checkIdx + 1].startsWith("--")) {
-    claimedTitle = argv[checkIdx + 1];
-  }
+  if (checkValueIdx !== -1) claimedTitle = argv[checkValueIdx];
 
   if (!id) {
     process.stderr.write(
@@ -53,9 +141,7 @@ const { resolveRfc } = require("./citation-resolve.js");
 
   let titleMatch = null;
   if (claimedTitle && r.title) {
-    const norm = (s) => s.toLowerCase().replace(/[^a-z0-9]+/g, " ").trim();
-    const a = norm(claimedTitle), b = norm(r.title);
-    titleMatch = a.length > 0 && (b.includes(a) || a.includes(b));
+    titleMatch = titleMatches(claimedTitle, r.title);
   }
   // Derive `ok` from the resolved status + title-check the same way the exit
   // code is derived below — a non-zero exit (status nonexistent OR an explicit
@@ -83,11 +169,20 @@ const { resolveRfc } = require("./citation-resolve.js");
   }
   // A mismatched or nonexistent citation is a non-zero exit for gates.
   if (fails) process.exitCode = 2;
-})().catch((err) => {
-  // A corrupt/unreadable RFC index (or any unexpected throw inside the async
-  // body) becomes a rejected promise. Emit the documented {ok:false,error}
-  // envelope rather than crashing with a raw stack trace, and signal failure
-  // via exitCode so the event loop drains stderr before exit.
-  process.stderr.write(JSON.stringify({ ok: false, verb: "rfc", error: String((err && err.message) || err) }) + "\n");
-  process.exitCode = 1;
-});
+}
+
+// Only run the CLI when invoked directly (`exceptd rfc ...`). When required by a
+// test the IIFE must not fire — it would read process.argv and write to stdout —
+// so the pure title-match helper can be exercised in-process.
+if (require.main === module) {
+  main().catch((err) => {
+    // A corrupt/unreadable RFC index (or any unexpected throw inside the async
+    // body) becomes a rejected promise. Emit the documented {ok:false,error}
+    // envelope rather than crashing with a raw stack trace, and signal failure
+    // via exitCode so the event loop drains stderr before exit.
+    process.stderr.write(JSON.stringify({ ok: false, verb: "rfc", error: String((err && err.message) || err) }) + "\n");
+    process.exitCode = 1;
+  });
+}
+
+module.exports = { titleMatches, normTitle, main };

package/lib/schemas/playbook.schema.json

@@ -39,7 +39,7 @@
                             "properties": {
                               "source": {
                                 "type": "string",
-                                "pattern": "(https://|http://|gh api|gh release|curl |wget |fetch )"
+                                "pattern": "(https://|http://|gh api|gh release|curl |wget |fetch |GET /|POST /|PUT /|PATCH /|DELETE /|Graph|Okta|Entra ID|Microsoft Graph)"
                               }
                             },
                             "required": ["source"]

package/lib/scoring.js

@@ -151,6 +151,18 @@ const RECOGNISED_FACTOR_KEYS = new Set([
   'patch_required_reboot',
 ]);
 
+// Shape-B (catalog post-weight) keys deriveRwepFromFactors is allowed to sum.
+// The post-weight summation operates on the catalog field names — which include
+// `ai_factor`, the +15 AI weight every Shape-B catalog entry stores. `ai_factor`
+// is deliberately ABSENT from RECOGNISED_FACTOR_KEYS (that set carries the
+// Shape-A boolean inputs `ai_assisted_weapon` / `ai_discovered` /
+// `ai_assisted_weaponization`), so the Shape-B allowlist must add it back — a
+// plain `RECOGNISED_FACTOR_KEYS.has(k)` filter would silently drop the AI weight
+// from every derivation. Any key NOT in this set is a typo or unknown field; it
+// is excluded from the sum AND surfaced (see the Shape-B loop) rather than blindly
+// added, so a sub-5 typo can't corrupt the derived score with no diagnostic.
+const RECOGNISED_POST_WEIGHT_KEYS = new Set([...RECOGNISED_FACTOR_KEYS, 'ai_factor']);
+
 function score(cveId, catalog) {
   const entry = catalog[cveId];
   if (!entry) throw new Error(`CVE not in catalog: ${cveId}`);
@@ -355,13 +367,29 @@ function scoreCustom(factors, opts) {
  */
 function deriveRwepFromFactors(factors) {
   if (!factors || typeof factors !== 'object') return 0;
-  const values = Object.values(factors);
-  if (values.length === 0) return 0;
+  const entries = Object.entries(factors);
+  if (entries.length === 0) return 0;
+  // A boolean factor OR a string active_exploitation ladder value is Shape-A
+  // evidence — scoreCustom reads exactly those. active_exploitation's string
+  // form legitimately appears in BOTH shapes (Shape A stores it as the literal
+  // ladder string; a Shape B post-weight block can ALSO carry it as a
+  // human-readable status alongside its post-weight integers), so it is the
+  // hasPostWeightInt guard below — NOT excluding active_exploitation from this
+  // check — that disambiguates them. Excluding it here under-scored an
+  // active-exploitation-ONLY raw bag (e.g. `{ active_exploitation: 'confirmed',
+  // blast_radius: 10 }`): hasBooleanOrLadder went false, the block fell through
+  // to the Shape-B sum, and the ladder string was skipped (10 vs scoreCustom 30).
   const aeAllowed = new Set(['none', 'unknown', 'suspected', 'theoretical', 'confirmed']);
-  const hasBooleanOrLadder = values.some(
-    (v) => typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase())),
+  const hasBooleanOrLadder = entries.some(
+    ([, v]) => (typeof v === 'boolean' || (typeof v === 'string' && aeAllowed.has(v.trim().toLowerCase()))),
+  );
+  // A boolean-named key carrying a post-weight integer (>=5) is unambiguous
+  // Shape-B evidence. When present, the block is Shape B even if it also carries
+  // a string active_exploitation — route to the post-weight sum, not scoreCustom.
+  const hasPostWeightInt = entries.some(
+    ([k, v]) => k !== 'blast_radius' && typeof v === 'number' && Number.isFinite(v) && Math.abs(v) >= 5,
   );
-  if (hasBooleanOrLadder) {
+  if (hasBooleanOrLadder && !hasPostWeightInt) {
     return scoreCustom(factors);
   }
   // Shape B: catalog post-weight. Sum + clamp.
@@ -380,6 +408,23 @@ function deriveRwepFromFactors(factors) {
   let sum = 0;
   for (const [k, v] of Object.entries(factors)) {
     if (typeof v !== 'number' || !Number.isFinite(v)) continue;
+    // Unrecognised key (a typo such as `cisa_kevv` / `reboot_requiredd`, or a
+    // field outside the post-weight vocabulary): do NOT add it to the sum, and
+    // surface it. scoreCustom/validateFactors already drop+warn on unknown
+    // keys; the Shape-B summation previously added ANY numeric value blindly, so
+    // the three scoring surfaces disagreed on what an unknown key means (a sub-5
+    // typo silently inflated the derived breakdown). Align them here. The
+    // warning mirrors the activeExploitationMultiplier precedent above — an
+    // observable diagnostic on the standard Node channel, not a silent skip, so
+    // the no-match path surfaces an error instead of defaulting (the file's own
+    // "out-of-vocab token -> must surface, not silent-default" rule).
+    if (!RECOGNISED_POST_WEIGHT_KEYS.has(k)) {
+      process.emitWarning(
+        `rwep_factors carries unrecognised key '${k}'; excluded from the derived sum`,
+        { type: 'RwepFactorUnrecognised', code: 'RWEP_FACTOR_UNRECOGNISED' },
+      );
+      continue;
+    }
     // reboot_required and patch_required_reboot are aliases for the SAME
     // post-weight contribution (scoreCustom collapses them). A block carrying
     // both must count it once; summing both double-counts the reboot weight,
@@ -476,7 +521,14 @@ function compare(cveId, catalog, opts) {
     if (entry.poc_available) driving.push('public PoC (+20)');
     if (entry.ai_discovered || entry.ai_assisted_weaponization) driving.push('AI-discovered (+15 weaponization)');
     if (String(entry.active_exploitation || '').trim().toLowerCase() === 'confirmed') driving.push('confirmed exploitation (+20)');
-    if ((entry.reboot_required || entry.patch_required_reboot) && !entry.live_patch_available) driving.push('reboot required (+5)');
+    // Mirror scoreCustom's rebootFactor EXACTLY: the +5 reboot weight is added
+    // whenever a reboot is required, regardless of live_patch_available (a live
+    // patch is a temporary workaround; the full-remediation window still extends
+    // — see the RWEP_WEIGHTS header note). Gating this driver on
+    // !live_patch_available made the enumerated factors sum to less than the
+    // delta on any entry that both requires a reboot AND has a live patch
+    // available, hiding a driver the score actually counted.
+    if (entry.reboot_required || entry.patch_required_reboot) driving.push('reboot required (+5)');
     explanation += driving.join(', ');
     explanation += '. Framework patch SLAs calibrated to CVSS are insufficient for this CVE.';
   } else if (delta < -10) {
@@ -495,7 +547,7 @@ function compare(cveId, catalog, opts) {
     cve_id: cveId,
     cvss: cvss,
     rwep: rwepValid ? rwep : null,
-    cvss_framework_sla: timeline(cvssEquivalent),
+    cvss_framework_sla: cvssAbsent ? { hours: null, label: 'CVSS unavailable — no framework SLA can be derived' } : timeline(cvssEquivalent),
     rwep_actual_sla: rwepValid ? timeline(rwep) : { hours: null, label: 'RWEP score unavailable' },
     delta,
     explanation,
@@ -540,6 +592,16 @@ function detectFactorShape(factors) {
   let sawWeightedInt = false;
   for (const [k, v] of Object.entries(factors)) {
     if (k === 'blast_radius') continue; // always integer in both shapes
+    if (k === 'active_exploitation' && typeof v === 'string') {
+      // active_exploitation's string-ladder form is valid in BOTH shapes — a
+      // Shape B (post-weight) block can carry it as the human-readable status
+      // string alongside its post-weight integers, exactly the way Shape A does.
+      // So a string active_exploitation is NOT Shape-A evidence; counting it as
+      // sawBool produced a spurious 'mixed' verdict (and a validate() error) on
+      // an otherwise-clean Shape B block. Its weight, when summed, is resolved
+      // via resolveActiveExploitation in the post-weight path, not here.
+      continue;
+    }
     if (typeof v === 'boolean' || v === null) {
       sawBool = true;
     } else if (typeof v === 'number' && Math.abs(v) >= 5 && boolFields.includes(k)) {
@@ -550,7 +612,7 @@ function detectFactorShape(factors) {
       // 0/1 on a boolean-named field could be either shape; ambiguous, ignore.
       continue;
     } else if (typeof v === 'string' && boolFields.includes(k)) {
-      // String values (e.g. active_exploitation: 'confirmed') are Shape A.
+      // String values on OTHER boolean-named fields are Shape A.
       sawBool = true;
     }
   }
@@ -735,4 +797,5 @@ module.exports = {
   RWEP_WEIGHTS,
   ACTIVE_EXPLOITATION_LADDER,
   RECOGNISED_FACTOR_KEYS,
+  RECOGNISED_POST_WEIGHT_KEYS,
 };

package/lib/source-advisories.js

@@ -204,10 +204,19 @@ function extractCveIds(text) {
  *
  * Returns [{ title, link, published, body }, ...].
  */
-const { parseFeed: tokenizerParseFeed } = require('./xml-tokenizer');
+const { parseFeedDetailed: tokenizerParseFeedDetailed } = require('./xml-tokenizer');
 
+// Parser errors are ALWAYS collected and surfaced — the tokenizer's loud-error
+// contract is no longer opt-in. The optional `errors` array is filled when a
+// caller passes one (so a reachable-but-unparsable feed reads 'partial' in the
+// refresh report instead of '0 new CVEs'). A caller that forgets the array
+// still triggers the always-on collection via parseFeedDetailed.
 function parseRssAtom(xml, errors = null) {
-  return tokenizerParseFeed(xml, errors);
+  const { items, errors: collected } = tokenizerParseFeedDetailed(xml);
+  if (Array.isArray(errors)) {
+    for (const e of collected) errors.push(e);
+  }
+  return items;
 }
 
 /**
@@ -291,9 +300,15 @@ function parseGitHubEvents(body, feed) {
  * GitHub account was removed — the .atom feed needs no API token and the
  * existing parseRssAtom tokenizer already handles its XML.
  */
-function parseGitLabActivity(body, feed) {
+function parseGitLabActivity(body, feed, errorsOut = null) {
   const errors = [];
   const entries = parseRssAtom(body, errors);
+  // Thread the Atom parse errors back to the caller's channel (checkFeed)
+  // instead of dropping them — a reachable-but-unparsable GitLab activity feed
+  // must read 'partial' in the refresh report, same as the RSS/Atom path.
+  if (Array.isArray(errorsOut)) {
+    for (const e of errors) errorsOut.push(e);
+  }
   const handle = feed.researcher_handle
     || (feed.url.match(/gitlab\.com\/([^/.]+)\.atom/) || [])[1]
     || null;
@@ -376,6 +391,11 @@ async function checkFeed(feed, ctx) {
   const res = await fetchFeed(feed, ctx);
   if (!res.ok) return { diffs: [], errors: 1, status: 'unreachable', _why: res.error };
   let items;
+  // Parse errors are collected on the XML-parsing feed kinds so a reachable-
+  // but-unparsable feed reads 'partial' in the report instead of silently
+  // returning 0 new CVEs (the loud-error contract was opt-in and the live
+  // path never opted in).
+  const parseErrors = [];
   if (feed.kind === 'csaf-index') {
     items = parseCsafIndex(res.body);
     // Flatten cves_from_filename onto cve_ids field uniformly.
@@ -384,10 +404,10 @@ async function checkFeed(feed, ctx) {
     items = parseGitHubEvents(res.body, feed);
     items = items.map((it) => ({ ...it, cve_ids: extractCveIds(`${it.title} ${it.body} ${it.link}`) }));
   } else if (feed.kind === 'gitlab-activity') {
-    items = parseGitLabActivity(res.body, feed);
+    items = parseGitLabActivity(res.body, feed, parseErrors);
     items = items.map((it) => ({ ...it, cve_ids: extractCveIds(`${it.title} ${it.body} ${it.link}`) }));
   } else {
-    items = parseRssAtom(res.body);
+    items = parseRssAtom(res.body, parseErrors);
     items = items.map((it) => ({ ...it, cve_ids: extractCveIds(`${it.title} ${it.body} ${it.link}`) }));
   }
   const diffs = [];
@@ -437,7 +457,18 @@ async function checkFeed(feed, ctx) {
       });
     }
   }
-  return { diffs, observations, errors: 0, status: 'ok' };
+  // Fold reachable-but-unparsable into a 'partial' status via a NEW channel.
+  // The integer `errors` field stays the unreachable count (0 here — the feed
+  // WAS reached) so the aggregate unreachable===FEEDS.length math and the
+  // refresh-* assertions that key off it keep working untouched.
+  return {
+    diffs,
+    observations,
+    errors: 0,
+    status: parseErrors.length ? 'partial' : 'ok',
+    parse_errors: parseErrors.length,
+    _parse_errors: parseErrors.slice(0, 5),
+  };
 }
 
 /**
@@ -452,10 +483,20 @@ const ADVISORIES_SOURCE = {
     const allDiffs = [];
     const allObservations = [];
     let unreachable = 0;
+    let parseErrorFeeds = 0;       // feeds reachable but with >=1 parse error
+    const parseErrorSamples = [];  // bounded sample of {message, position}
     for (const r of results) {
       allDiffs.push(...r.diffs);
       if (Array.isArray(r.observations)) allObservations.push(...r.observations);
       if (r.status === 'unreachable') unreachable++;
+      if (typeof r.parse_errors === 'number' && r.parse_errors > 0) {
+        parseErrorFeeds++;
+        if (Array.isArray(r._parse_errors)) {
+          for (const e of r._parse_errors) {
+            if (parseErrorSamples.length < 5) parseErrorSamples.push(e);
+          }
+        }
+      }
     }
     // Deduplicate by CVE-ID across feeds — multiple advisories for the
     // same CVE collapse to one entry with sources[] array of contributing
@@ -503,15 +544,23 @@ const ADVISORIES_SOURCE = {
       }
     }
     const observations = Array.from(obsByCve.values());
+    // Status ladder folds reachable-but-unparsable into 'partial'. The integer
+    // `errors` field stays the unreachable count (downstream refresh math keys
+    // off it); parse errors are surfaced via the separate parse_errors channel.
     const status =
-      unreachable === 0 ? 'ok' :
-      unreachable === FEEDS.length ? 'unreachable' : 'partial';
+      unreachable === FEEDS.length ? 'unreachable' :
+      (unreachable > 0 || parseErrorFeeds > 0) ? 'partial' :
+      'ok';
+    const summary = `${FEEDS.length - unreachable}/${FEEDS.length} feeds reachable; ${diffs.length} new CVE references found, ${observations.length} total CVE observations across primary advisory sources`
+      + (parseErrorFeeds > 0 ? `; ${parseErrorFeeds} feed${parseErrorFeeds === 1 ? '' : 's'} returned parse errors` : '');
     return {
       status,
       diffs,
       observations,
       errors: unreachable,
-      summary: `${FEEDS.length - unreachable}/${FEEDS.length} feeds reachable; ${diffs.length} new CVE references found, ${observations.length} total CVE observations across primary advisory sources`,
+      parse_errors: parseErrorFeeds,
+      _parse_errors: parseErrorSamples,
+      summary,
     };
   },
   // Report-only: no applyDiff. Operators route promising CVE IDs through

package/lib/ttp-mapper.js

@@ -36,6 +36,17 @@ function gapsFor(attackPattern, gapCatalog, atlasCatalog) {
 }
 
 function coverage(frameworkId, ttpId, gapCatalog, atlasCatalog) {
+  // Input guard before any deref — an empty / non-string frameworkId
+  // yielded frameworkPrefix='' which matched EVERY control via
+  // includes(''), and null/undefined threw on .split(). Match the
+  // { found:false } contract already used for an unknown TTP. Surface
+  // partially_covered_by / not_covered_by as an explicit null (not absent)
+  // so the no-match outcome is observable rather than a silent universal
+  // match.
+  if (typeof frameworkId !== 'string' || frameworkId.trim() === '') {
+    return { ttp_id: ttpId, found: false, error: 'frameworkId required', partially_covered_by: null, not_covered_by: null };
+  }
+
   const ttp = atlasCatalog[ttpId];
   if (!ttp) return { ttp_id: ttpId, found: false };
 
@@ -45,10 +56,27 @@ function coverage(frameworkId, ttpId, gapCatalog, atlasCatalog) {
   const gapDetail = ttp.framework_gap_detail || '';
   const hasFrameworkGap = ttp.framework_gap === true;
 
-  // Check if the requested framework has any coverage in the partially-helpful controls
+  // Check if the requested framework has any coverage in the partially-helpful
+  // controls. Match on the first hyphen-delimited segment of the control id
+  // (token-boundary), NOT bare substring containment: a bare includes() let
+  // 'IS' match 'NIST' and '' match everything. A control id matches when it
+  // begins with the prefix and the next char is a segment boundary (-, .) or
+  // end-of-string, so 'soc2' still matches 'soc2-z' but 'is' never matches
+  // 'nist-...'.
   const frameworkPrefix = frameworkId.split('-')[0].toLowerCase();
-  const partial = partialControls.find(c => c.toLowerCase().includes(frameworkPrefix));
-  const noHelp = noHelpControls.find(c => c.toLowerCase().includes(frameworkPrefix));
+  if (frameworkPrefix.length === 0) {
+    // frameworkId is a hyphen-led string (e.g. "-" or "-X") whose first
+    // segment is empty — same universal-match hazard, same fail-closed result.
+    return { ttp_id: ttpId, found: false, error: 'frameworkId required', partially_covered_by: null, not_covered_by: null };
+  }
+  const segMatch = (c) => {
+    const cl = String(c).toLowerCase();
+    if (!cl.startsWith(frameworkPrefix)) return false;
+    const next = cl.charAt(frameworkPrefix.length);
+    return next === '' || next === '-' || next === '.';
+  };
+  const partial = partialControls.find(segMatch);
+  const noHelp = noHelpControls.find(segMatch);
 
   return {
     ttp_id: ttpId,

package/lib/upstream-check-cli.js

@@ -80,4 +80,16 @@ function readManifest() {
     localManifest: readManifest(),
   });
   process.stdout.write(JSON.stringify(report) + "\n");
-})();
+})().catch((err) => {
+  // Any unexpected throw still yields one parseable JSON line on stdout and a
+  // clean exit, consistent with this probe's offline-degradation contract
+  // (missing freshness data is not an error for downstream callers, which parse
+  // res.stdout for the envelope). String(...) coerces the error to a primitive,
+  // so this JSON.stringify itself cannot throw. Exit 0 is the default — no prior
+  // non-zero exitCode is set on this path.
+  process.stdout.write(JSON.stringify({
+    ok: false,
+    error: String((err && err.message) || err),
+    source: "upstream-check",
+  }) + "\n");
+});