@blamejs/exceptd-skills 0.19.32 → 0.19.34
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +22 -0
- package/bin/exceptd.js +896 -2824
- package/data/_indexes/_meta.json +8 -8
- package/data/_indexes/activity-feed.json +2 -2
- package/data/_indexes/catalog-summaries.json +7 -7
- package/data/_indexes/chains.json +60118 -0
- package/data/attack-techniques.json +267 -7
- package/data/cve-catalog.json +9991 -3
- package/data/cwe-catalog.json +109 -2
- package/data/framework-control-gaps.json +578 -3
- package/data/zeroday-lessons.json +8330 -1
- package/lib/auto-discovery.js +56 -286
- package/lib/canonical-eq.js +7 -40
- package/lib/citation-resolve.js +22 -70
- package/lib/collectors/ai-api.js +20 -54
- package/lib/collectors/cicd-pipeline-compromise.js +40 -108
- package/lib/collectors/citation-hygiene.js +72 -210
- package/lib/collectors/containers.js +41 -130
- package/lib/collectors/cred-stores.js +31 -115
- package/lib/collectors/crypto-codebase.js +55 -138
- package/lib/collectors/crypto.js +24 -54
- package/lib/collectors/hardening.js +20 -78
- package/lib/collectors/kernel.js +16 -46
- package/lib/collectors/library-author.js +57 -206
- package/lib/collectors/mcp.js +24 -70
- package/lib/collectors/runtime.js +24 -86
- package/lib/collectors/sbom.js +34 -106
- package/lib/collectors/scan-excludes.js +31 -138
- package/lib/collectors/secrets.js +62 -178
- package/lib/cross-ref-api.js +39 -123
- package/lib/currency-severity.js +8 -27
- package/lib/cve-batch.js +13 -21
- package/lib/cve-cli.js +13 -20
- package/lib/cve-curation.js +72 -239
- package/lib/cve-regression-watcher.js +29 -152
- package/lib/cvss.js +13 -54
- package/lib/doctor-bucketing.js +3 -19
- package/lib/exit-codes.js +10 -42
- package/lib/flag-suggest.js +7 -25
- package/lib/framework-gap.js +35 -114
- package/lib/gap-detectors.js +37 -159
- package/lib/id-validation.js +9 -30
- package/lib/job-queue.js +13 -36
- package/lib/lint-skills.js +64 -232
- package/lib/playbook-runner.js +693 -2095
- package/lib/prefetch.js +100 -376
- package/lib/refresh-external.js +199 -627
- package/lib/refresh-network.js +75 -307
- package/lib/rfc-cli.js +23 -68
- package/lib/scoring.js +77 -145
- package/lib/sign.js +43 -229
- package/lib/source-advisories.js +43 -194
- package/lib/source-ghsa.js +37 -120
- package/lib/source-osv.js +94 -266
- package/lib/ttp-mapper.js +14 -24
- package/lib/upstream-check-cli.js +10 -28
- package/lib/upstream-check.js +19 -44
- package/lib/validate-catalog-meta.js +17 -61
- package/lib/validate-cve-catalog.js +43 -119
- package/lib/validate-indexes.js +25 -76
- package/lib/validate-package.js +16 -62
- package/lib/validate-playbooks.js +69 -275
- package/lib/validate-vendor.js +16 -49
- package/lib/verify.js +56 -286
- package/lib/version-pins.js +5 -34
- package/lib/worker-pool.js +11 -30
- package/lib/xml-tokenizer.js +47 -152
- package/manifest.json +53 -53
- package/orchestrator/dispatcher.js +17 -68
- package/orchestrator/event-bus.js +11 -74
- package/orchestrator/index.js +138 -412
- package/orchestrator/pipeline.js +28 -85
- package/orchestrator/scanner.js +34 -138
- package/orchestrator/scheduler.js +20 -84
- package/package.json +2 -2
- package/sbom.cdx.json +253 -253
- package/scripts/audit-catalog-gaps.js +9 -62
- package/scripts/audit-cross-skill.js +5 -31
- package/scripts/audit-perf.js +6 -16
- package/scripts/backfill-theater-test.js +7 -64
- package/scripts/bootstrap.js +12 -44
- package/scripts/build-indexes.js +40 -154
- package/scripts/builders/activity-feed.js +4 -14
- package/scripts/builders/catalog-summaries.js +3 -10
- package/scripts/builders/currency.js +7 -20
- package/scripts/builders/cwe-chains.js +7 -30
- package/scripts/builders/did-ladders.js +6 -13
- package/scripts/builders/frequency.js +5 -19
- package/scripts/builders/jurisdiction-clocks.js +6 -25
- package/scripts/builders/recipes.js +6 -14
- package/scripts/builders/section-offsets.js +13 -51
- package/scripts/builders/stale-content.js +7 -28
- package/scripts/builders/summary-cards.js +8 -29
- package/scripts/builders/theater-fingerprints.js +12 -27
- package/scripts/builders/token-budget.js +4 -31
- package/scripts/check-agents-md-collectors.js +11 -54
- package/scripts/check-catalog-gap-budget.js +15 -32
- package/scripts/check-changelog-extract.js +18 -48
- package/scripts/check-codebase-patterns-currency.js +6 -22
- package/scripts/check-codebase-patterns.js +50 -143
- package/scripts/check-epss-consistency.js +9 -64
- package/scripts/check-framework-gap-coverage.js +13 -31
- package/scripts/check-manifest-snapshot.js +13 -73
- package/scripts/check-sbom-currency.js +44 -142
- package/scripts/check-test-count.js +15 -52
- package/scripts/check-test-coverage.js +66 -197
- package/scripts/check-test-subjects.js +21 -62
- package/scripts/check-ttp-references.js +14 -38
- package/scripts/check-ttp-upstream.js +8 -40
- package/scripts/check-version-bump.js +9 -61
- package/scripts/check-version-tags.js +20 -121
- package/scripts/predeploy.js +38 -184
- package/scripts/refresh-manifest-snapshot.js +16 -38
- package/scripts/refresh-mitre-atlas.js +3 -8
- package/scripts/refresh-mitre-attack.js +1 -8
- package/scripts/refresh-mitre-d3fend.js +3 -9
- package/scripts/refresh-mitre-ics-attack.js +3 -8
- package/scripts/refresh-reverse-refs.js +27 -94
- package/scripts/refresh-rfc-index.js +2 -10
- package/scripts/refresh-sbom.js +31 -161
- package/scripts/refresh-upstream-catalogs.js +40 -137
- package/scripts/release.js +69 -232
- package/scripts/run-e2e-scenarios.js +24 -71
- package/scripts/sync-manifest-metadata.js +10 -34
- package/scripts/sync-package-description.js +8 -17
- package/scripts/validate-vendor-online.js +13 -44
- package/scripts/verify-shipped-tarball.js +35 -140
|
@@ -1,22 +1,12 @@
|
|
|
1
1
|
'use strict';
|
|
2
2
|
|
|
3
3
|
/**
|
|
4
|
-
* Event bus for trigger-driven skill updates.
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
10
|
-
* internal emitter for a durable queue (Redis Streams, SQS, NATS JetStream,
|
|
11
|
-
* etc.) without changing the event schema.
|
|
12
|
-
*
|
|
13
|
-
* Bounded log policy:
|
|
14
|
-
* - The in-memory log is capped at EVENT_LOG_MAX_SIZE entries to prevent
|
|
15
|
-
* unbounded memory growth on long-running `watch` processes.
|
|
16
|
-
* - Default cap is 1000 entries; override at process start via the
|
|
17
|
-
* EXCEPTD_EVENT_LOG_MAX_SIZE env var (positive integer).
|
|
18
|
-
* - When the cap is reached, the oldest entry is shifted off on each new
|
|
19
|
-
* emit (FIFO ring buffer semantics).
|
|
4
|
+
* Event bus for trigger-driven skill updates. This bus is in-process only: the
|
|
5
|
+
* event log is a bounded in-memory FIFO ring buffer and is NOT persisted across
|
|
6
|
+
* restarts, so a deployment needing durable history swaps the emitter for a
|
|
7
|
+
* queue without changing the event schema. The cap keeps a long-running `watch`
|
|
8
|
+
* from growing without bound — 1000 entries, overridden at process start by
|
|
9
|
+
* EXCEPTD_EVENT_LOG_MAX_SIZE (positive integer).
|
|
20
10
|
*/
|
|
21
11
|
|
|
22
12
|
const { EventEmitter } = require('events');
|
|
@@ -46,7 +36,6 @@ const EVENT_TYPES = {
|
|
|
46
36
|
SKILL_CURRENCY_LOW_AGGREGATE: 'skill.currency.low.aggregate'
|
|
47
37
|
};
|
|
48
38
|
|
|
49
|
-
// Maps event types to the skills they should trigger for review
|
|
50
39
|
const EVENT_SKILL_MAP = {
|
|
51
40
|
[EVENT_TYPES.CISA_KEV_ADDED]: ['kernel-lpe-triage', 'exploit-scoring', 'compliance-theater', 'skill-update-loop'],
|
|
52
41
|
[EVENT_TYPES.ATLAS_VERSION_RELEASED]: ['ai-attack-surface', 'mcp-agent-trust', 'rag-pipeline-security', 'ai-c2-detection', 'skill-update-loop'],
|
|
@@ -70,12 +59,8 @@ class ExceptdEventBus extends EventEmitter {
|
|
|
70
59
|
this.maxLogSize = cap;
|
|
71
60
|
}
|
|
72
61
|
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
*
|
|
76
|
-
* @param {string} eventType - One of EVENT_TYPES
|
|
77
|
-
* @param {object} payload - Event-specific data
|
|
78
|
-
*/
|
|
62
|
+
// Overrides EventEmitter.emit: `eventType` is one of EVENT_TYPES, and the
|
|
63
|
+
// return is the constructed event record, not the listener-present boolean.
|
|
79
64
|
emit(eventType, payload) {
|
|
80
65
|
const event = {
|
|
81
66
|
event_id: `evt_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`,
|
|
@@ -86,9 +71,8 @@ class ExceptdEventBus extends EventEmitter {
|
|
|
86
71
|
};
|
|
87
72
|
|
|
88
73
|
this.eventLog.push(event);
|
|
89
|
-
//
|
|
90
|
-
//
|
|
91
|
-
// exceeds the cap in a single tick) still leaves the buffer at-cap.
|
|
74
|
+
// A loop rather than an `if`: a lowered maxLogSize or a burst that clears
|
|
75
|
+
// the cap in one tick must still leave the buffer at-cap.
|
|
92
76
|
while (this.eventLog.length > this.maxLogSize) {
|
|
93
77
|
this.eventLog.shift();
|
|
94
78
|
}
|
|
@@ -97,89 +81,42 @@ class ExceptdEventBus extends EventEmitter {
|
|
|
97
81
|
return event;
|
|
98
82
|
}
|
|
99
83
|
|
|
100
|
-
/**
|
|
101
|
-
* Register a handler for an event type.
|
|
102
|
-
*
|
|
103
|
-
* @param {string} eventType
|
|
104
|
-
* @param {function} handler - (event) => void
|
|
105
|
-
*/
|
|
106
84
|
on(eventType, handler) {
|
|
107
85
|
super.on(eventType, handler);
|
|
108
86
|
return this;
|
|
109
87
|
}
|
|
110
88
|
|
|
111
|
-
/**
|
|
112
|
-
* Register a handler for all events.
|
|
113
|
-
*
|
|
114
|
-
* @param {function} handler - (event) => void
|
|
115
|
-
*/
|
|
116
89
|
onAny(handler) {
|
|
117
90
|
return this.on('*', handler);
|
|
118
91
|
}
|
|
119
92
|
|
|
120
|
-
/**
|
|
121
|
-
* Detach a handler previously registered via onAny().
|
|
122
|
-
*
|
|
123
|
-
* @param {function} handler
|
|
124
|
-
*/
|
|
125
93
|
offAny(handler) {
|
|
126
94
|
this.removeListener('*', handler);
|
|
127
95
|
return this;
|
|
128
96
|
}
|
|
129
97
|
|
|
130
|
-
/**
|
|
131
|
-
* Get all events that affected a specific skill.
|
|
132
|
-
*
|
|
133
|
-
* @param {string} skillName
|
|
134
|
-
* @returns {object[]}
|
|
135
|
-
*/
|
|
136
98
|
getSkillEvents(skillName) {
|
|
137
99
|
return this.eventLog.filter(e => e.affected_skills.includes(skillName));
|
|
138
100
|
}
|
|
139
101
|
|
|
140
|
-
|
|
141
|
-
* Get the event log, optionally filtered by type.
|
|
142
|
-
*
|
|
143
|
-
* @param {string} [eventType]
|
|
144
|
-
* @returns {object[]}
|
|
145
|
-
*/
|
|
102
|
+
// Always a fresh array; mutating it does not touch the live log.
|
|
146
103
|
getLog(eventType) {
|
|
147
104
|
if (eventType) return this.eventLog.filter(e => e.type === eventType);
|
|
148
105
|
return [...this.eventLog];
|
|
149
106
|
}
|
|
150
107
|
|
|
151
|
-
/**
|
|
152
|
-
* Fire a CISA KEV addition event.
|
|
153
|
-
*
|
|
154
|
-
* @param {{ cve_id: string, kev_date: string, rwep_score: number }} params
|
|
155
|
-
*/
|
|
156
108
|
kevAdded({ cve_id, kev_date, rwep_score }) {
|
|
157
109
|
return this.emit(EVENT_TYPES.CISA_KEV_ADDED, { cve_id, kev_date, rwep_score });
|
|
158
110
|
}
|
|
159
111
|
|
|
160
|
-
/**
|
|
161
|
-
* Fire an ATLAS version release event.
|
|
162
|
-
*
|
|
163
|
-
* @param {{ old_version: string, new_version: string, release_date: string }} params
|
|
164
|
-
*/
|
|
165
112
|
atlasReleased({ old_version, new_version, release_date }) {
|
|
166
113
|
return this.emit(EVENT_TYPES.ATLAS_VERSION_RELEASED, { old_version, new_version, release_date });
|
|
167
114
|
}
|
|
168
115
|
|
|
169
|
-
/**
|
|
170
|
-
* Fire an exploit status change event.
|
|
171
|
-
*
|
|
172
|
-
* @param {{ cve_id: string, old_status: string, new_status: string }} params
|
|
173
|
-
*/
|
|
174
116
|
exploitStatusChanged({ cve_id, old_status, new_status }) {
|
|
175
117
|
return this.emit(EVENT_TYPES.EXPLOIT_STATUS_CHANGE, { cve_id, old_status, new_status });
|
|
176
118
|
}
|
|
177
119
|
|
|
178
|
-
/**
|
|
179
|
-
* Fire a skill currency low event (emitted by scheduler).
|
|
180
|
-
*
|
|
181
|
-
* @param {{ skill_name: string, currency_score: number, days_since_review: number }} params
|
|
182
|
-
*/
|
|
183
120
|
skillCurrencyLow({ skill_name, currency_score, days_since_review }) {
|
|
184
121
|
return this.emit(EVENT_TYPES.SKILL_CURRENCY_LOW, { skill_name, currency_score, days_since_review });
|
|
185
122
|
}
|