@slicedearth/whoisleuth-cli 2.7.0 → 2.8.0

package/cli/risk-policy.mjs

@@ -0,0 +1,83 @@
+import { analyzeDomainIdn } from "../lib/idn-confusables.mjs";
+import { profileSignals } from "../packages/analysis/brand-profile-signals.mjs";
+import { boundedJsonLimitsForBytes, parseBoundedJsonObject } from "../packages/analysis/bounded-json.mjs";
+import { canonicalRegistrableDomain } from "../packages/analysis/registrable-domain.mjs";
+import { explainRiskScore } from "../packages/analysis/risk-scoring.mjs";
+import { BRAND_PROFILE_SCHEMA, MAX_PROFILES, MAX_PROFILE_IMPORT_BYTES } from "../packages/contracts/workspace-portability.mjs";
+import { CliUsageError } from "./errors.mjs";
+function record(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+/** Read one explicitly selected export, not browser storage or configuration. */
+export async function readCliRiskProfile(source, readInput, selectedId) {
+    if (!source)
+        return null;
+    const text = await readInput(source, MAX_PROFILE_IMPORT_BYTES, 'Brand Profile export');
+    try {
+        const raw = parseBoundedJsonObject(text, {
+            maximumBytes: MAX_PROFILE_IMPORT_BYTES, limits: boundedJsonLimitsForBytes(MAX_PROFILE_IMPORT_BYTES), label: 'Brand Profile export',
+        });
+        if (raw.schema !== BRAND_PROFILE_SCHEMA || typeof raw.version !== 'number'
+            || !Array.isArray(raw.profiles) || !raw.profiles.length || raw.profiles.length > MAX_PROFILES)
+            throw new TypeError();
+        const { normalizeBrandProfileId, normalizeBrandProfileStore } = await import("../packages/workspace/brand-profile-model.mjs");
+        if (selectedId !== undefined && normalizeBrandProfileId(selectedId) !== selectedId)
+            throw new TypeError();
+        const selected = selectedId === undefined ? raw.profiles : raw.profiles.filter(value => record(value).id === selectedId);
+        if (selected.length !== 1)
+            throw new TypeError();
+        const profile = normalizeBrandProfileStore({ ...raw, profiles: selected }).profiles[0];
+        if (!profile || !profile.officialDomains.length)
+            throw new TypeError();
+        // Private notes, contacts and other profile fields never enter output or
+        // checkpoints. Keep only the existing comparison inputs for this run.
+        return {
+            officialDomains: profile.officialDomains,
+            approvedPartnerDomains: profile.approvedPartnerDomains,
+            allowlistedDomains: profile.allowlistedDomains,
+            officialFaviconHash: profile.officialFaviconHash,
+            officialFaviconPHash: profile.officialFaviconPHash,
+        };
+    }
+    catch {
+        throw new CliUsageError('Use a supported Brand Profile export with a valid official domain; select one unambiguous profile with --brand-id if the export contains multiple profiles.');
+    }
+}
+/** Adapt collected evidence, never an asserted score, lane or severity label. */
+export function explainCliLookupRisk(document, profile, mode = document.mode) {
+    if (document.type !== undefined && document.type !== 'domain')
+        return null;
+    const availability = record(document.availability);
+    const domain = canonicalRegistrableDomain(document.registrableDomain ?? document.domain ?? availability.domain);
+    if (!domain || canonicalRegistrableDomain(availability.domain) !== domain)
+        return null;
+    const diagnostics = record(document.diagnostics);
+    const sourceCoverage = [
+        ...['rdap', 'whois', 'availability'].map(source => ({ source, state: record(diagnostics[source]).status })),
+        ...['dns', 'http', 'tls', 'pageIdentity'].map(source => ({
+            source: source === 'pageIdentity' ? 'page-identity' : source,
+            state: record(availability[source]).status,
+        })),
+    ].map(item => ({ ...item, state: item.state === 'disabled' ? 'skipped' : item.state }));
+    return explainRiskScore({
+        domain,
+        availability: availability.state,
+        ...profileSignals(domain, availability, profile),
+        hasActiveBrandProfile: Boolean(profile),
+        idnReferenceMatch: profile ? Boolean(analyzeDomainIdn(domain, profile.officialDomains)?.referenceMatches.length) : null,
+        mutationTypes: document.mutationTypes,
+        hasPasswordField: availability.hasPasswordField,
+        hasExternalFormAction: availability.hasExternalFormAction,
+        hasExternalPasswordForm: availability.hasExternalPasswordForm,
+        phishingLanguageMatch: availability.phishingLanguageMatch,
+        activityStatus: availability.activityStatus,
+        hasMx: availability.hasMx,
+        hasSpf: availability.hasSpf,
+        hasDmarc: availability.hasDmarc,
+        domainAgeDays: availability.domainAgeDays,
+        privacyProtected: availability.privacyProtected,
+        scanDepth: mode,
+        observedAt: document.observedAt ?? record(availability.http).observedAt,
+        sourceCoverage,
+    });
+}

package/cli/workflow-command-runner.mjs

@@ -88,6 +88,7 @@ async function runMonitorOnceCommand(args, dependencies, context) {
     const executeLookup = dependencies.runUnifiedLookup || (await import("../lib/lookup.mjs")).runUnifiedLookup;
     const progress = context.beginProgress('Collecting bounded domain-control evidence');
     let document;
+    let currentSourceFailureCount = 0;
     try {
         document = await runDomainControlMonitor(manifestInput, previousInput, {
             executeLookup,
@@ -95,6 +96,9 @@ async function runMonitorOnceCommand(args, dependencies, context) {
             limit: args.limit,
             concurrency: args.concurrency,
             ...(dependencies.signal ? { signal: dependencies.signal } : {}),
+            ...(args.failOn?.includes('source-failure') ? {
+                onSourceFailures: (count) => { currentSourceFailureCount = count; },
+            } : {}),
             onSettled: (completed, total) => progress.update(`Collected ${completed} of ${total} owned domains`),
         });
     }
@@ -108,7 +112,7 @@ async function runMonitorOnceCommand(args, dependencies, context) {
                 ? formatCliJunit(document)
                 : context.terminal(formatDomainControlMonitor(document), args.color));
     }
-    const policyFindings = evaluateCliFailPolicies(document, args.failOn || []);
+    const policyFindings = evaluateCliFailPolicies(document, args.failOn || [], null, currentSourceFailureCount);
     if (policyFindings.length)
         context.writeStderr(formatFailPolicyNotice(policyFindings));
     return document.collection.failed || policyFindings.length

package/docs/cli-reference.md

@@ -128,6 +128,13 @@ source state is unmeasured, not a negative result. `--csv` keeps the compact col
 `--fail-on` and `--strict-exit` expose selected evidence states to automation
 without changing the result document. Review focused help for the policies a
 command supports.
+Lookup, Bulk and Discover scan evaluate all collected and restored evidence,
+not only the rows retained by a filter. `danger` uses the canonical Risk model;
+select `--deep --brand-profile brand.json` for local reference comparisons, adding
+`--brand-id <exact-profile-id>` for a multi-profile export. A match returns 4 and identifies model and evidence
+quality on stderr. Missing/ineligible evidence is not zero risk and does not
+implicitly select another failure policy. See the
+[automation examples and limits](cli.md#formats-and-exit-behaviour).
 
 | Code | Meaning |
 | ---: | --- |

package/docs/cli.md

@@ -649,7 +649,10 @@ second input. Supply every input for an uncompleted step to use files instead,
 or override a connection with `--use-artifact <step-id>:<input-number>=<earlier-step-id>`.
 Input numbers start at 1 and refer to the fixed recipe's placeholders.
 `diff` compares saved observations of the same or different domains; `timeline`
-orders observations of one domain. Candidate and domain-control intent inputs
+orders observations of one domain. Web-derived fields require complete collection
+for the relevant page or favicon; failed, partial and historical unknown collection
+keep their values visible without establishing equality or change. Source-health
+changes remain comparable separately. Candidate and domain-control intent inputs
 remain analyst selections. No external file is inferred or extracted automatically.
 `reconcile` lists each observation time and declared observer/vantage, keeping
 disagreement and unavailable evidence separate. Distinct labels do not verify
@@ -763,6 +766,55 @@ and machine output contains no ANSI or transient progress text.
 - `--output` writes a private local file atomically and refuses an existing path
   unless `--force` is also selected.
 
+Lookup, Bulk and Discover scan evaluate `--fail-on` against every collected or
+restored result, before output filters. A fulfilled lookup can still match
+`source-failure` through its diagnostics. Quiet and event output do not change
+the policy exit: matches return **4**, with diagnostics on stderr. Ordinary
+collection/checkpoint failures and Lookup's separate `--strict-exit` still apply.
+
+For `monitor-once`, `source-failure` also checks the current run's constituent
+source diagnostics, even when the Lookup fulfils. `inconclusive` checks incomplete
+requested comparisons independently of the headline: MX drift does not hide
+unavailable nameserver evidence. Skipped or unsupported sources are not failed
+requests; an unsupported requested comparison can still be inconclusive.
+Unconfigured expectations and historical source failures do not match these
+policies. `material-drift` continues to mean unexpected complete observation
+changes in the flight recorder, not a desired-state mismatch or missing evidence.
+Policy matches return **4** in JSON and quiet modes too, without adding diagnostic
+fields to monitor reports or checkpoints. Without a policy, rejected Lookups
+retain their existing failure exit; constituent-source states alone do not.
+
+Domain-control review keeps registration evidence at the registrable domain and
+DNS, TLS and web evidence at the observed hostname. It selects the newest eligible
+evidence within each scope; a newer child-host capture cannot replace an apex or
+sibling's service evidence. Separately declared delegation scope is retained.
+Historical Lookups use their retained availability domain, or their original
+registration scope when no hostname was retained, never the submitted query.
+`monitor-once` accepts only registrable-domain targets and rejects an admitted
+child target before any collection starts. A wrong-host collector response is a
+failed Lookup, not an extra successful observation or a retargeted check.
+
+For `danger`, export your Brand Profiles from Brands and explicitly select Deep
+collection. The same Risk model and Brand comparisons used by the console
+evaluate the collected evidence without extra requests:
+
+```bash
+whoisleuth lookup candidate.example --deep --brand-profile brand.json --fail-on danger --json
+whoisleuth bulk domains.txt --deep --brand-profile brand.json --fail-on danger --errors-only --json
+```
+
+The selected file uses the existing versioned Brand Profile export format,
+must provide one unambiguous valid profile with an official domain, and is bounded
+by the existing Brand Profile import byte limit. If the export contains multiple
+profiles, add `--brand-id <exact-profile-id>` from the selected profile's `id`
+field; no first-profile default is chosen. Its private fields are not copied into
+results or checkpoints or sent to sources. Restore it explicitly when resuming.
+Danger matches report the scoring-model version and evidence quality. The
+threshold prioritises review, not confirmed maliciousness. Fast collection,
+missing Brand context or ineligible registration evidence cannot establish a
+match; exit **0** does not establish low risk, complete coverage or safety.
+`inconclusive` and `source-failure` remain independently selected policies.
+
 Local configuration profiles can set presentation, Fast collection, bounded
 concurrency and observer labels. They cannot add targets, enable Deep
 collection, choose output paths or approve network work. Explicit command

package/lib/generated/cisa-kev-catalog.mjs

@@ -1,9 +1,9 @@
 // Generated by tools/cisa-kev-catalog.mts from the pinned CISA KEV feed.
 // United States Government work; do not edit by hand.
 const CISA_KEV_CATALOG = Object.freeze({
-    catalogVersion: "2026.10.15",
-    releasedAt: "2026-10-15T17:00:11.2795Z",
-    sourceSha256: "0a4807c44c302e6c3f8ba5adbcd45f8163514f52059f636ad9048728cf0c57b8",
+    catalogVersion: "2026.10.16",
+    releasedAt: "2026-10-16T17:15:48.8752Z",
+    sourceSha256: "b6e27975f6635ecfc546fbd4fd6e444ba63a07ab2abc8876229d77fe083d357d",
     sourceUrl: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
     identifiers: Object.freeze([
         "CVE-2002-0367",
@@ -1547,6 +1547,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2025-59689",
         "CVE-2025-59718",
         "CVE-2025-60710",
+        "CVE-2025-61624",
         "CVE-2025-61757",
         "CVE-2025-61882",
         "CVE-2025-61884",
@@ -1582,6 +1583,7 @@ const CISA_KEV_CATALOG = Object.freeze({
         "CVE-2026-0770",
         "CVE-2026-102489",
         "CVE-2026-102490",
+        "CVE-2026-102764",
         "CVE-2026-104286",
         "CVE-2026-104935",
         "CVE-2026-105133",