nsauditor-ai 0.2.16 → 0.2.18

package/README.md

@@ -17,7 +17,9 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.16 + Enterprise 0.31.4** (June 2026) — paired content bump for the Enterprise **"Cloud-scan presentation false-clean fix + `--compliance all` / fail-fast validation"** cycle. A cloud scan (`--host aws|azure|gcp`) with real findings no longer surfaces the network concluder's *"Host is UP — No open services detected"* headline — the conclusion shows a cloud-appropriate summary (N findings by severity + top risks), and a plugin that **times out or errors** routes to **coverage UNVERIFIED** rather than an affirmative clean verdict. **`--compliance all`** expands to all seven frameworks and an unknown `--compliance` token now **fails fast** (no *"Framework load failed"* stub) — the CE `--help` now documents both (the only CE-side change). Detection is unchanged (oracle-validated). **No new framework, no new plugins (still 28), no coverage-matrix changes.** Paired **EE 0.31.4** + agent-skill 0.2.16. **EE 0.31.4 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
+**Latest: CE 0.2.18 + Enterprise 0.31.4** (June 2026) — **CLI usability patch:** `--host aws,gcp,azure` now scans **one or more clouds in a single run** (comma-separated; `--host aws` for one cloud). Previously a comma list hit the SSRF guard (`getaddrinfo ENOTFOUND aws,gcp,azure`) — there was no way to audit multiple clouds in one command. The `--host` `--help` documents the comma form + warns that the `aws|gcp|azure` (pipe) form is notation (a shell treats `|` as a pipe). **0.2.18** also fixes the per-host auto-scope log line so it no longer implies other clouds are dropped on a multi-cloud run (they're scanned on their own pass). **CLI-only change (CE)**; Enterprise 0.31.4 unaffected (peer `nsauditor-ai >=0.2.8` unchanged). See [CHANGELOG.md](./CHANGELOG.md).
+
+**Prior: CE 0.2.16 + Enterprise 0.31.4** (June 2026) — paired content bump for the Enterprise **"Cloud-scan presentation false-clean fix + `--compliance all` / fail-fast validation"** cycle. A cloud scan (`--host aws|azure|gcp`) with real findings no longer surfaces the network concluder's *"Host is UP — No open services detected"* headline — the conclusion shows a cloud-appropriate summary (N findings by severity + top risks), and a plugin that **times out or errors** routes to **coverage UNVERIFIED** rather than an affirmative clean verdict. **`--compliance all`** expands to all seven frameworks and an unknown `--compliance` token now **fails fast** (no *"Framework load failed"* stub) — the CE `--help` now documents both (the only CE-side change). Detection is unchanged (oracle-validated). **No new framework, no new plugins (still 28), no coverage-matrix changes.** Paired **EE 0.31.4** + agent-skill 0.2.16. **EE 0.31.4 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
 
 **Prior: CE 0.2.15 + Enterprise 0.31.3** (June 2026) — paired content bump for the Enterprise **"Enumeration-failure fleet sweep (no-silent-false-clean) + Aurora DB-cluster snapshot dimension"** cycle. The Enterprise engine closes a fleet-wide class of **enumeration-failure** false-cleans across **12 AWS plugins** — a scanner that cannot enumerate a resource population now fails **CLOSED** with a routed evidence-gap instead of reading CLEAN — and adds the Aurora **DB-cluster snapshot** dimension to plugin 1140 (a public `restore=all` cluster snapshot is CRITICAL, an unencrypted one HIGH; the cluster surface instance-level scans never see), with a Multi-AZ DB cluster fail-close. **No new framework, no new plugins (still 28), no coverage-matrix changes** — a false-negative-hardening release. **No CE engine behavior change** (the detection + routing live in the Enterprise engine). Paired **EE 0.31.3** + agent-skill 0.2.15. **EE 0.31.3 requires CE 0.2.8+.** See [CHANGELOG.md](./CHANGELOG.md).
 

package/cli.mjs

@@ -913,13 +913,19 @@ Environment:
   COMPLIANCE_TSA_URL             RFC 3161 timestamp authority for SOC 2 attestation
 
 Cloud-scan hosts:
-  --host aws | gcp | azure       Sentinel literals (case-insensitive). These are not
-                                 DNS-resolved; they route the scan to the matching
+  --host aws[,gcp,azure]         One or more cloud sentinel literals, comma-separated
+                                 (case-insensitive): use 'aws' for one cloud, or
+                                 'aws,gcp,azure' to audit all three in one run (each cloud
+                                 is scanned in turn). Do NOT write aws|gcp|azure with pipe
+                                 characters — your shell treats | as a pipe. Sentinels are
+                                 not DNS-resolved; they route the scan to the matching
                                  cloud-scanner plugins via the provider's control-plane
                                  API, and imply CLOUD_PROVIDER=<host> when unset. With
                                  --plugins all the scan AUTO-SCOPES to only that cloud's
-                                 plugins (other clouds + non-cloud plugins are skipped and
-                                 the skip is logged) — so --plugins all is safe here.
+                                 plugins (plugins not applicable to this host are skipped +
+                                 logged — other-cloud plugins run on their OWN --host pass,
+                                 non-cloud plugins need a network host) — so --plugins all
+                                 is safe here.
                                  Note: the composite zero-trust checker (1023) has no
                                  single cloud and is therefore skipped under this
                                  auto-scope; to run it, select it explicitly
@@ -929,6 +935,7 @@ Examples:
   nsauditor-ai scan --host 10.0.0.1 --plugins all
   CLOUD_PROVIDER=aws AWS_PROFILE=default \\
     nsauditor-ai scan --host aws --plugins all --compliance all   # full AWS audit, all 7 frameworks
+  nsauditor-ai scan --host aws,gcp,azure --plugins all --compliance all   # all 3 clouds in one run
   nsauditor-ai scan --host 10.0.0.0/24 --plugins all --compliance soc2
   nsauditor-ai license install enterprise_eyJhbGciOiJFUzI1NiIs...
   nsauditor-ai license --status

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.16",
+  "version": "0.2.18",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/plugin_manager.mjs

@@ -784,7 +784,8 @@ export class PluginManager {
         console.error(
           `Cloud host '${scope.provider}' → running ${scope.selected.length} ` +
           `${scope.provider.toUpperCase()} plugin(s); skipping ${scope.skipped.length} ` +
-          `non-${scope.provider} plugin(s) (other clouds + non-cloud).`,
+          `non-${scope.provider} plugin(s) not applicable to this host ` +
+          `(other-cloud plugins run on their own --host pass; non-cloud plugins need a network host/CIDR).`,
         );
       }
     }

package/utils/host_iterator.mjs

@@ -137,6 +137,8 @@ export function expandRange(range) {
  * Detect input type and return array of hosts.
  * - If contains '/' → CIDR
  * - If contains '-' with IP pattern → dash range
+ * - If contains ',' → comma-separated list (each token parsed + flattened, e.g.
+ *   `aws,gcp,azure` → multi-cloud, or `10.0.0.1,10.0.0.2`)
  * - If file exists → host file
  * - Otherwise → single IP/hostname
  */
@@ -151,6 +153,24 @@ export async function parseHostArg(arg) {
     return expandRange(arg);
   }
 
+  // Comma-separated list (e.g. multi-cloud `aws,gcp,azure`, or `10.0.0.1,10.0.0.2`):
+  // split and parse each token recursively so cloud sentinels, CIDRs, and ranges all
+  // compose. A real host-file whose path happens to contain a comma is still read as a
+  // file (checked first); otherwise the comma is treated as a list separator.
+  if (typeof arg === 'string' && arg.includes(',')) {
+    if (!path.isAbsolute(arg)) {
+      const r = path.resolve(arg);
+      if (r.startsWith(process.cwd() + path.sep)) {
+        try { await fsp.access(arg); return parseHostFile(arg); } catch { /* not a file → treat as a list */ }
+      }
+    }
+    const out = [];
+    for (const token of arg.split(',').map((t) => t.trim()).filter(Boolean)) {
+      out.push(...await parseHostArg(token));
+    }
+    return out;
+  }
+
   // Path traversal guard: reject absolute paths and paths resolving outside cwd
   if (path.isAbsolute(arg)) return [arg]; // treat as hostname, not file
   const resolved = path.resolve(arg);