nsauditor-ai 0.2.23 → 0.2.25

package/README.md

@@ -17,7 +17,7 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 0.2.23 + Enterprise 0.31.9** (July 2026) — **operator bug-fix cycle (real CE engine/CLI/MCP change).** Fixes three operator-reported bugs from a live test: **(BUG2b) cloud-scan scope integrity** — cloud auditor plugins ran during a `--host 192.168.1.1` **network** scan; a cloud auditor now runs **only** on its own cloud sentinel (`aws`/`gcp`/`azure`), never on a network host, never via credentials-in-env, and never via an explicit `--plugins`/MCP `probe_service` selection (`--host` is the sole cloud-intent signal); **(BUG1) AI-conclusion robustness** — the AI conclusion no longer aborts on cloud-scale payloads (payload-scaled timeout, 120s→600s, `NSA_AI_TIMEOUT_MS`-overridable) and writes a **visible** `scan_response_ai.txt` stub on failure instead of failing quiet; **(BUG2a)** the AI bail message names the unresolved API key instead of misreporting "AI_ENABLED=false". Externally reviewed across multiple rounds → 🟢 PASS. Paired **Enterprise 0.31.9** (GAP-1 #3 RoC positive-substrate render-site parity). No new framework, no new plugins (still 28), all seven coverage matrices unchanged. Requires CE 0.2.8+. Full detail in **[CHANGELOG.md](./CHANGELOG.md)**.
+**Enterprise GRC push activation + AWS positive-substrate evidence uplift.** The Enterprise **Vanta** push connector is now wired for scan-time activation, a **Drata** connector library ships alongside it (Secureframe on the roadmap), and AWS PASS-tier findings now surface as positive substrate evidence in the compliance RoC. See the **[GRC Connectors](#grc-connectors-vanta--drata)** section below, and **[CHANGELOG.md](./CHANGELOG.md)** for the full per-release history.
 
 → See a sample EE scan output: **[walk-through with synthetic Acme Corp AWS account](https://www.nsauditor.com/ai/docs/sample-scan/)** (no signup required)
 
@@ -58,7 +58,7 @@ If you're heading into a **SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS C
   - **GDPR Article 32 (Security of Processing)** (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units**; **GDPR Article 32 infrastructure substrate only — NOT GDPR compliance** (GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article an infrastructure scanner can substrate-evidence; the rest is operator-side, out of scope by design). Four-factor proportionality (substrate *for* your "appropriate to the risk" determination, never an absolute pass/fail); personal-data-scope attestation (pair with your Art. 30 records of processing); **Art. 83(4) lower fine tier** (€10M/2%, not the €20M/4% headline tier); Art. 32(3)/Art. 42 cloud-provider certification-inheritance
 - 🔐 **Cryptographically signed evidence** — SHA-256 chain-of-custody + RFC 3161 trusted timestamps + Ed25519 suppression signing. Non-repudiation, not just integrity. Auditors can verify offline.
 - 🏛️ **Zero Data Exfiltration architecture** — your scan data never leaves your infrastructure. Air-gapped deployment supported. AI analysis happens locally (Ollama) or via your own API keys. Important for PCI DSS CDE-isolation threat models.
-- 🔗 **Native GRC platform integration** — push evidence directly to **Vanta** (live; Drata + Secureframe planned). Idempotent retries, per-tenant token rotation, rate-limit handling, signed-envelope round-trip integrity.
+- 🔗 **GRC connectors — Vanta + Drata (Enterprise)** — map compliance findings to your GRC platform's evidence/test records and push them at **scan time** (opt-in). Suppression-aware outcome mapping, idempotent retries, rate-limit handling, token redaction, and Zero-Data-Exfiltration egress redaction. Secureframe on the roadmap; live validation against production tenants is in progress. See **[GRC Connectors](#grc-connectors-vanta--drata)** below.
 - 🗄️ **WORM evidence storage** — S3 Object Lock COMPLIANCE-mode for SEC Rule 17a-4(f) / FINRA 4511 retention compliance
 - 📊 **SLA / MTTR tracking + recurring-scan attestation** — the **Type II operating-effectiveness evidence** auditors actually demand (not just point-in-time snapshots)
 - 🎯 **11 adversarial-audit Claude Code skills** authored per the Per-Framework Adversarial-Audit Skill Pairing institutional pattern — Phase-4 Compliance/GRC chain 8-of-8 COMPLETE for all shipped frameworks (SOC 2 + HIPAA + NIST CSF + PCI DSS + ISO 27001 + CIS Controls v8 + GDPR Article 32 + GRC connector)
@@ -110,7 +110,7 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 | Recurring-scan attestation (Type II operating-effectiveness) | — | — | ✅ |
 | WORM evidence storage (S3 Object Lock — SEC 17a-4 / FINRA 4511) | — | — | ✅ |
 | **Enterprise — integration + deployment** | | | |
-| GRC platform connector (Vanta live; Drata + Secureframe planned) | — | — | ✅ |
+| GRC connectors — Vanta + Drata push (scan-time, opt-in); Secureframe planned | — | — | ✅ |
 | Tabletop simulation + SIEM correlation | — | — | ✅ |
 | Docker per-scan isolation | — | — | ✅ |
 | Air-gapped deployment | — | — | ✅ |
@@ -121,6 +121,35 @@ How Marketplace fulfillment works (ZDE and air-gap preserved — no runtime AWS
 
 ---
 
+## GRC Connectors (Vanta & Drata)
+
+*Enterprise feature. Requires `@nsasoft/nsauditor-ai-ee`.*
+
+Every compliance scan already produces a GRC-ready JSON evidence artifact. The **GRC connectors** take the next step: they map each NSAuditor compliance finding to your GRC platform's own evidence/test records and **push them at scan time** — so your Vanta or Drata workspace reflects the latest cloud posture without a manual export/import round-trip.
+
+**Opt-in, and Zero-Data-Exfiltration by default.** The push is off unless you set the environment variables below. When it runs, egress is redaction-gated: resource identifiers can be hashed or removed, the persisted audit log stores a body **fingerprint** (never the raw payload), and your API token is never written to any artifact. Nothing leaves your infrastructure that you didn't opt into.
+
+```bash
+# Enable the scan-time push (Enterprise)
+COMPLIANCE_GRC_PROVIDER=vanta        # or: drata
+COMPLIANCE_GRC_TOKEN=<your API key>  # never serialized to artifacts
+# Optional:
+# COMPLIANCE_GRC_REDACTION=hash      # off | hash | remove  (egress identifier redaction)
+# COMPLIANCE_GRC_CONTROL_MAP=/path/to/config.json  # provider config: Vanta control→test map, or Drata connection ({connectionId, resourceId, schemaMap})
+```
+
+| Platform | Status | Model |
+|---|---|---|
+| **Vanta** | Connector + scan-time activation shipped | Maps findings to Vanta test results; suppression-aware outcome mapping (pass / fail / passed-with-compensating-control), framework-dimensioned idempotency keys, retry with rate-limit backoff, circuit breaker |
+| **Drata** | Connector library shipped | Pushes structured records via Drata **Custom Connections**; your Drata **Test Builder** rules (Advanced/Enterprise plans) evaluate them — the connector delivers evidence, your rules do the evaluation |
+| **Secureframe** | On the roadmap | — |
+
+**Reliability + audit-integrity built in:** idempotent retries (a network-timed-out push won't create duplicate records), per-attempt + total-duration timeout caps, a consecutive-failure circuit breaker, token redaction across every log and error path, and a durable per-control push audit log written next to your scan artifacts.
+
+> **Honest status.** The Vanta and Drata connectors are shipped, opt-in, and covered by an extensive test suite. **Live validation against production Vanta / Drata tenants is in progress** as partner onboarding proceeds — until it completes, treat production use as early-access and validate against your own tenant first. This is a single-workspace, operator-configured connector; it is not a multi-tenant managed sync.
+
+---
+
 ## Quick Start
 
 ```bash
@@ -277,7 +306,7 @@ Results land in `./out/<host>_<timestamp>/`:
 | — | **GDPR Article 32 Compliance Engine (NEW EE 0.20.0)** | Enterprise | **GDPR Article 32 (Security of Processing)** infrastructure substrate (Regulation (EU) 2016/679) — **4 covered + 5 partial + 2 OOS across 11 Art. 32 sub-measure units** (the 7th framework). **This is GDPR Article 32 infrastructure substrate ONLY — NOT GDPR compliance.** GDPR is a 99-article legal regime; Art. 32 security-of-processing is the only article whose evidence is technical infrastructure state, so the rest of GDPR (lawful basis, consent, DSARs, records of processing, DPIAs, transfers) is operator-side and out of scope by design. **Four-factor proportionality** — Art. 32 measures are "appropriate to the risk" taking into account state-of-the-art / cost / nature-scope-context-purposes / risk; nothing is an absolute pass/fail, the engine produces substrate *for* the operator's determination. **Personal-data-scope attestation** — the scanner reads configuration, not data classification; a finding is an Art. 32 concern only if the resource processes personal data (pair with your Art. 30 records of processing). Controller-vs-processor role applicability + Art. 28 processor agreements. **Art. 83(4) lower fine tier** — Art. 32 infringements cap at €10M or 2% of turnover, NOT the €20M / 4% Art. 83(5) headline tier (which is for the basic principles + data-subject rights). Art. 32(3)/Art. 42 cloud-provider certification-inheritance (ISO 27001 / SOC 2 / C5 / EU Cloud CoC adherence as an element of demonstrable compliance, not a substitute). Use `--compliance gdpr` or any combination for multi-framework reports from a single scan. |
 | — | SLA & MTTR Tracking | Enterprise | Per-severity SLA targets, compensating-control flow, finding lifecycle, Type II rolling-quarter cadence. |
 | — | Recurring-Scan Attestation | Enterprise | Multi-scan chronological matrix, cadence gap detection, scope-drift surface (CC8.1). |
-| — | GRC Platform Connector | Enterprise | Native API push to Vanta / Drata / Secureframe with retry/backoff, idempotency, rate-limit handling, per-tenant token rotation. |
+| — | GRC Platform Connector | Enterprise | Vanta + Drata connectors (Secureframe planned) — scan-time push (opt-in), retry/backoff, deterministic idempotency, rate-limit handling, circuit breaker, foreign-token detection, ZDE egress redaction. See [GRC Connectors](#grc-connectors-vanta--drata). |
 | — | WORM Evidence Storage | Enterprise | S3 Object Lock COMPLIANCE-mode + resource redaction + SHA-256 manifest. SEC 17a-4 / FINRA 4511 retention-compatible. |
 | — | Tabletop Simulation | Enterprise | Probe-event manifest + SIEM detection correlation, configurable coverage bands (Type II / High-Assurance presets). |
 

package/cli.mjs

@@ -912,7 +912,8 @@ Usage:
 
 Scan options:
   --host, --ip, --target <h>   Target host, IP, or CIDR
-  --host-file <path>           File with one host per line
+  --host-file <path>           File with one host per line (cloud sentinels in the
+                               file reconcile CLOUD_PROVIDER the same as --host)
   --env <path>                 Load a dotenv (KEY=value) file for this scan (per-account
                                credentials). Override-on; missing file = hard error.
   --aws-profile <name>         Use a named profile from the OS-default ~/.aws/credentials.
@@ -984,7 +985,11 @@ Cloud-scan hosts:
                                  characters — your shell treats | as a pipe. Sentinels are
                                  not DNS-resolved; they route the scan to the matching
                                  cloud-scanner plugins via the provider's control-plane
-                                 API, and imply CLOUD_PROVIDER=<host> when unset. With
+                                 API, and imply CLOUD_PROVIDER to the cloud leg(s) when
+                                 unset ('aws,gcp,azure' → CLOUD_PROVIDER=aws,gcp,azure).
+                                 A CLOUD_PROVIDER already pinned to a cloud that does NOT
+                                 cover every requested leg is a hard error (fail-fast),
+                                 not a silent skip of the uncovered legs. With
                                  --plugins all the scan AUTO-SCOPES to only that cloud's
                                  plugins (plugins not applicable to this host are skipped +
                                  logged — other-cloud plugins run on their OWN --host pass,
@@ -1028,6 +1033,16 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     console.error('Error: --aws-profile requires a profile name (e.g. --aws-profile prod)');
     process.exit(2);
   }
+  // Resolve the scan host list up-front (scan command only) so the CLOUD_PROVIDER
+  // reconcile below (resolveScanEnv) sees --host-file cloud-sentinel legs too. With
+  // --host-file the `host` arg is undefined, so without this a host-file of cloud
+  // sentinels would bypass the fail-fast/imply reconcile entirely. Reused as the
+  // scan target below (no double-parse); a parse failure is left to the scan-time
+  // resolution so the existing error path + exit code are unchanged.
+  let resolvedHosts = null;
+  if (cmd === 'scan' && hostFile) {
+    try { resolvedHosts = await parseHostFile(hostFile); } catch { /* defer to scan-time resolution */ }
+  }
   try {
     const { resolveScanEnv } = await import('./utils/env_loader.mjs');
     const fsm = await import('node:fs');
@@ -1035,6 +1050,7 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       envPath: typeof args.env === 'string' ? args.env : undefined,
       awsProfile: typeof args.awsProfile === 'string' ? args.awsProfile : undefined,
       host,
+      hosts: resolvedHosts ?? undefined,
       env: process.env,
       fileExists: (p) => fsm.existsSync(p),
       readFile: (p) => fsm.readFileSync(p, 'utf8'),
@@ -1912,7 +1928,10 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   // Resolve host list
   let hosts;
   if (hostFile) {
-    hosts = await parseHostFile(hostFile);
+    // Reuse the up-front resolution done for the CLOUD_PROVIDER reconcile (avoids a
+    // second parse + duplicate suspicious-line warnings); re-parse only if that was
+    // skipped/failed so a genuine host-file error still surfaces here as before.
+    hosts = resolvedHosts ?? await parseHostFile(hostFile);
   } else if (host) {
     hosts = await parseHostArg(host);
   } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.23",
+  "version": "0.2.25",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,

package/plugin_manager.mjs

@@ -728,9 +728,15 @@ export class PluginManager {
       const wrappedRuns = await callPlugin(mod, host, ctx, outputs, opts);
       const duration_ms = Date.now() - startMs;
 
-      // Determine manifest status from the plugin results
+      // Determine manifest status from the plugin results. A gate-skip envelope
+      // ({ up:false, skipped:true, ... }) carries neither `timedOut` nor `error`,
+      // so classify it as 'skipped' (not 'ran') iff nothing actually ran and there
+      // was no timeout/error — otherwise a self-skipped plugin would be miscounted
+      // as audited. Timeout/error still win over a skip; a skip+real-run mix is 'ran'.
       let status = 'ran';
       let reason = null;
+      let sawRealRun = false;
+      let skipReason = null;
       for (const wrapped of wrappedRuns) {
         if (wrapped.result?.timedOut) {
           status = 'timeout';
@@ -738,8 +744,16 @@ export class PluginManager {
         } else if (wrapped.result?.error && status !== 'timeout') {
           status = 'error';
           reason = wrapped.result.error;
+        } else if (wrapped.result?.skipped === true) {
+          skipReason = wrapped.result.reason || wrapped.result.skipReason || 'skipped by plugin gate';
+        } else {
+          sawRealRun = true;
         }
       }
+      if (status === 'ran' && skipReason != null && !sawRealRun) {
+        status = 'skipped';
+        reason = skipReason;
+      }
 
       manifest.push({
         id: String(mod.id || ''),
@@ -973,12 +987,25 @@ export class PluginManager {
         const cloudHostKind = mod.cloudProvider ? `cloud:${mod.cloudProvider}` : opts.hostKind;
         const wrappedRuns = await callPlugin(mod, host, ctx, [], { ...opts, timeoutMs, hostKind: cloudHostKind });
         const duration_ms = Date.now() - startMs;
+        // Same classifier as _runOrchestrated: a gate-skip envelope
+        // ({ up:false, skipped:true, ... }) → 'skipped' (not 'ran') iff nothing ran
+        // and there was no timeout/error, so a self-skipped cloud is not counted as
+        // audited (auditedProviders derives from status==='ran' at :1034).
+        // NB: the `!sawRealRun` term is defensive-only on this path — cloud plugins
+        // are runStrategy:'single' (one wrappedRun), so a skip+real-run MIX cannot
+        // arise here (unlike the multi-port network path in _runOrchestrated, which
+        // has the mutation-pinned mix test). Kept for uniformity with that classifier.
         let status = 'ran';
         let reason = null;
+        let sawRealRun = false;
+        let skipReason = null;
         for (const w of wrappedRuns) {
           if (w.result?.timedOut) { status = 'timeout'; reason = w.result.error || `timed out after ${timeoutMs}ms`; }
           else if (w.result?.error && status !== 'timeout') { status = 'error'; reason = w.result.error; }
+          else if (w.result?.skipped === true) { skipReason = w.result.reason || w.result.skipReason || 'skipped by plugin gate'; }
+          else { sawRealRun = true; }
         }
+        if (status === 'ran' && skipReason != null && !sawRealRun) { status = 'skipped'; reason = skipReason; }
         return { manifest: { id: String(mod.id || ''), name: mod.name || 'Plugin', status, reason, duration_ms }, outputs: wrappedRuns };
       } catch (err) {
         return { manifest: { id: String(mod.id || ''), name: mod.name || 'Plugin', status: 'error', reason: String(err?.message || err), duration_ms: 0 }, outputs: [] };

package/utils/env_loader.mjs

@@ -48,17 +48,43 @@ function providerMatchesHost(effective, hostProvider) {
   return tokens.includes(hostProvider);
 }
 
+// The distinct cloud-sentinel legs implied by the scan target, in first-appearance
+// order, lowercased + deduped. Mirrors the CLI's host-file-XOR-host dispatch
+// precedence: a pre-resolved `hosts` array (the --host-file path) is the
+// authoritative source when present; otherwise the `--host` string (single 'aws'
+// or a CSV 'aws,gcp,azure') is used. The two are NEVER unioned — the scan
+// dispatches exactly one source, so reconciling both would over-widen
+// CLOUD_PROVIDER and could false-throw on a leg that is never dispatched.
+// Non-sentinel tokens (IPs / CIDRs / hostnames) are ignored; [] means no cloud
+// leg (a pure network scan needs no CLOUD_PROVIDER).
+function sentinelLegs(host, hosts) {
+  const tokens = Array.isArray(hosts)
+    ? hosts.slice()
+    : (typeof host === 'string' ? host.split(',') : []);
+  const legs = [];
+  for (const raw of tokens) {
+    const t = String(raw).trim().toLowerCase();
+    if (CLOUD_SENTINELS.has(t) && !legs.includes(t)) legs.push(t);
+  }
+  return legs;
+}
+
 /**
  * @param {object} args
  * @param {string} [args.envPath]     value of --env
  * @param {string} [args.awsProfile]  value of --aws-profile
- * @param {string} [args.host]        --host value (for sentinel CLOUD_PROVIDER implication)
+ * @param {string} [args.host]        --host value: a single sentinel ('aws'), a
+ *                                    CSV of sentinels ('aws,gcp,azure'), or a
+ *                                    network host — for CLOUD_PROVIDER implication
+ * @param {string[]} [args.hosts]     pre-resolved host list (the --host-file path,
+ *                                    where `host` is undefined); reconciled the
+ *                                    same way as a CSV `host`
  * @param {object} args.env           snapshot of current process.env (read-only)
  * @param {(p:string)=>boolean} args.fileExists
  * @param {(p:string)=>string}  args.readFile
  * @returns {{set: Record<string,string>, unset: string[]}}
  */
-export function resolveScanEnv({ envPath, awsProfile, host, env = {}, fileExists, readFile }) {
+export function resolveScanEnv({ envPath, awsProfile, host, hosts, env = {}, fileExists, readFile }) {
   const set = {};
   const unset = [];
 
@@ -79,6 +105,16 @@ export function resolveScanEnv({ envPath, awsProfile, host, env = {}, fileExists
     Object.assign(set, dotenv.parse(content));
   }
 
+  // Capture whether the OPERATOR (not the tool) pinned CLOUD_PROVIDER — from the
+  // --env file (step 1) or the shell env — BEFORE the --aws-profile implication
+  // in step 2. This is what decides throw-vs-imply for sentinel legs (step 3):
+  //  • operator-pinned provider that misses a host leg → conflict → fail-fast;
+  //  • unpinned (or only tool/profile-implied) → imply the UNION of the legs.
+  // Without this snapshot, --aws-profile's implied bare 'aws' (step 2) would look
+  // like an operator pin and wrongly THROW on a `--host aws,gcp,azure` run.
+  const operatorPinned = providerAlreadySet(set, env);
+  const operatorProvider = operatorPinned ? effectiveProvider(set, env) : '';
+
   // 2. --aws-profile: AWS_PROFILE wins; clear explicit keys; load ~/.aws/config; imply aws.
   if (typeof awsProfile === 'string' && awsProfile.length) {
     set.AWS_PROFILE = awsProfile;
@@ -90,23 +126,34 @@ export function resolveScanEnv({ envPath, awsProfile, host, env = {}, fileExists
     if (!providerAlreadySet(set, env)) set.CLOUD_PROVIDER = 'aws';
   }
 
-  // 3. Sentinel host implies its provider when CLOUD_PROVIDER is still unset.
-  //    Fail-fast on a host vs CLOUD_PROVIDER contradiction: if the effective
-  //    provider (--env file + shell env) is set to a cloud that does NOT match
-  //    the host, scoping would select host-plugins that then all self-skip on
-  //    the awsScanSkipReason gate → ZERO plugins run → a silent "clean" report.
-  if (typeof host === 'string' && CLOUD_SENTINELS.has(host.trim().toLowerCase())) {
-    const hostProvider = host.trim().toLowerCase();
-    const effective = effectiveProvider(set, env);
-    if (effective && !providerMatchesHost(effective, hostProvider)) {
-      throw new Error(
-        `--host '${hostProvider}' conflicts with CLOUD_PROVIDER='${effective}': the host and the ` +
-        `effective cloud provider do not match, which would silently skip every plugin (an empty ` +
-        `"clean" report). Resolve by dropping the conflicting CLOUD_PROVIDER, or scan the matching host ` +
-        `(--host ${effective.split(',')[0].trim()}).`,
-      );
+  // 3. Sentinel host leg(s) imply their provider(s) when the operator hasn't
+  //    pinned CLOUD_PROVIDER; fail-fast when a pinned provider does NOT cover
+  //    every leg. Handles a single sentinel ('aws'), a CSV ('aws,gcp,azure'),
+  //    AND a --host-file resolved list (`hosts`) uniformly — each is a set of
+  //    legs. A leg that the effective provider does not cover would silently
+  //    self-skip on the awsScanSkipReason/gcpScanSkipReason gate → ZERO plugins
+  //    run on that leg → a silent "clean" report for a whole cloud.
+  const legs = sentinelLegs(host, hosts);
+  if (legs.length) {
+    if (operatorPinned) {
+      const uncovered = legs.filter((leg) => !providerMatchesHost(operatorProvider, leg));
+      if (uncovered.length) {
+        throw new Error(
+          `--host '${legs.join(',')}' conflicts with CLOUD_PROVIDER='${operatorProvider}': the host ` +
+          `leg(s) [${uncovered.join(', ')}] are not covered by the effective cloud provider, so every ` +
+          `plugin on ${uncovered.length > 1 ? 'those legs' : 'that leg'} would silently self-skip (an ` +
+          `empty "clean" report). Resolve by dropping the conflicting CLOUD_PROVIDER, or set ` +
+          `CLOUD_PROVIDER to include ${uncovered.join(',')} (e.g. CLOUD_PROVIDER=${legs.join(',')}).`,
+        );
+      }
+      // pinned provider covers every leg → leave the operator's value untouched
+    } else {
+      // Unpinned (or only tool/profile-implied): imply the UNION of the legs so
+      // each cloud leg runs. This overrides a bare 'aws' that step 2's
+      // --aws-profile implication may have written — 'aws' ⊆ the union, and the
+      // aws leg still resolves the profile via AWS_PROFILE.
+      set.CLOUD_PROVIDER = legs.join(',');
     }
-    if (!providerAlreadySet(set, env)) set.CLOUD_PROVIDER = hostProvider;
   }
 
   return { set, unset };