nsauditor-ai 0.2.53 → 0.2.55

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "nsauditor-ai",
-  "version": "0.2.53",
+  "version": "0.2.55",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,
   "scripts": {
     "start": "node cli.mjs",
-    "test": "node --test",
+    "test": "node --test 'tests/**/*.test.mjs'",
     "mcp": "node mcp_server.mjs"
   },
   "bin": {

package/plugin_manager.mjs

@@ -26,7 +26,68 @@ import { mapLimit } from './utils/concurrency.mjs';
 const __filename = fileURLToPath(import.meta.url);
 
 const VERBOSE = /^(1|true|yes|on)$/i.test(String(process.env.NSA_VERBOSE || ''));
-const PLUGIN_TIMEOUT_MS = Number(process.env.PLUGIN_TIMEOUT_MS || 30000);
+// Exported so a caller that must bind every plugin to the operator's own budget (MCP `scan_host`,
+// `probe_service`) passes THIS value as its wall — never a re-read of the environment or a retyped number.
+export const PLUGIN_TIMEOUT_MS = Number(process.env.PLUGIN_TIMEOUT_MS || 30000);
+
+// ── A CALLER'S WALL TRAVELS ON ITS OWN KEY, AND NO PLUGIN EVER RECEIVES IT (EE 1.1.0 build 6) ─────
+// `opts.timeoutMs` belongs to the PLUGINS: twelve network plugins read it as their own discovery
+// window or per-probe timeout (port_scanner, ping_checker, 028, 070 …), and the caller's opts are
+// forwarded into every run. Through CE 0.2.54 the manager ALSO read that key as the caller's wall, so
+// one name meant two things — the cloud path injected its 25 s wall there, harmless only because no
+// cloud plugin reads it, and a wall carried that way on the network path would have become
+// port_scanner's per-probe timeout. The wall is `pluginWallMs` now: the manager reads it here and
+// STRIPS it before any plugin's opts are built. `opts.timeoutMs` is forwarded untouched and is no
+// longer a wall for anyone.
+export const PLUGIN_WALL_KEY = 'pluginWallMs';
+function splitWall(opts) {
+  if (!opts || typeof opts !== 'object') return { wallMs: undefined, forwarded: {} };
+  const { [PLUGIN_WALL_KEY]: wallMs, ...forwarded } = opts;
+  return { wallMs, forwarded };
+}
+
+// ── O1(b): A PLUGIN MAY DECLARE ITS OWN TIME BUDGET, BOUNDED BY THIS CEILING ────────────────
+// A plugin whose cost is LINEAR in what the account holds cannot be budgeted by a single global
+// constant: plugin 1020 audits every S3 bucket serially at roughly 3 s each, so it ran in ~18 s
+// on a six-bucket account and hit `status=timeout duration_ms=30001 findings=0` once a few more
+// buckets existed. The producer is the only party that knows its own cost, so it declares it —
+// and the ceiling is what stops a declaration from hanging a scan. An exceeded DECLARED budget
+// still fails closed to not-measured; a budget buys TIME, never a pass.
+export const PLUGIN_TIMEOUT_CEILING_MS = Number(process.env.PLUGIN_TIMEOUT_CEILING_MS || 120000);
+
+/**
+ * The ONE place the budget is decided. Both enforcement sites call it, because a policy with
+ * two call sites is how one of them silently keeps the old behaviour.
+ *
+ * PRECEDENCE: a plugin-declared budget outranks the GLOBAL DEFAULT ONLY. A caller budget is a
+ * WALL and always binds: `min(declared, ceiling, callerWall)`.
+ *
+ * ⚠️ DO NOT RE-INVERT THIS — a declaration outranking the caller reads reasonable from the
+ * PLUGIN's frame and is wrong in the CONSUMER's. The callers that name a wall are the three MCP
+ * tools that run plugins, all on the `pluginWallMs` carrier: `scan_cloud` (via
+ * `_runCloudPluginsParallel`, `CLOUD_PLUGIN_TIMEOUT_MS || 25000`), and `scan_host` / `probe_service`
+ * (the effective `PLUGIN_TIMEOUT_MS`, so on those two a declaration never reaches Desktop and every
+ * plugin gets exactly the budget it had before declarations existed) — and CLAUDE DESKTOP HARD-KILLS
+ * AN MCP TOOL CALL AT ABOUT 60 s. Measured live 2026-06-01: a 45,000 ms budget returned 15 of 20 plugins with an
+ * honest "5 incomplete"; 90,000 ms returned NOTHING AT ALL. So letting a 90 s declaration
+ * override a 25 s wall does not buy that plugin more time — it converts a DISCLOSED PARTIAL
+ * into a killed call with no result, which is strictly worse than the timeout it was meant to
+ * fix. The wall is the operator's, and it binds.
+ *
+ * CONSEQUENCE, STATED: on the Desktop path a large-estate S3 audit still reads not-measured
+ * unless the operator raises `CLOUD_PLUGIN_TIMEOUT_MS` toward 45-55 s. The CLI — which is the
+ * compliance path, and the one that writes evidence — names no caller budget and therefore gets
+ * the full declared budget. `PLUGIN_TIMEOUT_CEILING_MS` bounds a declaration on every path.
+ */
+export function resolvePluginTimeoutMs(mod, callerTimeoutMs, globalMs = PLUGIN_TIMEOUT_MS) {
+  const caller = Number(callerTimeoutMs);
+  const hasWall = Number.isFinite(caller) && caller > 0;
+  const base = hasWall ? caller : globalMs;
+  const declared = Number(mod && mod.timeoutMs);
+  if (!Number.isFinite(declared) || declared <= 0) return base;
+  const bounded = Math.min(declared, PLUGIN_TIMEOUT_CEILING_MS);
+  return hasWall ? Math.min(bounded, caller) : bounded;
+}
 const PREFIX = '[nsauditor]';
 const vlog   = VERBOSE ? (...a) => console.log(PREFIX, ...a) : () => {};
 const vwarn  = VERBOSE ? (...a) => console.warn(PREFIX, ...a) : () => {};
@@ -141,6 +202,12 @@ async function callPlugin(mod, host, ctx, priorOutputs = null, cliOpts = {}) {
   // Special-case OS Detector: pass prior plugin outputs so it can reason over them
   const isOsDetector = (mod?.id === "013") || /os\s*detector/i.test(String(mod?.name || ""));
 
+  // Hoisted: the resolved budget does not depend on the port, and the failure branch below
+  // reports it OUTSIDE runWithCtx's scope — printing the global constant there was false the
+  // moment any plugin declared its own.
+  const { wallMs, forwarded: pluginOpts } = splitWall(cliOpts);
+  const resolvedTimeoutMs = resolvePluginTimeoutMs(mod, wallMs);
+
   const runWithCtx = (port) => {
     const extra = isOsDetector && Array.isArray(priorOutputs) ? { results: priorOutputs } : {};
     // Forward CLI-derived opts (ports, etc.) so plugins can honor flags like --ports.
@@ -149,12 +216,16 @@ async function callPlugin(mod, host, ctx, priorOutputs = null, cliOpts = {}) {
     // Promise.resolve().then(...) so a plugin that throws SYNCHRONOUSLY (before its
     // first await) becomes a rejected promise the race below catches, instead of
     // propagating out of callPlugin and aborting the whole (sequential or parallel) batch.
-    const pluginPromise = Promise.resolve().then(() => mod.run(host, port, { ...cliOpts, context: withBaseContext(ctx), ...extra }));
+    // `effectiveTimeoutMs` IS the number raced below — the plugin reads its budget, it does not re-derive
+    // one. EE 1.1.0 build 7's Gate 2: plugin 1040 declared 60 s and capped itself at 0.8 × the 30 s
+    // environment default, because nothing told it what the manager actually allowed.
+    const pluginPromise = Promise.resolve().then(() => mod.run(host, port, {
+      ...pluginOpts, context: { ...withBaseContext(ctx), effectiveTimeoutMs: resolvedTimeoutMs }, ...extra,
+    }));
 
-    // Honor a per-run timeout (cloud path) but clamp to a positive number; an
-    // undefined (network path) or non-positive value falls back to PLUGIN_TIMEOUT_MS.
-    const reqTimeout = Number(cliOpts && cliOpts.timeoutMs);
-    const timeoutMs = Number.isFinite(reqTimeout) && reqTimeout > 0 ? reqTimeout : PLUGIN_TIMEOUT_MS;
+    // A caller's wall (the MCP tools) binds; with none (the CLI) a declared budget outranks
+    // PLUGIN_TIMEOUT_MS, and a plugin that declares nothing gets PLUGIN_TIMEOUT_MS.
+    const timeoutMs = resolvedTimeoutMs;
     let timer;
     const timeoutPromise = new Promise((_, reject) => {
       timer = setTimeout(() => reject(new Error(`Plugin "${mod.name}" timed out after ${timeoutMs}ms`)), timeoutMs);
@@ -188,7 +259,7 @@ async function callPlugin(mod, host, ctx, priorOutputs = null, cliOpts = {}) {
     if (!r.ok) {
       const isTimeout = r.error?.message?.includes('timed out') || false;
       if (isTimeout) {
-        vlog(`Plugin "${mod.name}" timed out after ${PLUGIN_TIMEOUT_MS}ms — skipping`);
+        vlog(`Plugin "${mod.name}" timed out after ${resolvedTimeoutMs}ms — skipping`);
       }
       return {
         id: String(mod.id || ""),
@@ -506,15 +577,21 @@ export class PluginManager {
   }
 
   async _runOne(plugin, host, port, opts = {}) {
-    const timeoutMs = parseInt(process.env.PLUGIN_TIMEOUT_MS, 10) || PLUGIN_TIMEOUT_MS;
+    // Same resolver as callPlugin — the env read stays the GLOBAL floor, not the whole answer.
+    const { wallMs, forwarded } = splitWall(opts);
+    const timeoutMs = resolvePluginTimeoutMs(
+      plugin, wallMs,
+      parseInt(process.env.PLUGIN_TIMEOUT_MS, 10) || PLUGIN_TIMEOUT_MS,
+    );
     let timer;
     const timeoutPromise = new Promise((_, reject) => {
       timer = setTimeout(() => reject(new Error(`Plugin ${plugin.name || plugin.id} timed out after ${timeoutMs}ms`)), timeoutMs);
     });
     try {
       vlog(`Running ${plugin.name} on ${host}:${port}`);
-      // Ensure every run gets the BASE_CTX helpers merged into opts.context
-      const mergedOpts = { ...opts, context: withBaseContext(opts?.context || {}) };
+      // Ensure every run gets the BASE_CTX helpers merged into opts.context — and the budget raced below,
+      // LAST, so a caller's context cannot name a budget the manager is not enforcing.
+      const mergedOpts = { ...forwarded, context: { ...withBaseContext(forwarded.context || {}), effectiveTimeoutMs: timeoutMs } };
       const raw = await Promise.race([
         plugin.run(host, port, mergedOpts),
         timeoutPromise,
@@ -686,6 +763,18 @@ export class PluginManager {
       tcpOpen: new Set(),
       udpOpen: new Set(),
       // guessedOs / pingOs / arpOs will be filled as plugins run
+      // ⚠️ WHAT EACH UPSTREAM ACTUALLY DID, so a LATE plugin can tell "scanned, nothing open"
+      // from "never scanned". Emptiness of `tcpOpen` is NOT that signal — it is the same value
+      // for both, which is why a consumer computing posture from `openPorts.length` emitted
+      // `Good segmentation` over a port scanner that had TIMED OUT, and the cross-run delta then
+      // reported a real exposure as RESOLVED.
+      //
+      // THREE STATES, and the third is ABSENCE: an entry reading `ran` means the surface was
+      // measured (an empty result is then genuinely empty); an entry reading `timeout` / `error`
+      // / `skipped` means requested and NOT measured, which is an evidence gap; NO ENTRY means
+      // the plugin was never requested in this run, which is not a gap at all — the surface was
+      // never in scope here, and the cross-run case is already `plugin-not-run` in the delta.
+      pluginRunStatus: new Map(),
     });
 
     // Sort by priority (stable)
@@ -740,7 +829,7 @@ export class PluginManager {
       for (const wrapped of wrappedRuns) {
         if (wrapped.result?.timedOut) {
           status = 'timeout';
-          reason = wrapped.result.error || `timed out after ${PLUGIN_TIMEOUT_MS}ms`;
+          reason = wrapped.result.error || `timed out after ${resolvePluginTimeoutMs(mod, opts && opts[PLUGIN_WALL_KEY])}ms`;
         } else if (wrapped.result?.error && status !== 'timeout') {
           status = 'error';
           reason = wrapped.result.error;
@@ -762,6 +851,9 @@ export class PluginManager {
         reason,
         duration_ms,
       });
+      // Recorded from the SAME `status` the manifest reports, so the context and the run record
+      // cannot disagree about what an upstream did — a second derivation is a second thing to rot.
+      ctx.pluginRunStatus.set(String(mod.id || ''), status);
 
       for (const wrapped of wrappedRuns) {
         vlog(`${mod.name} Result:`, JSON.stringify(wrapped, null, 2));
@@ -985,7 +1077,7 @@ export class PluginManager {
         // the defense-in-depth signal is present on EVERY cloud dispatch route
         // (selection here is already scoped to each plugin's cloudProvider).
         const cloudHostKind = mod.cloudProvider ? `cloud:${mod.cloudProvider}` : opts.hostKind;
-        const wrappedRuns = await callPlugin(mod, host, ctx, [], { ...opts, timeoutMs, hostKind: cloudHostKind });
+        const wrappedRuns = await callPlugin(mod, host, ctx, [], { ...opts, [PLUGIN_WALL_KEY]: timeoutMs, hostKind: cloudHostKind });
         const duration_ms = Date.now() - startMs;
         // Same classifier as _runOrchestrated: a gate-skip envelope
         // ({ up:false, skipped:true, ... }) → 'skipped' (not 'ran') iff nothing ran
@@ -1000,7 +1092,7 @@ export class PluginManager {
         let sawRealRun = false;
         let skipReason = null;
         for (const w of wrappedRuns) {
-          if (w.result?.timedOut) { status = 'timeout'; reason = w.result.error || `timed out after ${timeoutMs}ms`; }
+          if (w.result?.timedOut) { status = 'timeout'; reason = w.result.error || `timed out after ${resolvePluginTimeoutMs(mod, timeoutMs)}ms`; }
           else if (w.result?.error && status !== 'timeout') { status = 'error'; reason = w.result.error; }
           else if (w.result?.skipped === true) { skipReason = w.result.reason || w.result.skipReason || 'skipped by plugin gate'; }
           else { sawRealRun = true; }

package/plugins/040_tls_cert_auditor.mjs

@@ -535,6 +535,51 @@ async function auditPort(host, port, config) {
   };
 }
 
+// ── A certificate audit that did not happen is SAID, where the reader looks ────
+// Through CE 0.2.55 a failed handshake reached only the INFO `tls-not-responding` service row,
+// which the report loader never shapes. EE 1.1.0 build 6's Gate-2 run had 443 OPEN per the port
+// scanner, and 040's handshake there was RESET (`ECONNRESET`): `totalIssues 0`, `overallSeverity:
+// "pass"`. The executive report said nothing about a certificate audit that never happened.
+//
+// ⚠️ KEYED ON WHAT THE PORT SCANNER SAW, NOT ON THE ERROR. The test estate's router answers
+// ENETDOWN on 993/995 in every run since 0.34.0, and the port scanner reads the same, so those ports
+// were never open. A rule keyed on "any error but ECONNREFUSED" would have put a gap on every scan
+// (measured over the evidence tree before this was written).
+//   · WITH port-scanner evidence (`context.tcpOpen` is a Set AND 003 ran): a failed port is a gap iff
+//     003 saw it open — with ANY error, a refusal included, since it was open moments earlier.
+//   · WITHOUT it (a direct call, or 003 not measured): every failure except ECONNREFUSED is a gap,
+//     restricted to the NAMED port when the call names one. It is stated as `openness: 'unknown'`.
+// The gap is a FINDING in `result.findings`, the container the loader reads, flagged
+// `details.evidenceGap`: it is shown AS a gap and excluded from the finding count. The INFO row stays.
+export function tlsCoverageGap(failedPorts, context, namedPort) {
+  const failed = Array.isArray(failedPorts) ? failedPorts : [];
+  const tcpOpen = context?.tcpOpen instanceof Set ? context.tcpOpen : null;
+  const scannerRan = context?.pluginRunStatus instanceof Map && context.pluginRunStatus.get("003") === "ran";
+  const evidence = tcpOpen !== null && scannerRan;
+  const named = Number(namedPort) > 0 ? Number(namedPort) : null;
+  const gaps = evidence
+    ? failed.filter((f) => tcpOpen.has(Number(f.port)))
+    : failed.filter((f) => f.error !== "ECONNREFUSED" && (named === null || Number(f.port) === named));
+  if (gaps.length === 0) return null;
+  const list = gaps.map((f) => `${f.port} (${f.error})`).join(", ");
+  return {
+    severity: SEVERITY.INFO,
+    check: "tls_audit_incomplete",
+    title: `[COVERAGE GAP] TLS certificate audit could not complete on ${list}`,
+    detail: evidence
+      ? `The port scanner saw ${gaps.length === 1 ? "this port" : "these ports"} open, and the TLS handshake failed: ` +
+        "the certificate, chain, cipher and protocol checks did not run there. This is not a pass."
+      : "The TLS handshake failed, and this run holds no port-scanner evidence of whether the port was open: " +
+        "the certificate, chain, cipher and protocol checks did not run there. This is not a pass.",
+    port: gaps.length === 1 ? Number(gaps[0].port) : null,
+    details: {
+      evidenceGap: true,
+      openness: evidence ? "open-per-port-scanner" : "unknown",
+      failedPorts: gaps,
+    },
+  };
+}
+
 // ── Plugin Export ─────────────────────────────────────────────────────────────
 
 export default {
@@ -607,6 +652,8 @@ export default {
       info:     allIssues.filter((i) => i.severity === SEVERITY.INFO).length,
     };
 
+    const coverageGap = tlsCoverageGap(failedPorts, opts.context, port);
+
     return {
       up: activeResults.length > 0,
       audit_type: "tls_certificate",
@@ -616,6 +663,7 @@ export default {
       summary,
       portResults: activeResults,
       failedPorts,
+      ...(coverageGap ? { findings: [coverageGap] } : {}),
     };
   },
 

package/plugins/mcp_scanner.mjs

@@ -343,6 +343,18 @@ function buildFindings({ host, port, detection }) {
 
 export default {
   id: '070',
+  // ── O1(b) DECLARED BUDGET (CE 0.2.55, EE 1.1.0 build 6) — the STRUCTURAL bound ───────────────
+  // Measured maximum 44 512 ms at Gate 2 build 5 (pack 192.168.1.1_20260923_182912), and a timeout at
+  // the 30 s default on every other network scan in the evidence since EE 0.44.0. The cost is
+  // STRUCTURAL and linear: candidate ports are probed one after another — MCP_CANDIDATE_PORTS plus
+  // every open TCP port in 3000–9000 — and each port tries every MCP_PROBE_PATHS entry in turn, each
+  // bounded by the probe timeout (MCP_PROBE_TIMEOUT_MS, 2 s by default): 10 s a port with no MCP
+  // server, up to 3 s more on the port that finds one (the SSE check ≤ 1 s, tools/list ≤ 2 s). The test
+  // gateway offered 10 candidate ports → 100 s, above 1.5 × the measured maximum (66 768 ms), so the
+  // structural bound wins (architect ruling, build 6): a declaration a known worst case exceeds fails
+  // closed on a foreseeable input. A target with more candidate ports exceeds any fixed budget and
+  // reads not-measured — a budget buys TIME, never a pass — and a caller wall still binds.
+  timeoutMs: 100_000,
   name: 'MCP Scanner',
   description: 'Detects HTTP/SSE-transport MCP (Model Context Protocol) servers and audits them for cleartext transport, missing authentication, deprecated protocol versions, and Inspector exposure.',
   priority: 70,

package/plugins/port_scanner.mjs

@@ -72,8 +72,14 @@ export function parsePortsSpec(spec) {
  * That is a FALSE CLEAN shipped to every npm customer: an empty sweep is indistinguishable
  * from a host with nothing listening, and downstream every plugin gated on `tcp_open` is then
  * skipped silently. cwd is still tried FIRST so an operator can override the port set by
- * placing their own `config/services.json` beside them — the documented behaviour — but the
- * package copy is the floor, and a scan can no longer fall through to nothing.
+ * placing their own `config/services.json` beside them — the documented behaviour — and the
+ * package copy is the floor.
+ *
+ * ⚠️ AND THE FLOOR ITSELF CAN BE EMPTY, WHICH THIS COMMENT USED TO DENY (board item 18). It said "a
+ * scan can no longer fall through to nothing" — true only while the package copy yields ports. An
+ * unreadable floor (every published tarball carried it mode 0600 until 0.2.55), a missing one or an
+ * empty one fell through to the same `up:false` over zero probes. The scan now REFUSES instead: `run()`
+ * throws, the plugin manager records status `error`, and every consumer reads that as "not measured".
  */
 const PKG_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 
@@ -115,10 +121,10 @@ async function readPortSet(fp) {
  * A non-empty override REPLACES rather than merges — an operator narrowing the sweep on
  * purpose must not silently get the full set back.
  */
-async function loadConfigPortsFromServicesJson(cwd = process.cwd()) {
+export async function loadConfigPortsFromServicesJson(cwd = process.cwd(), pkgRoot = PKG_ROOT) {
   const override = await readPortSet(path.join(cwd, "config", "services.json"));
-  if (override.tcp.length || override.udp.length) return override;
-  return readPortSet(path.join(PKG_ROOT, "config", "services.json"));
+  if (override.tcp.length || override.udp.length) return { ...override, source: "override" };
+  return { ...(await readPortSet(path.join(pkgRoot, "config", "services.json"))), source: "package" };
 }
 
 function classifyTcpError(err) {
@@ -263,9 +269,24 @@ export default {
     let udpPorts = Array.isArray(opts.udpPorts) ? uniqInts(opts.udpPorts) : [];
 
     if (!tcpPorts.length && !udpPorts.length) {
-      const cfg = await loadConfigPortsFromServicesJson();
+      // `_servicesCwd` / `_servicesFloorRoot`: test seams, absent in every real invocation.
+      const cwd = opts._servicesCwd ?? process.cwd();
+      const floorRoot = opts._servicesFloorRoot ?? PKG_ROOT;
+      const cfg = await loadConfigPortsFromServicesJson(cwd, floorRoot);
       tcpPorts = cfg.tcp;
       udpPorts = cfg.udp;
+      // ⚠️ REFUSE, NEVER FALL THROUGH (board item 18). An empty DEFAULT set means neither the
+      // caller's override nor the package's own floor could be read — the surface cannot be
+      // measured. Returning `up:false` over zero probes reads, downstream, exactly like a host with
+      // nothing listening. `--ports` extras do not rescue it: they ADD to the default sweep, and the
+      // default sweep the operator asked for was not possible.
+      if (!tcpPorts.length && !udpPorts.length) {
+        throw new Error(`port scanner refused: the default port set is empty — neither `
+          + `${path.join(cwd, "config", "services.json")} nor the package's own `
+          + `${path.join(floorRoot, "config", "services.json")} yielded a port. An empty port set means `
+          + `the surface cannot be measured, not that nothing is listening. Check that the file is `
+          + `readable (it ships mode 0644), or pass the ports explicitly.`);
+      }
     }
 
     // Additive merge of CLI --ports flag (string spec)
@@ -275,23 +296,6 @@ export default {
       udpPorts = uniqInts([...udpPorts, ...extra.udp]);
     }
 
-    // If still nothing, just return empty structure
-    if (!tcpPorts.length && !udpPorts.length) {
-      return {
-        up: false,
-        program: "Unknown",
-        version: "Unknown",
-        os: null,
-        type: "port-scan",
-        tcpOpen: [],
-        tcpClosed: [],
-        tcpFiltered: [],
-        udpOpen: [],
-        udpClosed: [],
-        udpNoResponse: [],
-        data: [],
-      };
-    }
 
     const data = [];
 

package/plugins/upnp_scanner.mjs

@@ -21,6 +21,67 @@ const SEARCH_TARGETS = [
   'urn:schemas-wifialliance-org:device:WFADevice:1'
 ];
 
+// ⚠️ node-upnp-utils' discover() takes its window as `wait`, in WHOLE SECONDS from 1 to 120 (default 5),
+// and reads no other key for it (lib/upnp-utils.js, discover: `const sec = params.wait || 5`). Through
+// CE 0.2.54 this passed `timeout` in milliseconds, which the library never read: every one of the seven
+// searches waited the 5 s default whatever NSA_UPNP_TIMEOUT_MS said, a scan cost ~39 s — over the 30 s
+// plugin default on every network scan in the evidence — and the pack recorded a `timeout` window that
+// was never applied. The fake the unit tests used accepted any key, which is how it survived.
+// A window that is not a positive number falls back to the 15 s default rather than reaching the
+// library as NaN, which it rejects — and a rejected search is swallowed below as zero devices.
+export const DEFAULT_UPNP_WINDOW_MS = 15000;
+export function perTargetWaitSec(windowMs) {
+  const ms = Number.isFinite(windowMs) && windowMs > 0 ? windowMs : DEFAULT_UPNP_WINDOW_MS;
+  return Math.min(120, Math.max(1, Math.round(ms / SEARCH_TARGETS.length / 1000)));
+}
+// The M-SEARCH MX header tells devices how long they may take to answer; the library's default is 3 s.
+// An MX longer than the wait loses every device that answers after the window closes, so it sits
+// INSIDE the window, leaving a second for the description fetch each answer starts.
+export function perTargetMx(waitSec) {
+  return Math.max(1, waitSec - 1);
+}
+
+// ⚠️ THE LIBRARY'S PACKET HANDLER CAN REJECT, AND NOTHING CATCHES IT (EE 1.1.0 build 6, Gate 2).
+// node-upnp-utils 1.0.3 — the latest published — calls its async `_receivePacket` from the socket handler
+// without a catch, so any rejection is unhandled and ends the WHOLE process. Two ways, both measured on the
+// real library: (1) an answer whose description fetch is still in flight when the NEXT search's
+// `startDiscovery()` resets the device table reads an entry that no longer exists
+// (`SyntaxError: "undefined" is not valid JSON`) — the shorter per-search wait made that likely; (2) an
+// answer with no LOCATION, or one that is not a URL (`TypeError: Invalid URL`) — one misbehaving device on
+// the LAN, in every release. The guard catches the rejection on the module's single instance, once, and
+// COUNTS it by error, and the plugin reports the count and warns. MEASURED, not assumed: the library lists a
+// device the moment its answer arrives, BEFORE it fetches the description, so a caught answer is still in
+// its search's result — what fails is the library's own description, which 028 does not depend on: it
+// fetches the description of every device it reports itself. The original is called SYNCHRONOUSLY, so the
+// device is listed exactly when it would have been; only its promise is caught.
+const RECEIVE_GUARD = Symbol.for('nsauditor.upnp.receivePacketGuard');
+const DROPPED = Symbol.for('nsauditor.upnp.droppedResponses');
+export function guardReceivePacket(upnp) {
+  if (!upnp || typeof upnp._receivePacket !== 'function' || upnp[RECEIVE_GUARD]) return upnp;
+  const original = upnp._receivePacket;
+  upnp[DROPPED] = {};
+  const count = (err) => {
+    const name = err?.name || 'Error';
+    upnp[DROPPED][name] = (upnp[DROPPED][name] ?? 0) + 1;
+  };
+  upnp._receivePacket = function guardedReceivePacket(...args) {
+    let p;
+    try { p = original.apply(this, args); } catch (err) { count(err); return Promise.resolve(); }
+    return Promise.resolve(p).catch(count);
+  };
+  upnp[RECEIVE_GUARD] = true;
+  return upnp;
+}
+/** Library errors caught so far on this instance, by error name. */
+export function droppedResponses(upnp) {
+  return { ...(upnp?.[DROPPED] ?? {}) };
+}
+const droppedSince = (upnp, before) => {
+  const now = droppedResponses(upnp); const out = {};
+  for (const [k, v] of Object.entries(now)) if (v - (before[k] ?? 0) > 0) out[k] = v - (before[k] ?? 0);
+  return out;
+};
+
 function ipMatches(target, address) {
   const t = String(target || "").trim();
   const a = String(address || "").trim();
@@ -216,8 +277,9 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
     upnp = globalThis.__upnpFakeFactory();
   } else {
     const { default: upnpModule } = await import('node-upnp-utils');
-    upnp = upnpModule;
+    upnp = guardReceivePacket(upnpModule);
   }
+  const droppedBefore = droppedResponses(upnp);
 
   const allDevices = [];
   let matched = false;
@@ -228,10 +290,8 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
     for (const searchTarget of SEARCH_TARGETS) {
       try {
         dlog(`Searching for ${searchTarget}`);
-        const devices = await upnp.discover({ 
-          timeout: Math.floor(timeoutMs / SEARCH_TARGETS.length),
-          st: searchTarget 
-        });
+        const wait = perTargetWaitSec(timeoutMs);
+        const devices = await upnp.discover({ wait, mx: perTargetMx(wait), st: searchTarget });
         allDevices.push(...devices);
         dlog(`Found ${devices.length} devices for ${searchTarget}`);
       } catch (e) {
@@ -338,16 +398,27 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
       }
     }
 
-    return { rows, matched };
+    return { rows, matched, dropped: droppedSince(upnp, droppedBefore) };
     
   } catch (e) {
     dlog("UPnP discovery error:", e?.message || e);
-    return { rows: [], matched: false };
+    return { rows: [], matched: false, dropped: droppedSince(upnp, droppedBefore) };
   }
 }
 
 export default {
   id: "028",
+  // ── O1(b) DECLARED BUDGET (CE 0.2.55, EE 1.1.0 build 6) ──────────────────────────────────────
+  // Two bases, both named. PRE-FIX: 39 320 ms measured at Gate 2 build 5 (pack
+  // 192.168.1.1_20260923_182912), and a timeout at the 30 s default on every network scan in the
+  // evidence since EE 0.44.0 — seven searches at the library's 5 s default, the `wait` defect above.
+  // POST-FIX: seven searches at `perTargetWaitSec` (2 s at the default window) plus ~0.6 s of send
+  // overhead each, ~18 s with no device to describe, and up to 3 s more per matching device's
+  // description fetch; Gate 2 build 6 records the measured figure. Rule of record (architect ruling,
+  // build 6): ≥ 1.5 × the measured maximum, ≤ the 120 000 ceiling — 60 000 (1.53× the pre-fix
+  // maximum). A budget buys TIME, never a pass: an exceeded declared budget still fails closed to
+  // not-measured, and a caller wall still binds.
+  timeoutMs: 60_000,
   name: "Enhanced UPnP Scanner",
   description: "Comprehensive UPnP/SSDP discovery with active M-SEARCH probing, detailed header analysis, and enhanced device fingerprinting. Returns only instances matching the target host IP by default.",
   priority: 346,
@@ -357,7 +428,7 @@ export default {
   runStrategy: "single",
 
   async run(host, _port = 1900, opts = {}) {
-    const timeoutMs = Number(opts.timeoutMs ?? process.env.NSA_UPNP_TIMEOUT_MS ?? 15000); // Increased timeout
+    const timeoutMs = Number(opts.timeoutMs ?? process.env.NSA_UPNP_TIMEOUT_MS ?? DEFAULT_UPNP_WINDOW_MS);
     const data = [];
 
     if (!isPrivateLike(host)) {
@@ -377,8 +448,12 @@ export default {
       };
     }
 
-    const { rows, matched } = await runWithUpnp(host, timeoutMs, opts);
+    const { rows, matched, dropped } = await runWithUpnp(host, timeoutMs, opts);
     dlog(`Discovery complete: matched=${matched}, rows.length=${rows.length}`);
+    const upnpLibraryErrors = Object.values(dropped).reduce((a, b) => a + b, 0);
+    if (upnpLibraryErrors > 0) {
+      console.warn(`[upnp-scanner] ${upnpLibraryErrors} UPnP answer(s) failed inside the UPnP library and were caught (${Object.entries(dropped).map(([k, v]) => `${k} ×${v}`).join(', ')}); each device is still listed from its answer, and this scanner fetches the description of every device it reports itself`);
+    }
 
     if (rows.length === 0) {
       data.push({
@@ -388,6 +463,7 @@ export default {
         response_banner: JSON.stringify({
           searchTargets: SEARCH_TARGETS,
           timeout: timeoutMs,
+          waitPerTargetSec: perTargetWaitSec(timeoutMs),
           reason: "No responses received"
         })
       });
@@ -435,6 +511,9 @@ export default {
       type: "upnp",
       deviceCount: rows.length,
       searchTargets: SEARCH_TARGETS,
+      waitPerTargetSec: perTargetWaitSec(timeoutMs),
+      upnpLibraryErrors,
+      upnpLibraryErrorsByName: dropped,
       data
     };
   }

package/utils/capabilities.mjs

@@ -42,7 +42,7 @@ export const CAPABILITIES = {
   // Enterprise
   cloudScanners:      { tier: 'enterprise', desc: 'AWS / Azure / GCP cloud posture audit plugins (Enterprise plugin pack).' },
   zeroTrust:          { tier: 'enterprise', desc: 'Zero-trust posture checks over collected identity and network evidence.' },
-  complianceEngine:   { tier: 'enterprise', desc: 'Maps findings to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8 and GDPR Art. 32 controls, and renders the report artifacts.' },
+  complianceEngine:   { tier: 'enterprise', desc: 'Maps findings to SOC 2, HIPAA, NIST CSF 2.0, PCI DSS, ISO 27001, CIS v8, GDPR Art. 32 and NIST SP 800-171 Rev 2 controls, and renders the report artifacts.' },
   enterpriseMCP:      { tier: 'enterprise', desc: 'MCP tools scan_cloud and get_findings.' },
   airGapped:          { tier: 'enterprise', desc: 'Offline OPERATION: licence validation is local (ES256 against an embedded key, no callback, no phone-home) and CVE matching runs against a local feed. This describes how the software RUNS, not how it is delivered or installed.' },
   // Removed 2026-07-21 (capability claim audit): verificationEngine / brandedReports /
@@ -75,15 +75,17 @@ export function hasCapability(capabilities, cap) {
   return Boolean(capabilities?.[cap]);
 }
 
-// CE-0.1.30.3 reviewer M2 fold: derive the highest tier among a plugin's
-// required capabilities. Used by `license --plugins` to render
-// "✗ requires: <tier>" accurately when a plugin doesn't declare a `tier`
-// field. Pre-fold the CLI fell back to `'pro'` for plugins like 021/022/023
-// (no `tier` field, but require `cloudScanners` which is enterprise-gated)
-// — which misled customers about what license they needed.
+// Derive the highest tier among a plugin's required capabilities — the tier the
+// plugin manager's gate enforces. `license --plugins` renders "✗ requires: <tier>"
+// from this ALONE since 0.2.55; before that a manifest's own `tier` word outranked it,
+// and EE 1020 / 1030 declared "pro" over `cloudScanners`, so the list told a Community
+// user that Pro unlocks them. (An earlier version of this comment said EE 021/022/023
+// "require cloudScanners"; they declared no capability at all until EE 1.1.0.)
 //
 // Returns 'ce' / 'pro' / 'enterprise' (the highest tier among all required
-// caps), or null when the plugin has no requiredCapabilities.
+// caps), or null when the plugin has no requiredCapabilities. A capability the
+// registry does not define is SKIPPED here — the CLI names such a capability
+// rather than printing this function's answer for it.
 const _TIER_RANK = { ce: 0, pro: 1, enterprise: 2 };
 const _RANK_TO_TIER = ['ce', 'pro', 'enterprise'];
 

package/utils/cloud_finding_summary.mjs

@@ -223,7 +223,7 @@ export function incompleteCoverageAdvisory(scanScope) {
     return {
       severity: 'info',
       kind: 'incomplete-region-coverage',
-      text: `Incomplete region coverage — ${unscanned.length} enabled region(s) not scanned (${unscanned.join(', ')}). Re-run with --aws-region all (or set AWS_REGION) for full coverage.`,
+      text: `Incomplete region coverage — ${unscanned.length} enabled region(s) not scanned by the auditors that take their region from the client (${unscanned.join(', ')}); the auditors that enumerate their own region list report their own coverage. Re-run with --aws-region all (or set AWS_REGION) for full coverage.`,
     };
   }
   if (scanScope.resolveError) {