nsauditor-ai 0.2.55 → 0.2.57

package/plugins/webapp_detector.mjs

@@ -2,7 +2,9 @@
 // New plugin: Webapp Detector
 // Uses the in-house zero-dep fingerprinter (utils/tech_fingerprint.mjs) to identify
 // web applications present on a host.
-// Tries HTTPS first (port 443), then HTTP (port 80), and can also try custom ports via opts.ports.
+// Tries https:443, then http:80, then each TCP port --ports adds (both schemes), and stops at the first that answers.
+// THE REACH, stated: 010 runs only when TCP 80 or 443 is open; an added port is tried after https:443 and http:80 and
+// only if neither answers (1.3.0 item 12 — the CLI's --ports string never reached this plugin before).
 // NOTE: Unlike http_probe, undici/fetch cannot ignore TLS easily per-request, so self-signed
 // HTTPS will usually fail and the plugin will fall back to HTTP.
 //
@@ -28,6 +30,8 @@
 // }
 
 import { fingerprint } from '../utils/tech_fingerprint.mjs';
+import { canonicalIp, classifyAddress, resolveAndValidate, allowAllHosts } from '../utils/net_validation.mjs';
+import { parsePortsSpec } from '../utils/ports_spec.mjs';
 
 const DEBUG =
   String(process.env.DEBUG_MODE || '').toLowerCase() === '1' ||
@@ -70,21 +74,83 @@ function normalizeTarget(target) {
   return (target.host || target.hostname || target.name || '').replace(/^https?:\/\//i, '').split('/')[0];
 }
 
+// 1.3.0 lane 2 (R2): redirects are followed HERE, one hop at a time, never by undici. The target chooses
+// a hop, not the operator, and the scan-entry guard ran once, on the host the operator named — so with
+// `redirect: 'follow'` a target could send the scanner to loopback or cloud metadata and have the
+// answer's headers reflected into the result. A hop to the host the operator named (any port, http or
+// https) was admitted at entry and is followed; any other host goes through the MCP guard's policy:
+// loopback, link-local, metadata and unspecified refused in every configuration, private ranges only
+// under NSA_ALLOW_ALL_HOSTS, a name refused if ANY of its answers is. Stated limit, as at entry: the
+// checked name is resolved again by the request (no pin against rebinding).
+const MAX_REDIRECT_HOPS = 5;
+
+async function assertHopAllowed(next, entryHost) {
+  if (next.protocol !== 'http:' && next.protocol !== 'https:') {
+    throw new Error(`redirect to ${next.href} refused: only http and https hops are followed`);
+  }
+  const host = next.hostname.replace(/^\[|\]$/g, '');
+  if (host.toLowerCase() === String(entryHost).replace(/^\[|\]$/g, '').toLowerCase()) return;
+  const allowPrivate = allowAllHosts();
+  if (canonicalIp(host)) {
+    const cls = classifyAddress(host);
+    if (cls === 'always' || (cls === 'private' && !allowPrivate)) {
+      throw new Error(`redirect to ${host} refused by the SSRF guard (blocked address range)`);
+    }
+    return;
+  }
+  try {
+    await resolveAndValidate(host, { allowPrivate });
+  } catch (err) {
+    throw new Error(`redirect to ${host} refused by the SSRF guard (${err.message})`);
+  }
+}
+
 async function fetchOnce(url, signal) {
   const extra = parseExtraHeaders();
-  const headers = {
+  const base = {
     'User-Agent': 'Mozilla/5.0 (compatible; NetworkSecurityAuditor/1.18.0; +https://example.invalid)',
     DNT: '1',
-    ...extra,
   };
-  // global fetch (undici) is available in Node >=18
-  const res = await fetch(url, { redirect: 'follow', headers, signal });
-  const finalUrl = res.url || url;
-  const statusCode = res.status;
-  const rawHeaders = {};
-  res.headers.forEach((v, k) => (rawHeaders[k.toLowerCase()] = v));
-  const html = await res.text();
-  return { url: finalUrl, statusCode, headers: rawHeaders, html };
+  const entry = new URL(url);
+  const entryHost = entry.hostname;
+  // The operator's HTTP_EXTRA_HEADERS (where an Authorization or an API key goes) are for the origin the
+  // operator named. Once a hop leaves that origin — another host, scheme or port — none of them is sent
+  // again, even if the chain comes back. (undici's own follow drops only Authorization cross-origin.)
+  let leftOrigin = false;
+  let current = url;
+  for (let hop = 0; ; hop++) {
+    const headers = leftOrigin ? base : { ...base, ...extra };
+    // global fetch (undici) is available in Node >=18
+    const res = await fetch(current, { redirect: 'manual', headers, signal });
+    const location = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+    if (location) {
+      if (hop >= MAX_REDIRECT_HOPS) {
+        throw new Error(`redirect limit (${MAX_REDIRECT_HOPS} hops) reached at ${current}`);
+      }
+      const next = new URL(location, current);
+      await assertHopAllowed(next, entryHost);
+      if (next.origin !== entry.origin) leftOrigin = true;
+      await res.body?.cancel?.().catch(() => {});
+      current = next.href;
+      continue;
+    }
+    const statusCode = res.status;
+    const rawHeaders = {};
+    res.headers.forEach((v, k) => (rawHeaders[k.toLowerCase()] = v));
+    const html = await res.text();
+    return { url: current, statusCode, headers: rawHeaders, html };
+  }
+}
+
+/**
+ * The TCP ports --ports adds, in every form a caller passes: the CLI's string ('8443,9090/udp'), an array, or
+ * { tcp, udp }. One grammar with the port scanner (utils/ports_spec.mjs); a /udp entry adds no URL.
+ */
+export function addedTcpPorts(spec) {
+  if (typeof spec === 'string') return parsePortsSpec(spec).tcp;
+  if (Array.isArray(spec)) return parsePortsSpec(spec.join(',')).tcp;
+  if (spec && typeof spec === 'object' && Array.isArray(spec.tcp)) return parsePortsSpec(spec.tcp.join(',')).tcp;
+  return [];
 }
 
 async function tryDetectAt(url) {
@@ -143,8 +209,9 @@ export default {
 
   /**
    * @param {string} host - target hostname or IP
-   * @param {number} port - optional hint (ignored; detection tries 443 then 80 unless opts.ports provided)
-   * @param {object} opts - options: { ports?: number[] }
+   * @param {number} port - the port the manager dispatched (ignored: each run walks the whole candidate list — the double
+   *   fetch when 80 and 443 are both open is boarded with the per-port dispatch)
+   * @param {object} opts - options: { ports?: string | number[] | { tcp, udp } } — the CLI passes its --ports string
    */
   async run(host, port = 0, opts = {}) {
     const result = {
@@ -168,8 +235,8 @@ export default {
       set.add(`${proto}://${target}${portPart}/`);
     };
 
-    // If specific ports given, try both schemes for each; else default to 443 then 80
-    const ports = Array.isArray(opts.ports) && opts.ports.length ? opts.ports : [443, 80];
+    // https:443 and http:80 first, then each TCP port --ports ADDS (both schemes) — never in place of the defaults.
+    const ports = [443, 80, ...addedTcpPorts(opts.ports).filter((p) => p !== 443 && p !== 80)];
     for (const p of ports) {
       if (p === 443) addUrl('https', 443);
       else if (p === 80) addUrl('http', 80);

package/utils/conclusion_utils.mjs

@@ -78,6 +78,11 @@ function resolveLiveness(base, other) {
   return base?.status || 'unknown';
 }
 
+// What a service IS (or how it was merged) — the fields authority governs. Everything else on a record is an adapter's
+// finding or flag, and a merge must not drop it.
+export const IDENTITY_FIELDS = new Set(['port', 'protocol', 'service', 'program', 'version', 'cpe', 'status', 'info', 'banner',
+  'source', 'evidence', 'authoritative', '__authoritative']);
+
 // Merge by protocol:port with basic authority precedence.
 // If 'authoritative' flag is true on a record, it wins over non-authoritative —
 // for identity. See resolveLiveness above for why status is handled separately.
@@ -104,9 +109,16 @@ export function upsertService(services, next, { authoritative = false } = {}) {
     return;
   }
   if (!authoritative && cur.__authoritative) {
-    // keep current authoritative, but allow filling blanks
+    // keep current authoritative, but allow filling blanks — and carry every NON-identity field the authoritative
+    // record lacks (1.3.0): this branch kept only identity, so a non-authoritative adapter that reached an
+    // authoritative record (040's certificate audit on 011's 443) landed nothing.
+    const carried = {};
+    for (const [k, v] of Object.entries(next)) {
+      if (!IDENTITY_FIELDS.has(k) && v !== undefined && cur[k] === undefined) carried[k] = v;
+    }
     services[i] = {
       ...cur,
+      ...carried,
       program: cur.program || next.program || null,
       version: cur.version || next.version || null,
       info: cur.info || next.info || null,

package/utils/cookie_redaction.mjs

@@ -0,0 +1,50 @@
+// utils/cookie_redaction.mjs
+// A scanned service's Set-Cookie VALUE is that service's secret (a session token); its NAME fingerprints a framework
+// (PHPSESSID, JSESSIONID). A Location header's query string can carry an SSO ticket or an OAuth code the same way.
+// 1.3.0 (the audit seat's ruling (A), at BOTH seams): the HTTP probe redacts them when it builds its banner, and the AI
+// redactor redacts any Set-Cookie value it meets, so the AI path holds even where a producer does not.
+
+export const REDACTED = '<redacted>';
+
+// One Set-Cookie header value may carry several cookies joined with ", " (fetch merges them) — split only where the next
+// chunk starts a new `name=`, so a ", " inside an Expires date is not a boundary.
+const COOKIES = /,\s*(?=[^=;,\s]+=)/;
+// In free text a Set-Cookie line ends at CR, LF, or a literal backslash-r / backslash-n (the webapp detector joins its
+// banner lines with those two-character sequences).
+const SET_COOKIE_LINE = /(set-cookie:[ \t]*)((?:(?!\r|\n|\\r|\\n).)*)/gi;
+
+/** One Set-Cookie header value: every cookie's VALUE redacted; its name and attributes (Path, HttpOnly, Expires) kept. */
+export function redactSetCookie(value) {
+  return String(value).split(COOKIES).map((c) => c.replace(/^(\s*[^=;\s]+)=[^;]*/, `$1=${REDACTED}`)).join(', ');
+}
+
+/** A Location header without its query string and fragment — the query can carry a credential. */
+export function redactLocation(value) {
+  const v = String(value);
+  const i = v.search(/[?#]/);
+  if (i < 0) return v;
+  return v[i] === '?' ? `${v.slice(0, i)}?${REDACTED}` : v.slice(0, i);
+}
+
+/** Free text (a banner, an evidence row): every `set-cookie:` line's cookie values redacted. */
+export function redactSetCookieLines(text) {
+  return String(text).replace(SET_COOKIE_LINE, (_, head, value) => head + redactSetCookie(value));
+}
+
+/** Every UNREDACTED `name=value` a Set-Cookie line carries anywhere in a structure — the census helper. */
+export function setCookieValues(x) {
+  const found = [];
+  const visit = (v) => {
+    if (typeof v === 'string') {
+      for (const m of v.matchAll(SET_COOKIE_LINE)) {
+        for (const c of m[2].split(COOKIES)) {
+          const kv = /^\s*([^=;\s]+)=([^;]*)/.exec(c);
+          if (kv && kv[2].trim() !== REDACTED) found.push(`${kv[1]}=${kv[2].trim()}`);
+        }
+      }
+    } else if (Array.isArray(v)) v.forEach(visit);
+    else if (v && typeof v === 'object') Object.values(v).forEach(visit);
+  };
+  visit(x);
+  return found;
+}

package/utils/delta_reporter.mjs

@@ -1,7 +1,69 @@
 // utils/delta_reporter.mjs
 // Delta reporting: compare two full scan cycles across multiple hosts.
 
-import { computeDiff } from './scan_history.mjs';
+import { computeDiff, flagsChanged } from './scan_history.mjs';
+
+// 1.3.0 lane 4, items 4 + 11. The watch loop hands this module each host's scanSingleHost OUTPUT, which carries no
+// services, finding count or tier — so every cycle compared two empty summaries, stdout read "No significant changes
+// detected." and the webhook gate never opened on a change. The output now carries the summary [ScanHistory] records
+// (`scanSummary`), and the cycle compares those. A host whose summary is MISSING is never read as an empty one: that
+// would print "N service(s) removed" for a scan that failed (the naive fix) or "No changes" (the shipped defect).
+
+/** The per-host states in which two cycles are NOT compared — a closed set, held two ways by its test. */
+export const WATCH_NOT_COMPARABLE = Object.freeze(['scan-failed', 'baseline-scan-failed', 'no-summary', 'baseline-no-summary']);
+
+const NOT_COMPARED_TEXT = {
+  'scan-failed': (detail) => `scan failed this cycle — not compared${detail ? ` (${detail})` : ''}`,
+  'baseline-scan-failed': () => "the previous cycle's scan failed — not compared",
+  'no-summary': () => 'no scan summary was recorded this cycle — not compared',
+  'baseline-no-summary': () => 'no scan summary was recorded for the previous cycle — not compared',
+};
+
+/**
+ * What one host's cycle value offers the comparison: `{ summary }`, or `{ failed: detail }` for the scheduler's
+ * `{ error }`, or `{ missing: true }` when no summary is there to read.
+ */
+export function deltaInputOf(value) {
+  if (value && typeof value === 'object') {
+    if (value.error != null && !('scanSummary' in value) && !Array.isArray(value.services)) return { failed: String(value.error) };
+    if ('scanSummary' in value) return value.scanSummary && typeof value.scanSummary === 'object' ? { summary: value.scanSummary } : { missing: true };
+    if (Array.isArray(value.services)) return { summary: value };
+  }
+  return { missing: true };
+}
+
+function notComparedDiff(reason, detail) {
+  return {
+    newServices: [], removedServices: [], changedServices: [],
+    newFindings: null, findingsNotComparable: false, findingsNotComparableReason: null,
+    changedFlags: [], flagsNotComparable: false, flagsNotComparableReason: null,
+    notCompared: reason,
+    summary: NOT_COMPARED_TEXT[reason](detail),
+  };
+}
+
+/** Compare one host's two cycle values. */
+function hostDiff(current, previous) {
+  const cur = deltaInputOf(current);
+  if (cur.failed !== undefined) return notComparedDiff('scan-failed', cur.failed);
+  if (cur.missing) return notComparedDiff('no-summary');
+  if (previous == null) return computeDiff(cur.summary, null);
+  const prev = deltaInputOf(previous);
+  if (prev.failed !== undefined) return notComparedDiff('baseline-scan-failed');
+  if (prev.missing) return notComparedDiff('baseline-no-summary');
+  return computeDiff(cur.summary, prev.summary);
+}
+
+/**
+ * THE one per-host change predicate (ruled): stdout and the webhook read the same definition. A service appeared,
+ * went or changed; the finding count moved, or could not be compared; a service check appeared, cleared or could not
+ * be compared; or the two cycles could not be compared at all.
+ */
+export function hostChanged(diff) {
+  if (!diff) return false;
+  return Boolean(diff.notCompared || diff.newServices?.length || diff.removedServices?.length || diff.changedServices?.length
+    || diff.newFindings || diff.findingsNotComparable || flagsChanged(diff));
+}
 
 /**
  * Compare two full scan cycle results and produce a delta report.
@@ -32,9 +94,7 @@ export function buildDeltaReport(currentResults, previousResults) {
 
   const hostDiffs = new Map();
   for (const h of currentHosts) {
-    const curr = currMap.get(h);
-    const prev = prevMap.has(h) ? prevMap.get(h) : null;
-    hostDiffs.set(h, computeDiff(curr, prev));
+    hostDiffs.set(h, hostDiff(currMap.get(h), prevMap.has(h) ? prevMap.get(h) : null));
   }
 
   return { newHosts, removedHosts, hostDiffs };
@@ -70,18 +130,11 @@ export function formatDeltaSummary(deltaReport) {
   if (!deltaReport.newHosts.length && !deltaReport.removedHosts.length) {
     let anyChange = false;
     if (deltaReport.hostDiffs) {
-      for (const diff of deltaReport.hostDiffs.values()) {
-        // ⚠️ `findingsNotComparable` COUNTS AS A CHANGE (board C10). `newFindings` is `null` when
-        // the two scans counted findings on a different basis, and null is falsy — so without
-        // this the diff drops out of both gates and the operator hears NOTHING, which reads as
-        // "no change since last scan". That is the false clean this item is about, one layer out.
-        // A comparison we cannot make is news: it is what tells an operator to rescan.
-        if (diff.newServices?.length || diff.removedServices?.length || diff.changedServices?.length
-            || diff.newFindings || diff.findingsNotComparable) {
-          anyChange = true;
-          break;
-        }
-      }
+      // ⚠️ A comparison that could not be made COUNTS AS A CHANGE (board C10; 1.3.0 items 4 + 11): `newFindings` is null
+      // when the two scans counted on a different basis, and a host whose scan failed has nothing to compare — without
+      // this the operator hears NOTHING, which reads as "no change since last scan". A comparison we cannot make is
+      // news: it is what tells an operator to rescan. hostChanged is the one predicate the webhook reads too.
+      anyChange = [...deltaReport.hostDiffs.values()].some(hostChanged);
     }
     if (!anyChange) {
       lines.push('No significant changes detected.');
@@ -103,15 +156,7 @@ export function hasSignificantChanges(deltaReport) {
   if (deltaReport.newHosts.length > 0) return true;
   if (deltaReport.removedHosts.length > 0) return true;
 
-  if (deltaReport.hostDiffs) {
-    for (const diff of deltaReport.hostDiffs.values()) {
-      if (diff.newServices?.length > 0) return true;
-      if (diff.removedServices?.length > 0) return true;
-      if (diff.changedServices?.length > 0) return true;
-      if (diff.newFindings && diff.newFindings !== 0) return true;
-      if (diff.findingsNotComparable) return true;   // see the note in formatDeltaSummary
-    }
-  }
+  if (deltaReport.hostDiffs && [...deltaReport.hostDiffs.values()].some(hostChanged)) return true;
 
   return false;
 }

package/utils/ee_load.mjs

@@ -0,0 +1,45 @@
+// utils/ee_load.mjs — load the Enterprise package, telling "not installed" from "installed and broken" (1.1.1).
+//
+// ⚠️ PRESENCE IS DECIDED BY RESOLUTION, NEVER BY THE ERROR. The scan path used to import inside a bare `catch {}` read as
+// "EE not installed — the ONLY silent case", and every failure landed there: a named import Community does not export
+// (Enterprise installed above the Community it runs on — the measured case at EE 174212f), a missing dependency of
+// Enterprise's own, a syntax error. The scan then ran with no analysis agents, no CVE mapper and no compliance report,
+// said nothing, and the Pro delta read every agent and engine row RESOLVED. An error CODE cannot separate the cases —
+// a dependency Enterprise lacks is `ERR_MODULE_NOT_FOUND` too — so the package's MANIFEST is resolved first (see
+// `isInstalled`): no manifest is absence, the one silent case; installed-but-the-import-throws is a load failure,
+// returned for the caller to report and record.
+//
+// Seams (tests only): `resolveEE(specifier)` replaces the resolver; `importEE()` replaces the import. An import seam
+// with NO resolver means the package is installed — a test that injects a module is describing one that resolves.
+
+export const EE_PACKAGE = '@nsasoft/nsauditor-ai-ee';
+
+// The DEFAULT resolver, as a replaceable dependency: Enterprise resolves from a development checkout, so a test that must
+// describe a checkout without it replaces this rather than the environment. Nothing in the product assigns it.
+export const resolverDeps = { resolve: (s) => import.meta.resolve(s) };
+
+/**
+ * PRESENCE IS THE PACKAGE'S MANIFEST, NEVER ITS ENTRY (the audit seat's T1-c fold 2). Resolving the entry answers "does
+ * the entry resolve": a package whose main file is missing (a truncated install) or whose exports map does not serve
+ * "." throws at RESOLUTION — measured on node 24 with real packages — and read as absent, which is installed-but-broken
+ * one layer down. The manifest resolves for any installed package; an exports map that declines to serve it
+ * (ERR_PACKAGE_PATH_NOT_EXPORTED) still proves the package directory is there. Only a manifest that cannot be found at
+ * all is absence. (Community's MCP server resolves the same manifest for the compliance matrix.)
+ */
+function isInstalled(resolve) {
+  try { resolve(`${EE_PACKAGE}/package.json`); return true; } catch (err) { return err?.code === 'ERR_PACKAGE_PATH_NOT_EXPORTED'; }
+}
+
+/**
+ * @param {{ importEE?: () => Promise<object>, resolveEE?: (specifier: string) => string }} [opts]
+ * @returns {Promise<{ ee: object|null, loadError: string|null }>}
+ */
+export async function loadEnterprise({ importEE = null, resolveEE = null } = {}) {
+  const resolve = resolveEE ?? (importEE ? null : resolverDeps.resolve);
+  if (resolve && !isInstalled(resolve)) return { ee: null, loadError: null };
+  try {
+    return { ee: await (importEE ?? (() => import(EE_PACKAGE)))(), loadError: null };
+  } catch (err) {
+    return { ee: null, loadError: String(err?.message ?? err) };
+  }
+}

package/utils/executive_report.mjs

@@ -29,7 +29,7 @@
 import { escapeHtml } from './brand.mjs';
 // The two evaluability SENTINELS, imported so the per-row basis is keyed on identity rather
 // than on prose. `scan_delta.mjs` imports nothing from here, so there is no cycle.
-import { SCOPE_NOT_EVALUATED, FRAMEWORK_MOVEMENT_NOT_EVALUATED } from './scan_delta.mjs';
+import { SCOPE_NOT_EVALUATED, FRAMEWORK_MOVEMENT_NOT_EVALUATED, RUN_NAMES, NOT_REQUESTED_RECORD_SINCE_EE, cmpVersion } from './scan_delta.mjs';
 
 /* ------------------------------------------------------------------------------------------
  * egressViolations — deny-by-default. Two levels: every TAG, then EVERY attribute of it
@@ -625,17 +625,50 @@ function describeBrand(v) {
 //
 // ⚠️ KEYED ON THE EXPORTED SENTINELS, NEVER ON PROSE. Matching the limit text would rot the first
 // time somebody copy-edits a sentence, and it would rot SILENTLY in the direction that overstates.
-function deltaBasis(delta) {
+//
+// ⚠️ PER ROW (1.3.0, lane 6 — deltaBasis). The sentence used to be ONE for the whole table, so an analysis agent's or the
+// CVE mapper's row read "host, plugin, scope … present in both runs" although an agent is not a requested plugin and its
+// "plugin" leg was never checked. Now:
+//   - a plugin's row keeps the legs above;
+//   - an agent's row (`producerKind: 'agent'`) names the run that LACKS it — the baseline for a NEW row, this run for a
+//     RESOLVED one — as having recorded no evidence gap from its producer covering the row. TRUE BY CONSTRUCTION: the
+//     delta refuses a row when that run recorded such a gap, and reads it in that run only (a gap explains what a run is
+//     missing, never what it holds), so "either run" would be false;
+//   - where that lacking run predates EE 1.3.0 it could not record an input plugin LEFT OUT of the scan, so the row is
+//     not refused, and the cell says so; a run that records no EE version says that instead — never assumed either way.
+//     Keyed through `cmpVersion`, the delta's one comparator, on the version each run's own record carries.
+function deltaBasis(delta, f = null, bucket = null) {
   const limits = delta.limits ?? [];
   const scopeEvaluated = !limits.includes(SCOPE_NOT_EVALUATED);
   const fwEvaluated = !limits.includes(FRAMEWORK_MOVEMENT_NOT_EVALUATED);
-  const legs = ['host', 'plugin', scopeEvaluated ? 'scope' : null].filter(Boolean).join(', ');
+  const agent = f?.producerKind === 'agent';
+  const legs = ['host', agent ? null : 'plugin', scopeEvaluated ? 'scope' : null].filter(Boolean).join(', ');
   const fw = fwEvaluated ? 'present in both runs' : 'not evaluated';
   // BOTH sides' integrity: the run being REPORTED is as alterable as the one compared against.
   const integrity = `baseline ${delta.baselineIntegrity} · current ${delta.currentIntegrity ?? 'not recorded'}`;
-  return `comparable: ${legs} present in both runs; framework enumeration: ${fw}; ${integrity}`;
+  const lacking = bucket === 'new' ? { name: RUN_NAMES.baseline, ee: delta.baselineEeVersion }
+    : bucket === 'resolved' ? { name: RUN_NAMES.current, ee: delta.currentEeVersion } : null;
+  const producer = !agent ? ''
+    : lacking ? `; producer: ${f.plugin} — ${lacking.name} recorded no evidence gap from it covering this row`
+      : `; producer: ${f.plugin} — the row is in both runs`;
+  let limit = '';
+  if (agent && lacking && lacking.ee !== undefined) {
+    if (lacking.ee === null) {
+      limit = `; limit: ${lacking.name} records no EE version, so whether an input plugin was left out of it is not known`;
+    } else if (cmpVersion(lacking.ee, NOT_REQUESTED_RECORD_SINCE_EE) < 0) {
+      limit = `; limit: ${lacking.name} predates EE ${NOT_REQUESTED_RECORD_SINCE_EE}, so it could not record an input plugin left `
+        + 'out of the scan: an agent row it lacks is not refused';
+    }
+  }
+  return `comparable: ${legs} present in both runs${producer}; framework enumeration: ${fw}; ${integrity}${limit}`;
 }
 
+// What a not-comparable row's direction means, in the words a client reads.
+const NC_DIRECTION_WORDS = Object.freeze({
+  appeared: 'appeared in this run — not counted as NEW',
+  disappeared: 'absent from this run — not counted as RESOLVED',
+});
+
 function deltaRow(bucket, f, basis) {
   // ⚠️ THE REGION RIDES THE RESOURCE CELL (board E1(b)). Until E1 the region reached this table
   // only as a ` [<region>]` suffix that EE's region stamper had written INTO `resource` — which
@@ -674,15 +707,22 @@ ${escapeHtml(delta.refusal.detail)}</p>
   }
 
   const rows = [
-    ...delta.resolved.map((f) => deltaRow('resolved', f, deltaBasis(delta))),
-    ...delta.newFindings.map((f) => deltaRow('new', f, deltaBasis(delta))),
-    ...delta.changed.map((f) => deltaRow('changed', f, `${deltaBasis(delta)}; severity ${escapeHtml(String(f.from))} → ${escapeHtml(String(f.to))}`)),
+    // A UDP row carries WHY its port counts as measured (1.1.1 — `basisNote`, e.g. "53/udp answered in the other run
+    // (dns open · dnsmasq 2.79)"), so a resolved UDP row shows its work on the row, never in a footer.
+    ...delta.resolved.map((f) => deltaRow('resolved', f, `${deltaBasis(delta, f, 'resolved')}${f.basisNote ? `; ${f.basisNote}` : ''}`)),
+    ...delta.newFindings.map((f) => deltaRow('new', f, `${deltaBasis(delta, f, 'new')}${f.basisNote ? `; ${f.basisNote}` : ''}`)),
+    ...delta.changed.map((f) => deltaRow('changed', f, `${deltaBasis(delta, f, 'changed')}; severity ${escapeHtml(String(f.from))} → ${escapeHtml(String(f.to))}`)),
     // The reason rides the row, not a legend.
     // ⚠️ THE CODE IS PRINTED VERBATIM, AND THAT IS THE DESIGN. A render-time label map was tried
     // here and reverted: it moved this seam and left the terminal's, so one outcome carried two
     // names. The noun that made a code wrong in front of a human was removed from the CODE
     // instead, which fixes every seam at once. See `NOT_COMPARABLE_REASONS` in scan_delta.mjs.
-    ...delta.notComparable.map((f) => deltaRow('not-comparable', f, `${f.reason}: ${f.detail}`)),
+    // ⚠️ THE DIRECTION RIDES THE ROW (1.1.1, the audit seat's fold). Every detail sentence is direction-neutral by
+    // construction ("open in the run that HOLDS this finding"), so without this a client could not tell a finding that
+    // APPEARED — a new-exposure candidate the run could not confirm — from one that VANISHED. The terminal view has
+    // always printed it; this page had not.
+    ...delta.notComparable.map((f) => deltaRow('not-comparable', f,
+      `${NC_DIRECTION_WORDS[f.direction] ?? 'direction not recorded'}; ${f.reason}: ${f.detail}`)),
   ].join('\n');
 
   const counts = `${delta.newFindings.length} new · ${delta.resolved.length} resolved · `

package/utils/export_csv.mjs

@@ -1,6 +1,8 @@
 // utils/export_csv.mjs
 // Export scan results as CSV.
 
+import { csvTokens, PAYLOAD_KEYS } from './service_flags.mjs';
+
 /**
  * Escape a CSV field value.
  * - Wrap in double quotes if contains comma, newline, or double quote
@@ -24,30 +26,13 @@ export function escapeCsvField(value) {
 const COLUMNS = ['host', 'port', 'protocol', 'service', 'program', 'version', 'status', 'cpe', 'security_findings'];
 
 /**
- * Build a security_findings string from a service record.
- * @param {object} svc
+ * The security_findings cell for a record: the shared service-flag table's tokens (utils/service_flags.mjs, 1.3.0 (s1)),
+ * one per key that fired with its items joined by ';'. A custom SNMP community is never a finding and never printed.
+ * @param {object} record
  * @returns {string}
  */
-function buildFindings(svc) {
-  const parts = [];
-
-  if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length) {
-    parts.push(`weak_algorithms:${svc.weakAlgorithms.length}`);
-  }
-  if (svc.anonymousLogin) {
-    parts.push('anonymous_login');
-  }
-  if (svc.axfrAllowed) {
-    parts.push('axfr_allowed');
-  }
-  if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length) {
-    parts.push(`dangerous_methods:${svc.dangerousMethods.join(';')}`);
-  }
-  if (svc.community) {
-    parts.push(`default_community:${svc.community}`);
-  }
-
-  return parts.join(',');
+function buildFindings(record) {
+  return csvTokens(record).join(',');
 }
 
 /**
@@ -77,6 +62,13 @@ export function buildCsv(scanData) {
     ];
     return fields.map(escapeCsvField).join(',');
   });
+  // An adapter payload that landed in evidence (no port — a domain's DNS posture when no 53/udp service was found) gets
+  // its own row, with no port: its findings must not depend on whether an unrelated port answered.
+  for (const e of conclusion?.result?.evidence ?? []) {
+    if (!PAYLOAD_KEYS.some((k) => e?.[k] != null)) continue;
+    const payload = Object.fromEntries(PAYLOAD_KEYS.filter((k) => e[k] != null).map((k) => [k, e[k]]));
+    rows.push([host, '', '', e.from ?? '', '', '', '', '', buildFindings(payload)].map(escapeCsvField).join(','));
+  }
 
   return [header, ...rows].join('\r\n') + '\r\n';
 }

package/utils/mcp_call_digest.mjs

@@ -0,0 +1,31 @@
+// utils/mcp_call_digest.mjs
+// What binds an MCP tool response to its call_id (1.3.0 (s6)). The server logs a digest of the response BODY — the text
+// the receipt footer is appended to — and `nsauditor-ai mcp verify-call <id> --response <file>` recomputes it from the
+// text the user saved. The digest is never printed: a printed digest would replay together with the id.
+//
+// Canonicalisation is WHITESPACE-INSENSITIVE and WORD-EXACT (ruled): every whitespace run, newlines included, becomes
+// one space and the ends are trimmed. A copy that a client soft-wrapped or re-flowed still verifies; a changed word
+// does not. Stated limits: a RENDERED copy (Markdown turned into bullets and bold) is a different text and refutes —
+// copy the raw tool output; and differences inside code blocks that are whitespace only (indentation) are not seen.
+
+import { createHash } from 'node:crypto';
+
+/** The first line of the footer every tool response carries. */
+export const RECEIPT_MARKER = '── MCP call receipt ──';
+
+/** The response reduced to its words: every whitespace run becomes one space, the ends trimmed. */
+export function canonicalResponse(text) {
+  return String(text ?? '').replace(/\s+/g, ' ').trim();
+}
+
+/** SHA-256 (hex) of the canonical response body. */
+export function responseDigest(body) {
+  return createHash('sha256').update(canonicalResponse(body), 'utf8').digest('hex');
+}
+
+/** The body of a saved response: everything before the receipt footer, which is not part of what the tool produced. */
+export function bodyOf(saved) {
+  const text = String(saved ?? '');
+  const at = text.lastIndexOf(RECEIPT_MARKER);
+  return at < 0 ? text : text.slice(0, at);
+}