nsauditor-ai 0.2.55 → 0.2.57

package/utils/net_validation.mjs

@@ -1,43 +1,93 @@
 // utils/net_validation.mjs
 // Shared IP/host validation utilities for SSRF prevention.
+//
+// 1.3.0 lane 1 A: the classifier was a set of string tests — an exact `addr === '::1'`, mapped
+// IPv4 only in dotted notation, `/^fe80:/` for fe80::/10, IPv4 only as four decimal parts — and the
+// resolver read the FIRST answer only. So `0:0:0:0:0:0:0:1`, `::ffff:7f00:1` (127.0.0.1),
+// `::ffff:a9fe:a9fe` (169.254.169.254), `febf::1`, `0x7f000001` and a name answering
+// [public, 127.0.0.1] all passed. It now classifies on net.BlockList — which compares by address
+// value, so every IPv6 spelling of one address agrees and IPv4 rules also match the IPv4-mapped
+// form — after canonicalising the input, and the resolver checks EVERY answer.
+//
+// Stated limit: NAT64 (64:ff9b::/96) addresses that embed a blocked IPv4 are not classified.
 
 import dns from 'node:dns/promises';
+import net from 'node:net';
+
+// Refused in every configuration, NSA_ALLOW_ALL_HOSTS included: loopback, unspecified,
+// link-local and the cloud metadata endpoints.
+const ALWAYS = new net.BlockList();
+ALWAYS.addSubnet('127.0.0.0', 8, 'ipv4');          // loopback
+ALWAYS.addSubnet('0.0.0.0', 8, 'ipv4');            // "this network" / unspecified
+ALWAYS.addSubnet('169.254.0.0', 16, 'ipv4');       // link-local, incl. 169.254.169.254 (AWS/GCP/Azure metadata)
+ALWAYS.addAddress('100.100.100.200', 'ipv4');      // Alibaba Cloud metadata (inside 100.64/10)
+ALWAYS.addAddress('::1', 'ipv6');                  // loopback
+ALWAYS.addAddress('::', 'ipv6');                   // unspecified
+ALWAYS.addSubnet('::', 96, 'ipv6');                // IPv4-compatible (::a.b.c.d), deprecated — BlockList misses ::127.0.0.1 without it
+ALWAYS.addSubnet('fe80::', 10, 'ipv6');            // link-local, the whole /10
+ALWAYS.addAddress('fd00:ec2::254', 'ipv6');        // AWS IMDS over IPv6 (inside fc00::/7)
+
+// Refused unless the operator allows all hosts: private and shared address space.
+const PRIVATE = new net.BlockList();
+PRIVATE.addSubnet('10.0.0.0', 8, 'ipv4');          // RFC 1918
+PRIVATE.addSubnet('172.16.0.0', 12, 'ipv4');       // RFC 1918
+PRIVATE.addSubnet('192.168.0.0', 16, 'ipv4');      // RFC 1918
+PRIVATE.addSubnet('100.64.0.0', 10, 'ipv4');       // RFC 6598 CGNAT
+PRIVATE.addSubnet('fc00::', 7, 'ipv6');            // unique local
+
+/**
+ * Canonical IP literal for `input`, or null when it is not an IP literal (a name).
+ * Strips brackets and an IPv6 zone id, then accepts what net.isIP accepts; anything else is run
+ * through the WHATWG URL parser — but only when it is shaped like a legacy IPv4 spelling (digits,
+ * hex, x, dots) — which reads those spellings (0x7f000001, 0177.0.0.1, 2130706433, 127.1) as the
+ * dotted quad an OS resolver would.
+ * @param {string} input
+ * @returns {string|null}
+ */
+export function canonicalIp(input) {
+  const s = String(input ?? '').trim().replace(/^\[|\]$/g, '').replace(/%.*$/, '');
+  if (!s) return null;
+  if (net.isIP(s)) return s;
+  // Only a legacy-IPv4-SHAPED string may reach the URL parser. Fed anything else it reads
+  // userinfo, a port or a path: '127.0.0.1@8.8.8.8' parses to host 8.8.8.8 and '126.0.0.0/7' to
+  // host 126.0.0.0 — a public literal and a public network whose /7 spans 127/8. Those are NAMES
+  // here, routed to resolution, which refuses them.
+  if (!/^[0-9a-fx.]+$/i.test(s)) return null;
+  try {
+    const host = new URL(`http://${s}`).hostname.replace(/^\[|\]$/g, '');
+    return net.isIP(host) ? host : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * How the SSRF guards treat an address.
+ *   'always'  — refused in every configuration (loopback, unspecified, link-local, metadata)
+ *   'private' — refused unless the operator allows all hosts (RFC 1918, CGNAT, unique local)
+ *   null      — a public address, or not an IP literal at all (a name: resolve it, then classify
+ *               every answer)
+ * @param {string} ip
+ * @returns {'always'|'private'|null}
+ */
+export function classifyAddress(ip) {
+  const addr = canonicalIp(ip);
+  if (!addr) return null;
+  const type = net.isIP(addr) === 6 ? 'ipv6' : 'ipv4';
+  if (ALWAYS.check(addr, type)) return 'always';
+  if (PRIVATE.check(addr, type)) return 'private';
+  return null;
+}
 
 /**
  * Check whether an IP address belongs to a blocked (internal/private) range.
- * Covers loopback, RFC 1918, RFC 6598, link-local, unspecified, and IPv6 equivalents.
+ * Covers loopback, RFC 1918, RFC 6598, link-local, unspecified, metadata and their IPv6 and
+ * IPv4-mapped equivalents, in any spelling.
  * @param {string} ip
  * @returns {boolean}
  */
 export function isBlockedIp(ip) {
-  const addr = ip.replace(/^\[|\]$/g, '').trim();
-
-  // IPv6-mapped IPv4 — extract the IPv4 part and check it
-  const mappedMatch = addr.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
-  if (mappedMatch) return isBlockedIp(mappedMatch[1]);
-
-  // IPv6 blocked addresses
-  if (addr === '::1' || addr === '::') return true;
-  if (/^fe80:/i.test(addr)) return true;                     // link-local (fe80::/10)
-  if (/^f[cd]/i.test(addr.slice(0, 2))) return true;        // fc00::/7 unique local (fc__ and fd__)
-  // IPv4-compatible loopback: ::127.0.0.1 maps to 127.0.0.1/8
-  const compatMatch = addr.match(/^::(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
-  if (compatMatch) return isBlockedIp(compatMatch[1]);
-
-  // IPv4 checks
-  const parts = addr.split('.');
-  if (parts.length === 4 && parts.every((p) => /^\d{1,3}$/.test(p))) {
-    const [a, b] = parts.map(Number);
-    if (a === 127) return true;                          // 127.0.0.0/8  (loopback)
-    if (a === 10) return true;                           // 10.0.0.0/8   (RFC 1918)
-    if (a === 172 && b >= 16 && b <= 31) return true;    // 172.16.0.0/12 (RFC 1918)
-    if (a === 192 && b === 168) return true;             // 192.168.0.0/16 (RFC 1918)
-    if (a === 100 && b >= 64 && b <= 127) return true;   // 100.64.0.0/10 (RFC 6598 CGNAT)
-    if (a === 169 && b === 254) return true;             // 169.254.0.0/16 (link-local)
-    if (a === 0) return true;                            // 0.0.0.0/8
-  }
-
-  return false;
+  return classifyAddress(ip) !== null;
 }
 
 /**
@@ -52,15 +102,35 @@ export function isPrivateLike(ip) {
 }
 
 /**
- * Resolve a hostname and verify the resolved IP is not in a blocked range.
+ * Whether the operator has lifted the private-range check (NSA_ALLOW_ALL_HOSTS). Only an explicit
+ * truthy word lifts it — "0", "false", "no", "off" and "" do NOT (before 1.3.0 any non-empty value
+ * did, so "=0" and "=false" silently lifted the guard). Same convention as host_up_check.mjs.
+ * @param {Record<string,string|undefined>} [env]
+ * @returns {boolean}
+ */
+export function allowAllHosts(env = process.env) {
+  return /^(1|true|yes|on)$/i.test(String(env.NSA_ALLOW_ALL_HOSTS ?? '').trim());
+}
+
+/**
+ * Resolve a hostname and verify that NO resolved address is in a blocked range — a name whose
+ * answers include a single blocked address is refused, because a connecting client may try every
+ * answer (Node's net.connect does, with autoSelectFamily).
  * @param {string} hostname
- * @returns {Promise<string>} resolved IP address
- * @throws {Error} if hostname resolves to a blocked IP or DNS fails
+ * @param {{ allowPrivate?: boolean }} [opts] allowPrivate: admit 'private' answers (the operator's
+ *   allow-all); 'always' answers — loopback, link-local, metadata — are refused regardless
+ * @returns {Promise<string>} the first resolved address (every answer having passed)
+ * @throws {Error} if any answer is in a blocked range, or DNS fails
  */
-export async function resolveAndValidate(hostname) {
-  const { address } = await dns.lookup(hostname);
-  if (isBlockedIp(address)) {
-    throw new Error(`Host resolves to blocked IP range`);
+export async function resolveAndValidate(hostname, { allowPrivate = false } = {}) {
+  const answers = await dns.lookup(hostname, { all: true, verbatim: true });
+  const list = Array.isArray(answers) ? answers : [answers];
+  if (list.length === 0) throw new Error(`Host did not resolve`);
+  for (const { address } of list) {
+    const cls = classifyAddress(address);
+    if (cls === 'always' || (cls === 'private' && !allowPrivate)) {
+      throw new Error(`Host resolves to blocked IP range`);
+    }
   }
-  return address;
+  return list[0].address;
 }

package/utils/output_dir.mjs

@@ -12,6 +12,7 @@
 //     can't recur in a new format writer (Task N.17).
 //   - `OPENAI_OUT_PATH` is honored as a legacy fallback.
 
+import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { toCleanPath } from './path_helpers.mjs';
 
@@ -57,3 +58,72 @@ export function resolveBaseOutDir() {
 }
 
 // (toCleanPath moved to utils/path_helpers.mjs in v0.1.20 — no _internals export needed.)
+
+// A per-host directory's timestamp: YYYYMMDD_HHMMSS in LOCAL time, second granularity. Moved here from cli.mjs
+// unchanged, beside the helper that uses it, so the directory name has ONE definition.
+export function nowStamp(d = new Date()) {
+  const pad = (n) => String(n).padStart(2, '0');
+  return (
+    d.getFullYear().toString() +
+    pad(d.getMonth() + 1) +
+    pad(d.getDate()) + '_' +
+    pad(d.getHours()) +
+    pad(d.getMinutes()) +
+    pad(d.getSeconds())
+  );
+}
+
+// The host as a directory-name component. Moved here from cli.mjs unchanged — the per-host report filenames
+// (`scan_<host>.sarif.json` / `.csv` / `.md`) use it too, so both import it from here.
+export const safeHost = (h) => String(h ?? 'unknown').replace(/[\/\\?%*:|"<>]/g, '_');
+
+/**
+ * Create a FRESH per-host output directory and return its path.
+ *
+ * ⚠️ AN EXCLUSIVE CREATE, NEVER `recursive: true` ON THE LEAF (1.1.1 board — Gate 3-B on build 12). The name is
+ * `${safeHost(host)}_${nowStamp()}`, second-granular, so two scans of one host reaching this line in the same
+ * second computed the SAME name, and a recursive mkdir said yes to both: measured, three localhost scans wrote TWO
+ * directories and run 2's `scan_conclusion_raw.json` was overwritten by run 3's, exit 0, no warning. It is worse when
+ * the later run's finding queue is EMPTY — Enterprise writes `scan_finding_queue.json` only when there is something
+ * to write, so the earlier run's queue stayed in the shared directory and the later run's seal covered it as its own.
+ * The same second is reachable three ways: back-to-back runs, one run naming a host twice (`--host X,X`), and the
+ * repeated hour when daylight saving ends (the stamp is local time).
+ *
+ * So the leaf is created with `recursive: false`, which fails with EEXIST instead of reusing a directory, and a
+ * collision takes the next free suffix (`_2`, `_3`, …) — a COUNTER, not the run id: the run id is shared by every
+ * host of one run (so it cannot separate `--host X,X`) and is unset in watch mode. A WARNING naming both directories
+ * goes to STDOUT, where a scan's own progress lines go.
+ *
+ * ⚠️ When the seconds differ nothing changes: the name is byte-identical to the one this code has always written,
+ * because every reader, every run record's `hostsWritten[].dir` and every manifest keys on it.
+ *
+ * @param {string} baseOutDir   created if absent (recursively — the BASE may already exist; the leaf may not)
+ * @param {string} host
+ * @param {{ stamp?: () => string, log?: (line: string) => void, max?: number }} [opts]
+ *        `stamp` and `log` are seams; every real invocation takes the defaults.
+ * @returns {Promise<string>} the directory created
+ */
+export async function createHostOutDir(baseOutDir, host, { stamp = nowStamp, log = console.log, max = 100 } = {}) {
+  await fsp.mkdir(baseOutDir, { recursive: true });
+  // The stamp is taken ONCE: a suffix always belongs to the second it collided with.
+  const first = `${safeHost(host)}_${stamp()}`;
+  for (let n = 1; n <= max; n += 1) {
+    const dir = path.join(baseOutDir, n === 1 ? first : `${first}_${n}`);
+    try {
+      await fsp.mkdir(dir, { recursive: false });
+    } catch (e) {
+      if (e?.code === 'EEXIST') continue;
+      throw e;
+    }
+    if (n > 1) {
+      // v77-8 (1.3.0): the directory is stamped after the plugin runs, so the collision is two runs that FINISHED in the same
+      // second — they may have started minutes apart (README: "whose plugin runs finished in the same second").
+      log(`[scan] WARNING: ${path.join(baseOutDir, first)} already exists — another scan of ${host} finished its plugin runs in `
+        + `the same second — so this scan writes to ${dir} instead. Neither run's evidence overwrites the other's.`);
+    }
+    return dir;
+  }
+  // ⚠️ NEVER fall back to reusing an existing directory: that is the overwrite this function exists to prevent.
+  throw new Error(`could not create a fresh output directory for ${host} under ${baseOutDir}: `
+    + `${first} and ${max - 1} suffixed names already exist`);
+}

package/utils/plugin_discovery.mjs

@@ -33,9 +33,11 @@ async function loadPluginsFromDir(dir, source) {
       const mod = await import(join(dir, file));
       const plugin = mod.default;
       if (plugin?.id && plugin?.name && typeof plugin?.run === 'function') {
-        // Attach conclude from named export or plugin default
+        // Attach conclude (and its authoritativePorts) from the named export or the plugin default
         const conclude = mod.conclude ?? plugin.conclude;
-        plugins.push({ ...plugin, _source: source, ...(conclude ? { conclude } : {}) });
+        const authoritativePorts = mod.authoritativePorts ?? plugin.authoritativePorts;
+        plugins.push({ ...plugin, _source: source, ...(conclude ? { conclude } : {}),
+          ...(authoritativePorts ? { authoritativePorts } : {}) });
       }
     } catch (e) {
       if (process.env.NSA_VERBOSE) {

package/utils/ports_spec.mjs

@@ -0,0 +1,46 @@
+// utils/ports_spec.mjs
+// The --ports grammar, in one place (1.3.0 lane 4, item 12): the port scanner and the webapp detector both read it, so a
+// form one accepts the other accepts too. Moved here from plugins/port_scanner.mjs, which re-exports parsePortsSpec.
+
+export function uniqInts(arr = []) {
+  return [...new Set((arr || []).map((x) => Number(x)).filter(Number.isFinite))];
+}
+
+/**
+ * Parse a CLI-style ports spec string into TCP/UDP port arrays.
+ *
+ * Accepted formats (entries comma-separated, whitespace tolerated):
+ *   "8090"                   → { tcp: [8090],          udp: [] }
+ *   "8090,9090"              → { tcp: [8090, 9090],    udp: [] }
+ *   "8090/tcp"               → { tcp: [8090],          udp: [] }
+ *   "8090/udp"               → { tcp: [],              udp: [8090] }
+ *   "8090,9090/udp"          → { tcp: [8090],          udp: [9090] }
+ *   "8090/tcp,9090/udp"      → { tcp: [8090],          udp: [9090] }
+ *
+ * Default protocol when not specified: TCP.
+ *
+ * Malformed entries (non-numeric, out-of-range 1–65535, empty, unknown
+ * protocol suffix) are silently skipped — defensive for sloppy CLI input.
+ *
+ * @param {string} spec
+ * @returns {{ tcp: number[], udp: number[] }}
+ */
+export function parsePortsSpec(spec) {
+  const out = { tcp: [], udp: [] };
+  if (typeof spec !== 'string') return out;
+  const entries = spec.split(',').map(s => s.trim()).filter(Boolean);
+  for (const entry of entries) {
+    // Reject entries with more than one '/' separator (e.g. "8090/tcp/extra")
+    const parts = entry.split('/');
+    if (parts.length > 2) continue;
+    const portStr = parts[0];
+    const proto   = (parts[1] || 'tcp').toLowerCase();
+    if (proto !== 'tcp' && proto !== 'udp') continue;
+    const port = Number(portStr);
+    if (!Number.isInteger(port) || port < 1 || port > 65535) continue;
+    out[proto].push(port);
+  }
+  out.tcp = uniqInts(out.tcp);
+  out.udp = uniqInts(out.udp);
+  return out;
+}

package/utils/report_inputs.mjs

@@ -25,6 +25,7 @@ import {
 } from './run_record.mjs';
 import { CE_RETENTION_MS } from './scan_history.mjs';
 import { canonicalHost } from './cloud_providers.mjs';
+import { isUdpTransport, TRANSPORT_OF_LABEL } from './scan_delta.mjs';
 
 const refuse = (reason, message) => ({ ok: false, reason, message });
 
@@ -213,6 +214,12 @@ export function shapeFinding(host, f, plugin = null, pluginName = null) {
     // FIELD and never a suffix: a suffix is a value change that fabricates churn across an
     // upgrade, a field is recomputed identically on both sides of any comparison.
     region,
+    // ⚠️ NO TRANSPORT ON THE PLUGIN PATH (1.1.1), and deliberately null rather than read from `details.protocol`:
+    // there it is a cloud RULE's protocol (an SG / NSG ingress rule, 1170 · 1221), not the transport of a service
+    // finding, and no shipped plugin emits a service finding over UDP (the UDP probes write `data[]` and the
+    // concluder's services, never `result.findings`). So the delta's UDP rule does not reach a plugin row — the
+    // declared limit, pinned in tests/scan_delta_udp_port_not_measured.test.mjs.
+    protocol: null,
     // ⚠️ AN EVIDENCE GAP IS SCOPE, NOT A FINDING, and the delta cannot tell them apart without
     // this. A gap record says "the scanner could not read this surface" — so a finding that
     // vanished behind one was not fixed, nobody looked. It is carried on the finding rather than
@@ -294,6 +301,10 @@ function shapeQueueEntry(host, q) {
   return {
     host,
     port: q?.port ?? q?.target?.port ?? null,
+    // THE PRODUCER'S PROTOCOL LABEL (1.1.1), verbatim — `udp`, `upnp`, `llmnr`, `mdns`, `https`, … It is an
+    // application label, not a transport; the delta's `isUdpTransport` decides which labels are UDP. Before this the
+    // loader dropped it, so a vanished 161/udp row was judged by the TCP port rule and read RESOLVED.
+    protocol: typeof q?.target?.protocol === 'string' ? q.target.protocol : null,
     severity: q?.severity != null ? String(q.severity).toUpperCase() : 'INFO',
     title: q?.title ?? null,
     detail: q?.description ?? q?.detail ?? null,
@@ -503,6 +514,55 @@ export function portScanOf(raw) {
   return { tcpOpen: ports(res.tcpOpen), tcpClosed: ports(res.tcpClosed) };
 }
 
+// What the run recorded about each UDP port (1.1.1) — the delta's UDP oracle. Read from the concluder's service set,
+// the SAME set the queue producers (the analysis agents and the intelligence engine) are pure over, so whether a UDP
+// row's absence is a measurement depends on what this set says about its port: see `udpPortMeasurement` in
+// scan_delta.mjs, which both the delta and Enterprise's MTTR call. Only UDP-transport labels (a `53/tcp` record never
+// stands in for `53/udp`), port > 0. Measured over 27 real router raws the UDP statuses are `open` / `no response` /
+// `unknown` — never `closed`, which the concluder writes only from ECONNREFUSED (an ICMP port-unreachable, a real
+// negative). Null when the raw carries no service set: no oracle, never "nothing answered".
+export function udpServicesOf(raw) {
+  const services = raw?.conclusion?.result?.services;
+  if (!Array.isArray(services)) return null;
+  const out = [];
+  for (const s of services) {
+    const port = Number(s?.port);
+    if (!Number.isInteger(port) || port <= 0 || !isUdpTransport(s?.protocol)) continue;
+    out.push({ port, protocol: String(s.protocol).toLowerCase(), service: s?.service ?? null, status: s?.status ?? null,
+      program: s?.program ?? null, version: s?.version ?? null });
+  }
+  return out.sort((a, b) => a.port - b.port);
+}
+
+// Every transport's service identity (1.2.0 build 2) — the oracle for `serviceIdentityAt` in scan_delta.mjs, which the
+// delta and Enterprise's MTTR both call to decide whether a CVE row vanished while the SAME program and version still
+// answered. Read from the concluder's service set, the set the CVE mapper attributes from; port > 0 and a TCP or UDP
+// transport only. Null when the raw carries no service set: no oracle, never "nothing answered".
+export function servicesOf(raw) {
+  const services = raw?.conclusion?.result?.services;
+  if (!Array.isArray(services)) return null;
+  const out = [];
+  for (const s of services) {
+    const port = Number(s?.port);
+    const t = typeof s?.protocol === 'string' ? TRANSPORT_OF_LABEL[s.protocol.toLowerCase()] : null;
+    if (!Number.isInteger(port) || port <= 0 || (t !== 'tcp' && t !== 'udp')) continue;
+    out.push({ port, protocol: String(s.protocol).toLowerCase(), service: s?.service ?? null, status: s?.status ?? null,
+      program: s?.program ?? null, version: s?.version ?? null });
+  }
+  return out.sort((a, b) => a.port - b.port || a.protocol.localeCompare(b.protocol));
+}
+
+// WHETHER ENTERPRISE'S STAGE RAN ON THIS HOST (1.1.1 — the audit seat's T1-c ruling). The scan writes
+// `conclusion.result.eeLoadError` when the installed Enterprise package failed to LOAD (utils/ee_load.mjs) and
+// `conclusion.result.eeEnrichmentError` when its enrichment THREW; either way its analysis agents and CVE mapper produced
+// nothing on the host. Null when neither was recorded — which is also what a Community-only scan reads.
+export function eeStageOf(raw) {
+  const r = raw?.conclusion?.result ?? {};
+  const loadError = typeof r.eeLoadError === 'string' ? r.eeLoadError : null;
+  const enrichmentError = typeof r.eeEnrichmentError === 'string' ? r.eeEnrichmentError : null;
+  return loadError || enrichmentError ? { loadError, enrichmentError } : null;
+}
+
 function shapeHost(host, dir, raw) {
   const envelopes = Array.isArray(raw.results) ? raw.results : [];
   const up = envelopes.some((e) => e?.result?.up === true);
@@ -520,6 +580,9 @@ function shapeHost(host, dir, raw) {
     // destroyed here, before the consumer ever saw it.
     pluginStatusRecorded: Array.isArray(raw.pluginStatus),
     portScan: portScanOf(raw),
+    udpServices: udpServicesOf(raw),
+    services: servicesOf(raw),
+    eeStage: eeStageOf(raw),
   };
 }
 
@@ -537,7 +600,7 @@ function buildModel(rec, hosts, counts) {
     // which utils/host_iterator.mjs de-duplicates). A name-keyed Map is last-write-wins and
     // silently drops every same-named host's own plugin table but the final one's.
     plugins.byHost.push({ host: h.host, dir: h.dir, status: h.pluginStatus,
-      pluginStatusRecorded: h.pluginStatusRecorded, portScan: h.portScan });
+      pluginStatusRecorded: h.pluginStatusRecorded, portScan: h.portScan, udpServices: h.udpServices, services: h.services, eeStage: h.eeStage });
     for (const ps of h.pluginStatus) {
       if (ps?.status === 'ran') plugins.ran += 1;
       else if (ps?.status === 'skipped') plugins.skipped += 1;

package/utils/report_md.mjs

@@ -9,18 +9,25 @@
 // minimal report (header + "no services detected") rather than throwing, so callers
 // don't need to guard before invocation.
 
-const SEVERITIES = ['Critical', 'High', 'Medium', 'Low', 'Info'];
+import { conclusionFindings, conclusionNotTested, manifestNotTested, normalizeSeverity, SERVICE_FLAGS, SEVERITY_ORDER } from './service_flags.mjs';
+
+const SEVERITIES = SEVERITY_ORDER;
 
 /**
  * Escape Markdown special characters that would break table cell rendering.
  * Pipes break tables; backticks break inline code; newlines break row layout.
  */
+// Every Markdown- or HTML-active character is backslash-escaped (CommonMark allows a backslash before any
+// ASCII punctuation), so a value a NETWORK HOST chose — a hostname from mDNS or UPnP, an OS or program from a
+// banner, the summary that embeds them — renders as text: no link, image, autolink, emphasis or raw tag.
+// (1.3.0: it escaped only | and `, and the hostname and OS rows, once reachable, rendered live links,
+// remote images and <img onerror> in any renderer that allows HTML.)
+const MD_ACTIVE = /[\\`*_[\]<>!|~]/g;
 function escapeCell(value) {
   if (value == null) return '';
   return String(value)
-    .replace(/\|/g, '\\|')
-    .replace(/`/g, '\\`')
-    .replace(/[\r\n]+/g, ' ');
+    .replace(/[\r\n]+/g, ' ')
+    .replace(MD_ACTIVE, (c) => `\\${c}`);
 }
 
 /**
@@ -34,114 +41,19 @@ function cell(value) {
 }
 
 /**
- * Extract security findings from per-service fields.
- * Mirrors the per-service finding extraction used by sarif.mjs and export_csv.mjs:
- * findings are derived from service flags (anonymousLogin, weakAlgorithms, cves, etc.),
- * not from a separate findings array on the conclusion (which doesn't exist today).
+ * The security findings a conclusion carries — every one graded by the shared service-flag table
+ * (utils/service_flags.mjs, 1.3.0 (s1)), so this report, SARIF, the CSV and --fail-on count the same units.
+ * `evidence` is the conclusion's evidence list: an adapter payload that landed there (a domain's DNS posture when the
+ * scan found no 53/udp service) is graded too, targeting the host.
  *
  * @param {object[]} services
  * @param {string} host
+ * @param {object[]} [evidence]
  * @returns {Array<{ severity: string, title: string, target: string, evidence: string|null }>}
  */
-function extractFindings(services, host) {
-  const findings = [];
-
-  for (const svc of services) {
-    const target = `${host}:${svc.port}/${svc.protocol || 'tcp'}`;
-
-    if (svc.anonymousLogin === true) {
-      findings.push({
-        severity: 'Critical',
-        title: 'FTP anonymous login enabled',
-        target,
-        evidence: `${svc.service || 'ftp'} on ${target} accepts anonymous authentication.`,
-      });
-    }
-
-    if (svc.axfrAllowed === true) {
-      findings.push({
-        severity: 'Critical',
-        title: 'DNS zone transfer (AXFR) allowed',
-        target,
-        evidence: `Zone transfer permitted on ${target}; entire zone may be enumerated.`,
-      });
-    }
-
-    if (svc.community && (svc.community === 'public' || svc.community === 'private')) {
-      findings.push({
-        severity: 'High',
-        title: `SNMP default community string: ${svc.community}`,
-        target,
-        evidence: `SNMP responds to community "${svc.community}" on ${target}.`,
-      });
-    }
-
-    if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length > 0) {
-      const algos = svc.weakAlgorithms
-        .map((a) => (typeof a === 'string' ? a : a?.algorithm || a?.name || ''))
-        .filter(Boolean);
-      findings.push({
-        severity: 'Medium',
-        title: `Weak algorithm(s) supported: ${algos.join(', ')}`,
-        target,
-        evidence: null,
-      });
-    }
-
-    if (Array.isArray(svc.weakProtocols) && svc.weakProtocols.length > 0) {
-      findings.push({
-        severity: 'Medium',
-        title: `Weak protocol(s) enabled: ${svc.weakProtocols.join(', ')}`,
-        target,
-        evidence: null,
-      });
-    }
-
-    if (Array.isArray(svc.weakCiphers) && svc.weakCiphers.length > 0) {
-      findings.push({
-        severity: 'Medium',
-        title: `Weak cipher(s) supported: ${svc.weakCiphers.length} cipher(s)`,
-        target,
-        evidence: svc.weakCiphers.slice(0, 5).join(', '),
-      });
-    }
-
-    if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length > 0) {
-      findings.push({
-        severity: 'Medium',
-        title: `Dangerous HTTP method(s) allowed: ${svc.dangerousMethods.join(', ')}`,
-        target,
-        evidence: null,
-      });
-    }
-
-    const cves = svc.cves || svc.cve || [];
-    if (Array.isArray(cves)) {
-      for (const cve of cves) {
-        const cveId = typeof cve === 'string' ? cve : (cve?.id || cve?.cveId || '');
-        if (!cveId) continue;
-        const sev = (typeof cve === 'object' && cve?.severity) ? String(cve.severity) : 'High';
-        findings.push({
-          severity: normalizeSeverity(sev),
-          title: `${cveId} — ${svc.program || svc.service || 'service'}${svc.version && svc.version !== 'Unknown' ? ' ' + svc.version : ''}`,
-          target,
-          evidence: `See https://nvd.nist.gov/vuln/detail/${cveId}`,
-        });
-      }
-    }
-  }
-
-  return findings;
-}
-
-function normalizeSeverity(sev) {
-  if (!sev) return 'Info';
-  const s = String(sev).trim().toLowerCase();
-  if (s.startsWith('crit')) return 'Critical';
-  if (s.startsWith('hi'))   return 'High';
-  if (s.startsWith('med'))  return 'Medium';
-  if (s.startsWith('lo'))   return 'Low';
-  return 'Info';
+function extractFindings(services, host, evidence = []) {
+  return conclusionFindings({ services, evidence }, host)
+    .map((f) => ({ severity: f.severity, title: f.title, target: f.target, evidence: f.evidence }));
 }
 
 function severityRank(sev) {
@@ -191,8 +103,9 @@ export function buildMarkdownReport(scanData) {
   const host = scanData.host ?? '(unknown host)';
   const conclusion = scanData.conclusion ?? {};
   const services = conclusion?.result?.services ?? [];
-  const hostInfo = conclusion?.host ?? {};
-  const summaryText = conclusion?.summary ?? '';
+  // runConcluder's callers receive {id, name, result: <conclusion>}; a legacy flat shape is still read.
+  const hostInfo = conclusion?.result?.host ?? conclusion?.host ?? {};
+  const summaryText = conclusion?.result?.summary ?? conclusion?.summary ?? '';
   const toolVersion = scanData.toolVersion ?? '';
   const scanTime = scanData.scanTime instanceof Date
     ? scanData.scanTime.toISOString()
@@ -224,7 +137,7 @@ export function buildMarkdownReport(scanData) {
   }
   lines.push(`- **Services detected:** ${services.length}`);
 
-  const findings = extractFindings(services, host);
+  const findings = extractFindings(services, host, conclusion?.result?.evidence ?? conclusion?.evidence ?? []);
   if (findings.length > 0) {
     const counts = {};
     for (const sev of SEVERITIES) counts[sev] = 0;
@@ -237,6 +150,28 @@ export function buildMarkdownReport(scanData) {
   } else {
     lines.push(`- **Security findings:** 0`);
   }
+  // 1.3.0 (a4) + (s3): a check that did not run, or ran and could not complete, is said to be NOT TESTED with its reason —
+  // never "none" and never "refused". One line per check and reason, from the shared table, with every target it covers.
+  // Build 4 (Gate 3-A F-1): a host-level audit that did not run — the DNS-security audit (060) declines an IP-address
+  // target — is read from the run's MANIFEST, which both callers hand in; without one nothing is inferred from absence.
+  const notTested = new Map();
+  for (const n of [...conclusionNotTested(conclusion), ...manifestNotTested(scanData.manifest, host)]) {
+    const k = `${n.check}\u0000${n.reason}`;
+    if (!notTested.has(k)) notTested.set(k, { ...n, targets: [] });
+    notTested.get(k).targets.push(n.target);
+  }
+  for (const n of notTested.values()) {
+    lines.push(`- **${n.check} not tested:** ${n.targets.map((t) => escapeCell(t)).join(', ')} — ${escapeCell(n.reason)}`);
+  }
+  // 1.2.0 build 3: without this line "Security findings: 0" read as a clean verdict over a host whose CLI run carried 16
+  // CVEs (the Gate 3-A preparation's P8). Since 1.3.0 (s1) the counted list is DERIVED from the shared service-flag table's
+  // labels, so it names exactly what is graded — it cannot run ahead of the table or fall behind it.
+  const counted = [...new Set(SERVICE_FLAGS.map((r) => r.label).filter(Boolean))];
+  lines.push(`- **Scope:** counts only these service-check findings: ${counted.join(', ')}. `
+    + 'The opt-in checks are off by default. '
+    + 'It does not look up CVEs, and does not include Enterprise analysis-agent findings or exploit intelligence (a CLI scan '
+    + 'with the Enterprise package and a Pro or Enterprise licence records CVE and agent findings in scan_finding_queue.json, '
+    + 'when there are any).');
   lines.push('');
 
   // ---- Services table ----
@@ -267,12 +202,16 @@ export function buildMarkdownReport(scanData) {
   lines.push(`## Findings`);
   lines.push('');
   if (findings.length === 0) {
-    lines.push('_No security findings._');
+    lines.push('_None of the counted service checks found anything. This is not a statement that the host has no known '
+      + 'vulnerabilities — CVE lookups and analysis-agent findings are not part of this count (see Scope above), and '
+      + 'anonymous FTP login, zone transfer and the SMB null session are tested only when enabled._');
     lines.push('');
   } else {
     findings.sort((a, b) => severityRank(a.severity) - severityRank(b.severity));
     for (const f of findings) {
-      lines.push(`### [${f.severity}] ${f.title}`);
+      // The title is escaped as a WHOLE: a CVE title interpolates the service's program and version, which a host
+      // chooses (the HTTP probe's program is the raw Server header).
+      lines.push(`### [${f.severity}] ${escapeCell(f.title)}`);
       lines.push('');
       lines.push(`- **Target:** ${escapeCell(f.target)}`);
       if (f.evidence) {