nsauditor-ai 0.2.56 → 0.2.57

package/cli.mjs

@@ -17,15 +17,17 @@ import { parseHostArg, parseHostFile } from './utils/host_iterator.mjs';
 import { buildSarifLog } from './utils/sarif.mjs';
 import { buildCsv } from './utils/export_csv.mjs';
 import { buildMarkdownReport } from './utils/report_md.mjs';
-import { recordScan, getLastScan, computeDiff, formatDiffReport, pruneForCE, HISTORY_FILE } from './utils/scan_history.mjs';
+import { conclusionFindings, maxRank, severityRank as flagSeverityRank, OPEN_SERVICE_SEVERITY } from './utils/service_flags.mjs';
+import { recordScan, getLastScan, computeDiff, formatDiffReport, pruneForCE, HISTORY_FILE, historyServiceEntry, historyHostEntry } from './utils/scan_history.mjs';
 import { aiBailMessage, computeAiTimeoutMs, aiFailureStubText, aiSummaryLine } from './utils/ai_stage.mjs';
 import { getTierFromEnv, loadLicense } from './utils/license.mjs';
 import { resolveCapabilities, hasCapability, inferRequiredTier, CAPABILITIES } from './utils/capabilities.mjs';
 import { createScheduler } from './utils/scheduler.mjs';
-import { buildDeltaReport, formatDeltaSummary, hasSignificantChanges } from './utils/delta_reporter.mjs';
+import { watchCycle } from './utils/watch_cycle.mjs';
+import { redactSetCookieLines } from './utils/cookie_redaction.mjs';
 import { sendWebhook, buildAlertPayload, isSafeWebhookUrl } from './utils/webhook.mjs';
 import { scrubByKey } from './utils/redact.mjs';
-import { isBlockedIp, resolveAndValidate } from './utils/net_validation.mjs';
+import { isBlockedIp, resolveAndValidate, allowAllHosts, canonicalIp } from './utils/net_validation.mjs';
 import { getAllTechniques } from './utils/attack_map.mjs';
 import { TOOL_VERSION } from './utils/tool_version.mjs';
 import { resolveBaseOutDir, createHostOutDir, safeHost } from './utils/output_dir.mjs';
@@ -105,6 +107,9 @@ export function redactSensitiveForAI(input, targetHost) {
     s = s.replace(/\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\b/gi, '[IPv6]');
     // The shared rule; this call site's POLICY keeps private addresses and masks public ones.
     s = scrubIPv4KeepingProductIds(s, (ip) => (isPrivateV4(ip) ? ip : '[IP]'));
+    // A scanned service's Set-Cookie VALUE is its session token: redacted here whatever a producer kept (1.3.0, both
+    // seams ruled — the webapp detector still reflects its headers into the result).
+    s = redactSetCookieLines(s);
     return s;
   };
 
@@ -718,6 +723,8 @@ export async function parseArgs(argv) {
   }
   const alertSev = get('alert-severity') || get('alert_severity') || null;
   args.alertSeverity = (alertSev && alertSev !== true) ? alertSev.toLowerCase() : 'high';
+  // R4: by default a watch cycle alerts only hosts whose scan CHANGED; this restores an alert on every cycle.
+  args.alertEveryCycle = !!(get('alert-every-cycle') || get('alert_every_cycle'));
 
   // Compliance: framework selector + scope file. Forwarded to EE's
   // runCompliancePhase via enrichScan(). No-op without an EE Enterprise license.
@@ -879,25 +886,37 @@ export function scanTargetRefusal({ cmd, host, hostFile } = {}) {
 // rather than per scanSingleHost() call (reviewer L1 fold).
 const CLOUD_SENTINEL_HOSTS = new Set(['aws', 'gcp', 'azure']);
 
-async function scanSingleHost(pm, host, plugins, opts, promptMode) {
-  // SSRF guard — block loopback, private ranges, cloud metadata endpoints.
-  // Set NSA_ALLOW_ALL_HOSTS=1 to scan RFC 1918 / private ranges (local network auditing).
-  // Cloud-sentinel hosts (see CLOUD_SENTINEL_HOSTS above) skip the guard.
+/**
+ * The CLI's scan-target SSRF guard (exported so tests drive the REAL code — 1.3.0 lane 1 E).
+ * Cloud sentinels (aws/gcp/azure) skip it. NSA_ALLOW_ALL_HOSTS (1/true/yes/on only) lifts the WHOLE
+ * guard on the CLI, loopback and metadata included — documented, and the local-network smoke tests
+ * scan loopback that way. Otherwise a literal is classified by value in any spelling, and anything
+ * that is not a literal is resolved with EVERY answer checked. Before 1.3.0 a digits-and-dots string
+ * skipped resolution (/^[\\d.:[\\]]+$/), so '6425673729' — which the OS reads as 127.0.0.1 — was
+ * scanned unchecked.
+ * @param {string} host
+ * @param {Record<string,string|undefined>} [env]
+ */
+export async function assertScanTargetAllowed(host, env = process.env) {
   const isCloudSentinel = typeof host === 'string' && CLOUD_SENTINEL_HOSTS.has(host.toLowerCase());
-
-  if (!process.env.NSA_ALLOW_ALL_HOSTS && !isCloudSentinel) {
-    if (isBlockedIp(host)) {
-      throw new Error(`Scanning blocked address range is not allowed: ${host}`);
-    }
-    // Hostname (not literal IP) — resolve and validate the resolved address
-    if (!/^[\d.:[\]]+$/.test(host)) {
-      try {
-        await resolveAndValidate(host);
-      } catch (err) {
-        throw new Error(`Host rejected by SSRF guard: ${err.message}`);
-      }
+  if (isCloudSentinel || allowAllHosts(env)) return;
+  if (isBlockedIp(host)) {
+    throw new Error(`Scanning blocked address range is not allowed: ${host}`);
+  }
+  if (!canonicalIp(host)) {
+    try {
+      await resolveAndValidate(host);
+    } catch (err) {
+      throw new Error(`Host rejected by SSRF guard: ${err.message}`);
     }
   }
+}
+
+export async function scanSingleHost(pm, host, plugins, opts, promptMode) {
+  // SSRF guard — block loopback, private ranges, cloud metadata endpoints.
+  // Set NSA_ALLOW_ALL_HOSTS=1 to scan RFC 1918 / private ranges (local network auditing).
+  // Cloud-sentinel hosts (see CLOUD_SENTINEL_HOSTS above) skip the guard.
+  await assertScanTargetAllowed(host);
 
   // `manifest` classifies every selected plugin as ran|skipped|timeout|error with a reason.
   // Discarding it is what makes "no findings" ambiguous between a clean estate and one whose
@@ -1034,6 +1053,9 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
 
   // --- Scan history: record & compare ---
   let scanDiff = null;
+  // The per-host summary [ScanHistory] records — also what a --watch cycle compares (1.3.0 items 4 + 11). Null when the
+  // history step failed before building it; the watch delta reads null as NOT COMPARED, never as an empty scan.
+  let scanSummary = null;
   // Whether THIS host actually landed in the run record's `hostsWritten` — distinct from
   // whether the scan itself succeeded. `appendHostWritten` can fail independently (a
   // malformed argument, a disk fault) while the rest of the scan completes cleanly, and the
@@ -1107,15 +1129,8 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
     }
 
     const services = conclusion?.result?.services ?? [];
-    const serviceFindingsCount = services.reduce((n, svc) => {
-      if (svc.anonymousLogin === true) n++;
-      if (svc.axfrAllowed === true) n++;
-      if (Array.isArray(svc.weakAlgorithms)) n += svc.weakAlgorithms.length;
-      if (Array.isArray(svc.dangerousMethods)) n += svc.dangerousMethods.length;
-      const cves = svc.cves || svc.cve || [];
-      if (Array.isArray(cves)) n += cves.length;
-      return n;
-    }, 0);
+    // The legacy fallback's service share, graded by the shared service-flag table (1.3.0 (s1)) like every other reader.
+    const serviceFindingsCount = conclusionFindings(conclusion, host).length;
     // review fold R-1: cloud plugins emit findings on `results[].result.findings`,
     // NOT as service-level attrs — so a cloud (--host aws) scan recorded
     // findingsCount:0 in scan_history over a 201-finding scan (a false-clean
@@ -1155,7 +1170,7 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
         + 'legacy sum and marking the line as un-based, so no comparison is made across it.');
     }
 
-    const scanSummary = {
+    scanSummary = {
       timestamp: new Date().toISOString(),
       host,
       servicesCount: services.length,
@@ -1171,10 +1186,9 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
       // unreachable in production while its unit tests stay green.
       tier: getTierFromEnv(),
       cloudFindingsCount,
-      services: services.map((s) => ({
-        port: s.port, protocol: s.protocol ?? 'tcp',
-        service: s.service ?? null, version: s.version ?? null,
-      })),
+      services: services.map(historyServiceEntry),
+      // 1.3.0 (s1) B: the basis stamp and the host-level service checks (a domain's DNS posture, wherever it landed).
+      ...historyHostEntry(conclusion),
     };
 
     // Retrieve previous scan for this host before recording the new one
@@ -1201,6 +1215,11 @@ async function scanSingleHost(pm, host, plugins, opts, promptMode) {
     host, results, conclusion, ai_file_paths, ai_conclusion, ai_status, ai_error, scanDiff,
     // Additive, consumed only by main()'s top-level KEV/EPSS aggregation for the run record.
     hostAppended, kevDataAsOf, epssDataAsOf, nvdCache,
+    // Additive (1.3.0 items 4 + 11): what a --watch cycle compares, host by host.
+    scanSummary,
+    // Additive (1.3.0 build 4, Gate 3-A F-1): the plugin manifest, so the Markdown report says an audit that did not run
+    // — 060's decline of an IP address — the same way scan_host's does. The run record already carries it.
+    pluginStatus,
   };
 }
 
@@ -1241,13 +1260,6 @@ function aggregateStoreLoad(writtenOutputs, field, label) {
 
 const SEVERITY_RANK = { critical: 4, high: 3, medium: 2, low: 1, info: 0 };
 
-/**
- * Determine the maximum severity level present in a conclusion's services.
- * Checks security findings (anonymousLogin, axfrAllowed, weakAlgorithms,
- * dangerousMethods, CVEs) as well as open service status.
- * @param {object} conclusion
- * @returns {number} highest severity rank found (0-4)
- */
 async function readSecretFromStdin(keyName) {
   if (!process.stdin.isTTY) {
     // Piped input
@@ -1269,33 +1281,18 @@ async function readSecretFromStdin(keyName) {
   });
 }
 
+/**
+ * The highest severity rank (0-4) among the findings a conclusion carries — the `--fail-on` gate.
+ * @param {object} conclusion
+ * @returns {number} highest severity rank found (0-4); any concluded scan is at least info (0)
+ */
 export function maxSeverityInConclusion(conclusion) {
-  const services = conclusion?.result?.services || [];
-  let max = 0;
-
-  for (const svc of services) {
-    // anonymousLogin or axfrAllowed → Critical
-    if (svc.anonymousLogin === true) max = Math.max(max, SEVERITY_RANK.critical);
-    if (svc.axfrAllowed === true) max = Math.max(max, SEVERITY_RANK.critical);
-
-    // weakAlgorithms or dangerousMethods → Medium
-    if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length > 0) max = Math.max(max, SEVERITY_RANK.medium);
-    if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length > 0) max = Math.max(max, SEVERITY_RANK.medium);
-
-    // CVEs
-    const cves = svc.cves || svc.cve || [];
-    if (Array.isArray(cves)) {
-      for (const cve of cves) {
-        const sev = typeof cve === 'string' ? 'high' : String(cve?.severity || 'high').toLowerCase();
-        max = Math.max(max, SEVERITY_RANK[sev] ?? SEVERITY_RANK.high);
-      }
-    }
-
-    // Open service → Info (baseline)
-    if (svc.status === 'open') max = Math.max(max, SEVERITY_RANK.info);
-  }
-
-  return max;
+  // Every grade comes from the shared service-flag table (utils/service_flags.mjs, 1.3.0 (s1)) — the gate reads what the
+  // Markdown report, SARIF and the CSV read, including a payload that landed in the conclusion's evidence. An open service
+  // is graded OPEN_SERVICE_SEVERITY, the grade SARIF gives it ((s2)); any concluded scan is at least info.
+  const open = (conclusion?.result?.services || []).some((s) => s.status === 'open');
+  return Math.max(SEVERITY_RANK.info, open ? flagSeverityRank(OPEN_SERVICE_SEVERITY) : -1,
+    maxRank(conclusionFindings(conclusion, '')));
 }
 
 /**
@@ -1637,7 +1634,7 @@ export async function runReport(args, caps) {
 
 export async function main(testHooks = {}) {
   const args = await parseArgs(process.argv);
-  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion, approvalArgs, feedArgs } = args;
+  const { cmd, host, plugins, insecureHttps, hostFile, parallel, failOn, outputFormat, watch, intervalMinutes, webhookUrl, alertSeverity, alertEveryCycle, ports, compliance, complianceScope, complianceHistory, slaPolicy, attestWindow, framework, awsRegion, approvalArgs, feedArgs } = args;
 
   // Version: handled before license verification so it works without a key.
   // CE-0.1.30.1 — closes the discovery-flag UX gap where pre-fix
@@ -1681,27 +1678,41 @@ Scan options:
                                a range such as 1-1000 is not parsed and adds nothing)
   --out <dir>                  Output directory for scan artifacts
   --parallel <n>               Parallel host concurrency (default 1)
-  --fail-on <severity>         Exit 1 if a gated flag ≥ severity: anonymous FTP / zone
-                               transfer (critical; tested only with FTP_CHECK_ANON /
-                               DNS_CHECK_AXFR set), weak SSH algorithms (medium); any
-                               concluded scan is info. Dangerous HTTP methods are read
-                               but never reach the conclusion today. Not SNMP community,
-                               weak TLS, MCP checks, CVEs or agent findings — exit 0 is
-                               not a clean host. Exit 2: unknown severity or no conclusion.
+  --fail-on <severity>         Exit 1 if a finding ≥ severity — the findings the md /
+                               SARIF / CSV reports count, graded by one shared table:
+                               SNMP default community, weak SSH / TLS, MCP checks, SMB
+                               null session, self-signed / expired certificates, the
+                               040 / 050 / 060 audits (060: the domain's SPF / DMARC /
+                               NS), and Dangerous HTTP methods (medium) only where an
+                               Allow header was read. Anonymous FTP / zone transfer /
+                               null session only with FTP_CHECK_ANON / DNS_CHECK_AXFR /
+                               SMB_NULL_SESSION set; not tested never trips it; any
+                               concluded scan is info. Not CVEs or agent findings —
+                               exit 0 is not a clean host. Exit 2: unknown severity or
+                               no conclusion.
   --output-format <fmt>        Additional report format: sarif | csv | md
   --insecure-https             Skip TLS validation on probed HTTPS targets
-  --watch                      CTEM continuous ALERTING mode: re-scan on --interval,
-                               compare each host with its previous scan ([ScanHistory]
-                               lines); --webhook-url does NOT fire on a service, version or
-                               finding change in this release. NOT an evidence cadence —
+  --watch                      CTEM continuous ALERTING mode: re-scan on --interval and
+                               compare each host with the previous cycle. --webhook-url
+                               alerts a host whose scan changed (a service, its finding
+                               count or a service check, or a comparison that could not be
+                               made) and that has a finding at or above --alert-severity.
+                               The first cycle sets the baseline and alerts nobody; a host
+                               whose scan failed is reported on stdout and does not alert in
+                               this release. NOT an evidence cadence —
                                it adds no retention or cross-run aggregation, skips SARIF/
                                CSV/Markdown output and --fail-on, and dies with this process.
                                Each tick is an ordinary scan, so with --compliance it writes
                                that tick's artifacts; nothing relates them across ticks. For
                                SOC 2 Type II history use a scheduler (cron/systemd/CI).
+                               Watch mode scans each distinct host once per cycle; a
+                               one-shot --host X,X scans X twice.
   --interval <minutes>         Watch interval (default 60)
   --webhook-url <url>          Send --watch alerts (must be public; private/loopback blocked)
   --alert-severity <sev>       Min severity to alert on (default: high)
+  --alert-every-cycle          Alert every host with a finding at or above --alert-severity
+                               on every --watch cycle, the first included (default: only
+                               hosts whose scan changed)
   --compliance <framework>     Map findings to controls. 'all' = all 8 frameworks, or a CSV of
                                soc2,hipaa,nist-csf,pci-dss,iso-27001,cis-v8,gdpr,nist-800-171
                                (aliases nist/pci/iso/cis, and 800-171 or cmmc for nist-800-171 --
@@ -2690,30 +2701,45 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
         }
       }
     } else if (subCmd === 'verify-call') {
-      // CE 0.1.36 (Thread L Phase 2): cryptographic ground truth for
-      // "did Claude actually call the MCP server, or hallucinate a
-      // response?" Server mints a fresh UUID per tools/call, embeds it
-      // in the response text, AND appends to ~/.nsauditor/mcp-calls.log.
-      // Customer pastes the UUID here; we grep the log. UUID present →
-      // proven real call. UUID absent → fabricated (or log was rotated/
-      // deleted; we say "unverifiable" rather than "fake").
+      // 1.3.0 (s6): BIND THE RESPONSE TEXT, not only the id. The server logs each call's id and a digest of the response
+      // body (utils/mcp_call_digest.mjs); this recomputes the digest from the text the user saved. The id alone proves
+      // only that the server issued it once — an AI client that has seen an earlier response can paste a real id under
+      // a fabricated one — so an id with no text is INDETERMINATE, never "verified".
+      // Exit: 0 verified · 1 refuted (never issued, or the text does not match) · 2 usage · 3 indeterminate.
       const { readFile, stat } = await import('node:fs/promises');
       const { join: _join } = await import('node:path');
       const { homedir: _homedir } = await import('node:os');
+      const { responseDigest, bodyOf } = await import('./utils/mcp_call_digest.mjs');
       const logPath = _join(_homedir(), '.nsauditor', 'mcp-calls.log');
       const uuid = rawArgs[2];
-      if (!uuid) {
-        console.error('Usage: nsauditor-ai mcp verify-call <uuid>');
-        console.error('  Paste the call_id from the MCP tool response footer.');
+      const respAt = rawArgs.indexOf('--response');
+      const respPath = respAt > 0 ? rawArgs[respAt + 1] : null;
+      if (!uuid || (respAt > 0 && !respPath)) {
+        console.error('Usage: nsauditor-ai mcp verify-call <uuid> --response <file|->');
+        console.error('  Save the whole tool response (footer included) to a file, or pipe it in with --response -.');
         process.exit(2);
       }
-      // Conservative UUID v4 shape check — avoid grepping the log with
-      // arbitrary user input.
+      // Conservative UUID v4 shape check — avoid grepping the log with arbitrary user input.
       if (!/^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/.test(uuid)) {
         console.error(`✗ Not a valid UUID: ${uuid}`);
         console.error('  Expected format: xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx');
         process.exit(2);
       }
+      let responseText = null;
+      if (respPath) {
+        try {
+          if (respPath === '-') {
+            const chunks = [];
+            for await (const c of process.stdin) chunks.push(c);
+            responseText = Buffer.concat(chunks).toString('utf8');
+          } else {
+            responseText = await readFile(respPath, 'utf8');
+          }
+        } catch (err) {
+          console.error(`✗ Could not read the response from ${respPath}: ${err.message}`);
+          process.exit(2);
+        }
+      }
       let logExists = false;
       try { await stat(logPath); logExists = true; } catch { /* missing */ }
       if (!logExists) {
@@ -2726,33 +2752,50 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       const raw = await readFile(logPath, 'utf8');
       // Look for an exact JSON-string match on call_id to avoid prefix collisions.
       const needle = `"call_id":"${uuid.toLowerCase()}"`;
-      const lines = raw.split('\n').filter((l) => l.includes(needle));
-      if (lines.length === 0) {
+      const entries = raw.split('\n').filter((l) => l.includes(needle))
+        .map((l) => { try { return JSON.parse(l); } catch { return null; } }).filter(Boolean);
+      if (entries.length === 0) {
         console.log(`✗ call_id not found in ${logPath}`);
         console.log('');
         console.log(`  ${uuid}`);
         console.log('');
         console.log('  This UUID was NOT issued by this MCP server. Most likely cause:');
-        console.log('  Claude Desktop fabricated the response without invoking the server.');
-        console.log('  (See README §"Verifying that Claude actually called the MCP server".)');
+        console.log('  the AI client fabricated the response without invoking the server.');
+        console.log('  (See docs/mcp-verification.md.)');
         process.exit(1);
       }
-      try {
-        const entry = JSON.parse(lines[lines.length - 1]);
-        console.log(`✓ Verified MCP call`);
-        console.log(`  call_id: ${entry.call_id}`);
-        console.log(`  tool:    ${entry.tool}`);
-        console.log(`  ts:      ${entry.ts}`);
-        console.log(`  log:     ${logPath}`);
-        console.log('');
-        console.log('  This UUID was issued by the local MCP server, so the response');
-        console.log('  bearing it was a genuine tool call (not a hallucination).');
-        process.exit(0);
-      } catch {
-        console.log(`✓ Verified MCP call (matched ${lines.length} log line(s) for this UUID)`);
+      const issued = entries.find((e) => e.tool) ?? entries[0];
+      const ago = (() => {
+        const ms = Date.now() - Date.parse(issued.ts ?? '');
+        if (!Number.isFinite(ms)) return 'at an unrecorded time';
+        const units = [['day', 86400000], ['hour', 3600000], ['minute', 60000]];
+        for (const [u, n] of units) if (ms >= n) { const k = Math.floor(ms / n); return `${k} ${u}${k === 1 ? '' : 's'} ago`; }
+        return 'less than a minute ago';
+      })();
+      const issuedLine = `${issued.tool ?? 'an unrecorded tool'}, issued ${ago} (${issued.ts ?? 'no timestamp'})`;
+      const digests = entries.map((e) => e.digest).filter((d) => typeof d === 'string');
+      if (digests.length === 0) {
+        console.log(`? call_id ${uuid} was issued by this server for ${issued.tool ?? 'an unrecorded tool'} ${ago} (${issued.ts ?? 'no timestamp'}).`);
+        console.log('  This call predates response binding: no digest of its response was recorded, so the text');
+        console.log('  cannot be bound to it. The id alone does not verify a response.');
+        process.exit(3);
+      }
+      if (responseText == null) {
+        console.log(`? call_id ${uuid} was issued by this server for ${issued.tool ?? 'an unrecorded tool'} ${ago} (${issued.ts ?? 'no timestamp'}).`);
+        console.log('  That alone does not verify the text you are reading: an id from an earlier response can be');
+        console.log('  pasted under a fabricated one. Save the raw tool response and run:');
+        console.log(`    nsauditor-ai mcp verify-call ${uuid} --response <file>`);
+        process.exit(3);
+      }
+      if (digests.includes(responseDigest(bodyOf(responseText)))) {
+        console.log(`✓ This response text was produced by this server for that call — ${issuedLine}.`);
         console.log(`  log: ${logPath}`);
         process.exit(0);
       }
+      console.log(`✗ The text does not match what this server sent for that call (${issuedLine}).`);
+      console.log('  Either it was altered after copying (rendering, re-wrapping) or it was not produced by this');
+      console.log('  call — re-copy the RAW tool output and verify again.');
+      process.exit(1);
     } else {
       console.log('Usage:');
       console.log('  nsauditor-ai mcp install-key            Generate a new key, persist, print Claude config');
@@ -2761,7 +2804,7 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       console.log('  nsauditor-ai mcp rotate-key             Replace the stored key with a fresh one');
       console.log('  nsauditor-ai mcp status                 Show storage source without revealing the key');
       console.log('  nsauditor-ai mcp tier                   Print actual MCP server tier (ground truth, bypasses Claude AI synthesis)');
-      console.log('  nsauditor-ai mcp verify-call <uuid>     Prove a tool response came from the real MCP server (not Claude hallucination)');
+      console.log('  nsauditor-ai mcp verify-call <uuid> --response <file|->   Check that a saved tool response is the text this server produced for that call');
       console.log('');
       console.log('Environment variables:');
       console.log(`  ${MCP_AUTH_ENV_VAR}        Read by mcp_server.mjs at startup; client supplies via Claude config`);
@@ -3197,9 +3240,6 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
   // --- CTEM: continuous watch mode ---
   if (watch) {
     const intervalMs = intervalMinutes * 60 * 1000;
-    console.log(`[CTEM] Watch mode enabled. Interval: ${intervalMinutes}m, Concurrency: ${parallel}, Hosts: ${hosts.length}`);
-    if (webhookUrl) console.log(`[CTEM] Webhook URL: ${webhookUrl}, Alert severity: ${alertSeverity}`);
-
     let previousCycleResults = null;
 
     const scheduler = createScheduler({
@@ -3216,44 +3256,20 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       onCycleComplete: async (results) => {
         console.log(`[CTEM] Cycle complete. Scanned ${results.size} host(s).`);
 
-        // Build delta report
-        if (previousCycleResults) {
-          const delta = buildDeltaReport(results, previousCycleResults);
-          console.log(formatDeltaSummary(delta));
-
-          // Send webhook alerts for significant changes
-          if (webhookUrl && hasSignificantChanges(delta)) {
-            const sevRank = SEVERITY_RANK[alertSeverity] ?? SEVERITY_RANK.high;
-
-            for (const [h, scanOut] of results) {
-              if (!scanOut?.conclusion) continue;
-              const hostSev = maxSeverityInConclusion(scanOut.conclusion);
-              if (hostSev >= sevRank) {
-                const services = scanOut.conclusion?.result?.services || [];
-                const findings = services.filter((svc) => {
-                  let svcSev = 0;
-                  if (svc.anonymousLogin === true || svc.axfrAllowed === true) svcSev = SEVERITY_RANK.critical;
-                  if (Array.isArray(svc.weakAlgorithms) && svc.weakAlgorithms.length) svcSev = Math.max(svcSev, SEVERITY_RANK.medium);
-                  if (Array.isArray(svc.dangerousMethods) && svc.dangerousMethods.length) svcSev = Math.max(svcSev, SEVERITY_RANK.medium);
-                  const cves = svc.cves || svc.cve || [];
-                  if (Array.isArray(cves) && cves.length) svcSev = Math.max(svcSev, SEVERITY_RANK.high);
-                  return svcSev >= sevRank;
-                });
-
-                if (findings.length > 0) {
-                  const payload = buildAlertPayload(h, findings, alertSeverity);
-                  const webhookResult = await sendWebhook(webhookUrl, payload, { retries: 2, retryDelayMs: 1000 });
-                  if (webhookResult.success) {
-                    console.log(`[CTEM] Webhook alert sent for ${h}`);
-                  } else {
-                    console.warn(`[CTEM] Webhook alert failed for ${h}: ${webhookResult.error}`);
-                  }
-                }
-              }
+        // What stdout says and whom the webhook alerts, both from ONE predicate (utils/watch_cycle.mjs, 1.3.0 items 4 + 11).
+        const { text, alerts } = watchCycle(results, previousCycleResults,
+          { alertRank: SEVERITY_RANK[alertSeverity] ?? SEVERITY_RANK.high, everyCycle: alertEveryCycle });
+        console.log(text ?? '[CTEM] First cycle complete — it establishes the baseline. Delta reporting begins on the next cycle.');
+        if (webhookUrl) {
+          for (const { host: h, findings } of alerts) {
+            const payload = buildAlertPayload(h, findings, alertSeverity);
+            const webhookResult = await sendWebhook(webhookUrl, payload, { retries: 2, retryDelayMs: 1000 });
+            if (webhookResult.success) {
+              console.log(`[CTEM] Webhook alert sent for ${h}`);
+            } else {
+              console.warn(`[CTEM] Webhook alert failed for ${h}: ${webhookResult.error}`);
             }
           }
-        } else {
-          console.log('[CTEM] First cycle complete. Delta reporting will begin on next cycle.');
         }
 
         previousCycleResults = results;
@@ -3270,6 +3286,13 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
     process.on('SIGINT', shutdown);
     process.on('SIGTERM', shutdown);
 
+    // The banner reads the scheduler's own distinct list: a cycle scans each host once (1.3.0 lane 4, item 10).
+    const dropped = scheduler.duplicatesDropped
+      ? ` (${scheduler.duplicatesDropped} duplicate host(s) dropped — watch mode scans each host once per cycle)` : '';
+    console.log(`[CTEM] Watch mode enabled. Interval: ${intervalMinutes}m, Concurrency: ${parallel}, Hosts: ${scheduler.hosts.length}${dropped}`);
+    if (webhookUrl) console.log(`[CTEM] Webhook URL: ${webhookUrl}, Alert severity: ${alertSeverity}, alerting `
+      + (alertEveryCycle ? 'every host with such a finding, every cycle' : 'hosts whose scan changed (the first cycle sets the baseline)'));
+
     scheduler.start();
     return; // keep process alive via setInterval
   }
@@ -3476,6 +3499,7 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
         host: scanOut.host,
         conclusion: scanOut.conclusion,
         toolVersion: TOOL_VERSION,
+        manifest: scanOut.pluginStatus ?? [],
       });
       const mdFileName = scanOutputs.length > 1
         ? `scan_${safeHost(scanOut.host)}.md`