nsauditor-ai 0.2.56 → 0.2.57

package/plugins/upnp_scanner.mjs

@@ -5,7 +5,7 @@
 // Set UPNP_INCLUDE_NON_MATCHED=1 to keep all discovered devices.
 
 import upnp from 'node-upnp-utils';
-import { isPrivateLike } from '../utils/net_validation.mjs';
+import { isPrivateLike, canonicalIp } from '../utils/net_validation.mjs';
 
 const DEBUG = /^(1|true|yes|on)$/i.test(String(process.env.DEBUG_MODE || process.env.UPNP_DEBUG || ""));
 function dlog(...a) { if (DEBUG) console.log("[upnp-scanner]", ...a); }
@@ -54,17 +54,33 @@ export function perTargetMx(waitSec) {
 // its search's result — what fails is the library's own description, which 028 does not depend on: it
 // fetches the description of every device it reports itself. The original is called SYNCHRONOUSLY, so the
 // device is listed exactly when it would have been; only its promise is caught.
+//
+// 1.3.0 lane 2 (R2): the same wrapper also refuses a NOTIFY whose LOCATION names a host other than the
+// device that sent it. The library fetches the LOCATION of every NOTIFY it keeps with NO host check (its
+// M-SEARCH-answer path does check), so any device on the segment could point it at loopback, cloud
+// metadata or a third host. Such a NOTIFY is dropped before the library sees it, and COUNTED
+// (refusedAnnouncements), never silently. The decision is taken on the LIBRARY'S OWN PARSE of the packet
+// (`_parseSdpResponseHeader`, the same start-line test) — a parser of our own disagreed with it on a
+// repeated LOCATION (it keeps the last), a space before the colon and a `NOTIFYX` start line. Should that
+// parser ever be missing, every NOTIFY is refused: the check fails closed.
 const RECEIVE_GUARD = Symbol.for('nsauditor.upnp.receivePacketGuard');
 const DROPPED = Symbol.for('nsauditor.upnp.droppedResponses');
+const REFUSED = Symbol.for('nsauditor.upnp.refusedAnnouncements');
 export function guardReceivePacket(upnp) {
   if (!upnp || typeof upnp._receivePacket !== 'function' || upnp[RECEIVE_GUARD]) return upnp;
   const original = upnp._receivePacket;
   upnp[DROPPED] = {};
+  upnp[REFUSED] = 0;
   const count = (err) => {
     const name = err?.name || 'Error';
     upnp[DROPPED][name] = (upnp[DROPPED][name] ?? 0) + 1;
   };
   upnp._receivePacket = function guardedReceivePacket(...args) {
+    const [buffer, rinfo] = args;
+    if (refuseAnnouncement(upnp, buffer, rinfo)) {
+      upnp[REFUSED] += 1;
+      return Promise.resolve();
+    }
     let p;
     try { p = original.apply(this, args); } catch (err) { count(err); return Promise.resolve(); }
     return Promise.resolve(p).catch(count);
@@ -72,10 +88,44 @@ export function guardReceivePacket(upnp) {
   upnp[RECEIVE_GUARD] = true;
   return upnp;
 }
+/** Whether the library would fetch this packet's LOCATION as a NOTIFY, from a host other than the sender. */
+function refuseAnnouncement(upnp, buffer, rinfo) {
+  const text = Buffer.isBuffer(buffer) ? buffer.toString('utf8') : String(buffer ?? '');
+  if (/^M-SEARCH/.test(text)) return false; // the library ignores these
+  if (typeof upnp._parseSdpResponseHeader !== 'function') return /^NOTIFY/.test(text);
+  let headers;
+  try { headers = upnp._parseSdpResponseHeader(text); } catch { return /^NOTIFY/.test(text); }
+  if (!headers || !headers.USN || !/^NOTIFY/.test(String(headers['$']))) return false;
+  const loc = headers.LOCATION;
+  return loc !== undefined && !descriptionUrlAllowed(loc, rinfo?.address);
+}
+
 /** Library errors caught so far on this instance, by error name. */
 export function droppedResponses(upnp) {
   return { ...(upnp?.[DROPPED] ?? {}) };
 }
+/** NOTIFY announcements refused so far on this instance: their LOCATION named a host other than the sender. */
+export function refusedAnnouncements(upnp) {
+  return upnp?.[REFUSED] ?? 0;
+}
+
+/**
+ * Whether a description URL a UPnP device advertised may be fetched: http or https, on the address of the
+ * device that answered — never another host, a name, or another scheme. The device chooses this URL, not the
+ * operator, so a LOCATION aimed at loopback, cloud metadata or a third host is not followed (1.3.0 lane 2, R2).
+ * @param {string} location the advertised LOCATION
+ * @param {string} answeringAddress the source address of the SSDP answer
+ */
+export function descriptionUrlAllowed(location, answeringAddress) {
+  let url;
+  try { url = new URL(String(location ?? '')); } catch { return false; }
+  if (url.protocol !== 'http:' && url.protocol !== 'https:') return false;
+  const host = canonicalIp(url.hostname);
+  let from = canonicalIp(answeringAddress);
+  if (!host || !from) return false;
+  from = from.replace(/^::ffff:(\d+\.\d+\.\d+\.\d+)$/i, '$1');
+  return host.toLowerCase() === from.toLowerCase();
+}
 const droppedSince = (upnp, before) => {
   const now = droppedResponses(upnp); const out = {};
   for (const [k, v] of Object.entries(now)) if (v - (before[k] ?? 0) > 0) out[k] = v - (before[k] ?? 0);
@@ -197,23 +247,31 @@ function extractDeviceInfo(device, deviceXml) {
   return info;
 }
 
-async function fetchDeviceDescription(location, timeout = 5000) {
+// The description is fetched only from the answering device's own address, with the platform fetch and
+// `redirect: 'manual'` — a device that answers with a redirect is not followed elsewhere. (It used
+// node-fetch, which CE never declared, following up to 20 redirects to any host.)
+export const DESCRIPTION_REFUSED = Symbol('description refused');
+async function fetchDeviceDescription(location, answeringAddress, timeout = 5000) {
   if (!location) return null;
-  
+  if (!descriptionUrlAllowed(location, answeringAddress)) {
+    dlog(`Refused device description URL ${location}: not on the answering device ${answeringAddress}`);
+    return DESCRIPTION_REFUSED;
+  }
+
   try {
-    const { default: fetch } = await import('node-fetch');
     const controller = new AbortController();
     const timeoutId = setTimeout(() => controller.abort(), timeout);
-    
-    const response = await fetch(location, { 
+
+    const response = await fetch(location, {
       signal: controller.signal,
+      redirect: 'manual',
       headers: {
         'User-Agent': 'UPnP-Scanner/1.0'
       }
     });
-    
+
     clearTimeout(timeoutId);
-    
+
     if (response.ok) {
       return await response.text();
     } else {
@@ -280,6 +338,7 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
     upnp = guardReceivePacket(upnpModule);
   }
   const droppedBefore = droppedResponses(upnp);
+  const refusedBefore = refusedAnnouncements(upnp);
 
   const allDevices = [];
   let matched = false;
@@ -326,8 +385,10 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
       
       // Fetch and parse device description if available
       let deviceXml = null;
+      let descriptionRefused = false;
       if (location) {
-        deviceXml = await fetchDeviceDescription(location, 3000);
+        deviceXml = await fetchDeviceDescription(location, address, 3000);
+        if (deviceXml === DESCRIPTION_REFUSED) { deviceXml = null; descriptionRefused = true; }
       }
       
       // Extract detailed device information
@@ -360,6 +421,9 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
       if (location) {
         infoParts.push(`location=${location}`);
       }
+      if (descriptionRefused) {
+        infoParts.push('description refused (LOCATION is not on the answering device)');
+      }
 
       // Enhanced banner with comprehensive data
       const bannerObj = {
@@ -376,7 +440,8 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
         ssdpAnalysis,
         deviceInfo,
         descriptionXML: deviceXml ? deviceXml.substring(0, 2000) : null, // Limit XML size
-        xmlTruncated: deviceXml && deviceXml.length > 2000
+        xmlTruncated: deviceXml && deviceXml.length > 2000,
+        ...(descriptionRefused ? { descriptionRefused: true } : {})
       };
 
       const row = {
@@ -398,11 +463,11 @@ async function runWithUpnp(targetHost, timeoutMs, opts) {
       }
     }
 
-    return { rows, matched, dropped: droppedSince(upnp, droppedBefore) };
+    return { rows, matched, dropped: droppedSince(upnp, droppedBefore), refused: refusedAnnouncements(upnp) - refusedBefore };
     
   } catch (e) {
     dlog("UPnP discovery error:", e?.message || e);
-    return { rows: [], matched: false, dropped: droppedSince(upnp, droppedBefore) };
+    return { rows: [], matched: false, dropped: droppedSince(upnp, droppedBefore), refused: refusedAnnouncements(upnp) - refusedBefore };
   }
 }
 
@@ -448,7 +513,10 @@ export default {
       };
     }
 
-    const { rows, matched, dropped } = await runWithUpnp(host, timeoutMs, opts);
+    const { rows, matched, dropped, refused = 0 } = await runWithUpnp(host, timeoutMs, opts);
+    if (refused > 0) {
+      console.warn(`[upnp-scanner] ${refused} ssdp:alive announcement(s) named a description URL on a host other than the announcing device and were dropped before the UPnP library could fetch it`);
+    }
     dlog(`Discovery complete: matched=${matched}, rows.length=${rows.length}`);
     const upnpLibraryErrors = Object.values(dropped).reduce((a, b) => a + b, 0);
     if (upnpLibraryErrors > 0) {
@@ -514,6 +582,7 @@ export default {
       waitPerTargetSec: perTargetWaitSec(timeoutMs),
       upnpLibraryErrors,
       upnpLibraryErrorsByName: dropped,
+      upnpRefusedAnnouncements: refused,
       data
     };
   }

package/plugins/webapp_detector.mjs

@@ -2,7 +2,9 @@
 // New plugin: Webapp Detector
 // Uses the in-house zero-dep fingerprinter (utils/tech_fingerprint.mjs) to identify
 // web applications present on a host.
-// Tries HTTPS first (port 443), then HTTP (port 80), and can also try custom ports via opts.ports.
+// Tries https:443, then http:80, then each TCP port --ports adds (both schemes), and stops at the first that answers.
+// THE REACH, stated: 010 runs only when TCP 80 or 443 is open; an added port is tried after https:443 and http:80 and
+// only if neither answers (1.3.0 item 12 — the CLI's --ports string never reached this plugin before).
 // NOTE: Unlike http_probe, undici/fetch cannot ignore TLS easily per-request, so self-signed
 // HTTPS will usually fail and the plugin will fall back to HTTP.
 //
@@ -28,6 +30,8 @@
 // }
 
 import { fingerprint } from '../utils/tech_fingerprint.mjs';
+import { canonicalIp, classifyAddress, resolveAndValidate, allowAllHosts } from '../utils/net_validation.mjs';
+import { parsePortsSpec } from '../utils/ports_spec.mjs';
 
 const DEBUG =
   String(process.env.DEBUG_MODE || '').toLowerCase() === '1' ||
@@ -70,21 +74,83 @@ function normalizeTarget(target) {
   return (target.host || target.hostname || target.name || '').replace(/^https?:\/\//i, '').split('/')[0];
 }
 
+// 1.3.0 lane 2 (R2): redirects are followed HERE, one hop at a time, never by undici. The target chooses
+// a hop, not the operator, and the scan-entry guard ran once, on the host the operator named — so with
+// `redirect: 'follow'` a target could send the scanner to loopback or cloud metadata and have the
+// answer's headers reflected into the result. A hop to the host the operator named (any port, http or
+// https) was admitted at entry and is followed; any other host goes through the MCP guard's policy:
+// loopback, link-local, metadata and unspecified refused in every configuration, private ranges only
+// under NSA_ALLOW_ALL_HOSTS, a name refused if ANY of its answers is. Stated limit, as at entry: the
+// checked name is resolved again by the request (no pin against rebinding).
+const MAX_REDIRECT_HOPS = 5;
+
+async function assertHopAllowed(next, entryHost) {
+  if (next.protocol !== 'http:' && next.protocol !== 'https:') {
+    throw new Error(`redirect to ${next.href} refused: only http and https hops are followed`);
+  }
+  const host = next.hostname.replace(/^\[|\]$/g, '');
+  if (host.toLowerCase() === String(entryHost).replace(/^\[|\]$/g, '').toLowerCase()) return;
+  const allowPrivate = allowAllHosts();
+  if (canonicalIp(host)) {
+    const cls = classifyAddress(host);
+    if (cls === 'always' || (cls === 'private' && !allowPrivate)) {
+      throw new Error(`redirect to ${host} refused by the SSRF guard (blocked address range)`);
+    }
+    return;
+  }
+  try {
+    await resolveAndValidate(host, { allowPrivate });
+  } catch (err) {
+    throw new Error(`redirect to ${host} refused by the SSRF guard (${err.message})`);
+  }
+}
+
 async function fetchOnce(url, signal) {
   const extra = parseExtraHeaders();
-  const headers = {
+  const base = {
     'User-Agent': 'Mozilla/5.0 (compatible; NetworkSecurityAuditor/1.18.0; +https://example.invalid)',
     DNT: '1',
-    ...extra,
   };
-  // global fetch (undici) is available in Node >=18
-  const res = await fetch(url, { redirect: 'follow', headers, signal });
-  const finalUrl = res.url || url;
-  const statusCode = res.status;
-  const rawHeaders = {};
-  res.headers.forEach((v, k) => (rawHeaders[k.toLowerCase()] = v));
-  const html = await res.text();
-  return { url: finalUrl, statusCode, headers: rawHeaders, html };
+  const entry = new URL(url);
+  const entryHost = entry.hostname;
+  // The operator's HTTP_EXTRA_HEADERS (where an Authorization or an API key goes) are for the origin the
+  // operator named. Once a hop leaves that origin — another host, scheme or port — none of them is sent
+  // again, even if the chain comes back. (undici's own follow drops only Authorization cross-origin.)
+  let leftOrigin = false;
+  let current = url;
+  for (let hop = 0; ; hop++) {
+    const headers = leftOrigin ? base : { ...base, ...extra };
+    // global fetch (undici) is available in Node >=18
+    const res = await fetch(current, { redirect: 'manual', headers, signal });
+    const location = res.status >= 300 && res.status < 400 ? res.headers.get('location') : null;
+    if (location) {
+      if (hop >= MAX_REDIRECT_HOPS) {
+        throw new Error(`redirect limit (${MAX_REDIRECT_HOPS} hops) reached at ${current}`);
+      }
+      const next = new URL(location, current);
+      await assertHopAllowed(next, entryHost);
+      if (next.origin !== entry.origin) leftOrigin = true;
+      await res.body?.cancel?.().catch(() => {});
+      current = next.href;
+      continue;
+    }
+    const statusCode = res.status;
+    const rawHeaders = {};
+    res.headers.forEach((v, k) => (rawHeaders[k.toLowerCase()] = v));
+    const html = await res.text();
+    return { url: current, statusCode, headers: rawHeaders, html };
+  }
+}
+
+/**
+ * The TCP ports --ports adds, in every form a caller passes: the CLI's string ('8443,9090/udp'), an array, or
+ * { tcp, udp }. One grammar with the port scanner (utils/ports_spec.mjs); a /udp entry adds no URL.
+ */
+export function addedTcpPorts(spec) {
+  if (typeof spec === 'string') return parsePortsSpec(spec).tcp;
+  if (Array.isArray(spec)) return parsePortsSpec(spec.join(',')).tcp;
+  if (spec && typeof spec === 'object' && Array.isArray(spec.tcp)) return parsePortsSpec(spec.tcp.join(',')).tcp;
+  return [];
 }
 
 async function tryDetectAt(url) {
@@ -143,8 +209,9 @@ export default {
 
   /**
    * @param {string} host - target hostname or IP
-   * @param {number} port - optional hint (ignored; detection tries 443 then 80 unless opts.ports provided)
-   * @param {object} opts - options: { ports?: number[] }
+   * @param {number} port - the port the manager dispatched (ignored: each run walks the whole candidate list — the double
+   *   fetch when 80 and 443 are both open is boarded with the per-port dispatch)
+   * @param {object} opts - options: { ports?: string | number[] | { tcp, udp } } — the CLI passes its --ports string
    */
   async run(host, port = 0, opts = {}) {
     const result = {
@@ -168,8 +235,8 @@ export default {
       set.add(`${proto}://${target}${portPart}/`);
     };
 
-    // If specific ports given, try both schemes for each; else default to 443 then 80
-    const ports = Array.isArray(opts.ports) && opts.ports.length ? opts.ports : [443, 80];
+    // https:443 and http:80 first, then each TCP port --ports ADDS (both schemes) — never in place of the defaults.
+    const ports = [443, 80, ...addedTcpPorts(opts.ports).filter((p) => p !== 443 && p !== 80)];
     for (const p of ports) {
       if (p === 443) addUrl('https', 443);
       else if (p === 80) addUrl('http', 80);

package/utils/conclusion_utils.mjs

@@ -78,6 +78,11 @@ function resolveLiveness(base, other) {
   return base?.status || 'unknown';
 }
 
+// What a service IS (or how it was merged) — the fields authority governs. Everything else on a record is an adapter's
+// finding or flag, and a merge must not drop it.
+export const IDENTITY_FIELDS = new Set(['port', 'protocol', 'service', 'program', 'version', 'cpe', 'status', 'info', 'banner',
+  'source', 'evidence', 'authoritative', '__authoritative']);
+
 // Merge by protocol:port with basic authority precedence.
 // If 'authoritative' flag is true on a record, it wins over non-authoritative —
 // for identity. See resolveLiveness above for why status is handled separately.
@@ -104,9 +109,16 @@ export function upsertService(services, next, { authoritative = false } = {}) {
     return;
   }
   if (!authoritative && cur.__authoritative) {
-    // keep current authoritative, but allow filling blanks
+    // keep current authoritative, but allow filling blanks — and carry every NON-identity field the authoritative
+    // record lacks (1.3.0): this branch kept only identity, so a non-authoritative adapter that reached an
+    // authoritative record (040's certificate audit on 011's 443) landed nothing.
+    const carried = {};
+    for (const [k, v] of Object.entries(next)) {
+      if (!IDENTITY_FIELDS.has(k) && v !== undefined && cur[k] === undefined) carried[k] = v;
+    }
     services[i] = {
       ...cur,
+      ...carried,
       program: cur.program || next.program || null,
       version: cur.version || next.version || null,
       info: cur.info || next.info || null,

package/utils/cookie_redaction.mjs

@@ -0,0 +1,50 @@
+// utils/cookie_redaction.mjs
+// A scanned service's Set-Cookie VALUE is that service's secret (a session token); its NAME fingerprints a framework
+// (PHPSESSID, JSESSIONID). A Location header's query string can carry an SSO ticket or an OAuth code the same way.
+// 1.3.0 (the audit seat's ruling (A), at BOTH seams): the HTTP probe redacts them when it builds its banner, and the AI
+// redactor redacts any Set-Cookie value it meets, so the AI path holds even where a producer does not.
+
+export const REDACTED = '<redacted>';
+
+// One Set-Cookie header value may carry several cookies joined with ", " (fetch merges them) — split only where the next
+// chunk starts a new `name=`, so a ", " inside an Expires date is not a boundary.
+const COOKIES = /,\s*(?=[^=;,\s]+=)/;
+// In free text a Set-Cookie line ends at CR, LF, or a literal backslash-r / backslash-n (the webapp detector joins its
+// banner lines with those two-character sequences).
+const SET_COOKIE_LINE = /(set-cookie:[ \t]*)((?:(?!\r|\n|\\r|\\n).)*)/gi;
+
+/** One Set-Cookie header value: every cookie's VALUE redacted; its name and attributes (Path, HttpOnly, Expires) kept. */
+export function redactSetCookie(value) {
+  return String(value).split(COOKIES).map((c) => c.replace(/^(\s*[^=;\s]+)=[^;]*/, `$1=${REDACTED}`)).join(', ');
+}
+
+/** A Location header without its query string and fragment — the query can carry a credential. */
+export function redactLocation(value) {
+  const v = String(value);
+  const i = v.search(/[?#]/);
+  if (i < 0) return v;
+  return v[i] === '?' ? `${v.slice(0, i)}?${REDACTED}` : v.slice(0, i);
+}
+
+/** Free text (a banner, an evidence row): every `set-cookie:` line's cookie values redacted. */
+export function redactSetCookieLines(text) {
+  return String(text).replace(SET_COOKIE_LINE, (_, head, value) => head + redactSetCookie(value));
+}
+
+/** Every UNREDACTED `name=value` a Set-Cookie line carries anywhere in a structure — the census helper. */
+export function setCookieValues(x) {
+  const found = [];
+  const visit = (v) => {
+    if (typeof v === 'string') {
+      for (const m of v.matchAll(SET_COOKIE_LINE)) {
+        for (const c of m[2].split(COOKIES)) {
+          const kv = /^\s*([^=;\s]+)=([^;]*)/.exec(c);
+          if (kv && kv[2].trim() !== REDACTED) found.push(`${kv[1]}=${kv[2].trim()}`);
+        }
+      }
+    } else if (Array.isArray(v)) v.forEach(visit);
+    else if (v && typeof v === 'object') Object.values(v).forEach(visit);
+  };
+  visit(x);
+  return found;
+}

package/utils/delta_reporter.mjs

@@ -1,7 +1,69 @@
 // utils/delta_reporter.mjs
 // Delta reporting: compare two full scan cycles across multiple hosts.
 
-import { computeDiff } from './scan_history.mjs';
+import { computeDiff, flagsChanged } from './scan_history.mjs';
+
+// 1.3.0 lane 4, items 4 + 11. The watch loop hands this module each host's scanSingleHost OUTPUT, which carries no
+// services, finding count or tier — so every cycle compared two empty summaries, stdout read "No significant changes
+// detected." and the webhook gate never opened on a change. The output now carries the summary [ScanHistory] records
+// (`scanSummary`), and the cycle compares those. A host whose summary is MISSING is never read as an empty one: that
+// would print "N service(s) removed" for a scan that failed (the naive fix) or "No changes" (the shipped defect).
+
+/** The per-host states in which two cycles are NOT compared — a closed set, held two ways by its test. */
+export const WATCH_NOT_COMPARABLE = Object.freeze(['scan-failed', 'baseline-scan-failed', 'no-summary', 'baseline-no-summary']);
+
+const NOT_COMPARED_TEXT = {
+  'scan-failed': (detail) => `scan failed this cycle — not compared${detail ? ` (${detail})` : ''}`,
+  'baseline-scan-failed': () => "the previous cycle's scan failed — not compared",
+  'no-summary': () => 'no scan summary was recorded this cycle — not compared',
+  'baseline-no-summary': () => 'no scan summary was recorded for the previous cycle — not compared',
+};
+
+/**
+ * What one host's cycle value offers the comparison: `{ summary }`, or `{ failed: detail }` for the scheduler's
+ * `{ error }`, or `{ missing: true }` when no summary is there to read.
+ */
+export function deltaInputOf(value) {
+  if (value && typeof value === 'object') {
+    if (value.error != null && !('scanSummary' in value) && !Array.isArray(value.services)) return { failed: String(value.error) };
+    if ('scanSummary' in value) return value.scanSummary && typeof value.scanSummary === 'object' ? { summary: value.scanSummary } : { missing: true };
+    if (Array.isArray(value.services)) return { summary: value };
+  }
+  return { missing: true };
+}
+
+function notComparedDiff(reason, detail) {
+  return {
+    newServices: [], removedServices: [], changedServices: [],
+    newFindings: null, findingsNotComparable: false, findingsNotComparableReason: null,
+    changedFlags: [], flagsNotComparable: false, flagsNotComparableReason: null,
+    notCompared: reason,
+    summary: NOT_COMPARED_TEXT[reason](detail),
+  };
+}
+
+/** Compare one host's two cycle values. */
+function hostDiff(current, previous) {
+  const cur = deltaInputOf(current);
+  if (cur.failed !== undefined) return notComparedDiff('scan-failed', cur.failed);
+  if (cur.missing) return notComparedDiff('no-summary');
+  if (previous == null) return computeDiff(cur.summary, null);
+  const prev = deltaInputOf(previous);
+  if (prev.failed !== undefined) return notComparedDiff('baseline-scan-failed');
+  if (prev.missing) return notComparedDiff('baseline-no-summary');
+  return computeDiff(cur.summary, prev.summary);
+}
+
+/**
+ * THE one per-host change predicate (ruled): stdout and the webhook read the same definition. A service appeared,
+ * went or changed; the finding count moved, or could not be compared; a service check appeared, cleared or could not
+ * be compared; or the two cycles could not be compared at all.
+ */
+export function hostChanged(diff) {
+  if (!diff) return false;
+  return Boolean(diff.notCompared || diff.newServices?.length || diff.removedServices?.length || diff.changedServices?.length
+    || diff.newFindings || diff.findingsNotComparable || flagsChanged(diff));
+}
 
 /**
  * Compare two full scan cycle results and produce a delta report.
@@ -32,9 +94,7 @@ export function buildDeltaReport(currentResults, previousResults) {
 
   const hostDiffs = new Map();
   for (const h of currentHosts) {
-    const curr = currMap.get(h);
-    const prev = prevMap.has(h) ? prevMap.get(h) : null;
-    hostDiffs.set(h, computeDiff(curr, prev));
+    hostDiffs.set(h, hostDiff(currMap.get(h), prevMap.has(h) ? prevMap.get(h) : null));
   }
 
   return { newHosts, removedHosts, hostDiffs };
@@ -70,18 +130,11 @@ export function formatDeltaSummary(deltaReport) {
   if (!deltaReport.newHosts.length && !deltaReport.removedHosts.length) {
     let anyChange = false;
     if (deltaReport.hostDiffs) {
-      for (const diff of deltaReport.hostDiffs.values()) {
-        // ⚠️ `findingsNotComparable` COUNTS AS A CHANGE (board C10). `newFindings` is `null` when
-        // the two scans counted findings on a different basis, and null is falsy — so without
-        // this the diff drops out of both gates and the operator hears NOTHING, which reads as
-        // "no change since last scan". That is the false clean this item is about, one layer out.
-        // A comparison we cannot make is news: it is what tells an operator to rescan.
-        if (diff.newServices?.length || diff.removedServices?.length || diff.changedServices?.length
-            || diff.newFindings || diff.findingsNotComparable) {
-          anyChange = true;
-          break;
-        }
-      }
+      // ⚠️ A comparison that could not be made COUNTS AS A CHANGE (board C10; 1.3.0 items 4 + 11): `newFindings` is null
+      // when the two scans counted on a different basis, and a host whose scan failed has nothing to compare — without
+      // this the operator hears NOTHING, which reads as "no change since last scan". A comparison we cannot make is
+      // news: it is what tells an operator to rescan. hostChanged is the one predicate the webhook reads too.
+      anyChange = [...deltaReport.hostDiffs.values()].some(hostChanged);
     }
     if (!anyChange) {
       lines.push('No significant changes detected.');
@@ -103,15 +156,7 @@ export function hasSignificantChanges(deltaReport) {
   if (deltaReport.newHosts.length > 0) return true;
   if (deltaReport.removedHosts.length > 0) return true;
 
-  if (deltaReport.hostDiffs) {
-    for (const diff of deltaReport.hostDiffs.values()) {
-      if (diff.newServices?.length > 0) return true;
-      if (diff.removedServices?.length > 0) return true;
-      if (diff.changedServices?.length > 0) return true;
-      if (diff.newFindings && diff.newFindings !== 0) return true;
-      if (diff.findingsNotComparable) return true;   // see the note in formatDeltaSummary
-    }
-  }
+  if (deltaReport.hostDiffs && [...deltaReport.hostDiffs.values()].some(hostChanged)) return true;
 
   return false;
 }

package/utils/executive_report.mjs

@@ -29,7 +29,7 @@
 import { escapeHtml } from './brand.mjs';
 // The two evaluability SENTINELS, imported so the per-row basis is keyed on identity rather
 // than on prose. `scan_delta.mjs` imports nothing from here, so there is no cycle.
-import { SCOPE_NOT_EVALUATED, FRAMEWORK_MOVEMENT_NOT_EVALUATED } from './scan_delta.mjs';
+import { SCOPE_NOT_EVALUATED, FRAMEWORK_MOVEMENT_NOT_EVALUATED, RUN_NAMES, NOT_REQUESTED_RECORD_SINCE_EE, cmpVersion } from './scan_delta.mjs';
 
 /* ------------------------------------------------------------------------------------------
  * egressViolations — deny-by-default. Two levels: every TAG, then EVERY attribute of it
@@ -625,15 +625,42 @@ function describeBrand(v) {
 //
 // ⚠️ KEYED ON THE EXPORTED SENTINELS, NEVER ON PROSE. Matching the limit text would rot the first
 // time somebody copy-edits a sentence, and it would rot SILENTLY in the direction that overstates.
-function deltaBasis(delta) {
+//
+// ⚠️ PER ROW (1.3.0, lane 6 — deltaBasis). The sentence used to be ONE for the whole table, so an analysis agent's or the
+// CVE mapper's row read "host, plugin, scope … present in both runs" although an agent is not a requested plugin and its
+// "plugin" leg was never checked. Now:
+//   - a plugin's row keeps the legs above;
+//   - an agent's row (`producerKind: 'agent'`) names the run that LACKS it — the baseline for a NEW row, this run for a
+//     RESOLVED one — as having recorded no evidence gap from its producer covering the row. TRUE BY CONSTRUCTION: the
+//     delta refuses a row when that run recorded such a gap, and reads it in that run only (a gap explains what a run is
+//     missing, never what it holds), so "either run" would be false;
+//   - where that lacking run predates EE 1.3.0 it could not record an input plugin LEFT OUT of the scan, so the row is
+//     not refused, and the cell says so; a run that records no EE version says that instead — never assumed either way.
+//     Keyed through `cmpVersion`, the delta's one comparator, on the version each run's own record carries.
+function deltaBasis(delta, f = null, bucket = null) {
   const limits = delta.limits ?? [];
   const scopeEvaluated = !limits.includes(SCOPE_NOT_EVALUATED);
   const fwEvaluated = !limits.includes(FRAMEWORK_MOVEMENT_NOT_EVALUATED);
-  const legs = ['host', 'plugin', scopeEvaluated ? 'scope' : null].filter(Boolean).join(', ');
+  const agent = f?.producerKind === 'agent';
+  const legs = ['host', agent ? null : 'plugin', scopeEvaluated ? 'scope' : null].filter(Boolean).join(', ');
   const fw = fwEvaluated ? 'present in both runs' : 'not evaluated';
   // BOTH sides' integrity: the run being REPORTED is as alterable as the one compared against.
   const integrity = `baseline ${delta.baselineIntegrity} · current ${delta.currentIntegrity ?? 'not recorded'}`;
-  return `comparable: ${legs} present in both runs; framework enumeration: ${fw}; ${integrity}`;
+  const lacking = bucket === 'new' ? { name: RUN_NAMES.baseline, ee: delta.baselineEeVersion }
+    : bucket === 'resolved' ? { name: RUN_NAMES.current, ee: delta.currentEeVersion } : null;
+  const producer = !agent ? ''
+    : lacking ? `; producer: ${f.plugin} — ${lacking.name} recorded no evidence gap from it covering this row`
+      : `; producer: ${f.plugin} — the row is in both runs`;
+  let limit = '';
+  if (agent && lacking && lacking.ee !== undefined) {
+    if (lacking.ee === null) {
+      limit = `; limit: ${lacking.name} records no EE version, so whether an input plugin was left out of it is not known`;
+    } else if (cmpVersion(lacking.ee, NOT_REQUESTED_RECORD_SINCE_EE) < 0) {
+      limit = `; limit: ${lacking.name} predates EE ${NOT_REQUESTED_RECORD_SINCE_EE}, so it could not record an input plugin left `
+        + 'out of the scan: an agent row it lacks is not refused';
+    }
+  }
+  return `comparable: ${legs} present in both runs${producer}; framework enumeration: ${fw}; ${integrity}${limit}`;
 }
 
 // What a not-comparable row's direction means, in the words a client reads.
@@ -682,9 +709,9 @@ ${escapeHtml(delta.refusal.detail)}</p>
   const rows = [
     // A UDP row carries WHY its port counts as measured (1.1.1 — `basisNote`, e.g. "53/udp answered in the other run
     // (dns open · dnsmasq 2.79)"), so a resolved UDP row shows its work on the row, never in a footer.
-    ...delta.resolved.map((f) => deltaRow('resolved', f, `${deltaBasis(delta)}${f.basisNote ? `; ${f.basisNote}` : ''}`)),
-    ...delta.newFindings.map((f) => deltaRow('new', f, `${deltaBasis(delta)}${f.basisNote ? `; ${f.basisNote}` : ''}`)),
-    ...delta.changed.map((f) => deltaRow('changed', f, `${deltaBasis(delta)}; severity ${escapeHtml(String(f.from))} → ${escapeHtml(String(f.to))}`)),
+    ...delta.resolved.map((f) => deltaRow('resolved', f, `${deltaBasis(delta, f, 'resolved')}${f.basisNote ? `; ${f.basisNote}` : ''}`)),
+    ...delta.newFindings.map((f) => deltaRow('new', f, `${deltaBasis(delta, f, 'new')}${f.basisNote ? `; ${f.basisNote}` : ''}`)),
+    ...delta.changed.map((f) => deltaRow('changed', f, `${deltaBasis(delta, f, 'changed')}; severity ${escapeHtml(String(f.from))} → ${escapeHtml(String(f.to))}`)),
     // The reason rides the row, not a legend.
     // ⚠️ THE CODE IS PRINTED VERBATIM, AND THAT IS THE DESIGN. A render-time label map was tried
     // here and reverted: it moved this seam and left the terminal's, so one outcome carried two