nsauditor-ai 1.1.0 → 1.1.1

package/README.md

@@ -17,20 +17,24 @@ NSAuditor AI is the open-source core of a privacy-first security intelligence pl
 
 ## What's New
 
-**Latest: CE 1.1.0 + Enterprise 2.1.0 — *Node.js 24.22.1; scan_host stops at a time limit and names what it did not run; a saved response keeps its request beside it; a multi-entry cloud title says so; get_findings says what a scan holds*.**
-⚠️ **The supported runtime floor rises to Node.js 24.22.1** — the October 2026 Node.js security release for the 24
-line (`engines.node >=24.22.1`); npm only warns on an older runtime, so check `node --version`. Through the MCP server,
-`scan_host` stops at a total time limit by default (`SCAN_HOST_WALL_MS`, 50 s; `0` turns it off) and names the plugins it
-did not run; with `NSA_MCP_RESPONSE_DIR` set, each response is saved with its request beside it, and
-`nsauditor-ai mcp verify-call` checks both; a CRITICAL, HIGH or evidence-gap title in `scan_cloud` says when its finding
-holds more entries than it shows (` (+N more via get_findings)`); and a `get_findings` category filter that matches
-nothing returns the categories the scan does hold.
+**Latest: CE 1.1.1 + Enterprise 2.1.1 — *the OpenAI client on openai 7 and one zod; an AI assessment of part of the scan says so; a tier denial names the tools you can use; `license` exits 2 on an unknown subcommand*.**
+The OpenAI client moves from `openai` 4 to `openai` 7, so a project that depends on this package holds one `zod` at
+4.6.6 or later (GHSA-mrhx-c7xc-m3w5), with no `overrides`, and no `node-domexception`. After every AI response the CLI
+compares the input tokens the provider reports with its own estimate of the input (characters ÷ 4); when the provider
+reports reading less than half of it, `scan_response_ai.txt` and `.html` open with one line saying the assessment covers
+part of the scan, and `scan_response_ai.json` and the run record carry both numbers. Measured with a local Ollama model
+whose settings were left at their defaults, which read about a tenth of a host scan
+([docs/openai.md](./docs/openai.md#when-the-provider-reads-part-of-the-input)). A tool refused for its licence tier
+names the tools the caller can use now, and `compliance_matrix` without the Enterprise package names the licence it
+needs instead of an install command that fails. `nsauditor-ai license` with an unknown subcommand, or none, exits 2. The
+supported runtime is Node.js 24.22.1 or newer (`engines.node >=24.22.1`, since 1.1.0); npm only warns on an older
+runtime, so check `node --version`.
 Two limits from Enterprise 1.3.0 still hold in the Pro delta and Enterprise MTTR: a scan made before Enterprise 1.3.0
 could not record a plugin left out of it, so in a comparison with one an agent's row that scan lacks is not refused;
 and a scan that discovered ports with the Nmap plugin (024) alone records no port oracle, so an analysis agent's or the
 CVE mapper's row on a port it did not measure can read RESOLVED and count as closed in MTTR, and the control it failed
 can read PASS — include the port scanner (003).
-Plugin count UNCHANGED at 27 Community + 29 Enterprise; every coverage matrix UNCHANGED; Enterprise 2.1.0 pairs with this
+Plugin count UNCHANGED at 27 Community + 29 Enterprise; every coverage matrix UNCHANGED; Enterprise 2.1.1 pairs with this
 release, and its peer floor stays at `nsauditor-ai >= 1.0.0`. The free last-vs-current webhook alerting delta is
 untouched and stays free (see Continuous Monitoring below).
 
@@ -45,8 +49,8 @@ Scan → Analyze → Prioritize → Track → Act
 - **27 scanner plugins** probe networks across ICMP, TCP, UDP, HTTP, TLS, SNMP, DNS, SMB, RPC, mDNS, UPnP, WS-Discovery, MCP (Model Context Protocol), and more
 - **Smart result fusion** — the Result Concluder merges all plugin outputs into a normalized view with OS detection, service fingerprinting, and evidence linking
 - **Structured finding format** — all findings use a common schema with category, severity, evidence, and remediation — enabling consistent SARIF export and MCP integration
-- **AI-powered analysis** — send redacted scan results to OpenAI or Claude (your keys, your choice) for vulnerability assessments and remediation guidance
-- **Risk-scored prioritization (Pro/Enterprise)** — findings carry a composite risk score (CVSS weighted by verification status, with an uplift for initial-access techniques) and a status field. Enterprise adds an operator suppression workflow for compliance findings (accepted-risk / false-positive with expiry): the compliance report shows a suppressed finding as suppressed, naming its approver and rationale, and an expired suppression no longer applies
+- **AI-powered analysis** — send redacted scan results to OpenAI, Claude or a local Ollama model (your keys, your choice) for vulnerability assessments and remediation guidance
+- **Risk-scored prioritization (Pro/Enterprise)** — findings carry a composite risk score: CVSS/10 × a status weight, plus a 15% uplift for findings carrying an initial-access MITRE technique, capped at 1.0. Every finding the scanner emits is `UNVERIFIED`, so the weight is 0.6 for all of them (CVSS 9.8 → 0.59; with T1190 → 0.68; no CVSS → 0.30). The `VERIFIED` (1.0) and `FALSE_POSITIVE` (0.0) weights are unreachable in the shipped product: those status values are reserved, no shipped code or registered MCP tool sets them, and the re-probe engine that would have is withdrawn and not planned. Enterprise adds an operator suppression workflow for compliance findings (accepted-risk / false-positive with expiry): the compliance report shows a suppressed finding as suppressed, naming its approver and rationale, and an expired suppression no longer applies
 - **Continuous monitoring (CTEM)** — watch mode rescans on a schedule, compares each host with the previous cycle and alerts a host whose scan changed and that carries a finding at or above `--alert-severity`
 - **MCP integration** — expose scanning tools to AI assistants like Claude Code via Model Context Protocol
 - **CI/CD ready** — SARIF output with `--fail-on` severity gating for pipeline integration
@@ -66,8 +70,9 @@ NSAuditor AI is available in three editions: Community (free, MIT-licensed, no r
 | AI analysis (OpenAI, Claude, Ollama — your keys) | ✅ basic | ✅ enriched | ✅ enriched |
 | Structured findings + SARIF + CSV export | ✅ | ✅ | ✅ |
 | CTEM watch mode | ✅ basic | ✅ advanced | ✅ advanced |
+| MITRE ATT&CK technique mapping — every scan maps the detected services to technique ids, linked in the report | ✅ | ✅ | ✅ |
 | **Pro features** | | | |
-| CVE matching + MITRE ATT&CK mapping | — | ✅ | ✅ |
+| CVE matching + per-finding MITRE ATT&CK annotations (`evidence.mitre`) | — | ✅ | ✅ |
 | Risk scoring + prioritization | — | ✅ | ✅ |
 | Exploit intelligence — **CISA KEV** + **FIRST EPSS** joined onto the CVE matches, exploit-first ordering (a KEV-listed MEDIUM outranks an unexploited CRITICAL); stores are operator-populated — no feed data ships | — | ✅ | ✅ |
 | Parallel analysis agents | — | ✅ | ✅ |

package/cli.mjs

@@ -19,7 +19,7 @@ import { buildCsv } from './utils/export_csv.mjs';
 import { buildMarkdownReport } from './utils/report_md.mjs';
 import { conclusionFindings, maxRank, severityRank as flagSeverityRank, OPEN_SERVICE_SEVERITY } from './utils/service_flags.mjs';
 import { recordScan, getLastScan, computeDiff, formatDiffReport, pruneForCE, HISTORY_FILE, historyServiceEntry, historyHostEntry } from './utils/scan_history.mjs';
-import { aiBailMessage, computeAiTimeoutMs, aiFailureStubText, aiSummaryLine } from './utils/ai_stage.mjs';
+import { aiBailMessage, computeAiTimeoutMs, aiFailureStubText, aiSummaryLine, aiInputCoverage, aiTruncationCaveat } from './utils/ai_stage.mjs';
 import { getTierFromEnv, loadLicense } from './utils/license.mjs';
 import { resolveCapabilities, hasCapability, inferRequiredTier, CAPABILITIES } from './utils/capabilities.mjs';
 import { createScheduler } from './utils/scheduler.mjs';
@@ -571,9 +571,14 @@ async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basi
       clearTimeout(aiTimer);
     }
 
+    // B113a: what share of the input the provider says it read. Written BESIDE the raw response, never into it.
+    const inputCoverage = aiInputCoverage({ resp, promptText, userContent });
+    const truncationCaveat = inputCoverage?.inputTruncated ? aiTruncationCaveat(inputCoverage) : null;
+
     // Write full AI response
     try {
-      await fsp.writeFile(aiResponsePath, JSON.stringify(resp, null, 2), 'utf8');
+      const recorded = inputCoverage ? { ...JSON.parse(JSON.stringify(resp)), nsauditorMeta: { inputCoverage } } : resp;
+      await fsp.writeFile(aiResponsePath, JSON.stringify(recorded, null, 2), 'utf8');
       console.log(`[${providerLabel}] Wrote AI response:`, aiResponsePath);
     } catch (e) {
       console.warn(`[${providerLabel}] Failed to write AI response:`, e?.message || e);
@@ -582,6 +587,7 @@ async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basi
     // Write TXT & HTML
     try {
       const lines = [
+        ...(truncationCaveat ? [truncationCaveat, ``] : []),
         `Model: ${model}`,
         `Provider: ${providerLabel}`,
         `When: ${new Date().toISOString()}`,
@@ -601,7 +607,7 @@ async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basi
           host,
           whenIso: new Date().toISOString(),
           model,
-          md: aiConclusionText.trim()
+          md: `${truncationCaveat ? `> ${truncationCaveat}\n\n` : ''}${aiConclusionText.trim()}`
         });
         await fsp.writeFile(aiHtmlPath, html, 'utf8');
         console.log(`[${providerLabel}] Wrote AI HTML:`, aiHtmlPath);
@@ -623,6 +629,7 @@ async function maybeSendToOpenAI({ host, results, conclusion, promptMode = 'basi
       // review fold D: a 200 with no extractable text is NOT "ok" — the
       // end-of-scan summary must not read "OK" when there is no conclusion.
       ai_status: (typeof aiConclusionText === 'string' && aiConclusionText.trim()) ? 'ok' : 'empty',
+      ai_input_coverage: inputCoverage,
     };
   } catch (err) {
     const errMsg = String(err?.message || err);
@@ -1225,12 +1232,12 @@ export async function scanSingleHost(pm, host, plugins, opts, promptMode) {
     conclusion.result.eeEnrichmentError = String(err?.message ?? err);
   }
 
-  const { file_paths: ai_file_paths, ai_conclusion, ai_status, ai_error } = await maybeSendToOpenAI({
+  const { file_paths: ai_file_paths, ai_conclusion, ai_status, ai_error, ai_input_coverage = null } = await maybeSendToOpenAI({
     host, results, conclusion, promptMode, outDir, runId: opts?.runId ?? null, pluginStatus,
   });
   // BUG1 (fail-VISIBLE): a one-line end-of-scan AI status so a failed/aborted AI
   // conclusion is not silently swallowed under the per-stage logs.
-  console.log(aiSummaryLine({ host, ai_status, ai_error }));
+  console.log(aiSummaryLine({ host, ai_status, ai_error, ai_input_coverage }));
 
   // --- Scan history: record & compare ---
   let scanDiff = null;
@@ -1306,6 +1313,7 @@ export async function scanSingleHost(pm, host, plugins, opts, promptMode) {
       hostAppended = await appendHostWritten(runRecordRoot, opts.runId, {
         host, dir: path.basename(outDir),
         scopeScanned: hostScopeScanned,
+        aiInputCoverage: ai_input_coverage,   // B113a: per host, beside the scope
       });
     }
 
@@ -2454,7 +2462,14 @@ Docs: https://www.nsauditor.com/ai/   |   Pricing: https://www.nsauditor.com/ai/
       console.log('');
       console.log('  Verify with: nsauditor-ai license --status');
     } else {
-      console.log('Usage: nsauditor-ai license --status | --capabilities | --plugins | install <KEY> | --reset [--purge]');
+      const usage = 'Usage: nsauditor-ai license --status | --capabilities | --plugins | install <KEY> | --reset [--purge]';
+      // B99: anything that reached here — no subcommand at all, a typo, or one a later release adds — is a call that
+      // FAILED: the usage goes to stderr and the exit code is 2, as `feed` and `compliance` with no verb do, so a script
+      // or an AI agent never reads it as a success. The explicit ask for the usage is `license --help`, which the global
+      // help answers with exit 0.
+      console.error(rawArgs.length <= 1 ? 'missing license subcommand' : `unknown license subcommand: ${rawArgs[1]}`);
+      console.error(usage);
+      process.exit(2);
     }
     process.exit(0);
   }

package/mcp_server.mjs

@@ -55,35 +55,49 @@ export function _setTier(tier) {
   _capabilities = resolveCapabilities(_tier);
 }
 
-/** @internal Test-only. Returns the Pro-gate denial object (or null if allowed). */
-export function _requireProCapability(toolName) {
+/** @internal Test-only. Returns the Pro-gate denial object (or null if allowed). `opts.resolveEE` replaces the resolver. */
+export function _requireProCapability(toolName, opts) {
   if (process.env.NODE_ENV === 'production') throw new Error('_requireProCapability is test-only and disabled in production');
-  return requireProCapability(toolName);
+  return requireProCapability(toolName, opts);
 }
 
-/** @internal Test-only. Returns the Enterprise-gate denial object (or null if allowed). */
-export function _requireEnterpriseCapability(toolName) {
+/** @internal Test-only. Returns the Enterprise-gate denial object (or null if allowed). `opts.resolveEE` replaces the resolver. */
+export function _requireEnterpriseCapability(toolName, opts) {
   if (process.env.NODE_ENV === 'production') throw new Error('_requireEnterpriseCapability is test-only and disabled in production');
-  return requireEnterpriseCapability(toolName);
+  return requireEnterpriseCapability(toolName, opts);
 }
 
-function requireProCapability(toolName) {
+/**
+ * The tools this caller can use now, for a denial to name (B97, B98). DERIVED from the same gates the dispatcher applies
+ * — Pro adds probe_service and get_vulnerabilities — and from whether Enterprise resolves, since compliance_matrix reads
+ * the framework maps Enterprise ships and throws without them. It used to be one constant, "CE tools available:
+ * scan_host, list_plugins, compliance_matrix", so a Pro caller denied an Enterprise tool never learned it held the Pro
+ * tools, and a Community-only install was told compliance_matrix was available where it throws.
+ */
+function toolsAvailableLine({ resolveEE = _defaultResolveEE } = {}) {
+  const tools = ['scan_host', 'list_plugins'];
+  if (_capabilities.proMCP) tools.push('probe_service', 'get_vulnerabilities');
+  try { resolveEE(); tools.push('compliance_matrix'); } catch { /* Enterprise not installed: the matrix is not available */ }
+  return `**Tools available to you now:** ${tools.join(', ')}`;
+}
+
+function requireProCapability(toolName, opts) {
   if (_capabilities.proMCP) return null; // Pro/Enterprise: allow
   return {
     content: [{
       type: 'text',
-      text: `🔒 **${toolName}** requires a Pro license.\n\nView Pro/Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n**CE tools available:** scan_host, list_plugins, compliance_matrix`,
+      text: `🔒 **${toolName}** requires a Pro license.\n\nView Pro/Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n${toolsAvailableLine(opts)}`,
     }],
     isError: true,
   };
 }
 
-export function requireEnterpriseCapability(toolName) {
+export function requireEnterpriseCapability(toolName, opts) {
   if (_capabilities.enterpriseMCP) return null; // Enterprise: allow
   return {
     content: [{
       type: 'text',
-      text: `🔒 **${toolName}** (cloud account auditing) requires an Enterprise license.\n\nView Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n**CE tools available:** scan_host, list_plugins, compliance_matrix`,
+      text: `🔒 **${toolName}** (cloud account auditing) requires an Enterprise license.\n\nView Enterprise pricing at https://www.nsauditor.com/ai/pricing/\n\n${toolsAvailableLine(opts)}`,
     }],
     isError: true,
   };
@@ -1064,10 +1078,13 @@ export async function handleComplianceMatrix(args = {}) {
   try {
     eeRoot = resolveEE();
   } catch {
+    // B98: the package is RESTRICTED on npm, so an install command is one a non-buyer cannot run; name the licence it
+    // needs and where a buyer finds the command (the licence email), and where anyone else goes.
     throw new Error(
-      'The compliance coverage matrix is shipped with the Enterprise plugin pack, and ' +
-      '@nsasoft/nsauditor-ai-ee is not installed / not resolvable from this server. ' +
-      'Install it (npm i -g @nsasoft/nsauditor-ai-ee) and restart the MCP server. ' +
+      'The compliance coverage matrix is shipped with the Enterprise plugin pack (@nsasoft/nsauditor-ai-ee), ' +
+      'which is not installed / not resolvable from this server. That package needs a Pro or Enterprise license: ' +
+      'with one, install it with the command in your license email and restart the MCP server; without one, see ' +
+      'https://www.nsauditor.com/ai/pricing/. ' +
       'Do NOT reconstruct the matrix from the plugin inventory or from documentation — ' +
       'coverage is a property of the shipped framework maps, not of the plugin list.',
     );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nsauditor-ai",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "description": "Modular AI-assisted network security audit platform — Community Edition",
   "type": "module",
   "private": false,
@@ -31,22 +31,19 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "dnssd": "^0.4.1",
     "dotenv": "^17.2.1",
+    "jose": "^6.2.0",
     "markdown-it": "^14.1.0",
     "multicast-dns": "^7.2.5",
     "node-upnp-utils": "^1.0.3",
-    "openai": "^4.104.0",
+    "openai": "^7.45.1",
     "oui-data": "^1.1.427",
     "snmp-native": "^1.2.0",
-    "jose": "^6.2.0",
     "xml2js": "^0.6.2",
     "zod": "^4.6.6"
   },
   "optionalDependencies": {
     "mdns": "^2.7.2"
   },
-  "overrides": {
-    "zod": "$zod"
-  },
   "engines": {
     "node": ">=24.22.1"
   },

package/utils/ai_stage.mjs

@@ -117,9 +117,31 @@ export function aiFailureStubText({ host, model, providerLabel, errorMessage, ti
  *   'failed'        — the provider call threw (carries ai_error as the cause)
  * Any unknown status falls to the FAILED branch (fail-visible default).
  */
-export function aiSummaryLine({ host, ai_status, ai_error }) {
+// B113a (2.1.1): AN ASSESSMENT OF PART OF THE SCAN MUST SAY SO. The provider's reported input tokens are compared with the
+// input's own size estimate (characters / 4). Measured on the B87 e2e (2026-10-28): every OpenAI run read 1.12–1.26 of the
+// estimate (its tokenizer counts a little more than chars/4), while a local Ollama model behind its default context window
+// read 0.10 (2,050 of an input estimated at ~20,000). 0.5 sits in that gap.
+export const AI_INPUT_TRUNCATION_RATIO = 0.5;
+
+/** `{ providerInputTokens, estimatedInputTokens, inputTruncated }`, or null when the provider reported no input count. */
+export function aiInputCoverage({ resp, promptText, userContent }) {
+  const usage = resp?.usage ?? {};
+  const reported = [usage.input_tokens, usage.prompt_tokens].find((n) => Number.isFinite(n) && n >= 0);
+  const estimatedInputTokens = Math.ceil((String(promptText ?? '').length + String(userContent ?? '').length) / 4);
+  if (reported === undefined || estimatedInputTokens <= 0) return null;   // unknown is never read as "whole"
+  return { providerInputTokens: reported, estimatedInputTokens,
+    inputTruncated: reported < estimatedInputTokens * AI_INPUT_TRUNCATION_RATIO };
+}
+
+/** The ONE caveat line, the same words in the TXT, the HTML and the summary line. */
+export function aiTruncationCaveat(cov) {
+  return `⚠️ Partial input: the provider reports reading ${cov.providerInputTokens} tokens of an input estimated at `
+    + `${cov.estimatedInputTokens}; this assessment covers part of the scan.`;
+}
+
+export function aiSummaryLine({ host, ai_status, ai_error, ai_input_coverage = null }) {
   switch (ai_status) {
-    case 'ok':             return `AI conclusion: OK (${host})`;
+    case 'ok':             return `AI conclusion: OK (${host})${ai_input_coverage?.inputTruncated ? ` — ${aiTruncationCaveat(ai_input_coverage)}` : ''}`;
     case 'empty':          return `AI conclusion: EMPTY — provider returned no text (${host})`;
     case 'skipped':        return `AI conclusion: SKIPPED — AI_ENABLED not set (${host})`;
     case 'key_unresolved': return `AI conclusion: SKIPPED — API key could not be resolved (${host})`;

package/utils/finding_queue.mjs

@@ -29,12 +29,21 @@ export class FindingQueue {
     return this.getByStatus('UNVERIFIED');
   }
 
+  /**
+   * @deprecated No shipped code calls this. The re-probe layer that would have set `VERIFIED` is withdrawn and
+   * not planned (EE 0.32.7; operator ruling 2026-09-28); the status value is reserved. Kept for the FindingQueue
+   * API; removal deferred to the next major.
+   */
   markVerified(id, verification) {
     const f = this._find(id);
     f.status = 'VERIFIED';
     f.evidence = { ...(f.evidence ?? {}), verification };
   }
 
+  /**
+   * @deprecated No shipped code calls this; `FALSE_POSITIVE` is reserved (see markVerified). The shipped way to
+   * record a false positive is Enterprise's operator suppression workflow. Removal deferred to the next major.
+   */
   markFalsePositive(id, reason) {
     const f = this._find(id);
     f.status = 'FALSE_POSITIVE';

package/utils/mcp_call_digest.mjs

@@ -29,9 +29,16 @@ export function requestDigest(bytes) {
   return createHash('sha256').update(Buffer.isBuffer(bytes) ? bytes : Buffer.from(String(bytes ?? ''), 'utf8')).digest('hex');
 }
 
-/** The body of a saved response: everything before the receipt footer, which is not part of what the tool produced. */
+// The marker as a pattern whose whitespace is any whitespace run: the canonicalisation above is whitespace-insensitive,
+// so finding the footer must be as well — the marker carries spaces, and an exact search lost the footer of a copy whose
+// soft wrap fell inside it, refuting that copy (found 2026-10-27; tests/mcp_call_digest_marker_whitespace.test.mjs).
+const MARKER_RE = new RegExp(RECEIPT_MARKER.trim().split(/\s+/).map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('\\s+'), 'g');
+
+/** The body of a saved response: everything before the LAST receipt marker (found whitespace-insensitively), which
+ *  begins the footer — not part of what the tool produced. */
 export function bodyOf(saved) {
   const text = String(saved ?? '');
-  const at = text.lastIndexOf(RECEIPT_MARKER);
+  let at = -1;
+  for (const m of text.matchAll(MARKER_RE)) at = m.index;
   return at < 0 ? text : text.slice(0, at);
 }

package/utils/run_record.mjs

@@ -190,7 +190,7 @@ function withRunLock(runId, fn) {
 // scanned" on a client's cover — FALSE, because they WERE scanned; only the record was never
 // finalized. A false "not scanned" over scanned hosts is the exact false clean this record exists
 // to prevent, inverted.
-export async function appendHostWritten(outRoot, runId, { host, dir, scopeScanned = null }) {
+export async function appendHostWritten(outRoot, runId, { host, dir, scopeScanned = null, aiInputCoverage = null }) {
   return withRunLock(runId, async () => {
     const existing = await readRunRecord(outRoot, runId);
     if (!existing) return false;
@@ -209,6 +209,10 @@ export async function appendHostWritten(outRoot, runId, { host, dir, scopeScanne
     if (scopeScanned && typeof scopeScanned === 'object') {
       existing.scopeScanned = { ...(existing.scopeScanned ?? {}), [normalised]: scopeScanned };
     }
+    // B113a (2.1.1): what share of the input the AI provider read for this host, when it reported one. Absent when unknown.
+    if (aiInputCoverage && typeof aiInputCoverage === 'object') {
+      existing.aiInputCoverage = { ...(existing.aiInputCoverage ?? {}), [normalised]: aiInputCoverage };
+    }
     return Boolean(await writeJsonSafe(runRecordPath(outRoot, runId), existing, 'host append'));
   });
 }