blitzstrike 1.0.10 → 1.0.12

package/dist/index.js

@@ -22225,6 +22225,159 @@ function manualForTool(toolName) {
   return null;
 }
 
+// src/evidence.ts
+import { createHash as createHash2 } from "node:crypto";
+var REDACTION_PATTERNS = [
+  [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
+  [/(api[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(access[_-]?token\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(secret\s*[:=]\s*)["']?[A-Za-z0-9._/-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(password\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
+  [/(passwd\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
+  [/(private[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9+/=_-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
+  [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
+  [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
+  [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
+  [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
+  [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
+  [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
+];
+function redactSecrets(text) {
+  let out = text;
+  for (const [re, repl] of REDACTION_PATTERNS) {
+    out = out.replace(re, repl);
+  }
+  return out;
+}
+function redactObject(value) {
+  if (typeof value === "string")
+    return redactSecrets(value);
+  if (Array.isArray(value))
+    return value.map((v) => redactObject(v));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactObject(v);
+    }
+    return out;
+  }
+  return value;
+}
+function sha256(text) {
+  return createHash2("sha256").update(text).digest("hex");
+}
+var evidenceCounter = 0;
+function nextEvidenceId() {
+  evidenceCounter += 1;
+  return `EV-${String(evidenceCounter).padStart(6, "0")}`;
+}
+function makeEvidence(input) {
+  const artifacts = (input.artifacts ?? []).map((a) => {
+    const content = redactSecrets(a.content);
+    return { name: a.name, kind: a.kind, content, sha256: sha256(content) };
+  });
+  return {
+    evidence_id: nextEvidenceId(),
+    type: input.type,
+    description: redactSecrets(input.description),
+    source: input.source ? redactObject(input.source) : undefined,
+    sink: input.sink ? redactObject(input.sink) : undefined,
+    artifacts,
+    recorded: new Date().toISOString()
+  };
+}
+
+// src/finding.ts
+var LIFECYCLE_TRANSITIONS = {
+  detected: ["triaged", "rejected"],
+  triaged: ["hypothesis", "rejected", "out_of_scope"],
+  hypothesis: ["validating", "false_positive", "rejected", "blocked"],
+  validating: ["confirmed", "likely", "unconfirmed", "false_positive", "blocked", "out_of_scope"],
+  confirmed: [],
+  false_positive: [],
+  rejected: [],
+  blocked: [],
+  out_of_scope: []
+};
+function canTransition(from, to) {
+  const allowed = LIFECYCLE_TRANSITIONS[from] ?? [];
+  return allowed.includes(to);
+}
+var DEFAULT_WEIGHTS = {
+  static_analysis: 0.2,
+  data_flow: 0.25,
+  reachability: 0.15,
+  preconditions: 0.1,
+  runtime_validation: 0.2,
+  negative_control: 0.1
+};
+var confidenceWeights = { ...DEFAULT_WEIGHTS };
+function computeConfidence(factors) {
+  let score = 0;
+  for (const [key, weight] of Object.entries(confidenceWeights)) {
+    if (factors[key] === true)
+      score += weight;
+  }
+  return Math.round(score * 100) / 100;
+}
+function confidenceLevel(score) {
+  if (score >= 0.9)
+    return "confirmed";
+  if (score >= 0.7)
+    return "high_confidence";
+  if (score >= 0.5)
+    return "likely";
+  if (score >= 0.3)
+    return "suspected";
+  return "informational";
+}
+var findingCounter = 0;
+function nextFindingId() {
+  findingCounter += 1;
+  return `BS-${new Date().getUTCFullYear()}-${String(findingCounter).padStart(6, "0")}`;
+}
+function makeFinding(input) {
+  const now = new Date().toISOString();
+  const status = input.status ?? "detected";
+  const factors = confidenceFactorsFor(input);
+  const confidence = computeConfidence(factors);
+  return {
+    id: nextFindingId(),
+    status,
+    title: input.title,
+    target: input.target,
+    classification: {
+      severity: input.severity,
+      cwe: input.cwe,
+      cwe_name: input.cweName,
+      cwe_confidence: input.cweConfidence
+    },
+    confidence,
+    confidence_level: confidenceLevel(confidence),
+    source: input.source,
+    flow: input.flow ?? [],
+    sink: input.sink,
+    validation: { performed: false },
+    evidence: [],
+    chain: { id: input.chainId ?? null, name: input.chainName },
+    impact: {},
+    remediation: {},
+    timestamps: { created: now, updated: now }
+  };
+}
+function confidenceFactorsFor(_input) {
+  return {
+    static_analysis: true,
+    data_flow: false,
+    reachability: false,
+    preconditions: false,
+    runtime_validation: false,
+    negative_control: false
+  };
+}
+
 // src/orchestrator.ts
 var _chainsCache = null;
 function loadChains() {
@@ -22393,15 +22546,41 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   }
   report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
   const rank = { critical: 0, high: 1, medium: 2, low: 3 };
-  const findings = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
+  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
+  const findings = matchedSorted.map((f) => {
+    const chain = chainById.get(f.chain_id);
+    const severity = f.severity ?? "medium";
+    const finding = makeFinding({
+      title: f.name,
+      target: { type: "source", path: target },
+      severity,
+      source: { type: "static_sink_signal", name: f.chain_id },
+      sink: { type: f.chain_id, symbol: f.name },
+      chainId: f.chain_id,
+      chainName: f.name,
+      status: "hypothesis"
+    });
+    const ev = makeEvidence({
+      type: "sink_location",
+      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
+      sink: { chain_id: f.chain_id, name: f.name, severity },
+      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
+    });
+    finding.evidence.push(ev);
+    return finding;
+  });
   report.findings = findings.map((f) => ({
-    chain_id: f.chain_id,
-    name: f.name,
-    severity: f.severity,
-    status: "HYPOTHESIS"
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    evidence_count: f.evidence.length
   }));
   report.status = "COMPLETE";
-  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting.";
+  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
   if (remember) {
     let captured = 0;
     for (const mc of blitz.matched_chains) {
@@ -23424,6 +23603,68 @@ function createServer() {
   }, async ({ topic, limit }) => {
     return { content: [{ type: "text", text: JSON.stringify(templateLookup(topic, limit ?? 10)) }] };
   });
+  server.registerTool("finding_create", {
+    title: "Create a canonical finding",
+    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending).",
+    inputSchema: {
+      title: string2().describe("Finding title"),
+      target_type: string2().optional().describe("Target type (web/api/source/mobile/network/other)"),
+      host: string2().optional().describe("Target host"),
+      endpoint: string2().optional().describe("Target endpoint/path"),
+      severity: string2().describe("Severity: critical/high/medium/low/informational"),
+      cwe: string2().optional().describe("CWE id (e.g. CWE-89)"),
+      source_type: string2().describe("Source type (e.g. request_parameter, post_body, header, cookie, file)"),
+      source_name: string2().describe("Source name"),
+      sink_type: string2().describe("Sink type (e.g. sql_execution, command_execution, file_operations)"),
+      sink_symbol: string2().optional().describe("Sink symbol (e.g. '->query(')"),
+      chain_id: string2().optional().describe("Escalation chain id")
+    }
+  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id }) => {
+    const f = makeFinding({
+      title,
+      target: { type: target_type ?? "web", host, endpoint },
+      severity: severity ?? "medium",
+      cwe,
+      source: { type: source_type, name: source_name },
+      sink: { type: sink_type, symbol: sink_symbol },
+      chainId: chain_id ?? null,
+      status: "detected"
+    });
+    return { content: [{ type: "text", text: JSON.stringify(f) }] };
+  });
+  server.registerTool("finding_transition", {
+    title: "Advance a finding lifecycle",
+    description: "FINDINGS: advance a finding through its strict lifecycle (detected->triaged->hypothesis->validating->confirmed). Rejects illegal transitions.",
+    inputSchema: {
+      status: string2().describe("Current status"),
+      to: string2().describe("Target status (triaged/hypothesis/validating/confirmed/false_positive/rejected/blocked/out_of_scope)")
+    }
+  }, async ({ status, to }) => {
+    const ok = canTransition(status, to);
+    return { content: [{ type: "text", text: JSON.stringify({ from: status, to, legal: ok }) }] };
+  });
+  server.registerTool("confidence_score", {
+    title: "Compute deterministic confidence",
+    description: "FINDINGS: compute a deterministic weighted confidence score (static/data-flow/reachability/preconditions/validation/negative-control). Never an AI opinion.",
+    inputSchema: {
+      static_analysis: boolean2().optional(),
+      data_flow: boolean2().optional(),
+      reachability: boolean2().optional(),
+      preconditions: boolean2().optional(),
+      runtime_validation: boolean2().optional(),
+      negative_control: boolean2().optional()
+    }
+  }, async (factors) => {
+    const score = computeConfidence(factors);
+    return { content: [{ type: "text", text: JSON.stringify({ score, level: confidenceLevel(score) }) }] };
+  });
+  server.registerTool("redact", {
+    title: "Redact secrets from text",
+    description: "EVIDENCE: redact passwords/API keys/tokens/cookies/private keys from text before persisting evidence or reporting.",
+    inputSchema: { text: string2().describe("Text to redact") }
+  }, async ({ text }) => {
+    return { content: [{ type: "text", text: JSON.stringify({ redacted: redactSecrets(text) }) }] };
+  });
   return server;
 }
 async function serve() {
@@ -23534,14 +23775,14 @@ function jsonMcpServersWrite(p) {
   };
 }
 function opencodeWrite(p) {
-  return (command, args) => {
+  return (_command, _args) => {
     const dir = dirname(p);
     if (!existsSync6(dir))
       mkdirSync2(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
-      blitzstrike: { type: "local", command: [command, ...args], enabled: true }
+      blitzstrike: { type: "local", command: ["npx", "-y", "blitzstrike", "serve", "--mcp"], enabled: true }
     };
     writeFileSync(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();

package/docs/findings.md

@@ -0,0 +1,95 @@
+# Findings & Evidence Engine
+
+Blitz Strike follows one principle: **a scanner hit is a hypothesis; evidence is
+the verdict.**
+
+This document describes the canonical finding model, the strict lifecycle, and
+the deterministic confidence engine. No other part of the codebase invents its
+own finding shape — every producer funnels into these modules.
+
+## Finding schema
+
+`src/finding.ts` defines the single `Finding` model:
+
+| Field | Meaning |
+| :--- | :--- |
+| `id` | Canonical id, `BS-YYYY-NNNNNN` |
+| `status` | Lifecycle state (see below) |
+| `title` | Human-readable title |
+| `target` | `type` (web/api/source/mobile/network/other) + host/endpoint/path |
+| `classification` | severity, CWE id/name/confidence, CVSS (evidence-based) |
+| `confidence` | 0.0–1.0 deterministic score (NOT an AI opinion) |
+| `confidence_level` | informational / suspected / likely / high_confidence / confirmed |
+| `source` | attacker-controlled source (type + name + location) |
+| `flow` | data-flow path (source → transforms → sink) |
+| `sink` | security-sensitive operation (type + symbol + location) |
+| `validation` | performed + baseline + negative_control |
+| `evidence` | array of integrity-tagged evidence records |
+| `chain` | escalation chain id/name |
+| `impact` / `remediation` | impact + fix |
+| `timestamps` | created / updated |
+
+## Lifecycle
+
+Strict, machine-readable state machine (`transition()` rejects illegal moves):
+
+```
+detected → triaged → hypothesis → validating → confirmed
+                 ↘ rejected      ↘ false_positive
+                 ↘ out_of_scope   ↘ blocked
+                                  ↘ out_of_scope
+```
+
+`confirmed`, `false_positive`, `rejected`, `blocked`, `out_of_scope` are
+terminal.
+
+## Severity vs confidence
+
+- **Severity** = impact (`critical` / `high` / `medium` / `low` / `informational`).
+- **Confidence** = certainty (deterministic 0.0–1.0).
+
+They are never combined. "Severity CRITICAL + confidence 0.41" = *potentially
+critical, insufficient evidence*. "Severity MEDIUM + confidence 0.98" = *medium
+impact, highly reliable*.
+
+## Confidence engine
+
+`computeConfidence()` is deterministic and weighted (configurable via
+`setConfidenceWeights()`):
+
+| Factor | Default weight |
+| :--- | :--- |
+| static_analysis | 0.20 |
+| data_flow | 0.25 |
+| reachability | 0.15 |
+| preconditions | 0.10 |
+| runtime_validation | 0.20 |
+| negative_control | 0.10 |
+
+Levels: `0.00–0.29` informational · `0.30–0.49` suspected · `0.50–0.69` likely ·
+`0.70–0.89` high_confidence · `0.90–1.00` confirmed.
+
+A high confidence score is **never** proof by itself — confirmation requires
+validation + evidence.
+
+## Evidence engine
+
+`src/evidence.ts`:
+
+- **Schema** — `evidence_id`, `type`, `description`, `source`, `sink`, `artifacts[]`, `recorded`.
+- **Integrity** — every artifact carries a SHA-256 (`sha256()`), verified by `verifyEvidence()`.
+- **Secret redaction** — `redactSecrets()` strips passwords, API keys, tokens,
+  cookies, `Authorization` headers, private keys before persistence/report/log/context.
+- **Append-only** — confirmed evidence is never silently rewritten.
+
+## MCP tools
+
+| Tool | Purpose |
+| :--- | :--- |
+| `finding_create` | create a canonical finding (default `detected`) |
+| `finding_transition` | advance lifecycle (rejects illegal moves) |
+| `confidence_score` | deterministic weighted confidence |
+| `redact` | redact secrets from arbitrary text |
+
+`run_engagement` now emits canonical findings (status `hypothesis`, carrying
+static + sink evidence) instead of ad-hoc `{chain_id, name, severity}` tuples.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {