blitzstrike 1.0.11 → 1.0.13

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -43,6 +44,7 @@ var __esm = (fn, res, err) => () => {
     throw err[0];
   return res;
 };
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {
@@ -6930,6 +6932,262 @@ var require_dist = __commonJS(function(exports, module) {
   exports.default = formatsPlugin;
 });
 
+// src/scanner.ts
+import { readFileSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function lineno(text, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++) {
+    if (text.charCodeAt(i) === 10)
+      n++;
+  }
+  return n;
+}
+function iterSourceFiles(root, maxFiles = 5000) {
+  const out = [];
+  const walk = (dir) => {
+    if (out.length >= maxFiles)
+      return;
+    let entries;
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      if (out.length >= maxFiles)
+        return;
+      const full = join(dir, name);
+      let st;
+      try {
+        st = statSync(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) {
+        if (SKIP_PARTS.has(name) || LIB_PARTS.has(name))
+          continue;
+        walk(full);
+      } else if (st.isFile()) {
+        const dot = name.lastIndexOf(".");
+        const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
+        if (!TARGET_EXTS.has(ext))
+          continue;
+        out.push(full);
+      }
+    }
+  };
+  walk(root);
+  return out;
+}
+function findFunctionBounds(text, funcStart) {
+  const brace = text.indexOf("{", funcStart);
+  if (brace === -1)
+    return null;
+  let depth = 0;
+  for (let i = brace;i < text.length; i++) {
+    const c = text[i];
+    if (c === "{")
+      depth++;
+    else if (c === "}") {
+      depth--;
+      if (depth === 0)
+        return [funcStart, i + 1];
+    }
+  }
+  return null;
+}
+function scanFile(path) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
+  }
+  const endpoints = [];
+  for (const hook of NOPRIV_HOOKS) {
+    const re = new RegExp(escapeRegExp(hook), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      endpoints.push({ hook, line: lineno(text, m.index) });
+    }
+  }
+  const sinks = [];
+  for (const [sink, bugclass] of Object.entries(SINKS)) {
+    const re = new RegExp(escapeRegExp(sink), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
+    }
+  }
+  const gates = AUTH_GATES.filter((g) => text.includes(g));
+  const lines = text.split(`
+`).length;
+  return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
+}
+function traceFunction(path, symbol) {
+  let text;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return { file: path, symbol, definitions: [], definition_count: 0, error: "unreadable" };
+  }
+  const pattern = new RegExp(`function\\s+&?${escapeRegExp(symbol)}\\s*\\(`, "g");
+  const results = [];
+  let m;
+  while ((m = pattern.exec(text)) !== null) {
+    const bounds = findFunctionBounds(text, m.index);
+    if (!bounds)
+      continue;
+    const [start, end] = bounds;
+    const body = text.slice(start, end);
+    const bodyStartLine = lineno(text, start);
+    const bodyEndLine = lineno(text, end);
+    const innerSinks = [];
+    for (const [sink, bugclass] of Object.entries(SINKS)) {
+      const re = new RegExp(escapeRegExp(sink), "g");
+      let sm;
+      while ((sm = re.exec(body)) !== null) {
+        innerSinks.push({
+          sink,
+          class: bugclass,
+          line: bodyStartLine + body.slice(0, sm.index).split(`
+`).length - 1
+        });
+      }
+    }
+    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
+    results.push({
+      line: bodyStartLine,
+      line_end: bodyEndLine,
+      length: end - start,
+      sinks_in_scope: innerSinks,
+      auth_gates_in_scope: innerGates,
+      body_preview: body.slice(0, 4000)
+    });
+  }
+  return {
+    file: path,
+    symbol,
+    definitions: results,
+    definition_count: results.length
+  };
+}
+function grepInFunctions(root, sink, maxHits = 50) {
+  const hits = [];
+  for (const p of iterSourceFiles(root)) {
+    if (hits.length >= maxHits)
+      break;
+    let text;
+    try {
+      text = readFileSync(p, "utf8");
+    } catch {
+      continue;
+    }
+    const re = new RegExp(escapeRegExp(sink), "g");
+    let m;
+    while ((m = re.exec(text)) !== null) {
+      const line = lineno(text, m.index);
+      const head = text.slice(0, m.index);
+      const funcRe = /function\s+&?\w+\s*\(/g;
+      const funcs = [];
+      let fm;
+      while ((fm = funcRe.exec(head)) !== null)
+        funcs.push(fm);
+      if (funcs.length === 0)
+        continue;
+      const fstart = funcs[funcs.length - 1].index;
+      const bounds = findFunctionBounds(text, fstart);
+      if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
+        continue;
+      const body = text.slice(bounds[0], bounds[1]);
+      const gates = AUTH_GATES.filter((g) => body.includes(g));
+      hits.push({
+        file: p,
+        line,
+        sink,
+        auth_gates_in_scope: gates,
+        guarded: gates.length > 0
+      });
+      if (hits.length >= maxHits)
+        break;
+    }
+  }
+  return hits;
+}
+var NOPRIV_HOOKS, SINKS, AUTH_GATES, TARGET_EXTS, SKIP_PARTS, LIB_PARTS;
+var init_scanner = __esm(() => {
+  NOPRIV_HOOKS = [
+    "wp_ajax_nopriv_",
+    "admin_post_nopriv_",
+    "register_rest_route",
+    "wp_ajax_"
+  ];
+  SINKS = {
+    "eval(": "RCE (code execution)",
+    "assert(": "RCE (code execution, PHP <8)",
+    "system(": "RCE (command execution)",
+    "exec(": "RCE (command execution)",
+    "shell_exec(": "RCE (command execution)",
+    "passthru(": "RCE (command execution)",
+    "proc_open(": "RCE (command execution)",
+    "popen(": "RCE (command execution)",
+    "move_uploaded_file(": "File upload (-> RCE if .php lands in webroot)",
+    "file_put_contents(": "Arbitrary file write (-> RCE via CF-003)",
+    "fwrite(": "Arbitrary file write",
+    "unserialize(": "PHP object injection (POP gadget chain)",
+    "maybe_unserialize(": "PHP object injection (weak)",
+    "include(": "Local file inclusion",
+    "require(": "Local file inclusion",
+    "include_once(": "Local file inclusion",
+    "require_once(": "Local file inclusion",
+    "$wpdb->query(": "SQL injection (unprepared query)",
+    "$wpdb->get_var(": "SQL injection (unprepared query)",
+    "$wpdb->get_results(": "SQL injection (unprepared query)",
+    "->query(": "SQL injection (query builder)",
+    "->whereRaw(": "SQL injection (raw where)",
+    "wp_remote_get(": "SSRF (unvalidated URL fetch)",
+    "wp_remote_post(": "SSRF (unvalidated URL fetch)",
+    "file_get_contents(": "SSRF / file read",
+    "extract(": "Variable injection (-> LFI/RCE without EXTR_SKIP)",
+    "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
+    "call_user_func_array(": "Dynamic dispatch",
+    "create_function(": "RCE (deprecated eval wrapper)",
+    "preg_replace(": "RCE (if /e modifier or code in pattern)"
+  };
+  AUTH_GATES = [
+    "check_ajax_referer",
+    "check_admin_referer",
+    "wp_verify_nonce",
+    "current_user_can",
+    "is_user_logged_in",
+    "JSession::checkToken",
+    "->authorise(",
+    "->authorize(",
+    "permission_callback"
+  ];
+  TARGET_EXTS = new Set([
+    ".php",
+    ".phtml",
+    ".php5",
+    ".php7",
+    ".inc",
+    ".module",
+    ".install"
+  ]);
+  SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
+  LIB_PARTS = new Set([
+    "lib",
+    "libraries",
+    "third-party",
+    "third_party",
+    "libs"
+  ]);
+});
+
 // src/sync.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync8, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
 import { join as join8 } from "node:path";
@@ -21669,258 +21927,8 @@ class StdioServerTransport {
   }
 }
 
-// src/scanner.ts
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { join } from "node:path";
-var NOPRIV_HOOKS = [
-  "wp_ajax_nopriv_",
-  "admin_post_nopriv_",
-  "register_rest_route",
-  "wp_ajax_"
-];
-var SINKS = {
-  "eval(": "RCE (code execution)",
-  "assert(": "RCE (code execution, PHP <8)",
-  "system(": "RCE (command execution)",
-  "exec(": "RCE (command execution)",
-  "shell_exec(": "RCE (command execution)",
-  "passthru(": "RCE (command execution)",
-  "proc_open(": "RCE (command execution)",
-  "popen(": "RCE (command execution)",
-  "move_uploaded_file(": "File upload (-> RCE if .php lands in webroot)",
-  "file_put_contents(": "Arbitrary file write (-> RCE via CF-003)",
-  "fwrite(": "Arbitrary file write",
-  "unserialize(": "PHP object injection (POP gadget chain)",
-  "maybe_unserialize(": "PHP object injection (weak)",
-  "include(": "Local file inclusion",
-  "require(": "Local file inclusion",
-  "include_once(": "Local file inclusion",
-  "require_once(": "Local file inclusion",
-  "$wpdb->query(": "SQL injection (unprepared query)",
-  "$wpdb->get_var(": "SQL injection (unprepared query)",
-  "$wpdb->get_results(": "SQL injection (unprepared query)",
-  "->query(": "SQL injection (query builder)",
-  "->whereRaw(": "SQL injection (raw where)",
-  "wp_remote_get(": "SSRF (unvalidated URL fetch)",
-  "wp_remote_post(": "SSRF (unvalidated URL fetch)",
-  "file_get_contents(": "SSRF / file read",
-  "extract(": "Variable injection (-> LFI/RCE without EXTR_SKIP)",
-  "call_user_func(": "Dynamic dispatch (attacker-controlled callback)",
-  "call_user_func_array(": "Dynamic dispatch",
-  "create_function(": "RCE (deprecated eval wrapper)",
-  "preg_replace(": "RCE (if /e modifier or code in pattern)"
-};
-var AUTH_GATES = [
-  "check_ajax_referer",
-  "check_admin_referer",
-  "wp_verify_nonce",
-  "current_user_can",
-  "is_user_logged_in",
-  "JSession::checkToken",
-  "->authorise(",
-  "->authorize(",
-  "permission_callback"
-];
-var TARGET_EXTS = new Set([
-  ".php",
-  ".phtml",
-  ".php5",
-  ".php7",
-  ".inc",
-  ".module",
-  ".install"
-]);
-var SKIP_PARTS = new Set(["vendor", "node_modules", ".git", "tests", "test"]);
-var LIB_PARTS = new Set([
-  "lib",
-  "libraries",
-  "third-party",
-  "third_party",
-  "libs"
-]);
-function escapeRegExp(s) {
-  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function lineno(text, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++) {
-    if (text.charCodeAt(i) === 10)
-      n++;
-  }
-  return n;
-}
-function iterSourceFiles(root, maxFiles = 5000) {
-  const out = [];
-  const walk = (dir) => {
-    if (out.length >= maxFiles)
-      return;
-    let entries;
-    try {
-      entries = readdirSync(dir);
-    } catch {
-      return;
-    }
-    for (const name of entries) {
-      if (out.length >= maxFiles)
-        return;
-      const full = join(dir, name);
-      let st;
-      try {
-        st = statSync(full);
-      } catch {
-        continue;
-      }
-      if (st.isDirectory()) {
-        if (SKIP_PARTS.has(name) || LIB_PARTS.has(name))
-          continue;
-        walk(full);
-      } else if (st.isFile()) {
-        const dot = name.lastIndexOf(".");
-        const ext = dot >= 0 ? name.slice(dot).toLowerCase() : "";
-        if (!TARGET_EXTS.has(ext))
-          continue;
-        out.push(full);
-      }
-    }
-  };
-  walk(root);
-  return out;
-}
-function findFunctionBounds(text, funcStart) {
-  const brace = text.indexOf("{", funcStart);
-  if (brace === -1)
-    return null;
-  let depth = 0;
-  for (let i = brace;i < text.length; i++) {
-    const c = text[i];
-    if (c === "{")
-      depth++;
-    else if (c === "}") {
-      depth--;
-      if (depth === 0)
-        return [funcStart, i + 1];
-    }
-  }
-  return null;
-}
-function scanFile(path) {
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch {
-    return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
-  }
-  const endpoints = [];
-  for (const hook of NOPRIV_HOOKS) {
-    const re = new RegExp(escapeRegExp(hook), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      endpoints.push({ hook, line: lineno(text, m.index) });
-    }
-  }
-  const sinks = [];
-  for (const [sink, bugclass] of Object.entries(SINKS)) {
-    const re = new RegExp(escapeRegExp(sink), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
-    }
-  }
-  const gates = AUTH_GATES.filter((g) => text.includes(g));
-  const lines = text.split(`
-`).length;
-  return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
-}
-function traceFunction(path, symbol) {
-  let text;
-  try {
-    text = readFileSync(path, "utf8");
-  } catch {
-    return { file: path, symbol, definitions: [], definition_count: 0, error: "unreadable" };
-  }
-  const pattern = new RegExp(`function\\s+&?${escapeRegExp(symbol)}\\s*\\(`, "g");
-  const results = [];
-  let m;
-  while ((m = pattern.exec(text)) !== null) {
-    const bounds = findFunctionBounds(text, m.index);
-    if (!bounds)
-      continue;
-    const [start, end] = bounds;
-    const body = text.slice(start, end);
-    const bodyStartLine = lineno(text, start);
-    const bodyEndLine = lineno(text, end);
-    const innerSinks = [];
-    for (const [sink, bugclass] of Object.entries(SINKS)) {
-      const re = new RegExp(escapeRegExp(sink), "g");
-      let sm;
-      while ((sm = re.exec(body)) !== null) {
-        innerSinks.push({
-          sink,
-          class: bugclass,
-          line: bodyStartLine + body.slice(0, sm.index).split(`
-`).length - 1
-        });
-      }
-    }
-    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
-    results.push({
-      line: bodyStartLine,
-      line_end: bodyEndLine,
-      length: end - start,
-      sinks_in_scope: innerSinks,
-      auth_gates_in_scope: innerGates,
-      body_preview: body.slice(0, 4000)
-    });
-  }
-  return {
-    file: path,
-    symbol,
-    definitions: results,
-    definition_count: results.length
-  };
-}
-function grepInFunctions(root, sink, maxHits = 50) {
-  const hits = [];
-  for (const p of iterSourceFiles(root)) {
-    if (hits.length >= maxHits)
-      break;
-    let text;
-    try {
-      text = readFileSync(p, "utf8");
-    } catch {
-      continue;
-    }
-    const re = new RegExp(escapeRegExp(sink), "g");
-    let m;
-    while ((m = re.exec(text)) !== null) {
-      const line = lineno(text, m.index);
-      const head = text.slice(0, m.index);
-      const funcRe = /function\s+&?\w+\s*\(/g;
-      const funcs = [];
-      let fm;
-      while ((fm = funcRe.exec(head)) !== null)
-        funcs.push(fm);
-      if (funcs.length === 0)
-        continue;
-      const fstart = funcs[funcs.length - 1].index;
-      const bounds = findFunctionBounds(text, fstart);
-      if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
-        continue;
-      const body = text.slice(bounds[0], bounds[1]);
-      const gates = AUTH_GATES.filter((g) => body.includes(g));
-      hits.push({
-        file: p,
-        line,
-        sink,
-        auth_gates_in_scope: gates,
-        guarded: gates.length > 0
-      });
-      if (hits.length >= maxHits)
-        break;
-    }
-  }
-  return hits;
-}
+// src/server.ts
+init_scanner();
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -22002,6 +22010,7 @@ async function nvdLookup(cveId) {
 }
 
 // src/orchestrator.ts
+init_scanner();
 import { readFileSync as readFileSync4, existsSync as existsSync3, statSync as statSync2 } from "node:fs";
 import { join as join4 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
@@ -22225,6 +22234,159 @@ function manualForTool(toolName) {
   return null;
 }
 
+// src/evidence.ts
+import { createHash as createHash2 } from "node:crypto";
+var REDACTION_PATTERNS = [
+  [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
+  [/(api[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(access[_-]?token\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(secret\s*[:=]\s*)["']?[A-Za-z0-9._/-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(password\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
+  [/(passwd\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
+  [/(private[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9+/=_-]{16,}["']?/gi, "$1[REDACTED]"],
+  [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
+  [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
+  [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
+  [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
+  [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
+  [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
+  [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
+  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
+];
+function redactSecrets(text) {
+  let out = text;
+  for (const [re, repl] of REDACTION_PATTERNS) {
+    out = out.replace(re, repl);
+  }
+  return out;
+}
+function redactObject(value) {
+  if (typeof value === "string")
+    return redactSecrets(value);
+  if (Array.isArray(value))
+    return value.map((v) => redactObject(v));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = redactObject(v);
+    }
+    return out;
+  }
+  return value;
+}
+function sha256(text) {
+  return createHash2("sha256").update(text).digest("hex");
+}
+var evidenceCounter = 0;
+function nextEvidenceId() {
+  evidenceCounter += 1;
+  return `EV-${String(evidenceCounter).padStart(6, "0")}`;
+}
+function makeEvidence(input) {
+  const artifacts = (input.artifacts ?? []).map((a) => {
+    const content = redactSecrets(a.content);
+    return { name: a.name, kind: a.kind, content, sha256: sha256(content) };
+  });
+  return {
+    evidence_id: nextEvidenceId(),
+    type: input.type,
+    description: redactSecrets(input.description),
+    source: input.source ? redactObject(input.source) : undefined,
+    sink: input.sink ? redactObject(input.sink) : undefined,
+    artifacts,
+    recorded: new Date().toISOString()
+  };
+}
+
+// src/finding.ts
+var LIFECYCLE_TRANSITIONS = {
+  detected: ["triaged", "rejected"],
+  triaged: ["hypothesis", "rejected", "out_of_scope"],
+  hypothesis: ["validating", "false_positive", "rejected", "blocked"],
+  validating: ["confirmed", "false_positive", "blocked", "out_of_scope"],
+  confirmed: [],
+  false_positive: [],
+  rejected: [],
+  blocked: [],
+  out_of_scope: []
+};
+function canTransition(from, to) {
+  const allowed = LIFECYCLE_TRANSITIONS[from] ?? [];
+  return allowed.includes(to);
+}
+var DEFAULT_WEIGHTS = {
+  static_analysis: 0.2,
+  data_flow: 0.25,
+  reachability: 0.15,
+  preconditions: 0.1,
+  runtime_validation: 0.2,
+  negative_control: 0.1
+};
+var confidenceWeights = { ...DEFAULT_WEIGHTS };
+function computeConfidence(factors) {
+  let score = 0;
+  for (const [key, weight] of Object.entries(confidenceWeights)) {
+    if (factors[key] === true)
+      score += weight;
+  }
+  return Math.round(score * 100) / 100;
+}
+function confidenceLevel(score) {
+  if (score >= 0.9)
+    return "confirmed";
+  if (score >= 0.7)
+    return "high_confidence";
+  if (score >= 0.5)
+    return "likely";
+  if (score >= 0.3)
+    return "suspected";
+  return "informational";
+}
+var findingCounter = 0;
+function nextFindingId() {
+  findingCounter += 1;
+  return `BS-${new Date().getUTCFullYear()}-${String(findingCounter).padStart(6, "0")}`;
+}
+function makeFinding(input) {
+  const now = new Date().toISOString();
+  const status = input.status ?? "detected";
+  const factors = confidenceFactorsFor(input);
+  const confidence = computeConfidence(factors);
+  return {
+    id: nextFindingId(),
+    status,
+    title: input.title,
+    target: input.target,
+    classification: {
+      severity: input.severity,
+      cwe: input.cwe,
+      cwe_name: input.cweName,
+      cwe_confidence: input.cweConfidence
+    },
+    confidence,
+    confidence_level: confidenceLevel(confidence),
+    source: input.source,
+    flow: input.flow ?? [],
+    sink: input.sink,
+    validation: { performed: false },
+    evidence: [],
+    chain: { id: input.chainId ?? null, name: input.chainName },
+    impact: {},
+    remediation: {},
+    timestamps: { created: now, updated: now }
+  };
+}
+function confidenceFactorsFor(_input) {
+  return {
+    static_analysis: true,
+    data_flow: false,
+    reachability: false,
+    preconditions: false,
+    runtime_validation: false,
+    negative_control: false
+  };
+}
+
 // src/orchestrator.ts
 var _chainsCache = null;
 function loadChains() {
@@ -22393,15 +22555,41 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   }
   report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
   const rank = { critical: 0, high: 1, medium: 2, low: 3 };
-  const findings = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
+  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
+  const findings = matchedSorted.map((f) => {
+    const chain = chainById.get(f.chain_id);
+    const severity = f.severity ?? "medium";
+    const finding = makeFinding({
+      title: f.name,
+      target: { type: "source", path: target },
+      severity,
+      source: { type: "static_sink_signal", name: f.chain_id },
+      sink: { type: f.chain_id, symbol: f.name },
+      chainId: f.chain_id,
+      chainName: f.name,
+      status: "hypothesis"
+    });
+    const ev = makeEvidence({
+      type: "sink_location",
+      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
+      sink: { chain_id: f.chain_id, name: f.name, severity },
+      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
+    });
+    finding.evidence.push(ev);
+    return finding;
+  });
   report.findings = findings.map((f) => ({
-    chain_id: f.chain_id,
-    name: f.name,
-    severity: f.severity,
-    status: "HYPOTHESIS"
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    evidence_count: f.evidence.length
   }));
   report.status = "COMPLETE";
-  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting.";
+  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
   if (remember) {
     let captured = 0;
     for (const mc of blitz.matched_chains) {
@@ -22967,6 +23155,151 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
   return result;
 }
 
+// src/dataflow.ts
+init_scanner();
+var SOURCES = {
+  $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
+  $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
+  $_REQUEST: { id: "http_request", label: "HTTP request (merged)", attacker_controlled: true },
+  $_COOKIE: { id: "http_cookie", label: "HTTP cookie", attacker_controlled: true },
+  $_FILES: { id: "uploaded_file", label: "Uploaded file", attacker_controlled: true },
+  $_SERVER: { id: "http_header", label: "HTTP header / server env", attacker_controlled: true },
+  "file_get_contents('php://input')": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  "php://input": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  json_decode: { id: "json_input", label: "JSON input", attacker_controlled: true },
+  getallheaders: { id: "http_header", label: "HTTP header", attacker_controlled: true },
+  $argv: { id: "cli_argument", label: "CLI argument", attacker_controlled: false },
+  getenv: { id: "environment_variable", label: "Environment variable", attacker_controlled: false },
+  "$wpdb->get_results": { id: "database_value", label: "Database value", attacker_controlled: false },
+  wp_remote_get: { id: "external_api", label: "External API data", attacker_controlled: false }
+};
+function classifySource(line) {
+  for (const [token, cls] of Object.entries(SOURCES)) {
+    if (line.includes(token))
+      return cls;
+  }
+  return null;
+}
+var SINK_CLASS_MAP = [
+  [/->query\(|\$wpdb->query|\$wpdb->get_var|\$wpdb->get_results|->whereRaw|->selectRaw/, { id: "sql_execution", category: "SQL execution", cwe: "CWE-89" }],
+  [/eval\(|assert\(|create_function\(|call_user_func\(|preg_replace\(/, { id: "code_execution", category: "Dynamic evaluation / code execution", cwe: "CWE-94" }],
+  [/system\(|exec\(|shell_exec\(|passthru\(|proc_open\(|popen\(/, { id: "command_execution", category: "Command execution", cwe: "CWE-78" }],
+  [/move_uploaded_file\(|file_put_contents\(|fwrite\(|fopen\(|unlink\(/, { id: "file_operations", category: "File operations", cwe: "CWE-434" }],
+  [/include\(|require\(|include_once\(|require_once\(/, { id: "file_inclusion", category: "File inclusion", cwe: "CWE-98" }],
+  [/unserialize\(|maybe_unserialize\(/, { id: "deserialization", category: "Deserialization", cwe: "CWE-502" }],
+  [/wp_remote_get\(|wp_remote_post\(|file_get_contents\(|curl_exec\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
+  [/header\(|wp_redirect\(|wp_safe_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
+  [/echo\s|print\s|printf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
+  [/simplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
+  [/ZipArchive|PharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
+];
+function classifySink2(sink) {
+  for (const [re, cls] of SINK_CLASS_MAP) {
+    if (re.test(sink))
+      return cls;
+  }
+  return null;
+}
+var SANITIZERS = {
+  htmlspecialchars: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_html: { id: "html_escape", label: "HTML escape", neutralizes: ["html_render"] },
+  esc_attr: { id: "html_escape", label: "HTML attribute escape", neutralizes: ["html_render"] },
+  htmlentities: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_sql: { id: "sql_escape", label: "SQL escape", neutralizes: ["sql_execution"] },
+  "$wpdb->prepare": { id: "sql_prepare", label: "Prepared SQL statement", neutralizes: ["sql_execution"] },
+  "->prepare(": { id: "sql_prepare", label: "Prepared statement", neutralizes: ["sql_execution"] },
+  filter_var: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  filter_input: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  sanitize_text_field: { id: "wp_sanitize", label: "WordPress sanitize", neutralizes: ["html_render"] },
+  sanitize_file_name: { id: "wp_sanitize_file", label: "File-name sanitize", neutralizes: ["file_operations", "file_inclusion"] },
+  wp_verify_nonce: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  check_ajax_referer: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  escapeshellarg: { id: "shell_escape", label: "Shell argument escape", neutralizes: ["command_execution"] },
+  escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
+  intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
+};
+function findSanitizers(line) {
+  const out = [];
+  for (const [token, san] of Object.entries(SANITIZERS)) {
+    if (line.includes(token))
+      out.push(san);
+  }
+  return out;
+}
+function isSanitized(sanitizers, sinkCategory) {
+  return sanitizers.some((s) => s.neutralizes.includes(sinkCategory) || s.neutralizes.includes("authorization"));
+}
+function traceDataFlow(path) {
+  const scan = scanFile(path);
+  const result = { file: path, candidates: [], sanitized: [], authorized: [] };
+  if (scan.error)
+    return result;
+  let text;
+  try {
+    const { readFileSync } = __require("node:fs");
+    text = readFileSync(path, "utf8");
+  } catch {
+    return result;
+  }
+  const lines = text.split(`
+`);
+  for (const s of scan.sinks) {
+    const sinkClass = classifySink2(s.sink);
+    if (!sinkClass)
+      continue;
+    const start = Math.max(0, s.line - 15);
+    const window = lines.slice(start, s.line).join(`
+`);
+    const source = classifySource(window);
+    const sanitizers = findSanitizers(window);
+    const authGates = AUTH_GATES.filter((g) => window.includes(g));
+    const edge = {
+      source,
+      sanitizers,
+      auth_gates: authGates,
+      sink: sinkClass,
+      sink_line: s.line,
+      sink_token: s.sink
+    };
+    if (authGates.length > 0) {
+      result.authorized.push(edge);
+      continue;
+    }
+    if (isSanitized(sanitizers, sinkClass.category)) {
+      result.sanitized.push(edge);
+      continue;
+    }
+    result.candidates.push(edge);
+  }
+  return result;
+}
+function groupVariants(results) {
+  const groups = new Map;
+  for (const r of results) {
+    for (const c of r.candidates) {
+      const sig = `${c.sink?.category ?? "?"}|${c.source?.id ?? "unknown"}`;
+      const g = groups.get(sig);
+      if (g) {
+        g.occurrences += 1;
+        if (!g.files.includes(r.file))
+          g.files.push(r.file);
+      } else {
+        groups.set(sig, {
+          signature: sig,
+          root_cause: `unsanitized ${c.source?.label ?? "unknown"} reaching ${c.sink?.category ?? "sink"}`,
+          sink_category: c.sink?.category ?? "?",
+          cwe: c.sink?.cwe,
+          occurrences: 1,
+          files: [r.file]
+        });
+      }
+    }
+  }
+  return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
@@ -23424,6 +23757,97 @@ function createServer() {
   }, async ({ topic, limit }) => {
     return { content: [{ type: "text", text: JSON.stringify(templateLookup(topic, limit ?? 10)) }] };
   });
+  server.registerTool("finding_create", {
+    title: "Create a canonical finding",
+    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending).",
+    inputSchema: {
+      title: string2().describe("Finding title"),
+      target_type: string2().optional().describe("Target type (web/api/source/mobile/network/other)"),
+      host: string2().optional().describe("Target host"),
+      endpoint: string2().optional().describe("Target endpoint/path"),
+      severity: string2().describe("Severity: critical/high/medium/low/informational"),
+      cwe: string2().optional().describe("CWE id (e.g. CWE-89)"),
+      source_type: string2().describe("Source type (e.g. request_parameter, post_body, header, cookie, file)"),
+      source_name: string2().describe("Source name"),
+      sink_type: string2().describe("Sink type (e.g. sql_execution, command_execution, file_operations)"),
+      sink_symbol: string2().optional().describe("Sink symbol (e.g. '->query(')"),
+      chain_id: string2().optional().describe("Escalation chain id")
+    }
+  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id }) => {
+    const f = makeFinding({
+      title,
+      target: { type: target_type ?? "web", host, endpoint },
+      severity: severity ?? "medium",
+      cwe,
+      source: { type: source_type, name: source_name },
+      sink: { type: sink_type, symbol: sink_symbol },
+      chainId: chain_id ?? null,
+      status: "detected"
+    });
+    return { content: [{ type: "text", text: JSON.stringify(f) }] };
+  });
+  server.registerTool("finding_transition", {
+    title: "Advance a finding lifecycle",
+    description: "FINDINGS: advance a finding through its strict lifecycle (detected->triaged->hypothesis->validating->confirmed). Rejects illegal transitions.",
+    inputSchema: {
+      status: string2().describe("Current status"),
+      to: string2().describe("Target status (triaged/hypothesis/validating/confirmed/false_positive/rejected/blocked/out_of_scope)")
+    }
+  }, async ({ status, to }) => {
+    const ok = canTransition(status, to);
+    return { content: [{ type: "text", text: JSON.stringify({ from: status, to, legal: ok }) }] };
+  });
+  server.registerTool("confidence_score", {
+    title: "Compute deterministic confidence",
+    description: "FINDINGS: compute a deterministic weighted confidence score (static/data-flow/reachability/preconditions/validation/negative-control). Never an AI opinion.",
+    inputSchema: {
+      static_analysis: boolean2().optional(),
+      data_flow: boolean2().optional(),
+      reachability: boolean2().optional(),
+      preconditions: boolean2().optional(),
+      runtime_validation: boolean2().optional(),
+      negative_control: boolean2().optional()
+    }
+  }, async (factors) => {
+    const score = computeConfidence(factors);
+    return { content: [{ type: "text", text: JSON.stringify({ score, level: confidenceLevel(score) }) }] };
+  });
+  server.registerTool("redact", {
+    title: "Redact secrets from text",
+    description: "EVIDENCE: redact passwords/API keys/tokens/cookies/private keys from text before persisting evidence or reporting.",
+    inputSchema: { text: string2().describe("Text to redact") }
+  }, async ({ text }) => {
+    return { content: [{ type: "text", text: JSON.stringify({ redacted: redactSecrets(text) }) }] };
+  });
+  server.registerTool("trace_data_flow", {
+    title: "Trace source-to-sink data flow",
+    description: "EAGLE-EYE: trace data flow in a file — classify sources, sinks, sanitizers, and authorization gates. Returns candidates (reachable+unsanitized), sanitized (not findings), and authorized (lower priority).",
+    inputSchema: { path: string2().describe("Source file path") }
+  }, async ({ path }) => {
+    const r = traceDataFlow(path);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
+  server.registerTool("variant_analysis", {
+    title: "Group findings by root cause",
+    description: "EAGLE-EYE: variant analysis — group data-flow candidates by root cause (sink category + source), deduplicating identical patterns across files.",
+    inputSchema: { path: string2().describe("Source directory path") }
+  }, async ({ path }) => {
+    await Promise.resolve().then(() => init_scanner());
+    const files = iterSourceFiles(path, 5000);
+    const results = files.map((f) => traceDataFlow(f));
+    const groups = groupVariants(results);
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          files_analyzed: files.length,
+          total_candidates: results.reduce((n, r) => n + r.candidates.length, 0),
+          variant_groups: groups.length,
+          groups
+        })
+      }]
+    };
+  });
   return server;
 }
 async function serve() {

package/docs/findings.md

@@ -0,0 +1,95 @@
+# Findings & Evidence Engine
+
+Blitz Strike follows one principle: **a scanner hit is a hypothesis; evidence is
+the verdict.**
+
+This document describes the canonical finding model, the strict lifecycle, and
+the deterministic confidence engine. No other part of the codebase invents its
+own finding shape — every producer funnels into these modules.
+
+## Finding schema
+
+`src/finding.ts` defines the single `Finding` model:
+
+| Field | Meaning |
+| :--- | :--- |
+| `id` | Canonical id, `BS-YYYY-NNNNNN` |
+| `status` | Lifecycle state (see below) |
+| `title` | Human-readable title |
+| `target` | `type` (web/api/source/mobile/network/other) + host/endpoint/path |
+| `classification` | severity, CWE id/name/confidence, CVSS (evidence-based) |
+| `confidence` | 0.0–1.0 deterministic score (NOT an AI opinion) |
+| `confidence_level` | informational / suspected / likely / high_confidence / confirmed |
+| `source` | attacker-controlled source (type + name + location) |
+| `flow` | data-flow path (source → transforms → sink) |
+| `sink` | security-sensitive operation (type + symbol + location) |
+| `validation` | performed + baseline + negative_control |
+| `evidence` | array of integrity-tagged evidence records |
+| `chain` | escalation chain id/name |
+| `impact` / `remediation` | impact + fix |
+| `timestamps` | created / updated |
+
+## Lifecycle
+
+Strict, machine-readable state machine (`transition()` rejects illegal moves):
+
+```
+detected → triaged → hypothesis → validating → confirmed
+                 ↘ rejected      ↘ false_positive
+                 ↘ out_of_scope   ↘ blocked
+                                  ↘ out_of_scope
+```
+
+`confirmed`, `false_positive`, `rejected`, `blocked`, `out_of_scope` are
+terminal.
+
+## Severity vs confidence
+
+- **Severity** = impact (`critical` / `high` / `medium` / `low` / `informational`).
+- **Confidence** = certainty (deterministic 0.0–1.0).
+
+They are never combined. "Severity CRITICAL + confidence 0.41" = *potentially
+critical, insufficient evidence*. "Severity MEDIUM + confidence 0.98" = *medium
+impact, highly reliable*.
+
+## Confidence engine
+
+`computeConfidence()` is deterministic and weighted (configurable via
+`setConfidenceWeights()`):
+
+| Factor | Default weight |
+| :--- | :--- |
+| static_analysis | 0.20 |
+| data_flow | 0.25 |
+| reachability | 0.15 |
+| preconditions | 0.10 |
+| runtime_validation | 0.20 |
+| negative_control | 0.10 |
+
+Levels: `0.00–0.29` informational · `0.30–0.49` suspected · `0.50–0.69` likely ·
+`0.70–0.89` high_confidence · `0.90–1.00` confirmed.
+
+A high confidence score is **never** proof by itself — confirmation requires
+validation + evidence.
+
+## Evidence engine
+
+`src/evidence.ts`:
+
+- **Schema** — `evidence_id`, `type`, `description`, `source`, `sink`, `artifacts[]`, `recorded`.
+- **Integrity** — every artifact carries a SHA-256 (`sha256()`), verified by `verifyEvidence()`.
+- **Secret redaction** — `redactSecrets()` strips passwords, API keys, tokens,
+  cookies, `Authorization` headers, private keys before persistence/report/log/context.
+- **Append-only** — confirmed evidence is never silently rewritten.
+
+## MCP tools
+
+| Tool | Purpose |
+| :--- | :--- |
+| `finding_create` | create a canonical finding (default `detected`) |
+| `finding_transition` | advance lifecycle (rejects illegal moves) |
+| `confidence_score` | deterministic weighted confidence |
+| `redact` | redact secrets from arbitrary text |
+
+`run_engagement` now emits canonical findings (status `hypothesis`, carrying
+static + sink evidence) instead of ad-hoc `{chain_id, name, severity}` tuples.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {