blitzstrike 1.0.22 → 1.0.23

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -43,6 +44,7 @@ var __esm = (fn, res, err) => () => {
     throw err[0];
   return res;
 };
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {
@@ -29759,6 +29761,18 @@ function listMemory() {
     entries: entries.sort((a, b) => a.created < b.created ? 1 : -1).map((e) => ({ id: e.id, topic: e.topic, type: e.type, verified: e.verified, created: e.created }))
   };
 }
+function forget(id) {
+  const { writeFileSync } = __require("node:fs");
+  const entries = loadMemory();
+  const kept = entries.filter((e) => e.id !== id);
+  if (kept.length === entries.length) {
+    return { removed: false, id, note: "not found" };
+  }
+  writeFileSync(MEMORY_PATH, kept.map((e) => JSON.stringify(e)).join(`
+`) + (kept.length ? `
+` : ""));
+  return { removed: true, id };
+}
 function rememberIfAbsent(topic, content, type, tags, source, verified) {
   const r = remember(topic, content, type, tags, source, verified);
   return r.saved === true;
@@ -29954,6 +29968,12 @@ var DEFAULT_WEIGHTS = {
   negative_control: 0.1
 };
 var confidenceWeights = { ...DEFAULT_WEIGHTS };
+function setConfidenceWeights(weights) {
+  confidenceWeights = { ...DEFAULT_WEIGHTS, ...weights };
+}
+function getConfidenceWeights() {
+  return { ...confidenceWeights };
+}
 function computeConfidence(factors) {
   let score = 0;
   for (const [key, weight] of Object.entries(confidenceWeights)) {
@@ -30024,6 +30044,13 @@ function transition(finding, to) {
   const updated = { ...finding, status: to, timestamps: { ...finding.timestamps, updated: new Date().toISOString() } };
   return updated;
 }
+function attachEvidence(finding, evidence) {
+  return {
+    ...finding,
+    evidence: [...finding.evidence, evidence],
+    timestamps: { ...finding.timestamps, updated: new Date().toISOString() }
+  };
+}
 function confirmFinding(finding, opts) {
   const evidence = opts.evidence.map((e) => makeEvidence(e));
   const negativeControl = opts.negative_control ?? true;
@@ -30429,7 +30456,7 @@ function ensureTool(name) {
 }
 
 // src/intel.ts
-import { readFileSync as readFileSync6, existsSync as existsSync5 } from "node:fs";
+import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { readdirSync as readdirSync3 } from "node:fs";
@@ -30438,7 +30465,7 @@ var ROOT3 = join6(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var INTEL = join6(ROOT3, "intelligence");
 function loadJson(name) {
   const p = join6(INTEL, `${name}.json`);
-  if (!existsSync5(p))
+  if (!existsSync4(p))
     return null;
   try {
     return JSON.parse(readFileSync6(p, "utf8"));
@@ -30454,7 +30481,6 @@ function detectWaf(headers, body = "") {
   const bodySigs = sigs.body_signatures ?? [];
   const matches = [];
   const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
-  const headerVals = Object.values(headers).join(" ").toLowerCase();
   for (const s of headerSigs) {
     const h = (s.header ?? "").toLowerCase();
     const pattern = (s.pattern ?? "").toLowerCase();
@@ -30553,12 +30579,12 @@ var PACKAGE_PAYLOADS = join6(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join6(ROOT3, "templates");
 var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join6(homedir2(), ".blitzstrike", "data");
 function payloadsDir() {
-  if (existsSync5(PACKAGE_PAYLOADS))
+  if (existsSync4(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
   return join6(DATA_ROOT, "payloads");
 }
 function templatesDir() {
-  if (existsSync5(PACKAGE_TEMPLATES))
+  if (existsSync4(PACKAGE_TEMPLATES))
     return PACKAGE_TEMPLATES;
   return join6(DATA_ROOT, "templates");
 }
@@ -31132,7 +31158,6 @@ function walkExpression(node, env, summaries, findings, suppressed, file) {
         const sanitizers = tainted.flatMap((t) => t.sanitizers);
         const inlineSan = findSanitizers(JSON.stringify(node));
         const san = [...sanitizers, ...inlineSan].filter((s, i, arr) => arr.indexOf(s) === i);
-        const authGated = false;
         const cls = sink.cls;
         if (!isSanitized(san, cls.id)) {
           findings.push({
@@ -49403,7 +49428,6 @@ var phpAdapter = {
         }
       }
     }
-    const superSources = new Map;
     for (const n of nodes) {
       if (n.kind === "assign") {
         const target = phpVar(n.left);
@@ -49476,7 +49500,7 @@ function jsWalk(node, out) {
 var jsAdapter = {
   language: "javascript",
   extensions: [".js", ".mjs", ".cjs", ".jsx", ".ts", ".tsx"],
-  parse(code, file) {
+  parse(code, _file) {
     let ast;
     try {
       ast = parse6(code, {
@@ -49585,7 +49609,7 @@ var PY_SANITIZERS = [
 var pythonAdapter = {
   language: "python",
   extensions: [".py", ".pyw"],
-  parse(code, file) {
+  parse(code, _file) {
     const tree = parser2.parse(code);
     const sources = [];
     const sinks = [];
@@ -49703,7 +49727,7 @@ var JAVA_SANITIZERS = [
 var javaAdapter = {
   language: "java",
   extensions: [".java"],
-  parse(code, file) {
+  parse(code, _file) {
     const sources = [];
     const sinks = [];
     const sanitizers = [];
@@ -50231,10 +50255,10 @@ async function liveRecon(target, includeActive = false) {
 }
 
 // src/strike.ts
-var TIMEOUT_MS3 = 15000;
-async function httpRequest(url, method, data, headers) {
+var DEFAULT_TIMEOUT_MS = 15000;
+async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEOUT_MS) {
   const controller = new AbortController;
-  const t = setTimeout(() => controller.abort(), TIMEOUT_MS3);
+  const t = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const res = await fetch(url, {
       method,
@@ -50272,12 +50296,13 @@ async function strikeVerify(input) {
   const marker = input.marker ?? defaultMarker();
   const control = input.control ?? defaultMarker();
   const baseUrl = input.url;
+  const timeoutMs = input.timeout ?? DEFAULT_TIMEOUT_MS;
   const baselineTarget = inject(baseUrl, "", param).replace(/[?&]q=$/, "").replace(/[?&]$/, "");
   const markerTarget = inject(baseUrl, marker, param);
   const controlTarget = inject(baseUrl, control, param);
-  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers);
-  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers);
-  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers);
+  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers, timeoutMs);
+  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers, timeoutMs);
+  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers, timeoutMs);
   if (baseline.status === 0 || markerResp.status === 0) {
     return {
       status: "blocked",
@@ -50478,7 +50503,8 @@ function createServer() {
       headers: hdrs,
       marker,
       control,
-      param
+      param,
+      timeout: timeout ? timeout * 1000 : undefined
     });
     return {
       content: [{
@@ -50703,6 +50729,13 @@ function createServer() {
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(listMemory()) }] };
   });
+  server.registerTool("memory_forget", {
+    title: "Forget a memory entry",
+    description: "MEMORY: remove a memory entry by id (append-only store; 'forget' = tombstone).",
+    inputSchema: { id: string2().describe("Memory entry id (from memory_list)") }
+  }, async ({ id }) => {
+    return { content: [{ type: "text", text: JSON.stringify(forget(id)) }] };
+  });
   server.registerTool("read_tool_manual", {
     title: "Read a tool manual",
     description: "Read the full deep reference manual for a security tool (270+ manuals from kali-pentest, Apache-2.0).",
@@ -50886,6 +50919,44 @@ function createServer() {
     const score = computeConfidence(factors);
     return { content: [{ type: "text", text: JSON.stringify({ score, level: confidenceLevel(score) }) }] };
   });
+  server.registerTool("confidence_weights", {
+    title: "Get/set confidence weights",
+    description: "FINDINGS: inspect or override the deterministic confidence weights (configurable per the framework spec). Pass `set` (JSON object of weight overrides) to change them; omit to read the current weights.",
+    inputSchema: {
+      set: string2().optional().describe('JSON object of weight overrides (e.g. {"data_flow":0.3})')
+    }
+  }, async ({ set }) => {
+    if (set) {
+      let w;
+      try {
+        w = JSON.parse(set);
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
+      }
+      setConfidenceWeights(w);
+    }
+    return { content: [{ type: "text", text: JSON.stringify({ weights: getConfidenceWeights() }) }] };
+  });
+  server.registerTool("finding_attach_evidence", {
+    title: "Attach evidence to a finding",
+    description: "FINDINGS: attach a redacted, SHA-256-tagged evidence record to an existing canonical finding (without advancing its lifecycle).",
+    inputSchema: {
+      finding: string2().describe("JSON of the Finding object"),
+      type: string2().describe("Evidence type (source_location/response/validation_result/negative_control/...)"),
+      description: string2().describe("Evidence description"),
+      content: string2().optional().describe("Evidence artifact content")
+    }
+  }, async ({ finding, type, description, content }) => {
+    let f;
+    try {
+      f = JSON.parse(finding);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid finding JSON" }) }] };
+    }
+    const ev = makeEvidence({ type, description, artifacts: content ? [{ name: "artifact", kind: "evidence", content }] : [] });
+    const updated = attachEvidence(f, ev);
+    return { content: [{ type: "text", text: JSON.stringify(updated) }] };
+  });
   server.registerTool("redact", {
     title: "Redact secrets from text",
     description: "EVIDENCE: redact passwords/API keys/tokens/cookies/private keys from text before persisting evidence or reporting.",
@@ -51022,7 +51093,7 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync9, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { readFileSync as readFileSync9, existsSync as existsSync5, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
 import { join as join7, dirname } from "node:path";
 import { homedir as homedir3 } from "node:os";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
@@ -51062,7 +51133,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync6(join7(ROOT4, "chains.json")) && existsSync6(join7(ROOT4, "tools-catalog.json"));
+  const dataOk = existsSync5(join7(ROOT4, "chains.json")) && existsSync5(join7(ROOT4, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -51091,14 +51162,14 @@ function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
   const src = join7(ROOT4, "src", "index.ts");
-  if (which("bun") && existsSync6(src))
+  if (which("bun") && existsSync5(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
   const dist = join7(ROOT4, "dist", "index.js");
-  if (existsSync6(dist))
+  if (existsSync5(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
@@ -51112,7 +51183,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -51125,7 +51196,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (_command, _args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -51139,14 +51210,14 @@ function opencodeWrite(p) {
 function copyOpenCodeAgents() {
   const srcDir = join7(ROOT4, "opencode-agents");
   const dstDir = join7(homedir3(), ".config", "opencode", "agents");
-  if (!existsSync6(srcDir))
+  if (!existsSync5(srcDir))
     return;
-  if (!existsSync6(dstDir))
+  if (!existsSync5(dstDir))
     mkdirSync2(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
     const src = join7(srcDir, f);
     const dst = join7(dstDir, f);
-    if (existsSync6(src)) {
+    if (existsSync5(src)) {
       writeFileSync(dst, readFileSync9(src, "utf8"));
     }
   }
@@ -51154,9 +51225,9 @@ function copyOpenCodeAgents() {
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
+    let existing = existsSync5(p) ? readFileSync9(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -51173,9 +51244,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
+    let existing = existsSync5(p) ? readFileSync9(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -51206,70 +51277,70 @@ function detectAgents() {
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync6(claudeJson) || which("claude"),
+    installed: () => existsSync5(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
   const claudeDesktop = join7(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync6(claudeDesktop),
+    installed: () => existsSync5(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
   const cursor = join7(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync6(join7(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync5(join7(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
   const opencode = join7(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync6(join7(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync5(join7(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
   const codex = join7(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync6(join7(home, ".codex")) || which("codex"),
+    installed: () => existsSync5(join7(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
   const hermes = join7(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync6(join7(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync5(join7(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
   const gemini = join7(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync6(join7(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync5(join7(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
   const windsurf = join7(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync6(join7(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync5(join7(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
   const copilot = join7(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync6(join7(home, ".copilot")),
+    installed: () => existsSync5(join7(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
   const cline = join7(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync6(join7(home, ".cline")),
+    installed: () => existsSync5(join7(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -51313,14 +51384,14 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync11, existsSync as existsSync8 } from "node:fs";
+import { readFileSync as readFileSync11, existsSync as existsSync6 } from "node:fs";
 import { join as join9 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 var ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
     const p = join9(ROOT6, "package.json");
-    if (existsSync8(p))
+    if (existsSync6(p))
       return JSON.parse(readFileSync11(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.22",
+  "version": "1.0.23",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {