blitzstrike 1.0.22 → 1.0.24

package/dist/index.js

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -43,6 +44,7 @@ var __esm = (fn, res, err) => () => {
     throw err[0];
   return res;
 };
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS(function(exports) {
@@ -14820,10 +14822,10 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync10, readdirSync as readdirSync4, statSync as statSync3, rmSync } from "node:fs";
-import { join as join8 } from "node:path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync2, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync3, rmSync } from "node:fs";
+import { join as join9 } from "node:path";
 import { homedir as homedir4 } from "node:os";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -14836,9 +14838,9 @@ function countFiles(dir) {
   try {
     let n = 0;
     const walk = (d) => {
-      for (const e of readdirSync4(d, { withFileTypes: true })) {
+      for (const e of readdirSync5(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join8(d, e.name));
+          walk(join9(d, e.name));
         else
           n++;
       }
@@ -14852,8 +14854,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync3(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join8(DATA_ROOT2, "payloads");
-  const templatesPath = join8(DATA_ROOT2, "templates");
+  const payloadsPath = join9(DATA_ROOT2, "payloads");
+  const templatesPath = join9(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -14863,8 +14865,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join8(ROOT5, "payloads");
-  const localTemplates = join8(ROOT5, "templates");
+  const localPayloads = join9(ROOT6, "payloads");
+  const localTemplates = join9(ROOT6, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -14877,7 +14879,7 @@ function syncData() {
   }
   const gitOk = spawnSync3("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join8(DATA_ROOT2, ".tmp-clone");
+    const tmp = join9(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync(tmp, { recursive: true, force: true });
     const r = spawnSync3("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -14885,11 +14887,11 @@ function syncData() {
       const sparse = spawnSync3("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join8(tmp, "payloads"), payloadsPath);
+          copyDir(join9(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join8(tmp, "templates"), templatesPath);
+          copyDir(join9(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -14910,19 +14912,19 @@ function copyDir(src, dst) {
 }
 function manualCopy(src, dst) {
   mkdirSync3(dst, { recursive: true });
-  for (const e of readdirSync4(src, { withFileTypes: true })) {
-    const s = join8(src, e.name);
-    const d = join8(dst, e.name);
+  for (const e of readdirSync5(src, { withFileTypes: true })) {
+    const s = join9(src, e.name);
+    const d = join9(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync2(d, readFileSync10(s));
+      writeFileSync2(d, readFileSync11(s));
   }
 }
-var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var ROOT6, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT5 = join8(fileURLToPath6(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join8(homedir4(), ".blitzstrike", "data");
+  ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join9(homedir4(), ".blitzstrike", "data");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -29759,6 +29761,18 @@ function listMemory() {
     entries: entries.sort((a, b) => a.created < b.created ? 1 : -1).map((e) => ({ id: e.id, topic: e.topic, type: e.type, verified: e.verified, created: e.created }))
   };
 }
+function forget(id) {
+  const { writeFileSync } = __require("node:fs");
+  const entries = loadMemory();
+  const kept = entries.filter((e) => e.id !== id);
+  if (kept.length === entries.length) {
+    return { removed: false, id, note: "not found" };
+  }
+  writeFileSync(MEMORY_PATH, kept.map((e) => JSON.stringify(e)).join(`
+`) + (kept.length ? `
+` : ""));
+  return { removed: true, id };
+}
 function rememberIfAbsent(topic, content, type, tags, source, verified) {
   const r = remember(topic, content, type, tags, source, verified);
   return r.saved === true;
@@ -29954,6 +29968,12 @@ var DEFAULT_WEIGHTS = {
   negative_control: 0.1
 };
 var confidenceWeights = { ...DEFAULT_WEIGHTS };
+function setConfidenceWeights(weights) {
+  confidenceWeights = { ...DEFAULT_WEIGHTS, ...weights };
+}
+function getConfidenceWeights() {
+  return { ...confidenceWeights };
+}
 function computeConfidence(factors) {
   let score = 0;
   for (const [key, weight] of Object.entries(confidenceWeights)) {
@@ -30024,6 +30044,13 @@ function transition(finding, to) {
   const updated = { ...finding, status: to, timestamps: { ...finding.timestamps, updated: new Date().toISOString() } };
   return updated;
 }
+function attachEvidence(finding, evidence) {
+  return {
+    ...finding,
+    evidence: [...finding.evidence, evidence],
+    timestamps: { ...finding.timestamps, updated: new Date().toISOString() }
+  };
+}
 function confirmFinding(finding, opts) {
   const evidence = opts.evidence.map((e) => makeEvidence(e));
   const negativeControl = opts.negative_control ?? true;
@@ -30429,7 +30456,7 @@ function ensureTool(name) {
 }
 
 // src/intel.ts
-import { readFileSync as readFileSync6, existsSync as existsSync5 } from "node:fs";
+import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
 import { join as join6 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { readdirSync as readdirSync3 } from "node:fs";
@@ -30438,7 +30465,7 @@ var ROOT3 = join6(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var INTEL = join6(ROOT3, "intelligence");
 function loadJson(name) {
   const p = join6(INTEL, `${name}.json`);
-  if (!existsSync5(p))
+  if (!existsSync4(p))
     return null;
   try {
     return JSON.parse(readFileSync6(p, "utf8"));
@@ -30454,7 +30481,6 @@ function detectWaf(headers, body = "") {
   const bodySigs = sigs.body_signatures ?? [];
   const matches = [];
   const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
-  const headerVals = Object.values(headers).join(" ").toLowerCase();
   for (const s of headerSigs) {
     const h = (s.header ?? "").toLowerCase();
     const pattern = (s.pattern ?? "").toLowerCase();
@@ -30553,12 +30579,12 @@ var PACKAGE_PAYLOADS = join6(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join6(ROOT3, "templates");
 var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join6(homedir2(), ".blitzstrike", "data");
 function payloadsDir() {
-  if (existsSync5(PACKAGE_PAYLOADS))
+  if (existsSync4(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
   return join6(DATA_ROOT, "payloads");
 }
 function templatesDir() {
-  if (existsSync5(PACKAGE_TEMPLATES))
+  if (existsSync4(PACKAGE_TEMPLATES))
     return PACKAGE_TEMPLATES;
   return join6(DATA_ROOT, "templates");
 }
@@ -31132,7 +31158,6 @@ function walkExpression(node, env, summaries, findings, suppressed, file) {
         const sanitizers = tainted.flatMap((t) => t.sanitizers);
         const inlineSan = findSanitizers(JSON.stringify(node));
         const san = [...sanitizers, ...inlineSan].filter((s, i, arr) => arr.indexOf(s) === i);
-        const authGated = false;
         const cls = sink.cls;
         if (!isSanitized(san, cls.id)) {
           findings.push({
@@ -49403,7 +49428,6 @@ var phpAdapter = {
         }
       }
     }
-    const superSources = new Map;
     for (const n of nodes) {
       if (n.kind === "assign") {
         const target = phpVar(n.left);
@@ -49476,7 +49500,7 @@ function jsWalk(node, out) {
 var jsAdapter = {
   language: "javascript",
   extensions: [".js", ".mjs", ".cjs", ".jsx", ".ts", ".tsx"],
-  parse(code, file) {
+  parse(code, _file) {
     let ast;
     try {
       ast = parse6(code, {
@@ -49585,7 +49609,7 @@ var PY_SANITIZERS = [
 var pythonAdapter = {
   language: "python",
   extensions: [".py", ".pyw"],
-  parse(code, file) {
+  parse(code, _file) {
     const tree = parser2.parse(code);
     const sources = [];
     const sinks = [];
@@ -49703,7 +49727,7 @@ var JAVA_SANITIZERS = [
 var javaAdapter = {
   language: "java",
   extensions: [".java"],
-  parse(code, file) {
+  parse(code, _file) {
     const sources = [];
     const sinks = [];
     const sanitizers = [];
@@ -50231,10 +50255,10 @@ async function liveRecon(target, includeActive = false) {
 }
 
 // src/strike.ts
-var TIMEOUT_MS3 = 15000;
-async function httpRequest(url, method, data, headers) {
+var DEFAULT_TIMEOUT_MS = 15000;
+async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEOUT_MS) {
   const controller = new AbortController;
-  const t = setTimeout(() => controller.abort(), TIMEOUT_MS3);
+  const t = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const res = await fetch(url, {
       method,
@@ -50272,12 +50296,13 @@ async function strikeVerify(input) {
   const marker = input.marker ?? defaultMarker();
   const control = input.control ?? defaultMarker();
   const baseUrl = input.url;
+  const timeoutMs = input.timeout ?? DEFAULT_TIMEOUT_MS;
   const baselineTarget = inject(baseUrl, "", param).replace(/[?&]q=$/, "").replace(/[?&]$/, "");
   const markerTarget = inject(baseUrl, marker, param);
   const controlTarget = inject(baseUrl, control, param);
-  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers);
-  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers);
-  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers);
+  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers, timeoutMs);
+  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers, timeoutMs);
+  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers, timeoutMs);
   if (baseline.status === 0 || markerResp.status === 0) {
     return {
       status: "blocked",
@@ -50367,6 +50392,421 @@ function resolveFinding(finding, verdict) {
   }
 }
 
+// src/cvss.ts
+var AV_WEIGHT = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+var AC_WEIGHT = { L: 0.77, H: 0.44 };
+var PR_WEIGHT = {
+  U: { N: 0.85, L: 0.62, H: 0.27 },
+  C: { N: 0.85, L: 0.68, H: 0.5 }
+};
+var UI_WEIGHT = { N: 0.85, R: 0.62 };
+var CIA_WEIGHT = { H: 0.56, L: 0.22, N: 0 };
+function roundup(value) {
+  return Math.ceil(value * 10) / 10;
+}
+function cvssBaseScore(input) {
+  const AV = input.AV ?? "N";
+  const AC = input.AC ?? "L";
+  const PR = input.PR ?? "N";
+  const UI = input.UI ?? "N";
+  const S = input.S ?? "U";
+  const C = input.C ?? "N";
+  const I = input.I ?? "N";
+  const A = input.A ?? "N";
+  const iscBase = 1 - (1 - CIA_WEIGHT[C]) * (1 - CIA_WEIGHT[I]) * (1 - CIA_WEIGHT[A]);
+  let impact;
+  if (S === "U") {
+    impact = 6.42 * iscBase;
+  } else {
+    impact = 7.52 * (iscBase - 0.029) - 3.25 * Math.pow(iscBase - 0.02, 15);
+  }
+  const exploitability = 8.22 * AV_WEIGHT[AV] * AC_WEIGHT[AC] * PR_WEIGHT[S][PR] * UI_WEIGHT[UI];
+  if (impact <= 0)
+    return 0;
+  if (S === "U") {
+    return roundup(Math.min(impact + exploitability, 10));
+  }
+  return roundup(Math.min(1.08 * (impact + exploitability), 10));
+}
+function cvssVector(input) {
+  const order = [
+    ["AV", input.AV ?? "N"],
+    ["AC", input.AC ?? "L"],
+    ["PR", input.PR ?? "N"],
+    ["UI", input.UI ?? "N"],
+    ["S", input.S ?? "U"],
+    ["C", input.C ?? "N"],
+    ["I", input.I ?? "N"],
+    ["A", input.A ?? "N"]
+  ];
+  return "CVSS:3.1/" + order.map(([k, v]) => `${k}:${v}`).join("/");
+}
+function cvssSeverity(score) {
+  if (score === 0)
+    return "none";
+  if (score < 4)
+    return "low";
+  if (score < 7)
+    return "medium";
+  if (score < 9)
+    return "high";
+  return "critical";
+}
+function cvssAssess(input) {
+  const score = cvssBaseScore(input);
+  return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
+}
+
+// src/dedup.ts
+function rootCauseSignature(finding) {
+  const sinkType = (finding.sink?.type ?? "unknown").toLowerCase();
+  const sourceType = (finding.source?.type ?? "unknown").toLowerCase();
+  const cwe = (finding.classification?.cwe ?? "").toUpperCase();
+  return [sinkType, sourceType, cwe].filter(Boolean).join("|");
+}
+function dedupFindings(findings) {
+  const groups = new Map;
+  for (const f of findings) {
+    const sig = rootCauseSignature(f);
+    const existing = groups.get(sig);
+    if (existing) {
+      existing.count += 1;
+      existing.findings.push(f);
+    } else {
+      groups.set(sig, { signature: sig, count: 1, representative: f, findings: [f] });
+    }
+  }
+  return [...groups.values()];
+}
+
+// src/report.ts
+function summarize(findings) {
+  const byStatus = {};
+  const bySeverity = {};
+  let evidenceArtifacts = 0;
+  for (const f of findings) {
+    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
+    const sev = f.classification?.severity ?? "informational";
+    bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
+    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+  }
+  const groups = dedupFindings(findings);
+  return {
+    total_findings: findings.length,
+    unique_root_causes: groups.length,
+    by_status: byStatus,
+    by_severity: bySeverity,
+    confirmed: byStatus["confirmed"] ?? 0,
+    false_positives: byStatus["false_positive"] ?? 0,
+    evidence_artifacts: evidenceArtifacts
+  };
+}
+function severityLabel(sev) {
+  const s = sev.toUpperCase();
+  if (s === "CRITICAL")
+    return "\uD83D\uDD34 CRITICAL";
+  if (s === "HIGH")
+    return "\uD83D\uDFE0 HIGH";
+  if (s === "MEDIUM")
+    return "\uD83D\uDFE1 MEDIUM";
+  if (s === "LOW")
+    return "\uD83D\uDD35 LOW";
+  return "⚪ INFORMATIONAL";
+}
+function reportMarkdown(findings, opts = {}) {
+  const summary = summarize(findings);
+  const lines = [];
+  lines.push(`# ${opts.title ?? "Blitz Strike — Security Assessment Report"}`);
+  lines.push("");
+  lines.push(`- Scope: ${opts.scope ?? "(unset)"}`);
+  lines.push(`- Blitz Strike version: ${opts.version ?? "unknown"}`);
+  if (opts.include_timestamp)
+    lines.push(`- Generated: ${new Date().toISOString()}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`| Metric | Value |`);
+  lines.push(`|--------|-------|`);
+  lines.push(`| Total findings | ${summary.total_findings} |`);
+  lines.push(`| Unique root causes | ${summary.unique_root_causes} |`);
+  lines.push(`| Confirmed | ${summary.confirmed} |`);
+  lines.push(`| False positives | ${summary.false_positives} |`);
+  lines.push(`| Evidence artifacts | ${summary.evidence_artifacts} |`);
+  lines.push("");
+  lines.push("### By status");
+  lines.push("");
+  for (const [status, n] of Object.entries(summary.by_status).sort()) {
+    lines.push(`- ${status}: ${n}`);
+  }
+  lines.push("");
+  lines.push("### By severity");
+  lines.push("");
+  for (const [sev, n] of Object.entries(summary.by_severity).sort()) {
+    lines.push(`- ${sev}: ${n}`);
+  }
+  lines.push("");
+  lines.push("## Findings");
+  lines.push("");
+  if (findings.length === 0) {
+    lines.push("_No findings._");
+    return lines.join(`
+`) + `
+`;
+  }
+  for (const f of findings) {
+    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
+    lines.push("");
+    lines.push(`- **Status**: \`${f.status}\``);
+    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
+    if (f.classification?.cwe)
+      lines.push(`- **CWE**: ${f.classification.cwe}`);
+    if (f.classification?.cvss_score != null)
+      lines.push(`- **CVSS**: ${f.classification.cvss_score} (${f.classification.cvss_vector ?? ""}) — ${cvssSeverity(f.classification.cvss_score)}`);
+    lines.push(`- **Source**: ${f.source?.type} \`${f.source?.name ?? ""}\``);
+    lines.push(`- **Sink**: ${f.sink?.type}${f.sink?.symbol ? ` \`${f.sink.symbol}\`` : ""}`);
+    if (f.target?.host || f.target?.endpoint)
+      lines.push(`- **Target**: ${[f.target.host, f.target.endpoint].filter(Boolean).join("")}`);
+    lines.push(`- **Evidence**: ${f.evidence?.length ?? 0} record(s)`);
+    if (f.remediation && Object.keys(f.remediation).length) {
+      lines.push(`- **Note**: ${JSON.stringify(f.remediation)}`);
+    }
+    lines.push("");
+  }
+  return lines.join(`
+`) + `
+`;
+}
+function reportJson(findings, opts = {}) {
+  const summary = summarize(findings);
+  const payload = {
+    title: opts.title ?? "Blitz Strike — Security Assessment Report",
+    scope: opts.scope ?? null,
+    version: opts.version ?? null,
+    summary,
+    findings,
+    integrity: sha256(JSON.stringify({ summary, findings }))
+  };
+  return JSON.stringify(payload, null, 2);
+}
+
+// src/benchmark.ts
+import { readFileSync as readFileSync9, readdirSync as readdirSync4 } from "node:fs";
+import { join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+var ROOT4 = join7(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var CORPUS = join7(ROOT4, "bench", "corpus");
+function parseCorpusFile(path) {
+  let text;
+  try {
+    text = readFileSync9(path, "utf8");
+  } catch {
+    return null;
+  }
+  const lines = text.split(`
+`);
+  let id = "";
+  let language = "php";
+  let vulnerable = true;
+  let sinkType;
+  let code = "";
+  let inCode = false;
+  let codeLang = "";
+  for (const line of lines) {
+    const m = line.match(/^\s*-\s*(id|language|vulnerable|sink_type)\s*:\s*(.+)$/i);
+    if (!inCode && m) {
+      const key = m[1].toLowerCase();
+      const val = m[2].trim();
+      if (key === "id")
+        id = val;
+      else if (key === "language")
+        language = val.toLowerCase();
+      else if (key === "vulnerable")
+        vulnerable = val === "true";
+      else if (key === "sink_type")
+        sinkType = val;
+      continue;
+    }
+    const start = line.match(/^```(\w*)/);
+    if (start && !inCode) {
+      inCode = true;
+      codeLang = start[1] || "php";
+      continue;
+    }
+    if (inCode && line.trim() === "```")
+      break;
+    if (inCode)
+      code += line + `
+`;
+  }
+  if (!id)
+    id = path.split("/").pop().replace(/\.md$/, "");
+  return { id, language: language || codeLang || "php", vulnerable, sink_type: sinkType, code: code.trim() };
+}
+function loadCorpus() {
+  let entries = [];
+  try {
+    for (const f of readdirSync4(CORPUS)) {
+      if (!f.endsWith(".md"))
+        continue;
+      const e = parseCorpusFile(join7(CORPUS, f));
+      if (e)
+        entries.push(e);
+    }
+  } catch {
+    entries = [];
+  }
+  return entries;
+}
+function detect(entry) {
+  const lang = entry.language;
+  if (lang === "php") {
+    const tmp = join7(ROOT4, "bench", ".tmp.php");
+    const { writeFileSync, rmSync } = __require("node:fs");
+    writeFileSync(tmp, entry.code);
+    const r = analyzeTaint(tmp);
+    rmSync(tmp, { force: true });
+    if (r.findings.length > 0)
+      return { detected: true, sinkKind: r.findings[0].sink };
+    return { detected: false };
+  }
+  const ext = { javascript: ".js", typescript: ".ts", python: ".py", java: ".java" }[lang] ?? ".php";
+  const r = analyzeTaintUniversal(entry.code, "bench." + ext);
+  if (r.findings.length > 0)
+    return { detected: true, sinkKind: r.findings[0].sink };
+  return { detected: false };
+}
+function runBenchmark() {
+  const entries = loadCorpus();
+  const results = entries.map((entry) => {
+    const { detected, sinkKind } = detect(entry);
+    const outcome = entry.vulnerable ? detected ? "tp" : "fn" : detected ? "fp" : "tn";
+    return { entry, detected, sink_kind: sinkKind, outcome };
+  });
+  const tp = results.filter((r) => r.outcome === "tp").length;
+  const tn = results.filter((r) => r.outcome === "tn").length;
+  const fp = results.filter((r) => r.outcome === "fp").length;
+  const fn = results.filter((r) => r.outcome === "fn").length;
+  const total = results.length;
+  const detectionRate = tp + fn > 0 ? tp / (tp + fn) : 0;
+  const falsePositiveRate = fp + tn > 0 ? fp / (fp + tn) : 0;
+  const precision = tp + fp > 0 ? tp / (tp + fp) : 0;
+  return {
+    total_cases: total,
+    tp,
+    tn,
+    fp,
+    fn,
+    detection_rate: Number(detectionRate.toFixed(3)),
+    false_positive_rate: Number(falsePositiveRate.toFixed(3)),
+    precision: Number(precision.toFixed(3)),
+    results: results.map((r) => ({ id: r.entry.id, language: r.entry.language, outcome: r.outcome, sink: r.sink_kind }))
+  };
+}
+
+// src/coverage.ts
+var SINK_CLASSES = [
+  "sql_execution",
+  "code_execution",
+  "command_execution",
+  "file_operations",
+  "file_inclusion",
+  "deserialization",
+  "http_request",
+  "redirect",
+  "html_render",
+  "xml_processing",
+  "archive_extraction",
+  "path_traversal"
+];
+var PHP_SINKS2 = {
+  sql_execution: true,
+  code_execution: true,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: true,
+  deserialization: true,
+  http_request: true,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var JS_SINKS2 = {
+  sql_execution: true,
+  code_execution: true,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: true,
+  deserialization: false,
+  http_request: true,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var PY_SINKS2 = {
+  sql_execution: true,
+  code_execution: true,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: false,
+  deserialization: true,
+  http_request: false,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var JAVA_SINKS2 = {
+  sql_execution: true,
+  code_execution: false,
+  command_execution: true,
+  file_operations: true,
+  file_inclusion: false,
+  deserialization: true,
+  http_request: true,
+  redirect: true,
+  html_render: true,
+  xml_processing: false,
+  archive_extraction: false,
+  path_traversal: true
+};
+var SINK_BY_LANG = {
+  php: PHP_SINKS2,
+  javascript: JS_SINKS2,
+  python: PY_SINKS2,
+  java: JAVA_SINKS2
+};
+function coverageMatrix() {
+  const langs = listLanguages();
+  const sinkCoverage = SINK_CLASSES.map((sink) => {
+    const covered = langs.map((l) => l.language).filter((lang) => SINK_BY_LANG[lang]?.[sink] === true);
+    return { sink, languages: covered };
+  });
+  let coveredPairs = 0;
+  for (const lang of langs) {
+    for (const sink of SINK_CLASSES) {
+      if (SINK_BY_LANG[lang.language]?.[sink])
+        coveredPairs += 1;
+    }
+  }
+  const totalPairs = langs.length * SINK_CLASSES.length;
+  return {
+    languages: langs,
+    sink_coverage: sinkCoverage,
+    counts: {
+      languages: langs.length,
+      sink_classes: SINK_CLASSES.length,
+      covered_pairs: coveredPairs,
+      total_pairs: totalPairs
+    },
+    coverage_ratio: Number((coveredPairs / totalPairs).toFixed(3))
+  };
+}
+
 // src/server.ts
 function createServer() {
   const server = new McpServer({
@@ -50478,7 +50918,8 @@ function createServer() {
       headers: hdrs,
       marker,
       control,
-      param
+      param,
+      timeout: timeout ? timeout * 1000 : undefined
     });
     return {
       content: [{
@@ -50703,6 +51144,13 @@ function createServer() {
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(listMemory()) }] };
   });
+  server.registerTool("memory_forget", {
+    title: "Forget a memory entry",
+    description: "MEMORY: remove a memory entry by id (append-only store; 'forget' = tombstone).",
+    inputSchema: { id: string2().describe("Memory entry id (from memory_list)") }
+  }, async ({ id }) => {
+    return { content: [{ type: "text", text: JSON.stringify(forget(id)) }] };
+  });
   server.registerTool("read_tool_manual", {
     title: "Read a tool manual",
     description: "Read the full deep reference manual for a security tool (270+ manuals from kali-pentest, Apache-2.0).",
@@ -50886,6 +51334,44 @@ function createServer() {
     const score = computeConfidence(factors);
     return { content: [{ type: "text", text: JSON.stringify({ score, level: confidenceLevel(score) }) }] };
   });
+  server.registerTool("confidence_weights", {
+    title: "Get/set confidence weights",
+    description: "FINDINGS: inspect or override the deterministic confidence weights (configurable per the framework spec). Pass `set` (JSON object of weight overrides) to change them; omit to read the current weights.",
+    inputSchema: {
+      set: string2().optional().describe('JSON object of weight overrides (e.g. {"data_flow":0.3})')
+    }
+  }, async ({ set }) => {
+    if (set) {
+      let w;
+      try {
+        w = JSON.parse(set);
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
+      }
+      setConfidenceWeights(w);
+    }
+    return { content: [{ type: "text", text: JSON.stringify({ weights: getConfidenceWeights() }) }] };
+  });
+  server.registerTool("finding_attach_evidence", {
+    title: "Attach evidence to a finding",
+    description: "FINDINGS: attach a redacted, SHA-256-tagged evidence record to an existing canonical finding (without advancing its lifecycle).",
+    inputSchema: {
+      finding: string2().describe("JSON of the Finding object"),
+      type: string2().describe("Evidence type (source_location/response/validation_result/negative_control/...)"),
+      description: string2().describe("Evidence description"),
+      content: string2().optional().describe("Evidence artifact content")
+    }
+  }, async ({ finding, type, description, content }) => {
+    let f;
+    try {
+      f = JSON.parse(finding);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid finding JSON" }) }] };
+    }
+    const ev = makeEvidence({ type, description, artifacts: content ? [{ name: "artifact", kind: "evidence", content }] : [] });
+    const updated = attachEvidence(f, ev);
+    return { content: [{ type: "text", text: JSON.stringify(updated) }] };
+  });
   server.registerTool("redact", {
     title: "Redact secrets from text",
     description: "EVIDENCE: redact passwords/API keys/tokens/cookies/private keys from text before persisting evidence or reporting.",
@@ -51013,6 +51499,72 @@ function createServer() {
     });
     return { content: [{ type: "text", text: JSON.stringify({ ...r, next_steps: guidance }) }] };
   });
+  server.registerTool("cvss_score", {
+    title: "Compute CVSS v3.1 base score",
+    description: "CVSS: compute a deterministic CVSS v3.1 base score + vector + severity from metric values (AV/AC/PR/UI/S/C/I/A). Self-computed, not read from NVD.",
+    inputSchema: {
+      AV: string2().optional().describe("Attack Vector: N/A/L/P"),
+      AC: string2().optional().describe("Attack Complexity: L/H"),
+      PR: string2().optional().describe("Privileges Required: N/L/H"),
+      UI: string2().optional().describe("User Interaction: N/R"),
+      S: string2().optional().describe("Scope: U/C"),
+      C: string2().optional().describe("Confidentiality: H/L/N"),
+      I: string2().optional().describe("Integrity: H/L/N"),
+      A: string2().optional().describe("Availability: H/L/N")
+    }
+  }, async (input) => {
+    return { content: [{ type: "text", text: JSON.stringify(cvssAssess(input)) }] };
+  });
+  server.registerTool("dedup_findings", {
+    title: "Deduplicate findings by root cause",
+    description: "FINDINGS: collapse a list of findings that share a root cause (sink type + source type + CWE) into one group per root cause.",
+    inputSchema: {
+      findings: string2().describe("JSON array of Finding objects")
+    }
+  }, async ({ findings }) => {
+    let list;
+    try {
+      list = JSON.parse(findings);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
+    }
+    const groups = dedupFindings(list);
+    return { content: [{ type: "text", text: JSON.stringify(groups.map((g) => ({ signature: g.signature, count: g.count, representative: g.representative.id }))) }] };
+  });
+  server.registerTool("generate_report", {
+    title: "Generate a reproducible report",
+    description: "REPORT: emit a deterministic markdown (or JSON) report from canonical Findings, with summary + integrity hash. Reproducible: same findings -> byte-identical output.",
+    inputSchema: {
+      findings: string2().describe("JSON array of Finding objects"),
+      format: _enum(["markdown", "json"]).optional().describe("Report format"),
+      title: string2().optional().describe("Report title"),
+      scope: string2().optional().describe("Scope description")
+    }
+  }, async ({ findings, format, title, scope }) => {
+    let list;
+    try {
+      list = JSON.parse(findings);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
+    }
+    const opts = { title, scope, version: "1.0.23" };
+    const out = (format ?? "markdown") === "json" ? reportJson(list, opts) : reportMarkdown(list, opts);
+    return { content: [{ type: "text", text: out }] };
+  });
+  server.registerTool("run_benchmark", {
+    title: "Run the benchmark suite",
+    description: "BENCHMARK: run the labelled corpus and report detection rate, false-positive rate, and precision. The quality metric, not the tool count.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(runBenchmark()) }] };
+  });
+  server.registerTool("coverage_matrix", {
+    title: "Report coverage matrix",
+    description: "BENCHMARK: enumerate language × sink-class coverage (which languages detect which sink types), plus the coverage ratio.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(coverageMatrix()) }] };
+  });
   return server;
 }
 async function serve() {
@@ -51022,12 +51574,12 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync9, existsSync as existsSync6, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join7, dirname } from "node:path";
+import { readFileSync as readFileSync10, existsSync as existsSync5, writeFileSync, mkdirSync as mkdirSync2 } from "node:fs";
+import { join as join8, dirname } from "node:path";
 import { homedir as homedir3 } from "node:os";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { spawnSync as spawnSync2 } from "node:child_process";
-var ROOT4 = join7(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var ROOT5 = join8(fileURLToPath6(new URL(".", import.meta.url)), "..");
 function which(cmd) {
   return spawnSync2(`command -v ${cmd}`, { shell: true }).status === 0;
 }
@@ -51062,7 +51614,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync6(join7(ROOT4, "chains.json")) && existsSync6(join7(ROOT4, "tools-catalog.json"));
+  const dataOk = existsSync5(join8(ROOT5, "chains.json")) && existsSync5(join8(ROOT5, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -51090,21 +51642,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join7(ROOT4, "src", "index.ts");
-  if (which("bun") && existsSync6(src))
+  const src = join8(ROOT5, "src", "index.ts");
+  if (which("bun") && existsSync5(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join7(ROOT4, "dist", "index.js");
-  if (existsSync6(dist))
+  const dist = join8(ROOT5, "dist", "index.js");
+  if (existsSync5(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync9(p, "utf8"));
+    return JSON.parse(readFileSync10(p, "utf8"));
   } catch {
     return null;
   }
@@ -51112,7 +51664,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -51125,7 +51677,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (_command, _args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -51137,26 +51689,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join7(ROOT4, "opencode-agents");
-  const dstDir = join7(homedir3(), ".config", "opencode", "agents");
-  if (!existsSync6(srcDir))
+  const srcDir = join8(ROOT5, "opencode-agents");
+  const dstDir = join8(homedir3(), ".config", "opencode", "agents");
+  if (!existsSync5(srcDir))
     return;
-  if (!existsSync6(dstDir))
+  if (!existsSync5(dstDir))
     mkdirSync2(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join7(srcDir, f);
-    const dst = join7(dstDir, f);
-    if (existsSync6(src)) {
-      writeFileSync(dst, readFileSync9(src, "utf8"));
+    const src = join8(srcDir, f);
+    const dst = join8(dstDir, f);
+    if (existsSync5(src)) {
+      writeFileSync(dst, readFileSync10(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
+    let existing = existsSync5(p) ? readFileSync10(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -51173,9 +51725,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname(p);
-    if (!existsSync6(dir))
+    if (!existsSync5(dir))
       mkdirSync2(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync9(p, "utf8") : "";
+    let existing = existsSync5(p) ? readFileSync10(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -51202,74 +51754,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir3();
   const agents = [];
-  const claudeJson = join7(home, ".claude.json");
+  const claudeJson = join8(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync6(claudeJson) || which("claude"),
+    installed: () => existsSync5(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join7(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join8(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync6(claudeDesktop),
+    installed: () => existsSync5(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join7(home, ".cursor", "mcp.json");
+  const cursor = join8(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync6(join7(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync5(join8(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join7(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join8(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync6(join7(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync5(join8(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join7(home, ".codex", "config.toml");
+  const codex = join8(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync6(join7(home, ".codex")) || which("codex"),
+    installed: () => existsSync5(join8(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join7(home, ".hermes", "config.yaml");
+  const hermes = join8(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync6(join7(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync5(join8(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join7(home, ".gemini", "settings.json");
+  const gemini = join8(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync6(join7(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync5(join8(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join7(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join8(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync6(join7(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync5(join8(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join7(home, ".copilot", "mcp.json");
+  const copilot = join8(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync6(join7(home, ".copilot")),
+    installed: () => existsSync5(join8(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join7(home, ".cline", "mcp_settings.json");
+  const cline = join8(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync6(join7(home, ".cline")),
+    installed: () => existsSync5(join8(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -51313,15 +51865,15 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync11, existsSync as existsSync8 } from "node:fs";
-import { join as join9 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
-var ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync12, existsSync as existsSync6 } from "node:fs";
+import { join as join10 } from "node:path";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
+var ROOT7 = join10(fileURLToPath8(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join9(ROOT6, "package.json");
-    if (existsSync8(p))
-      return JSON.parse(readFileSync11(p, "utf8")).version ?? "1.0.0";
+    const p = join10(ROOT7, "package.json");
+    if (existsSync6(p))
+      return JSON.parse(readFileSync12(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.22",
+  "version": "1.0.24",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {
@@ -29,8 +29,9 @@
     "serve": "bun run src/index.ts serve",
     "doctor": "bun run src/index.ts doctor",
     "compile": "bun build src/index.ts --compile --outfile dist/blitzstrike",
-    "test": "bun test",
-    "prepublishOnly": "bun run typecheck && bun run build"
+    "test": "bun run test/verify.ts",
+    "prepublishOnly": "bun run typecheck && bun run build",
+    "bench": "bun run test/verify.ts"
   },
   "keywords": [
     "mcp",