blitzstrike 1.0.25 → 1.0.26

package/dist/index.js

@@ -30473,7 +30473,7 @@ function loadJson(name) {
 function detectWaf(headers, body = "") {
   const sigs = loadJson("waf_signatures");
   if (!sigs)
-    return { error: "waf_signatures.json not loaded" };
+    return { detected: false, wafs: [], error: "waf_signatures.json not loaded" };
   const headerSigs = sigs.header_signatures ?? [];
   const bodySigs = sigs.body_signatures ?? [];
   const matches = [];
@@ -30484,7 +30484,7 @@ function detectWaf(headers, body = "") {
     if (!h)
       continue;
     if (pattern) {
-      const val = (headers[h] ?? headers[s.header] ?? "").toLowerCase();
+      const val = (headers[h] ?? headers[s.header ?? ""] ?? "").toLowerCase();
       if (val.includes(pattern)) {
         matches.push({ waf: s.waf, header: s.header, pattern: s.pattern, confidence: s.confidence, via: "header-value" });
       }
@@ -30517,14 +30517,14 @@ function detectWaf(headers, body = "") {
 function techCorrelation(tech) {
   const data = loadJson("tech_correlations");
   if (!data)
-    return { error: "tech_correlations.json not loaded" };
+    return { found: false, error: "tech_correlations.json not loaded" };
   const key = tech.toLowerCase();
   const entry = data[key];
   if (!entry) {
     const matches = Object.keys(data).filter((k) => k.includes(key) || key.includes(k)).slice(0, 5);
     return { found: false, tech, suggestions: matches };
   }
-  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? entry };
+  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? { vulns: entry.vulns, paths: entry.paths } };
 }
 function cveCorrelation(cveId) {
   const data = loadJson("cve_correlations");
@@ -51384,7 +51384,7 @@ function createServer() {
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
     const r = traceDataFlow(path);
-    const taintedSinks = [...new Set(r.candidates.map((c) => c.sink_id ?? c.sink ?? c.category))];
+    const taintedSinks = [...new Set(r.candidates.map((c) => c.sink?.id ?? "unknown"))];
     const guidance = nextSteps({
       tier: "eagle-eye",
       hasFindings: r.candidates.length > 0,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.25",
+  "version": "1.0.26",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {