blitzstrike 1.0.31 → 1.0.33

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.33] — 2026-09-13
+
+### Added
+
+- **Phase 1 — Core Integrity** (per the master upgrade spec):
+  - **Finding invariants** (`src/invariants.ts`) — hard, machine-checkable rules:
+    a finding cannot be CONFIRMED without evidence, cannot be CONFIRMED with a
+    failed negative control, cannot be CONFIRMED out of scope, cannot persist a
+    raw secret, and its evidence hash must stay stable. Enforced in
+    `confirmFinding` and re-checkable via `checkFindingInvariants`.
+  - **Evidence provenance** (`src/evidence.ts` §16) — every evidence record now
+    carries chain-of-custody metadata (`tool`, `version`, `target`, `scope`,
+    `parentEvidence`).
+  - **Audit log** (`src/audit.ts` §45) — structured append-only audit events
+    (`scope_checked`, `finding_created`, `finding_updated`, `validation_finished`,
+    `evidence_created`, …) at `~/.blitzstrike/audit.jsonl`, wired into scope
+    check, finding creation, evidence attachment, and validation.
+  - `confirmFinding` now **throws** if called with no evidence (hard invariant).
+
+### Changed
+
+- `scopeCheck` refactored to a single exit path that always records a
+  `scope_checked` audit event.
+- Shared `src/version.ts` — single source of truth for the package version
+  (removed the duplicate VERSION readers in `server.ts`).
+
 ## [1.0.26] — 2026-09-13
 
 The first hardening milestone: the whole roadmap is implemented, measured, and
@@ -51,6 +77,9 @@ code path, not a slogan.
   master reference of web attack vectors (RCE, SQL, auth, SSRF, XSS, API,
   business logic, race conditions, cloud, supply chain, CI/CD, AI/LLM, Web3,
   XS-leaks, …) for BLITZ attack-surface mapping.
+- **Self-update** (`blitzstrike update` + `check_update` tool) — query the npm
+  registry for the latest version (semver-aware) and refresh the heavy data
+  cache (payloads + templates) in one shot.
 
 ### Changed
 

package/README.md

@@ -117,6 +117,8 @@ blitzstrike serve --mcp       # start MCP server over stdio (default)
 blitzstrike doctor            # health check: runtime + 130-tool catalog + creds
 blitzstrike install           # write MCP config to detected clients (Claude/Cursor/OpenCode)
 blitzstrike install --dry-run # preview the config without writing
+blitzstrike sync-data         # fetch heavy datasets (payloads + templates) on-demand
+blitzstrike update            # check for a newer version + refresh the data cache
 blitzstrike version           # print version
 ```
 
@@ -226,6 +228,7 @@ MCP servers. With no client detected, it prints the snippet for manual paste.
 | `template_lookup(topic)` | Find nuclei detection templates (11.9k YAML signatures). |
 | `list_attack_vectors()` | List the full web attack-vector taxonomy (34 categories, 588 vectors). |
 | `attack_vectors(category)` | Enumerate the vector list for one category (e.g. ssrf, business logic, ai/llm). |
+| `check_update()` | Query the npm registry for the latest blitzstrike version. |
 
 The intelligence layer (WAF signatures, tech/CVE/port correlations, fuzzer
 data, vuln ontology, exploit payloads, nuclei detection templates) is sourced

package/dist/index.js

@@ -14820,11 +14820,11 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join9 } from "node:path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readFileSync as readFileSync12, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join10 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync2 } from "node:child_process";
 function dirExists(p) {
   try {
     return statSync3(p).isDirectory();
@@ -14838,7 +14838,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync5(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join9(d, e.name));
+          walk(join10(d, e.name));
         else
           n++;
       }
@@ -14852,8 +14852,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync3(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join9(DATA_ROOT2, "payloads");
-  const templatesPath = join9(DATA_ROOT2, "templates");
+  const payloadsPath = join10(DATA_ROOT2, "payloads");
+  const templatesPath = join10(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -14863,8 +14863,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join9(ROOT6, "payloads");
-  const localTemplates = join9(ROOT6, "templates");
+  const localPayloads = join10(ROOT5, "payloads");
+  const localTemplates = join10(ROOT5, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -14875,21 +14875,21 @@ function syncData() {
     copyDir(localTemplates, templatesPath);
     templatesSynced = true;
   }
-  const gitOk = spawnSync3("git", ["--version"]).status === 0;
+  const gitOk = spawnSync2("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join9(DATA_ROOT2, ".tmp-clone");
+    const tmp = join10(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync2(tmp, { recursive: true, force: true });
-    const r = spawnSync3("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
+    const r = spawnSync2("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
-      const sparse = spawnSync3("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
+      const sparse = spawnSync2("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join9(tmp, "payloads"), payloadsPath);
+          copyDir(join10(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join9(tmp, "templates"), templatesPath);
+          copyDir(join10(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -14903,7 +14903,7 @@ function syncData() {
   };
 }
 function copyDir(src, dst) {
-  const r = spawnSync3("cp", ["-r", src, dst], { timeout: 120000 });
+  const r = spawnSync2("cp", ["-r", src, dst], { timeout: 120000 });
   if (r.status !== 0) {
     manualCopy(src, dst);
   }
@@ -14911,18 +14911,59 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync3(dst, { recursive: true });
   for (const e of readdirSync5(src, { withFileTypes: true })) {
-    const s = join9(src, e.name);
-    const d = join9(dst, e.name);
+    const s = join10(src, e.name);
+    const d = join10(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync4(d, readFileSync11(s));
+      writeFileSync3(d, readFileSync12(s));
   }
 }
-var ROOT6, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT6 = join9(fileURLToPath7(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join9(homedir4(), ".blitzstrike", "data");
+  ROOT5 = join10(fileURLToPath7(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join10(homedir4(), ".blitzstrike", "data");
+});
+
+// src/update.ts
+async function checkLatestVersion(timeoutMs = 1e4) {
+  try {
+    const controller = new AbortController;
+    const t = setTimeout(() => controller.abort(), timeoutMs);
+    const res = await fetch("https://registry.npmjs.org/blitzstrike/latest", { signal: controller.signal });
+    clearTimeout(t);
+    if (!res.ok)
+      return null;
+    const data = await res.json();
+    return data.version ?? null;
+  } catch {
+    return null;
+  }
+}
+function semverCompare(a, b) {
+  const pa = a.replace(/^v/, "").split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.replace(/^v/, "").split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0;i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y)
+      return x < y ? -1 : 1;
+  }
+  return 0;
+}
+async function runUpdate(currentVersion) {
+  const latest = await checkLatestVersion();
+  const outdated = latest !== null && semverCompare(currentVersion, latest) < 0;
+  return {
+    current: currentVersion,
+    latest,
+    outdated,
+    update_command: "npm install -g blitzstrike@latest   # or: bun add -g blitzstrike@latest",
+    data_sync: syncData()
+  };
+}
+var init_update = __esm(() => {
+  init_sync();
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -29642,9 +29683,9 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync4, existsSync as existsSync3, statSync as statSync2 } from "node:fs";
-import { join as join4 } from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
+import { readFileSync as readFileSync6, existsSync as existsSync4, statSync as statSync2 } from "node:fs";
+import { join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/memory.ts
 import { readFileSync as readFileSync2, appendFileSync, mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -29876,6 +29917,47 @@ function manualForTool(toolName) {
   return null;
 }
 
+// src/audit.ts
+import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync2, existsSync as existsSync3, readFileSync as readFileSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+import { homedir as homedir2 } from "node:os";
+
+// src/version.ts
+import { readFileSync as readFileSync4 } from "node:fs";
+import { join as join4, dirname } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+var VERSION = (() => {
+  try {
+    const root = join4(dirname(fileURLToPath2(import.meta.url)), "..");
+    return JSON.parse(readFileSync4(join4(root, "package.json"), "utf8")).version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+})();
+
+// src/audit.ts
+var HOME_DIR2 = process.env.BLITZSTRIKE_HOME ?? join5(homedir2(), ".blitzstrike");
+var AUDIT_PATH = join5(HOME_DIR2, "audit.jsonl");
+function recordAudit(event, opts = {}) {
+  const record = {
+    timestamp: new Date().toISOString(),
+    event,
+    actor: opts.actor ?? "system",
+    tool: opts.tool,
+    tool_version: VERSION,
+    target: opts.target,
+    result: opts.result,
+    correlationId: opts.correlationId
+  };
+  try {
+    if (!existsSync3(HOME_DIR2))
+      mkdirSync2(HOME_DIR2, { recursive: true });
+    appendFileSync2(AUDIT_PATH, JSON.stringify(record) + `
+`);
+  } catch {}
+  return record;
+}
+
 // src/evidence.ts
 import { createHash as createHash2 } from "node:crypto";
 var REDACTION_PATTERNS = [
@@ -29902,6 +29984,13 @@ function redactSecrets(text) {
   }
   return out;
 }
+function hasSecrets(text) {
+  for (const [re] of REDACTION_PATTERNS) {
+    if (re.test(text))
+      return true;
+  }
+  return false;
+}
 function redactObject(value) {
   if (typeof value === "string")
     return redactSecrets(value);
@@ -29936,9 +30025,61 @@ function makeEvidence(input) {
     source: input.source ? redactObject(input.source) : undefined,
     sink: input.sink ? redactObject(input.sink) : undefined,
     artifacts,
-    recorded: new Date().toISOString()
+    recorded: new Date().toISOString(),
+    provenance: {
+      tool: input.provenance?.tool ?? "blitzstrike",
+      version: input.provenance?.version ?? VERSION,
+      ...input.provenance?.target ? { target: input.provenance.target } : {},
+      ...input.provenance?.scope ? { scope: input.provenance.scope } : {},
+      ...input.provenance?.parentEvidence ? { parentEvidence: input.provenance.parentEvidence } : {}
+    }
   };
 }
+function verifyArtifact(artifact) {
+  return sha256(artifact.content) === artifact.sha256;
+}
+function verifyEvidence(evidence) {
+  const failed = [];
+  for (const a of evidence.artifacts) {
+    if (!verifyArtifact(a))
+      failed.push(a.name);
+  }
+  return { ok: failed.length === 0, failed };
+}
+
+// src/invariants.ts
+function checkFindingInvariants(finding) {
+  const violations = [];
+  if (finding.status === "confirmed" && finding.evidence.length === 0) {
+    violations.push({ invariant: "confirmed-requires-evidence", detail: `finding ${finding.id} is confirmed with no evidence` });
+  }
+  if (finding.status === "confirmed" && finding.validation.negative_control === false) {
+    violations.push({ invariant: "confirmed-requires-clean-negative-control", detail: `finding ${finding.id} confirmed with a failed negative control` });
+  }
+  if (finding.status === "confirmed" && finding.validation.scope_allowed === false) {
+    violations.push({ invariant: "confirmed-requires-scope-allowed", detail: `finding ${finding.id} confirmed out of scope` });
+  }
+  for (const e of finding.evidence) {
+    for (const a of e.artifacts) {
+      if (hasSecrets(a.content)) {
+        violations.push({ invariant: "no-secret-in-evidence", detail: `evidence ${e.evidence_id} artifact ${a.name} contains a raw secret` });
+      }
+    }
+  }
+  for (const e of finding.evidence) {
+    const v = verifyEvidence(e);
+    if (!v.ok) {
+      violations.push({ invariant: "evidence-hash-stable", detail: `evidence ${e.evidence_id} artifacts ${v.failed.join(",")} failed integrity check` });
+    }
+  }
+  return violations;
+}
+function assertFindingInvariants(finding) {
+  const violations = checkFindingInvariants(finding);
+  if (violations.length > 0) {
+    throw new Error(`invariant violation: ${violations.map((v) => v.invariant).join(", ")}`);
+  }
+}
 
 // src/finding.ts
 var LIFECYCLE_TRANSITIONS = {
@@ -30000,7 +30141,7 @@ function makeFinding(input) {
   const status = input.status ?? "detected";
   const factors = confidenceFactorsFor(input);
   const confidence = computeConfidence(factors);
-  return {
+  const finding = {
     id: nextFindingId(),
     status,
     title: input.title,
@@ -30023,6 +30164,8 @@ function makeFinding(input) {
     remediation: {},
     timestamps: { created: now, updated: now }
   };
+  recordAudit("finding_created", { tool: "eagle-eye", target: input.target.host ?? input.target.endpoint, result: status, correlationId: finding.id });
+  return finding;
 }
 function confidenceFactorsFor(_input) {
   return {
@@ -30042,6 +30185,7 @@ function transition(finding, to) {
   return updated;
 }
 function attachEvidence(finding, evidence) {
+  recordAudit("evidence_created", { tool: "blitzstrike", target: finding.target.host ?? finding.target.endpoint, result: evidence.evidence_id, correlationId: finding.id });
   return {
     ...finding,
     evidence: [...finding.evidence, evidence],
@@ -30049,8 +30193,12 @@ function attachEvidence(finding, evidence) {
   };
 }
 function confirmFinding(finding, opts) {
+  if (opts.evidence.length === 0) {
+    throw new Error("invariant: cannot confirm a finding without evidence");
+  }
   const evidence = opts.evidence.map((e) => makeEvidence(e));
   const negativeControl = opts.negative_control ?? true;
+  const scopeAllowed = opts.scope_allowed ?? true;
   const confidence = computeConfidence({
     static_analysis: true,
     data_flow: true,
@@ -30061,7 +30209,7 @@ function confirmFinding(finding, opts) {
   });
   const level = confidenceLevel(confidence);
   const status = negativeControl ? "confirmed" : "hypothesis";
-  return {
+  const confirmed = {
     ...finding,
     status,
     confidence,
@@ -30070,11 +30218,15 @@ function confirmFinding(finding, opts) {
       performed: true,
       status: negativeControl ? "confirmed" : "unconfirmed",
       baseline: opts.baseline ?? true,
-      negative_control: negativeControl
+      negative_control: negativeControl,
+      scope_allowed: scopeAllowed
     },
     evidence: [...finding.evidence, ...evidence],
     timestamps: { ...finding.timestamps, updated: new Date().toISOString() }
   };
+  assertFindingInvariants(confirmed);
+  recordAudit("validation_finished", { tool: "strike", target: finding.target.host ?? finding.target.endpoint, result: status, correlationId: finding.id });
+  return confirmed;
 }
 function rejectFinding(finding, status, reason, evidence) {
   const ev = evidence?.map((e) => makeEvidence(e)) ?? [];
@@ -30094,9 +30246,9 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join4(fileURLToPath2(new URL(".", import.meta.url)), "..");
-    const path = join4(dir, "chains.json");
-    const raw = JSON.parse(readFileSync4(path, "utf8"));
+    const dir = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
+    const path = join6(dir, "chains.json");
+    const raw = JSON.parse(readFileSync6(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
   } catch {
@@ -30105,40 +30257,50 @@ function loadChains() {
   }
 }
 function scopeCheck(target, scope = "", mode = "bug-bounty") {
+  let result;
   if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
-    return { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
-  }
-  if (!scope.trim()) {
-    return { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
-  }
-  const inScope = [];
-  const outScope = [];
-  for (const raw of scope.split(/[,\n]/)) {
-    const line = raw.trim();
-    if (!line)
-      continue;
-    if (line.startsWith("-"))
-      outScope.push(line.slice(1).trim());
-    else
-      inScope.push(line);
-  }
-  let host = target;
-  host = host.replace(/^https?:\/\//, "");
-  host = host.split("/")[0].split(":")[0];
-  for (const exc of outScope) {
-    if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
-      return { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
+    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
+  } else if (!scope.trim()) {
+    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
+  } else {
+    const inScope = [];
+    const outScope = [];
+    for (const raw of scope.split(/[,\n]/)) {
+      const line = raw.trim();
+      if (!line)
+        continue;
+      if (line.startsWith("-"))
+        outScope.push(line.slice(1).trim());
+      else
+        inScope.push(line);
+    }
+    let host = target;
+    host = host.replace(/^https?:\/\//, "");
+    host = host.split("/")[0].split(":")[0];
+    let decided = false;
+    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
+    for (const exc of outScope) {
+      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
+        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
+        decided = true;
+        break;
+      }
     }
-  }
-  for (const allowed of inScope) {
-    const a = allowed.replace(/\*/g, "");
-    if (!a)
-      continue;
-    if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
-      return { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
+    if (!decided) {
+      for (const allowed of inScope) {
+        const a = allowed.replace(/\*/g, "");
+        if (!a)
+          continue;
+        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
+          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
+          decided = true;
+          break;
+        }
+      }
     }
   }
-  return { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
+  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
+  return result;
 }
 function classifySink(sink) {
   if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
@@ -30202,7 +30364,7 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   };
   const isPath = (() => {
     try {
-      return existsSync3(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+      return existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
     } catch {
       return false;
     }
@@ -30319,18 +30481,18 @@ function listChains() {
 }
 
 // src/catalog.ts
-import { readFileSync as readFileSync5, readdirSync as readdirSync2 } from "node:fs";
-import { join as join5 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readFileSync as readFileSync7, readdirSync as readdirSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { spawnSync } from "node:child_process";
-var ROOT2 = join5(fileURLToPath3(new URL(".", import.meta.url)), "..");
+var ROOT2 = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var _toolsCache = null;
 var _skillsCache = null;
 function loadTools() {
   if (_toolsCache)
     return _toolsCache;
   try {
-    const raw = JSON.parse(readFileSync5(join5(ROOT2, "tools-catalog.json"), "utf8"));
+    const raw = JSON.parse(readFileSync7(join7(ROOT2, "tools-catalog.json"), "utf8"));
     _toolsCache = raw.tools ?? [];
   } catch {
     _toolsCache = [];
@@ -30340,14 +30502,14 @@ function loadTools() {
 function loadSkills() {
   if (_skillsCache)
     return _skillsCache;
-  const dir = join5(ROOT2, "skills");
+  const dir = join7(ROOT2, "skills");
   const out = [];
   try {
     for (const f of readdirSync2(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const p = join5(dir, f);
-      const text = readFileSync5(p, "utf8");
+      const p = join7(dir, f);
+      const text = readFileSync7(p, "utf8");
       const descMatch = text.match(/^description:\s*(.+)$/m);
       out.push({
         name: f.replace(/\.md$/, ""),
@@ -30420,7 +30582,7 @@ function readSkill(name) {
   if (!s)
     return { found: false, query: name };
   try {
-    const text = readFileSync5(join5(ROOT2, "skills", s.file), "utf8");
+    const text = readFileSync7(join7(ROOT2, "skills", s.file), "utf8");
     return { found: true, name: s.name, content: text.slice(0, 12000) };
   } catch {
     return { found: false, query: name, error: "unreadable" };
@@ -30453,19 +30615,19 @@ function ensureTool(name) {
 }
 
 // src/intel.ts
-import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
-import { join as join6 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
 import { readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-var ROOT3 = join6(fileURLToPath4(new URL(".", import.meta.url)), "..");
-var INTEL = join6(ROOT3, "intelligence");
+import { homedir as homedir3 } from "node:os";
+var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var INTEL = join8(ROOT3, "intelligence");
 function loadJson(name) {
-  const p = join6(INTEL, `${name}.json`);
-  if (!existsSync4(p))
+  const p = join8(INTEL, `${name}.json`);
+  if (!existsSync5(p))
     return null;
   try {
-    return JSON.parse(readFileSync6(p, "utf8"));
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
     return null;
   }
@@ -30597,18 +30759,18 @@ function attackVectors(category) {
   }
   return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
 }
-var PACKAGE_PAYLOADS = join6(ROOT3, "payloads");
-var PACKAGE_TEMPLATES = join6(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join6(homedir2(), ".blitzstrike", "data");
+var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
+var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
 function payloadsDir() {
-  if (existsSync4(PACKAGE_PAYLOADS))
+  if (existsSync5(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
-  return join6(DATA_ROOT, "payloads");
+  return join8(DATA_ROOT, "payloads");
 }
 function templatesDir() {
-  if (existsSync4(PACKAGE_TEMPLATES))
+  if (existsSync5(PACKAGE_TEMPLATES))
     return PACKAGE_TEMPLATES;
-  return join6(DATA_ROOT, "templates");
+  return join8(DATA_ROOT, "templates");
 }
 var PAYLOADS = payloadsDir();
 var TEMPLATES = templatesDir();
@@ -30644,7 +30806,7 @@ function payloadLookup(topic) {
   const normalized = ALIASES[key] ?? key;
   const exact = cats.find((c) => c.toLowerCase() === normalized);
   if (exact) {
-    return { found: true, category: exact, files: listFiles(join6(PAYLOADS, exact)) };
+    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
   }
   const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
   const matches = cats.filter((c) => {
@@ -30654,7 +30816,7 @@ function payloadLookup(topic) {
     return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
   });
   if (matches.length > 0) {
-    return { found: true, category: matches[0], files: listFiles(join6(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
+    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
   }
   return { found: false, topic, suggestions: cats.slice(0, 20) };
 }
@@ -30663,19 +30825,19 @@ function readPayload(category, file) {
   const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
   if (!exact)
     return { found: false, category, suggestions: cats.slice(0, 20) };
-  const dir = join6(PAYLOADS, exact);
+  const dir = join8(PAYLOADS, exact);
   const files = listFiles(dir);
   if (!file) {
     const readme = files.find((f) => f.toLowerCase() === "readme.md");
     if (readme) {
-      return { found: true, category: exact, file: readme, content: readFileSync6(join6(dir, readme), "utf8").slice(0, 20000) };
+      return { found: true, category: exact, file: readme, content: readFileSync8(join8(dir, readme), "utf8").slice(0, 20000) };
     }
     return { found: true, category: exact, files };
   }
   const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
   if (!f)
     return { found: false, category: exact, file, suggestions: files };
-  return { found: true, category: exact, file: f, content: readFileSync6(join6(dir, f), "utf8").slice(0, 20000) };
+  return { found: true, category: exact, file: f, content: readFileSync8(join8(dir, f), "utf8").slice(0, 20000) };
 }
 function listFiles(dir) {
   try {
@@ -30690,7 +30852,7 @@ function countTemplates() {
     const walk = (dir) => {
       for (const e of readdirSync3(dir, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join6(dir, e.name));
+          walk(join8(dir, e.name));
         else if (e.name.endsWith(".yaml"))
           n++;
       }
@@ -30715,14 +30877,14 @@ function templateLookup(topic, limit = 10) {
     }
     for (const e of entries) {
       if (e.isDirectory())
-        walk(join6(dir, e.name), depth + 1);
+        walk(join8(dir, e.name), depth + 1);
       else if (e.name.endsWith(".yaml")) {
         const name = e.name.toLowerCase();
         if (name.includes(key)) {
-          const full = join6(dir, e.name);
+          const full = join8(dir, e.name);
           let id = "";
           try {
-            const content = readFileSync6(full, "utf8");
+            const content = readFileSync8(full, "utf8");
             const m = content.match(/^\s*id:\s*(.+)$/m);
             if (m)
               id = m[1].trim();
@@ -30882,7 +31044,7 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
 
 // src/dataflow.ts
 init_scanner();
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -30964,7 +31126,7 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    text = readFileSync7(path, "utf8");
+    text = readFileSync9(path, "utf8");
   } catch {
     return result;
   }
@@ -31043,7 +31205,7 @@ function groupVariants(results) {
 // src/taint.ts
 init_scanner();
 var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -31341,7 +31503,7 @@ function analyzeTaint(path) {
   const result = { file: path, findings: [], suppressed: 0 };
   let code;
   try {
-    code = readFileSync8(path, "utf8");
+    code = readFileSync10(path, "utf8");
   } catch {
     return result;
   }
@@ -50615,16 +50777,16 @@ function reportJson(findings, opts = {}) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync9, readdirSync as readdirSync4, writeFileSync as writeFileSync2, rmSync } from "node:fs";
-import { join as join7 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { readFileSync as readFileSync11, readdirSync as readdirSync4, writeFileSync as writeFileSync2, rmSync } from "node:fs";
+import { join as join9 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
 import { tmpdir } from "node:os";
-var ROOT4 = join7(fileURLToPath5(new URL(".", import.meta.url)), "..");
-var CORPUS = join7(ROOT4, "bench", "corpus");
+var ROOT4 = join9(fileURLToPath6(new URL(".", import.meta.url)), "..");
+var CORPUS = join9(ROOT4, "bench", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync9(path, "utf8");
+    text = readFileSync11(path, "utf8");
   } catch {
     return null;
   }
@@ -50674,7 +50836,7 @@ function loadCorpus() {
     for (const f of readdirSync4(CORPUS)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join7(CORPUS, f));
+      const e = parseCorpusFile(join9(CORPUS, f));
       if (e)
         entries.push(e);
     }
@@ -50686,7 +50848,7 @@ function loadCorpus() {
 function detect(entry) {
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join7(tmpdir(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join9(tmpdir(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync2(tmp, entry.code);
     const r = analyzeTaint(tmp);
     rmSync(tmp, { force: true });
@@ -50833,6 +50995,7 @@ function coverageMatrix() {
 }
 
 // src/server.ts
+init_update();
 function createServer() {
   const server = new McpServer({
     name: "blitzstrike",
@@ -51589,7 +51752,7 @@ function createServer() {
     } catch {
       return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
     }
-    const opts = { title, scope, version: "1.0.23" };
+    const opts = { title, scope, version: VERSION };
     const out = (format ?? "markdown") === "json" ? reportJson(list, opts) : reportMarkdown(list, opts);
     return { content: [{ type: "text", text: out }] };
   });
@@ -51607,6 +51770,14 @@ function createServer() {
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(coverageMatrix()) }] };
   });
+  server.registerTool("check_update", {
+    title: "Check for a newer blitzstrike version",
+    description: "UPDATE: query the npm registry for the latest blitzstrike version. Tells a driving agent whether the package or the data cache is stale.",
+    inputSchema: {}
+  }, async () => {
+    const latest = await checkLatestVersion();
+    return { content: [{ type: "text", text: JSON.stringify({ latest, note: "package updates via `npx blitzstrike` (always-latest) or `npm i -g blitzstrike@latest`; heavy data via `blitzstrike sync-data`" }) }] };
+  });
   return server;
 }
 async function serve() {
@@ -51616,14 +51787,14 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync10, existsSync as existsSync5, writeFileSync as writeFileSync3, mkdirSync as mkdirSync2 } from "node:fs";
-import { join as join8, dirname } from "node:path";
-import { homedir as homedir3 } from "node:os";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
-import { spawnSync as spawnSync2 } from "node:child_process";
-var ROOT5 = join8(fileURLToPath6(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync13, existsSync as existsSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join11, dirname as dirname2 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { spawnSync as spawnSync3 } from "node:child_process";
+var ROOT6 = join11(fileURLToPath8(new URL(".", import.meta.url)), "..");
 function which(cmd) {
-  return spawnSync2(`command -v ${cmd}`, { shell: true }).status === 0;
+  return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
 }
 function installedCount() {
   const tools = loadTools();
@@ -51656,7 +51827,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync5(join8(ROOT5, "chains.json")) && existsSync5(join8(ROOT5, "tools-catalog.json"));
+  const dataOk = existsSync6(join11(ROOT6, "chains.json")) && existsSync6(join11(ROOT6, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -51684,73 +51855,73 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join8(ROOT5, "src", "index.ts");
-  if (which("bun") && existsSync5(src))
+  const src = join11(ROOT6, "src", "index.ts");
+  if (which("bun") && existsSync6(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join8(ROOT5, "dist", "index.js");
-  if (existsSync5(dist))
+  const dist = join11(ROOT6, "dist", "index.js");
+  if (existsSync6(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync10(p, "utf8"));
+    return JSON.parse(readFileSync13(p, "utf8"));
   } catch {
     return null;
   }
 }
 function jsonMcpServersWrite(p) {
   return (command, args) => {
-    const dir = dirname(p);
-    if (!existsSync5(dir))
-      mkdirSync2(dir, { recursive: true });
+    const dir = dirname2(p);
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
       blitzstrike: { command, args }
     };
-    writeFileSync3(p, JSON.stringify(existing, null, 2));
+    writeFileSync4(p, JSON.stringify(existing, null, 2));
   };
 }
 function opencodeWrite(p) {
   return (_command, _args) => {
-    const dir = dirname(p);
-    if (!existsSync5(dir))
-      mkdirSync2(dir, { recursive: true });
+    const dir = dirname2(p);
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
       blitzstrike: { type: "local", command: ["npx", "-y", "blitzstrike", "serve", "--mcp"], enabled: true }
     };
-    writeFileSync3(p, JSON.stringify(existing, null, 2));
+    writeFileSync4(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join8(ROOT5, "opencode-agents");
-  const dstDir = join8(homedir3(), ".config", "opencode", "agents");
-  if (!existsSync5(srcDir))
+  const srcDir = join11(ROOT6, "opencode-agents");
+  const dstDir = join11(homedir5(), ".config", "opencode", "agents");
+  if (!existsSync6(srcDir))
     return;
-  if (!existsSync5(dstDir))
-    mkdirSync2(dstDir, { recursive: true });
+  if (!existsSync6(dstDir))
+    mkdirSync4(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join8(srcDir, f);
-    const dst = join8(dstDir, f);
-    if (existsSync5(src)) {
-      writeFileSync3(dst, readFileSync10(src, "utf8"));
+    const src = join11(srcDir, f);
+    const dst = join11(dstDir, f);
+    if (existsSync6(src)) {
+      writeFileSync4(dst, readFileSync13(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
-    const dir = dirname(p);
-    if (!existsSync5(dir))
-      mkdirSync2(dir, { recursive: true });
-    let existing = existsSync5(p) ? readFileSync10(p, "utf8") : "";
+    const dir = dirname2(p);
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
+    let existing = existsSync6(p) ? readFileSync13(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -51761,15 +51932,15 @@ function codexWrite(p) {
 command = "${command}"
 args = ${JSON.stringify(args)}
 `;
-    writeFileSync3(p, existing);
+    writeFileSync4(p, existing);
   };
 }
 function hermesWrite(p) {
   return (command, args) => {
-    const dir = dirname(p);
-    if (!existsSync5(dir))
-      mkdirSync2(dir, { recursive: true });
-    let existing = existsSync5(p) ? readFileSync10(p, "utf8") : "";
+    const dir = dirname2(p);
+    if (!existsSync6(dir))
+      mkdirSync4(dir, { recursive: true });
+    let existing = existsSync6(p) ? readFileSync13(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -51790,80 +51961,80 @@ mcp_servers:
     args: ${JSON.stringify(args)}
 `;
     }
-    writeFileSync3(p, existing);
+    writeFileSync4(p, existing);
   };
 }
 function detectAgents() {
-  const home = homedir3();
+  const home = homedir5();
   const agents = [];
-  const claudeJson = join8(home, ".claude.json");
+  const claudeJson = join11(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync5(claudeJson) || which("claude"),
+    installed: () => existsSync6(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join8(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join11(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync5(claudeDesktop),
+    installed: () => existsSync6(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join8(home, ".cursor", "mcp.json");
+  const cursor = join11(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync5(join8(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync6(join11(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join8(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join11(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync5(join8(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync6(join11(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join8(home, ".codex", "config.toml");
+  const codex = join11(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync5(join8(home, ".codex")) || which("codex"),
+    installed: () => existsSync6(join11(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join8(home, ".hermes", "config.yaml");
+  const hermes = join11(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync5(join8(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync6(join11(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join8(home, ".gemini", "settings.json");
+  const gemini = join11(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync5(join8(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync6(join11(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join8(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join11(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync5(join8(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync6(join11(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join8(home, ".copilot", "mcp.json");
+  const copilot = join11(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync5(join8(home, ".copilot")),
+    installed: () => existsSync6(join11(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join8(home, ".cline", "mcp_settings.json");
+  const cline = join11(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync5(join8(home, ".cline")),
+    installed: () => existsSync6(join11(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -51907,29 +52078,31 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync12, existsSync as existsSync6 } from "node:fs";
-import { join as join10 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
-var ROOT7 = join10(fileURLToPath8(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync14, existsSync as existsSync7 } from "node:fs";
+import { join as join12 } from "node:path";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
+var ROOT7 = join12(fileURLToPath9(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join10(ROOT7, "package.json");
-    if (existsSync6(p))
-      return JSON.parse(readFileSync12(p, "utf8")).version ?? "1.0.0";
+    const p = join12(ROOT7, "package.json");
+    if (existsSync7(p))
+      return JSON.parse(readFileSync14(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }
-var VERSION = readVersion();
+var VERSION2 = readVersion();
 function usage() {
-  return `BlitzStrike ${VERSION} — MCP security-audit toolbelt
+  return `BlitzStrike ${VERSION2} — MCP security-audit toolbelt
 
 Usage:
   blitzstrike serve --mcp       Start the MCP server over stdio (default transport)
   blitzstrike doctor            Environment health check (runtime + tools + creds)
   blitzstrike install           Write MCP client config to detected clients
   blitzstrike install --dry-run Print the config without writing
-  blitzstrike version           Print version
-  blitzstrike --help            This help`;
+  blitzstrike sync-data        Fetch heavy datasets (payloads + templates) on-demand
+  blitzstrike update           Check for a newer version + refresh the data cache
+  blitzstrike version          Print version
+  blitzstrike --help           This help`;
 }
 async function main() {
   const args = process.argv.slice(2);
@@ -51938,7 +52111,7 @@ async function main() {
     return;
   }
   if (args[0] === "version" || args[0] === "--version" || args[0] === "-v") {
-    console.log(`blitzstrike ${VERSION}`);
+    console.log(`blitzstrike ${VERSION2}`);
     return;
   }
   if (args[0] === "doctor") {
@@ -51958,6 +52131,22 @@ async function main() {
     console.log(`  templates: ${r.templates.files} files ${r.templates.synced ? "(synced)" : "(already present)"}`);
     return;
   }
+  if (args[0] === "update") {
+    await Promise.resolve().then(() => init_update());
+    const r = await runUpdate(VERSION2);
+    console.log("Blitz Strike self-update");
+    console.log(`  current: ${r.current}`);
+    console.log(`  latest:  ${r.latest ?? "unknown (registry unreachable)"}`);
+    if (r.outdated) {
+      console.log(`  status:  OUTDATED — update with: ${r.update_command}`);
+    } else if (r.latest === null) {
+      console.log(`  status:  could not reach npm registry`);
+    } else {
+      console.log(`  status:  up to date`);
+    }
+    console.log(`  data:    payloads ${r.data_sync.payloads.files} files, templates ${r.data_sync.templates.files} files ${r.data_sync.payloads.synced ? "(refreshed)" : ""}`);
+    return;
+  }
   if (args[0] === "serve") {
     await serve();
     return;

package/docs/findings.md

@@ -76,12 +76,33 @@ validation + evidence.
 
 `src/evidence.ts`:
 
-- **Schema** — `evidence_id`, `type`, `description`, `source`, `sink`, `artifacts[]`, `recorded`.
+- **Schema** — `evidence_id`, `type`, `description`, `source`, `sink`, `artifacts[]`, `recorded`, `provenance`.
+- **Provenance (§16)** — every record carries chain-of-custody metadata: `tool`,
+  `version`, `target`, `scope`, `parentEvidence`.
 - **Integrity** — every artifact carries a SHA-256 (`sha256()`), verified by `verifyEvidence()`.
 - **Secret redaction** — `redactSecrets()` strips passwords, API keys, tokens,
   cookies, `Authorization` headers, private keys before persistence/report/log/context.
 - **Append-only** — confirmed evidence is never silently rewritten.
 
+## Finding invariants (§53)
+
+`src/invariants.ts` enforces hard, machine-checkable rules:
+
+| Invariant | Enforcement |
+| :--- | :--- |
+| CONFIRMED requires evidence | `confirmFinding` throws without evidence |
+| CONFIRMED requires clean negative control | `checkFindingInvariants` |
+| CONFIRMED requires in-scope target | `checkFindingInvariants` |
+| No raw secret in persisted evidence | `checkFindingInvariants` |
+| Evidence hash must stay stable | `checkFindingInvariants` |
+
+## Audit log (§45)
+
+`src/audit.ts` emits structured append-only audit events to
+`~/.blitzstrike/audit.jsonl`: `scope_checked`, `finding_created`,
+`finding_updated`, `validation_finished`, `evidence_created`, … each carrying
+timestamp, actor, tool, target, result, and correlationId.
+
 ## MCP tools
 
 | Tool | Purpose |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.31",
+  "version": "1.0.33",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {