blitzstrike 1.0.35 → 1.0.37

package/dist/index.js

@@ -14820,8 +14820,8 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, readFileSync as readFileSync14, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync15, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync3 } from "node:fs";
+import { join as join11 } from "node:path";
 import { homedir as homedir4 } from "node:os";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { spawnSync as spawnSync2 } from "node:child_process";
@@ -14838,7 +14838,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync5(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join10(d, e.name));
+          walk(join11(d, e.name));
         else
           n++;
       }
@@ -14852,8 +14852,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync3(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join10(DATA_ROOT2, "payloads");
-  const templatesPath = join10(DATA_ROOT2, "templates");
+  const payloadsPath = join11(DATA_ROOT2, "payloads");
+  const templatesPath = join11(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -14863,8 +14863,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join10(ROOT5, "payloads");
-  const localTemplates = join10(ROOT5, "templates");
+  const localPayloads = join11(ROOT5, "payloads");
+  const localTemplates = join11(ROOT5, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -14877,23 +14877,23 @@ function syncData() {
   }
   const gitOk = spawnSync2("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join10(DATA_ROOT2, ".tmp-clone");
+    const tmp = join11(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
-      rmSync2(tmp, { recursive: true, force: true });
+      rmSync3(tmp, { recursive: true, force: true });
     const r = spawnSync2("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
       const sparse = spawnSync2("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join10(tmp, "payloads"), payloadsPath);
+          copyDir(join11(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join10(tmp, "templates"), templatesPath);
+          copyDir(join11(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
-      rmSync2(tmp, { recursive: true, force: true });
+      rmSync3(tmp, { recursive: true, force: true });
     }
   }
   return {
@@ -14911,18 +14911,18 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync3(dst, { recursive: true });
   for (const e of readdirSync5(src, { withFileTypes: true })) {
-    const s = join10(src, e.name);
-    const d = join10(dst, e.name);
+    const s = join11(src, e.name);
+    const d = join11(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync3(d, readFileSync14(s));
+      writeFileSync4(d, readFileSync15(s));
   }
 }
 var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT5 = join10(fileURLToPath7(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join10(homedir4(), ".blitzstrike", "data");
+  ROOT5 = join11(fileURLToPath7(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join11(homedir4(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -31072,8 +31072,8 @@ var SINK_CLASS_MAP = [
   [/\bmove_uploaded_file\(|\bfile_put_contents\(|\bfwrite\(|\bfopen\(|\bunlink\(/, { id: "file_operations", category: "File operations", cwe: "CWE-434" }],
   [/\binclude\(|\brequire\(|\binclude_once\(|\brequire_once\(/, { id: "file_inclusion", category: "File inclusion", cwe: "CWE-98" }],
   [/\bunserialize\(|\bmaybe_unserialize\(/, { id: "deserialization", category: "Deserialization", cwe: "CWE-502" }],
-  [/\bwp_remote_get\(|\bwp_remote_post\(|\bfile_get_contents\(|\bcurl_exec\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
-  [/\bheader\(|\bwp_redirect\(|\bwp_safe_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
+  [/\bwp_remote_get\(|\bwp_remote_post\(|\bfile_get_contents\(|\bcurl_exec\(|\bcurl_setopt\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
+  [/\bheader\(|\bwp_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
   [/echo\s|print\s|\bprintf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
   [/\bsimplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
   [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
@@ -31859,9 +31859,11 @@ function sinkClassOf2(call) {
     return null;
   let token = "";
   if (what.kind === "propertylookup") {
-    const base = rootVarName2(what.what);
+    const baseNode = what.what;
+    const base = rootVarName2(baseNode);
     const method = what.offset?.name ?? what.offset?.value;
-    token = `${base}->${method}(`;
+    const baseStr = isNode3(baseNode) && (baseNode.kind === "variable" || baseNode.kind === "offsetlookup") ? `$${base}` : base;
+    token = `${baseStr}->${method}(`;
   } else if (what.kind === "name") {
     token = `${what.name}(`;
   }
@@ -31918,26 +31920,27 @@ function summarizeFunction(fn, id, name, summaries) {
   }
   return summary;
 }
-function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeAuth, summaries) {
+function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating = false) {
   for (const stmt of statements) {
     if (!isNode3(stmt))
       continue;
     const kind = stmt.kind;
     if (kind === "expressionstatement") {
-      analyzeExpr(stmt.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      analyzeExpr(stmt.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     } else if (kind === "if") {
       const condGates = authGatesOf(stmt.test);
       const branchAuth = [...activeAuth, ...condGates];
+      const condValidating = validationGatesOf(stmt.test);
       const thenStmts = stmt.body?.kind === "block" ? stmt.body.children ?? [] : [stmt.body];
       const thenEnv = cloneEnv(env);
       const thenCtx = { sinks: [], returnsTainted: false, calls: [] };
-      analyzeBody(thenStmts, thenEnv, summary, thenCtx, taintedParam, cloneProps(props), branchAuth, summaries);
+      analyzeBody(thenStmts, thenEnv, summary, thenCtx, taintedParam, cloneProps(props), branchAuth, summaries, validating || condValidating);
       mergeCtx(ctx, thenCtx);
       if (stmt.alternate) {
         const altStmts = stmt.alternate.kind === "block" ? stmt.alternate.children ?? [] : [stmt.alternate];
         const altEnv = cloneEnv(env);
         const altCtx = { sinks: [], returnsTainted: false, calls: [] };
-        analyzeBody(altStmts, altEnv, summary, altCtx, taintedParam, cloneProps(props), activeAuth, summaries);
+        analyzeBody(altStmts, altEnv, summary, altCtx, taintedParam, cloneProps(props), activeAuth, summaries, validating);
         mergeCtx(ctx, altCtx);
         for (const [k, v] of thenEnv) {
           const alt = altEnv.get(k);
@@ -31948,25 +31951,25 @@ function analyzeBody(statements, env, summary, ctx, taintedParam, props, activeA
           env.set(k, v);
       }
     } else if (kind === "block") {
-      analyzeBody(stmt.children ?? [], env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      analyzeBody(stmt.children ?? [], env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     } else if (kind === "return") {
-      const t = analyzeExpr(stmt.expr, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      const t = analyzeExpr(stmt.expr, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       if (t.tainted)
         ctx.returnsTainted = true;
     } else if (kind === "echo" || kind === "print") {
-      analyzeExpr(stmt, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      analyzeExpr(stmt, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     } else {
       for (const c of children3(stmt)) {
         if (c.kind === "block" || c.kind === "if") {
-          analyzeBody([c], env, summary, ctx, taintedParam, props, activeAuth, summaries);
+          analyzeBody([c], env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
         } else {
-          analyzeExpr(c, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+          analyzeExpr(c, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
         }
       }
     }
   }
 }
-function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, summaries) {
+function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating = false) {
   if (!isNode3(node))
     return CLEAN;
   const src = sourceOf2(node);
@@ -31974,7 +31977,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
     return { tainted: true, sources: [src], sanitizers: [], sourceLine: node.loc?.start?.line };
   if (node.kind === "assign") {
     const byref = node.operator === "=&";
-    const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
     const lhs = node.left;
     if (isNode3(lhs) && lhs.kind === "variable") {
       const varName = lhs.name;
@@ -32006,7 +32009,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
   }
   if (node.kind === "call") {
     const sink = sinkClassOf2(node);
-    const argTaints = node.arguments.map((a) => analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries));
+    const argTaints = node.arguments.map((a) => analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating));
     const taintedArgs = argTaints.filter((t) => t.tainted);
     if (sink) {
       if (taintedArgs.length > 0) {
@@ -32016,7 +32019,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         ctx.sinks.push({ sink: sink.token, line: node.loc?.start?.line ?? 0, sanitized, authGated: gates.length > 0, authGates: gates });
       }
       for (const a of node.arguments)
-        analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+        analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       return taintedArgs.length > 0 ? mergeTaint(...taintedArgs) : CLEAN;
     }
     const fnName = rootVarName2(node.what);
@@ -32059,6 +32062,9 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         }
       }
     }
+    if (isNode3(node.what) && node.what.kind === "propertylookup") {
+      analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    }
     return CLEAN;
   }
   if (node.kind === "variable") {
@@ -32072,7 +32078,7 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
       if (t)
         return { ...t };
     }
-    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
   }
   if (node.kind === "propertylookup") {
     const objName = rootVarName2(node.what);
@@ -32082,35 +32088,55 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
       if (pt)
         return { ...pt };
     }
-    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    return analyzeExpr(node.what, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
   }
   if (node.kind === "retif") {
-    const t = analyzeExpr(node.trueExpr ?? node.test, env, summary, ctx, taintedParam, props, activeAuth, summaries);
-    const f = node.falseExpr ? analyzeExpr(node.falseExpr, env, summary, ctx, taintedParam, props, activeAuth, summaries) : CLEAN;
+    const t = analyzeExpr(node.trueExpr ?? node.test, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    const f = node.falseExpr ? analyzeExpr(node.falseExpr, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating) : CLEAN;
     return mergeTaint(t, f);
   }
   if (node.kind === "bin" || node.kind === "concat" || node.kind === "encapsed") {
     const parts = children3(node);
-    const taints = parts.map((p) => analyzeExpr(p, env, summary, ctx, taintedParam, props, activeAuth, summaries));
+    const taints = parts.map((p) => analyzeExpr(p, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating));
     return mergeTaint(...taints);
   }
   if (node.kind === "encapsedpart") {
-    return analyzeExpr(node.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+    return analyzeExpr(node.expression, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
   }
   if (node.kind === "echo" || node.kind === "print") {
     const exprs = node.expressions ?? [node.expression];
     const cls = classifySink2(node.kind === "echo" ? "echo " : "print ");
     let ret = CLEAN;
     for (const e of exprs) {
-      const t = analyzeExpr(e, env, summary, ctx, taintedParam, props, activeAuth, summaries);
+      const t = analyzeExpr(e, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       if (t.tainted && cls) {
         const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(e))];
-        ctx.sinks.push({ sink: node.kind + " ", line: node.loc?.start?.line ?? 0, sanitized: isSanitized(san, cls.id), authGated: activeAuth.length > 0, authGates: activeAuth });
+        ctx.sinks.push({ sink: node.kind + " ", line: node.loc?.start?.line ?? 0, sanitized: isSanitized(san, cls.id) || validating, authGated: activeAuth.length > 0, authGates: activeAuth });
       }
       ret = mergeTaint(ret, t);
     }
     return ret;
   }
+  if (node.kind === "include") {
+    const base = node.require ? "require" : "include";
+    const suffix = node.once ? "_once" : "";
+    const sinkToken = base + suffix + "(";
+    const cls = classifySink2(sinkToken);
+    const t = analyzeExpr(node.target, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    if (t.tainted && cls) {
+      const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(node))];
+      ctx.sinks.push({ sink: sinkToken, line: node.loc?.start?.line ?? 0, sanitized: isSanitized(san, cls.id) || validating, authGated: activeAuth.length > 0, authGates: activeAuth });
+    }
+    return t;
+  }
+  if (node.kind === "eval") {
+    const cls = classifySink2("eval(");
+    const t = analyzeExpr(node.source, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    if (t.tainted && cls) {
+      ctx.sinks.push({ sink: "eval(", line: node.loc?.start?.line ?? 0, sanitized: false, authGated: activeAuth.length > 0, authGates: activeAuth });
+    }
+    return t;
+  }
   return CLEAN;
 }
 function cloneEnv(env) {
@@ -32133,6 +32159,13 @@ function authGatesOf(node) {
     return [];
   return AUTH_GATES.filter((g) => JSON.stringify(node).includes(g));
 }
+var VALIDATION_GATES = ["in_array", "preg_match", "ctype_digit", "ctype_alnum", "is_numeric"];
+function validationGatesOf(node) {
+  if (!isNode3(node))
+    return false;
+  const text = JSON.stringify(node);
+  return VALIDATION_GATES.some((g) => text.includes(g));
+}
 function collectDecls(ast, out) {
   walkDecls(ast, out);
 }
@@ -32293,6 +32326,12 @@ function analyzeDataFlow2(path) {
   return result;
 }
 
+// src/differential.ts
+import { writeFileSync as writeFileSync2, rmSync, mkdtempSync, readFileSync as readFileSync13 } from "node:fs";
+import { join as join9 } from "node:path";
+import { tmpdir } from "node:os";
+import { execSync } from "node:child_process";
+
 // src/universal-taint.ts
 function runTaintEngine(adapter, code, file) {
   const result = { file, language: adapter.language, findings: [], suppressed: 0 };
@@ -50346,8 +50385,13 @@ var JS_SINKS = [
   [/document\.write/i, "html_render", "CWE-79"],
   [/fs\.writeFile/i, "file_operations", "CWE-434"],
   [/fs\.appendFile/i, "file_operations", "CWE-434"],
+  [/fs\.readFile/i, "path_traversal", "CWE-22"],
+  [/fs\.readFileSync/i, "path_traversal", "CWE-22"],
+  [/fs\.unlink/i, "file_operations", "CWE-434"],
   [/require\s*\(/i, "file_inclusion", "CWE-98"],
   [/fetch\s*\(/i, "http_request", "CWE-918"],
+  [/http\.get|https\.get|axios/i, "http_request", "CWE-918"],
+  [/http\.request|https\.request/i, "http_request", "CWE-918"],
   [/redirect\s*\(/i, "redirect", "CWE-601"],
   [/res\.redirect/i, "redirect", "CWE-601"]
 ];
@@ -50434,6 +50478,8 @@ var jsAdapter = {
             argVars.push(c.name);
         for (const [re, kind, cwe] of JS_SINKS) {
           if (re.test(fullCallText) || re.test(calleeText + "(")) {
+            if (kind === "sql_execution" && /\?/.test(fullCallText) && /,\s*\[/.test(fullCallText))
+              continue;
             for (const v of argVars)
               sinks.push({ variable: v, kind, line: n.loc?.start?.line ?? 0, cwe });
           }
@@ -50472,6 +50518,8 @@ var PY_SINKS = [
   [/\.save\s*\(/i, "file_operations", "CWE-434"],
   [/render_template/i, "html_render", "CWE-79"],
   [/redirect\s*\(/i, "redirect", "CWE-601"],
+  [/requests\.(get|post|put|head|request)\s*\(/i, "http_request", "CWE-918"],
+  [/urllib\.request/i, "http_request", "CWE-918"],
   [/pickle\.loads\s*\(/i, "deserialization", "CWE-502"],
   [/yaml\.load\s*\(/i, "deserialization", "CWE-502"],
   [/os\.popen\s*\(/i, "command_execution", "CWE-78"],
@@ -50556,9 +50604,14 @@ var pythonAdapter = {
           if (m[1] !== callee.trim().split(".").pop())
             argVars.push(m[1]);
         for (const [re, kind, cwe] of PY_SINKS) {
-          if (re.test(full))
-            for (const v of argVars)
-              sinks.push({ variable: v, kind, line: lineOf(n), cwe });
+          if (!re.test(full))
+            continue;
+          if (kind === "sql_execution" && /\?/.test(full) && /,\s*\(/.test(full))
+            continue;
+          if (kind === "command_execution" && /subprocess/.test(full) && /\[/.test(full))
+            continue;
+          for (const v of argVars)
+            sinks.push({ variable: v, kind, line: lineOf(n), cwe });
         }
         for (const [re, kinds] of PY_SANITIZERS) {
           if (re.test(full))
@@ -50594,6 +50647,10 @@ var JAVA_SINKS = [
   [/readObject\s*\(/i, "deserialization", "CWE-502"],
   [/new File\s*\(/i, "file_operations", "CWE-434"],
   [/\.getInputStream\s*\(/i, "http_request", "CWE-918"],
+  [/new URL\s*\(/i, "http_request", "CWE-918"],
+  [/openConnection\s*\(/i, "http_request", "CWE-918"],
+  [/DocumentBuilder|SAXParser|XMLReader/i, "xml_processing", "CWE-611"],
+  [/\.parse\s*\(/i, "xml_processing", "CWE-611"],
   [/sendRedirect\s*\(/i, "redirect", "CWE-601"],
   [/\.forward\s*\(/i, "redirect", "CWE-601"]
 ];
@@ -50661,6 +50718,193 @@ registerLanguage(jsAdapter);
 registerLanguage(pythonAdapter);
 registerLanguage(javaAdapter);
 
+// src/differential.ts
+init_scanner();
+function runEngine(code, language, file) {
+  if (language === "php") {
+    const dir = mkdtempSync(join9(tmpdir(), "blitz-diff-"));
+    const tmp = join9(dir, "old.php");
+    writeFileSync2(tmp, code);
+    try {
+      const r = analyzeDataFlow2(tmp);
+      return r.findings.map((f) => ({ sink: f.sink, sink_line: f.sink_line, category: f.category, source: f.source, cwe: f.cwe }));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+  const r = analyzeTaintUniversal(code, file);
+  return r.findings.map((f) => ({ sink: f.sink, sink_line: f.sink_line, category: f.sink, source: f.source_kind, cwe: f.cwe }));
+}
+function diffLines(oldText, newText) {
+  const a = oldText.split(`
+`);
+  const b = newText.split(`
+`);
+  const m = a.length;
+  const n = b.length;
+  const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = m - 1;i >= 0; i--) {
+    for (let j = n - 1;j >= 0; j--) {
+      dp[i][j] = a[i] === b[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
+    }
+  }
+  const added = [];
+  const removed = [];
+  let i = 0;
+  let j = 0;
+  while (i < m && j < n) {
+    if (a[i] === b[j]) {
+      i++;
+      j++;
+    } else if (dp[i + 1][j] >= dp[i][j + 1]) {
+      removed.push({ line: i + 1, text: a[i] });
+      i++;
+    } else {
+      added.push({ line: j + 1, text: b[j] });
+      j++;
+    }
+  }
+  while (i < m) {
+    removed.push({ line: i + 1, text: a[i] });
+    i++;
+  }
+  while (j < n) {
+    added.push({ line: j + 1, text: b[j] });
+    j++;
+  }
+  return { added, removed };
+}
+function analyzeDifferential(oldCode, newCode, language, file = "target") {
+  const changes = [];
+  const oldFindings = runEngine(oldCode, language, file);
+  const newFindings = runEngine(newCode, language, file);
+  const key = (f) => `${f.category}|${f.sink}|${f.sink_line}`;
+  const oldKeys = new Set(oldFindings.map(key));
+  const newKeys = new Set(newFindings.map(key));
+  for (const f of newFindings) {
+    if (!oldKeys.has(key(f))) {
+      changes.push({
+        kind: "new_vulnerability",
+        severity: "high",
+        sink: f.sink,
+        category: f.category,
+        source: f.source,
+        cwe: f.cwe,
+        line: f.sink_line,
+        detail: `new ${f.category} at line ${f.sink_line} (${f.sink.trim()})`
+      });
+    }
+  }
+  for (const f of oldFindings) {
+    if (!newKeys.has(key(f))) {
+      changes.push({
+        kind: "fixed_vulnerability",
+        severity: "low",
+        sink: f.sink,
+        category: f.category,
+        source: f.source,
+        cwe: f.cwe,
+        line: f.sink_line,
+        detail: `removed ${f.category} at line ${f.sink_line} (${f.sink.trim()})`
+      });
+    }
+  }
+  const { added, removed } = diffLines(oldCode, newCode);
+  for (const l of added) {
+    const sink = classifySink2(l.text);
+    if (sink) {
+      changes.push({
+        kind: "new_sink",
+        severity: "medium",
+        sink: l.text.trim(),
+        category: sink.category,
+        cwe: sink.cwe,
+        line: l.line,
+        detail: `added sink ${l.text.trim()} (${sink.category})`
+      });
+    }
+    const source = classifySource(l.text);
+    if (source) {
+      changes.push({
+        kind: "new_source",
+        severity: source.attacker_controlled ? "medium" : "low",
+        source: source.label,
+        line: l.line,
+        detail: `added source ${l.text.trim()} (${source.label})`
+      });
+    }
+  }
+  for (const l of removed) {
+    const san = findSanitizers(l.text);
+    if (san.length > 0) {
+      changes.push({
+        kind: "sanitizer_removed",
+        severity: "high",
+        line: l.line,
+        detail: `removed sanitizer ${san.map((s) => s.label).join(", ")} (${l.text.trim()})`
+      });
+    }
+    const gates = AUTH_GATES.filter((g) => l.text.includes(g));
+    if (gates.length > 0) {
+      changes.push({
+        kind: "authorization_removed",
+        severity: "high",
+        line: l.line,
+        detail: `removed authorization gate ${gates.join(", ")} (${l.text.trim()})`
+      });
+    }
+  }
+  const rank = { high: 0, medium: 1, low: 2 };
+  changes.sort((x, y) => rank[x.severity] - rank[y.severity] || x.line - y.line);
+  const count = (k) => changes.filter((c) => c.kind === k).length;
+  return {
+    language,
+    changes,
+    summary: {
+      new_vulnerabilities: count("new_vulnerability"),
+      fixed_vulnerabilities: count("fixed_vulnerability"),
+      new_sinks: count("new_sink"),
+      new_sources: count("new_source"),
+      sanitizers_removed: count("sanitizer_removed"),
+      authorizations_removed: count("authorization_removed")
+    }
+  };
+}
+function languageOf(file) {
+  const adapter = detectLanguage(file);
+  return adapter?.language ?? "php";
+}
+function analyzeDifferentialFiles(oldPath, newPath, language) {
+  const oldCode = readFileSync13(oldPath, "utf8");
+  const newCode = readFileSync13(newPath, "utf8");
+  const lang = language ?? languageOf(newPath);
+  return analyzeDifferential(oldCode, newCode, lang, newPath);
+}
+var SOURCE_EXTS = [".php", ".phtml", ".php5", ".js", ".mjs", ".ts", ".tsx", ".py", ".pyw", ".java"];
+function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
+  const git = (args) => {
+    try {
+      return execSync(`git ${args}`, { cwd: repo, encoding: "utf8", maxBuffer: 50 * 1024 * 1024 }).trim();
+    } catch {
+      return "";
+    }
+  };
+  const changed = git(`diff --name-only ${base} ${head}`).split(`
+`).filter((f) => f && SOURCE_EXTS.some((e) => f.endsWith(e)));
+  const files = [];
+  for (const file of changed) {
+    const oldCode = git(`show ${base}:${file}`);
+    const newCode = git(`show ${head}:${file}`);
+    if (!newCode)
+      continue;
+    const lang = languageOf(file);
+    files.push({ file, result: analyzeDifferential(oldCode || "", newCode, lang, file) });
+  }
+  const total_changes = files.reduce((n, f) => n + f.result.changes.length, 0);
+  const security_sensitive = files.reduce((n, f) => n + f.result.changes.filter((c) => c.severity === "high").length, 0);
+  return { repo, base, head, files, total_changes, security_sensitive };
+}
+
 // src/guidance.ts
 var SINK_DIRECTIVES = {
   sql_execution: "Validate the SQL injection live with strike_verify (use a unique MARKER and a NEGATIVE CONTROL that stays inert), or read_tool_manual for sqlmap. Only a reflected marker + inert control = confirmed.",
@@ -51474,16 +51718,16 @@ function reportJson(findings, opts = {}) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync13, readdirSync as readdirSync4, writeFileSync as writeFileSync2, rmSync } from "node:fs";
-import { join as join9 } from "node:path";
+import { readFileSync as readFileSync14, readdirSync as readdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
-import { tmpdir } from "node:os";
-var ROOT4 = join9(fileURLToPath6(new URL(".", import.meta.url)), "..");
-var CORPUS = join9(ROOT4, "bench", "corpus");
+import { tmpdir as tmpdir2 } from "node:os";
+var ROOT4 = join10(fileURLToPath6(new URL(".", import.meta.url)), "..");
+var CORPUS = join10(ROOT4, "bench", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync13(path, "utf8");
+    text = readFileSync14(path, "utf8");
   } catch {
     return null;
   }
@@ -51533,7 +51777,7 @@ function loadCorpus() {
     for (const f of readdirSync4(CORPUS)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join9(CORPUS, f));
+      const e = parseCorpusFile(join10(CORPUS, f));
       if (e)
         entries.push(e);
     }
@@ -51545,10 +51789,10 @@ function loadCorpus() {
 function detect(entry) {
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join9(tmpdir(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
-    writeFileSync2(tmp, entry.code);
-    const r = analyzeTaint(tmp);
-    rmSync(tmp, { force: true });
+    const tmp = join10(tmpdir2(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    writeFileSync3(tmp, entry.code);
+    const r = analyzeDataFlow2(tmp);
+    rmSync2(tmp, { force: true });
     if (r.findings.length > 0)
       return { detected: true, sinkKind: r.findings[0].sink };
     return { detected: false };
@@ -52363,6 +52607,34 @@ function createServer() {
       }]
     };
   });
+  server.registerTool("diff_analyze", {
+    title: "Differential security analysis",
+    description: "PHASE 4: compare two versions of code (files or a git commit range) and surface only security-sensitive changes — new vulnerabilities, fixed vulnerabilities, new sinks/sources, removed sanitizers, and removed authorization gates.",
+    inputSchema: {
+      old_path: string2().optional().describe("Old file path"),
+      new_path: string2().optional().describe("New file path"),
+      old_code: string2().optional().describe("Old source code (when not using paths)"),
+      new_code: string2().optional().describe("New source code (when not using paths)"),
+      language: string2().optional().describe("Language (php/javascript/python/java); auto-detected from path if omitted"),
+      repo: string2().optional().describe("Git repo path (for git-diff mode)"),
+      base: string2().optional().describe("Git base ref (default HEAD~1)"),
+      head: string2().optional().describe("Git head ref (default HEAD)")
+    }
+  }, async ({ old_path, new_path, old_code, new_code, language, repo, base, head }) => {
+    if (repo) {
+      const r = analyzeGitDiff(repo, base ?? "HEAD~1", head ?? "HEAD");
+      return { content: [{ type: "text", text: JSON.stringify(r) }] };
+    }
+    let result;
+    if (old_path && new_path) {
+      result = analyzeDifferentialFiles(old_path, new_path, language);
+    } else if (old_code !== undefined && new_code !== undefined) {
+      result = analyzeDifferential(old_code, new_code, language ?? "php", new_path ?? "target");
+    } else {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "provide (old_path+new_path), (old_code+new_code), or (repo)" }) }] };
+    }
+    return { content: [{ type: "text", text: JSON.stringify(result) }] };
+  });
   server.registerTool("taint_tree", {
     title: "Whole-tree taint scan",
     description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",
@@ -52516,12 +52788,12 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync15, existsSync as existsSync6, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join11, dirname as dirname2 } from "node:path";
+import { readFileSync as readFileSync16, existsSync as existsSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join12, dirname as dirname2 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
-var ROOT6 = join11(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var ROOT6 = join12(fileURLToPath8(new URL(".", import.meta.url)), "..");
 function which(cmd) {
   return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
 }
@@ -52556,7 +52828,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync6(join11(ROOT6, "chains.json")) && existsSync6(join11(ROOT6, "tools-catalog.json"));
+  const dataOk = existsSync6(join12(ROOT6, "chains.json")) && existsSync6(join12(ROOT6, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -52584,21 +52856,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join11(ROOT6, "src", "index.ts");
+  const src = join12(ROOT6, "src", "index.ts");
   if (which("bun") && existsSync6(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join11(ROOT6, "dist", "index.js");
+  const dist = join12(ROOT6, "dist", "index.js");
   if (existsSync6(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync15(p, "utf8"));
+    return JSON.parse(readFileSync16(p, "utf8"));
   } catch {
     return null;
   }
@@ -52613,7 +52885,7 @@ function jsonMcpServersWrite(p) {
       ...existing.mcpServers ?? {},
       blitzstrike: { command, args }
     };
-    writeFileSync4(p, JSON.stringify(existing, null, 2));
+    writeFileSync5(p, JSON.stringify(existing, null, 2));
   };
 }
 function opencodeWrite(p) {
@@ -52626,22 +52898,22 @@ function opencodeWrite(p) {
       ...existing.mcp ?? {},
       blitzstrike: { type: "local", command: ["npx", "-y", "blitzstrike", "serve", "--mcp"], enabled: true }
     };
-    writeFileSync4(p, JSON.stringify(existing, null, 2));
+    writeFileSync5(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join11(ROOT6, "opencode-agents");
-  const dstDir = join11(homedir5(), ".config", "opencode", "agents");
+  const srcDir = join12(ROOT6, "opencode-agents");
+  const dstDir = join12(homedir5(), ".config", "opencode", "agents");
   if (!existsSync6(srcDir))
     return;
   if (!existsSync6(dstDir))
     mkdirSync4(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join11(srcDir, f);
-    const dst = join11(dstDir, f);
+    const src = join12(srcDir, f);
+    const dst = join12(dstDir, f);
     if (existsSync6(src)) {
-      writeFileSync4(dst, readFileSync15(src, "utf8"));
+      writeFileSync5(dst, readFileSync16(src, "utf8"));
     }
   }
 }
@@ -52650,7 +52922,7 @@ function codexWrite(p) {
     const dir = dirname2(p);
     if (!existsSync6(dir))
       mkdirSync4(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync15(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync16(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -52661,7 +52933,7 @@ function codexWrite(p) {
 command = "${command}"
 args = ${JSON.stringify(args)}
 `;
-    writeFileSync4(p, existing);
+    writeFileSync5(p, existing);
   };
 }
 function hermesWrite(p) {
@@ -52669,7 +52941,7 @@ function hermesWrite(p) {
     const dir = dirname2(p);
     if (!existsSync6(dir))
       mkdirSync4(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync15(p, "utf8") : "";
+    let existing = existsSync6(p) ? readFileSync16(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -52690,80 +52962,80 @@ mcp_servers:
     args: ${JSON.stringify(args)}
 `;
     }
-    writeFileSync4(p, existing);
+    writeFileSync5(p, existing);
   };
 }
 function detectAgents() {
   const home = homedir5();
   const agents = [];
-  const claudeJson = join11(home, ".claude.json");
+  const claudeJson = join12(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync6(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join11(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join12(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync6(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join11(home, ".cursor", "mcp.json");
+  const cursor = join12(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync6(join11(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync6(join12(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join11(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join12(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync6(join11(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync6(join12(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join11(home, ".codex", "config.toml");
+  const codex = join12(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync6(join11(home, ".codex")) || which("codex"),
+    installed: () => existsSync6(join12(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join11(home, ".hermes", "config.yaml");
+  const hermes = join12(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync6(join11(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync6(join12(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join11(home, ".gemini", "settings.json");
+  const gemini = join12(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync6(join11(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync6(join12(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join11(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join12(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync6(join11(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync6(join12(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join11(home, ".copilot", "mcp.json");
+  const copilot = join12(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync6(join11(home, ".copilot")),
+    installed: () => existsSync6(join12(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join11(home, ".cline", "mcp_settings.json");
+  const cline = join12(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync6(join11(home, ".cline")),
+    installed: () => existsSync6(join12(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -52807,15 +53079,15 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync16, existsSync as existsSync7 } from "node:fs";
-import { join as join12 } from "node:path";
+import { readFileSync as readFileSync17, existsSync as existsSync7 } from "node:fs";
+import { join as join13 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-var ROOT7 = join12(fileURLToPath9(new URL(".", import.meta.url)), "..");
+var ROOT7 = join13(fileURLToPath9(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join12(ROOT7, "package.json");
+    const p = join13(ROOT7, "package.json");
     if (existsSync7(p))
-      return JSON.parse(readFileSync16(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync17(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }