blitzstrike 1.0.37 → 1.0.39

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.39] — 2026-09-13
+
+### Added
+
+- **Phase 5 — Framework Intelligence** (`src/frameworks.ts` + `intelligence/frameworks.json`):
+  - Data-driven framework knowledge for 7 frameworks (361 patterns), extensible
+    without code changes: Laravel, WordPress (PHP); Express, Next.js (JS/TS);
+    Django, FastAPI (Python); Spring (Java). Rails (Ruby) deferred until Ruby support.
+  - Each framework defines sources, sinks, sanitizers, auth gates, routing, ORM,
+    and middleware patterns (with CWE tags on sinks).
+  - `detectFramework(code, language)` — heuristic detection via scored signals.
+  - `scanFramework(code, framework)` — framework-aware source/sink/sanitizer/auth hits.
+  - New MCP tools: `list_frameworks`, `detect_framework`, `framework_intel`.
+
+## [1.0.38] — 2026-09-13
+
+### Fixed (Phase 4 review)
+
+- `diff_analyze` ignored the `language` argument for non-PHP code (bare `file`
+  without an extension resolved to `unknown`, silently returning 0 findings).
+  The engine now derives a probe extension from the declared language.
+- `eagle_eye2` now surfaces `entry_points` (uncalled functions = potential unauth
+  entry points) and `unreachable` (dead code) — previously computed but hidden.
+- Removed the unused `call_graph` field from `Eagle2Result.summary` (Map/Set-based,
+  not JSON-safe, never consumed).
+- Removed the dead `nextCorrelationId` export from `audit.ts`.
+
 ## [1.0.37] — 2026-09-13
 
 ### Added

package/dist/index.js

@@ -14820,10 +14820,10 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync15, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync3 } from "node:fs";
-import { join as join11 } from "node:path";
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync16, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync3 } from "node:fs";
+import { join as join12 } from "node:path";
 import { homedir as homedir4 } from "node:os";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { spawnSync as spawnSync2 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -14838,7 +14838,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync5(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join11(d, e.name));
+          walk(join12(d, e.name));
         else
           n++;
       }
@@ -14852,8 +14852,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync3(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join11(DATA_ROOT2, "payloads");
-  const templatesPath = join11(DATA_ROOT2, "templates");
+  const payloadsPath = join12(DATA_ROOT2, "payloads");
+  const templatesPath = join12(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -14863,8 +14863,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join11(ROOT5, "payloads");
-  const localTemplates = join11(ROOT5, "templates");
+  const localPayloads = join12(ROOT6, "payloads");
+  const localTemplates = join12(ROOT6, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -14877,7 +14877,7 @@ function syncData() {
   }
   const gitOk = spawnSync2("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join11(DATA_ROOT2, ".tmp-clone");
+    const tmp = join12(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync3(tmp, { recursive: true, force: true });
     const r = spawnSync2("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -14885,11 +14885,11 @@ function syncData() {
       const sparse = spawnSync2("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join11(tmp, "payloads"), payloadsPath);
+          copyDir(join12(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join11(tmp, "templates"), templatesPath);
+          copyDir(join12(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -14911,18 +14911,18 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync3(dst, { recursive: true });
   for (const e of readdirSync5(src, { withFileTypes: true })) {
-    const s = join11(src, e.name);
-    const d = join11(dst, e.name);
+    const s = join12(src, e.name);
+    const d = join12(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync4(d, readFileSync15(s));
+      writeFileSync4(d, readFileSync16(s));
   }
 }
-var ROOT5, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var ROOT6, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT5 = join11(fileURLToPath7(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join11(homedir4(), ".blitzstrike", "data");
+  ROOT6 = join12(fileURLToPath8(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join12(homedir4(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -29601,6 +29601,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
+import { readFileSync as readFileSync17 } from "node:fs";
 
 // src/recon.ts
 var TIMEOUT_MS = 25000;
@@ -31777,6 +31778,30 @@ function resolveCall(g, call, callerId, ctx, file, line) {
     return;
   }
 }
+function reachableFrom(g, entry) {
+  const seen = new Set;
+  const stack = [entry];
+  while (stack.length) {
+    const cur = stack.pop();
+    if (seen.has(cur))
+      continue;
+    seen.add(cur);
+    const n = g.nodes.get(cur);
+    if (!n)
+      continue;
+    for (const c of n.callees)
+      stack.push(c);
+  }
+  return seen;
+}
+function entryPoints(g) {
+  const entries = [];
+  for (const [id, n] of g.nodes) {
+    if (n.callers.size === 0)
+      entries.push(id);
+  }
+  return entries;
+}
 
 // src/eagle2.ts
 var parser3 = new import_php_parser3.Engine({
@@ -32206,11 +32231,17 @@ function resolveFuncId(name, summaries) {
 }
 function analyzeDataFlow2(path) {
   const cg = buildCallGraph(path);
+  const entries = entryPoints(cg);
+  const reachable = new Set;
+  for (const e of entries)
+    for (const n of reachableFrom(cg, e))
+      reachable.add(n);
+  const unreachable = [...cg.nodes.keys()].filter((id) => !reachable.has(id));
   const result = {
     file: path,
     findings: [],
     suppressed: 0,
-    summary: { functions: 0, methods: 0, edges: cg.edges.length, call_graph: cg }
+    summary: { functions: 0, methods: 0, edges: cg.edges.length, entry_points: entries, unreachable }
   };
   let code;
   try {
@@ -50732,7 +50763,9 @@ function runEngine(code, language, file) {
       rmSync(dir, { recursive: true, force: true });
     }
   }
-  const r = analyzeTaintUniversal(code, file);
+  const extMap = { javascript: ".js", typescript: ".ts", python: ".py", java: ".java" };
+  const probe = file.includes(".") ? file : `target${extMap[language] ?? ""}`;
+  const r = analyzeTaintUniversal(code, probe);
   return r.findings.map((f) => ({ sink: f.sink, sink_line: f.sink_line, category: f.sink, source: f.source_kind, cwe: f.cwe }));
 }
 function diffLines(oldText, newText) {
@@ -50905,6 +50938,98 @@ function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
   return { repo, base, head, files, total_changes, security_sensitive };
 }
 
+// src/frameworks.ts
+import { readFileSync as readFileSync14, existsSync as existsSync6 } from "node:fs";
+import { join as join10 } from "node:path";
+import { fileURLToPath as fileURLToPath6 } from "node:url";
+var ROOT4 = join10(fileURLToPath6(new URL(".", import.meta.url)), "..");
+var INTEL2 = join10(ROOT4, "intelligence");
+var cache = null;
+function load() {
+  if (cache)
+    return cache;
+  const p = join10(INTEL2, "frameworks.json");
+  if (!existsSync6(p))
+    return null;
+  try {
+    cache = JSON.parse(readFileSync14(p, "utf8"));
+    return cache;
+  } catch {
+    return null;
+  }
+}
+function listFrameworks() {
+  const data = load();
+  if (!data)
+    return [];
+  return data.frameworks.map((f) => ({ id: f.id, name: f.name, language: f.language }));
+}
+function frameworkProfile(id) {
+  const data = load();
+  if (!data)
+    return null;
+  return data.frameworks.find((f) => f.id === id) ?? null;
+}
+function detectFramework(code, language) {
+  const data = load();
+  const hay = code.toLowerCase();
+  const candidates = [];
+  if (data) {
+    for (const f of data.frameworks) {
+      if (f.language !== language)
+        continue;
+      const score = f.detect.reduce((n, sig) => hay.includes(sig.toLowerCase()) ? n + 1 : n, 0);
+      if (score > 0)
+        candidates.push({ id: f.id, name: f.name, score });
+    }
+  }
+  candidates.sort((a, b) => b.score - a.score);
+  return { framework: candidates[0]?.id ?? null, language, candidates };
+}
+function scanFramework(code, frameworkId) {
+  const profile = frameworkProfile(frameworkId);
+  const empty = {
+    framework: frameworkId,
+    language: profile?.language ?? "unknown",
+    detected: false,
+    sources: [],
+    sinks: [],
+    sanitizers: [],
+    auth: [],
+    summary: { sources: 0, sinks: 0, sanitizers: 0, auth: 0 }
+  };
+  if (!profile)
+    return empty;
+  const lines = code.split(`
+`);
+  const scan = (patterns) => {
+    const hits = [];
+    for (let i = 0;i < lines.length; i++) {
+      const line = lines[i].toLowerCase();
+      for (const p of patterns) {
+        if (line.includes(p.pattern.toLowerCase())) {
+          hits.push({ line: i + 1, pattern: p.pattern, label: p.label, cwe: p.cwe });
+        }
+      }
+    }
+    return hits;
+  };
+  const sources = scan(profile.sources);
+  const sinks = scan(profile.sinks);
+  const sanitizers = scan(profile.sanitizers);
+  const auth = scan(profile.auth);
+  return {
+    framework: frameworkId,
+    language: profile.language,
+    detected: true,
+    sources,
+    sinks,
+    sanitizers,
+    auth,
+    summary: { sources: sources.length, sinks: sinks.length, sanitizers: sanitizers.length, auth: auth.length }
+  };
+}
+
 // src/guidance.ts
 var SINK_DIRECTIVES = {
   sql_execution: "Validate the SQL injection live with strike_verify (use a unique MARKER and a NEGATIVE CONTROL that stays inert), or read_tool_manual for sqlmap. Only a reflected marker + inert control = confirmed.",
@@ -51718,16 +51843,16 @@ function reportJson(findings, opts = {}) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync14, readdirSync as readdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "node:fs";
-import { join as join10 } from "node:path";
-import { fileURLToPath as fileURLToPath6 } from "node:url";
+import { readFileSync as readFileSync15, readdirSync as readdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "node:fs";
+import { join as join11 } from "node:path";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
 import { tmpdir as tmpdir2 } from "node:os";
-var ROOT4 = join10(fileURLToPath6(new URL(".", import.meta.url)), "..");
-var CORPUS = join10(ROOT4, "bench", "corpus");
+var ROOT5 = join11(fileURLToPath7(new URL(".", import.meta.url)), "..");
+var CORPUS = join11(ROOT5, "bench", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync14(path, "utf8");
+    text = readFileSync15(path, "utf8");
   } catch {
     return null;
   }
@@ -51777,7 +51902,7 @@ function loadCorpus() {
     for (const f of readdirSync4(CORPUS)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join10(CORPUS, f));
+      const e = parseCorpusFile(join11(CORPUS, f));
       if (e)
         entries.push(e);
     }
@@ -51789,7 +51914,7 @@ function loadCorpus() {
 function detect(entry) {
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join10(tmpdir2(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join11(tmpdir2(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync3(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync2(tmp, { force: true });
@@ -52601,6 +52726,8 @@ function createServer() {
           functions: r.summary.functions,
           methods: r.summary.methods,
           call_edges: r.summary.edges,
+          entry_points: r.summary.entry_points,
+          unreachable: r.summary.unreachable,
           results: r.findings,
           next_steps: guidance
         })
@@ -52635,6 +52762,62 @@ function createServer() {
     }
     return { content: [{ type: "text", text: JSON.stringify(result) }] };
   });
+  server.registerTool("list_frameworks", {
+    title: "List supported frameworks",
+    description: "PHASE 5: list the web frameworks Blitz Strike understands for framework-aware security analysis (Laravel, WordPress, Express, Next.js, Django, FastAPI, Spring)."
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify({ frameworks: listFrameworks() }) }] };
+  });
+  server.registerTool("detect_framework", {
+    title: "Detect web framework",
+    description: "PHASE 5: detect the web framework used by a source file (reads the file, then scores each framework's detection signals for the file's language).",
+    inputSchema: {
+      path: string2().optional().describe("Source file path (alternative: code)"),
+      code: string2().optional().describe("Source code directly (alternative to path)"),
+      language: string2().optional().describe("Language (auto-detected from path if omitted)")
+    }
+  }, async ({ path, code, language }) => {
+    let src = code ?? "";
+    let lang = language;
+    if (path && !code) {
+      try {
+        src = readFileSync17(path, "utf8");
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
+      }
+      lang = lang ?? detectLanguage(path)?.language ?? "php";
+    }
+    const d = detectFramework(src, lang ?? "php");
+    const scan = d.framework ? scanFramework(src, d.framework) : null;
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          framework: d.framework,
+          language: d.language,
+          candidates: d.candidates,
+          scan
+        })
+      }]
+    };
+  });
+  server.registerTool("framework_intel", {
+    title: "Framework security knowledge",
+    description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware) and optionally scan code with those patterns.",
+    inputSchema: {
+      framework: string2().describe("Framework id (see list_frameworks)"),
+      code: string2().optional().describe("Optional source code to scan with the framework's patterns")
+    }
+  }, async ({ framework, code }) => {
+    const profile = frameworkProfile(framework);
+    if (!profile) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: `unknown framework: ${framework}` }) }] };
+    }
+    const out = { profile };
+    if (code !== undefined)
+      out.scan = scanFramework(code, framework);
+    return { content: [{ type: "text", text: JSON.stringify(out) }] };
+  });
   server.registerTool("taint_tree", {
     title: "Whole-tree taint scan",
     description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",
@@ -52788,12 +52971,12 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync16, existsSync as existsSync6, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join12, dirname as dirname2 } from "node:path";
+import { readFileSync as readFileSync18, existsSync as existsSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join13, dirname as dirname2 } from "node:path";
 import { homedir as homedir5 } from "node:os";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
-var ROOT6 = join12(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var ROOT7 = join13(fileURLToPath9(new URL(".", import.meta.url)), "..");
 function which(cmd) {
   return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
 }
@@ -52828,7 +53011,7 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync6(join12(ROOT6, "chains.json")) && existsSync6(join12(ROOT6, "tools-catalog.json"));
+  const dataOk = existsSync7(join13(ROOT7, "chains.json")) && existsSync7(join13(ROOT7, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -52856,21 +53039,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join12(ROOT6, "src", "index.ts");
-  if (which("bun") && existsSync6(src))
+  const src = join13(ROOT7, "src", "index.ts");
+  if (which("bun") && existsSync7(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join12(ROOT6, "dist", "index.js");
-  if (existsSync6(dist))
+  const dist = join13(ROOT7, "dist", "index.js");
+  if (existsSync7(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync16(p, "utf8"));
+    return JSON.parse(readFileSync18(p, "utf8"));
   } catch {
     return null;
   }
@@ -52878,7 +53061,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync6(dir))
+    if (!existsSync7(dir))
       mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -52891,7 +53074,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (_command, _args) => {
     const dir = dirname2(p);
-    if (!existsSync6(dir))
+    if (!existsSync7(dir))
       mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -52903,26 +53086,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join12(ROOT6, "opencode-agents");
-  const dstDir = join12(homedir5(), ".config", "opencode", "agents");
-  if (!existsSync6(srcDir))
+  const srcDir = join13(ROOT7, "opencode-agents");
+  const dstDir = join13(homedir5(), ".config", "opencode", "agents");
+  if (!existsSync7(srcDir))
     return;
-  if (!existsSync6(dstDir))
+  if (!existsSync7(dstDir))
     mkdirSync4(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join12(srcDir, f);
-    const dst = join12(dstDir, f);
-    if (existsSync6(src)) {
-      writeFileSync5(dst, readFileSync16(src, "utf8"));
+    const src = join13(srcDir, f);
+    const dst = join13(dstDir, f);
+    if (existsSync7(src)) {
+      writeFileSync5(dst, readFileSync18(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync6(dir))
+    if (!existsSync7(dir))
       mkdirSync4(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync16(p, "utf8") : "";
+    let existing = existsSync7(p) ? readFileSync18(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -52939,9 +53122,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync6(dir))
+    if (!existsSync7(dir))
       mkdirSync4(dir, { recursive: true });
-    let existing = existsSync6(p) ? readFileSync16(p, "utf8") : "";
+    let existing = existsSync7(p) ? readFileSync18(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -52968,74 +53151,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir5();
   const agents = [];
-  const claudeJson = join12(home, ".claude.json");
+  const claudeJson = join13(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync6(claudeJson) || which("claude"),
+    installed: () => existsSync7(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join12(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join13(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync6(claudeDesktop),
+    installed: () => existsSync7(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join12(home, ".cursor", "mcp.json");
+  const cursor = join13(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync6(join12(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync7(join13(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join12(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join13(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync6(join12(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync7(join13(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join12(home, ".codex", "config.toml");
+  const codex = join13(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync6(join12(home, ".codex")) || which("codex"),
+    installed: () => existsSync7(join13(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join12(home, ".hermes", "config.yaml");
+  const hermes = join13(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync6(join12(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync7(join13(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join12(home, ".gemini", "settings.json");
+  const gemini = join13(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync6(join12(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync7(join13(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join12(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join13(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync6(join12(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync7(join13(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join12(home, ".copilot", "mcp.json");
+  const copilot = join13(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync6(join12(home, ".copilot")),
+    installed: () => existsSync7(join13(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join12(home, ".cline", "mcp_settings.json");
+  const cline = join13(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync6(join12(home, ".cline")),
+    installed: () => existsSync7(join13(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -53079,15 +53262,15 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync17, existsSync as existsSync7 } from "node:fs";
-import { join as join13 } from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
-var ROOT7 = join13(fileURLToPath9(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync19, existsSync as existsSync8 } from "node:fs";
+import { join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
+var ROOT8 = join14(fileURLToPath10(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join13(ROOT7, "package.json");
-    if (existsSync7(p))
-      return JSON.parse(readFileSync17(p, "utf8")).version ?? "1.0.0";
+    const p = join14(ROOT8, "package.json");
+    if (existsSync8(p))
+      return JSON.parse(readFileSync19(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }