blitzstrike 1.0.41 → 1.0.44

package/dist/index.js

@@ -30238,1378 +30238,1533 @@ function rejectFinding(finding, status, reason, evidence) {
   };
 }
 
-// src/orchestrator.ts
-var _chainsCache = null;
-function loadChains() {
-  if (_chainsCache)
-    return _chainsCache;
-  try {
-    const dir = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
-    const path = join6(dir, "chains.json");
-    const raw = JSON.parse(readFileSync6(path, "utf8"));
-    _chainsCache = raw.chains ?? [];
-    return _chainsCache;
-  } catch {
-    _chainsCache = [];
-    return [];
-  }
+// src/orchestration.ts
+var STATE_MACHINE = [
+  { state: "scope_check", description: "Validate target against scope + risk policy.", recommended_tools: ["scope_check"], required_evidence: ["scope_decision"], next: ["plan"], confidence: "high" },
+  { state: "plan", description: "Derive the engagement plan from surface + scope.", recommended_tools: ["list_chains"], required_evidence: ["plan_steps"], next: ["recon"], confidence: "high" },
+  { state: "recon", description: "Map the attack surface (endpoints, tech, WAF).", recommended_tools: ["blitz_scan", "active_scan", "fofa_search", "detect_waf"], required_evidence: ["attack_surface"], next: ["analyze"], confidence: "medium" },
+  { state: "analyze", description: "Trace source→sink flows (interprocedural taint).", recommended_tools: ["eagle_eye2", "blitz_scan", "blitz_file"], required_evidence: ["sink_hits", "taint_flow"], next: ["hypothesis"], confidence: "medium" },
+  { state: "hypothesis", description: "Form defensible hypotheses (static finding).", recommended_tools: ["blitz_file", "enrich_scan"], required_evidence: ["static_finding"], next: ["select_chain"], blocking: "live_validation_required", confidence: "high" },
+  { state: "select_chain", description: "Match the hypothesis to an escalation chain.", recommended_tools: ["list_chains", "read_playbook"], required_evidence: ["matched_chain"], next: ["validate"], confidence: "high" },
+  { state: "validate", description: "Verify live with baseline + marker + negative control.", recommended_tools: ["strike_verify", "browser_validate"], required_evidence: ["baseline", "marker_reflection", "negative_control"], next: ["evidence"], confidence: "medium" },
+  { state: "evidence", description: "Attach hashable, provenance-bound evidence.", recommended_tools: ["finding_attach_evidence"], required_evidence: ["evidence_artifact"], next: ["finding"], confidence: "high" },
+  { state: "finding", description: "Confirm the finding (invariants enforced).", recommended_tools: ["confirm_finding"], required_evidence: ["confirmed_finding"], next: ["report"], confidence: "high" },
+  { state: "report", description: "Produce a reproducible report.", recommended_tools: ["report", "security-report"], required_evidence: ["report"], next: [], confidence: "high" }
+];
+function stateDefinition(state) {
+  return STATE_MACHINE.find((s) => s.state === state);
+}
+var RISK_POLICY = [
+  { action: "scope_check", risk: "low", requires_scope: false, destructive: false },
+  { action: "blitz_scan", risk: "low", requires_scope: false, destructive: false },
+  { action: "blitz_file", risk: "low", requires_scope: false, destructive: false },
+  { action: "eagle_eye2", risk: "low", requires_scope: false, destructive: false },
+  { action: "enrich_scan", risk: "low", requires_scope: false, destructive: false },
+  { action: "detect_waf", risk: "low", requires_scope: false, destructive: false },
+  { action: "fofa_search", risk: "low", requires_scope: false, destructive: false },
+  { action: "list_chains", risk: "low", requires_scope: false, destructive: false },
+  { action: "read_playbook", risk: "low", requires_scope: false, destructive: false },
+  { action: "active_scan", risk: "medium", requires_scope: true, destructive: false },
+  { action: "browser_validate", risk: "medium", requires_scope: true, destructive: false },
+  { action: "strike_verify", risk: "high", requires_scope: true, destructive: false },
+  { action: "confirm_finding", risk: "high", requires_scope: true, destructive: false }
+];
+function riskOf(action) {
+  return RISK_POLICY.find((r) => r.action === action) ?? null;
 }
-function scopeCheck(target, scope = "", mode = "bug-bounty") {
-  let result;
-  if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
-    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
-  } else if (!scope.trim()) {
-    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
+function actionPermitted(action, scopeAllowed, mode) {
+  const rule = riskOf(action);
+  if (!rule)
+    return true;
+  if (mode === "ctf" || mode === "offensive" || mode === "reverse-engineering")
+    return true;
+  if (rule.requires_scope && !scopeAllowed)
+    return false;
+  return true;
+}
+function buildPlan(scopeAllowed, mode, executedState) {
+  const order = ["scope_check", "plan", "recon", "analyze", "hypothesis", "select_chain", "validate", "evidence", "finding", "report"];
+  const executedIdx = order.indexOf(executedState);
+  return order.map((state, i) => {
+    const def = stateDefinition(state);
+    const tool = def.recommended_tools[0] ?? "";
+    const rule = riskOf(tool);
+    const permitted = actionPermitted(tool, scopeAllowed, mode);
+    const status = i <= executedIdx ? "done" : permitted ? "pending" : "blocked";
+    return {
+      order: i + 1,
+      state,
+      action: def.description,
+      tool,
+      evidence_required: def.required_evidence,
+      risk: rule?.risk ?? "low",
+      permitted,
+      status
+    };
+  });
+}
+function computeGuidance(state, scopeAllowed) {
+  const def = stateDefinition(state);
+  const next = def.next[0];
+  const nextDef = next ? stateDefinition(next) : null;
+  const tool = nextDef?.recommended_tools[0] ?? "";
+  const permitted = actionPermitted(tool, scopeAllowed, "bug-bounty");
+  return {
+    state,
+    confidence: def.confidence,
+    blocking_reason: !scopeAllowed && nextDef && riskOf(tool)?.requires_scope ? "scope_required" : def.blocking ?? null,
+    required_evidence: def.required_evidence,
+    recommended_next_action: nextDef?.description ?? "complete",
+    recommended_tool: permitted ? tool : ""
+  };
+}
+
+// src/cvss.ts
+var AV_WEIGHT = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+var AC_WEIGHT = { L: 0.77, H: 0.44 };
+var PR_WEIGHT = {
+  U: { N: 0.85, L: 0.62, H: 0.27 },
+  C: { N: 0.85, L: 0.68, H: 0.5 }
+};
+var UI_WEIGHT = { N: 0.85, R: 0.62 };
+var CIA_WEIGHT = { H: 0.56, L: 0.22, N: 0 };
+function roundup(value) {
+  return Math.ceil(value * 10) / 10;
+}
+function cvssBaseScore(input) {
+  const AV = input.AV ?? "N";
+  const AC = input.AC ?? "L";
+  const PR = input.PR ?? "N";
+  const UI = input.UI ?? "N";
+  const S = input.S ?? "U";
+  const C = input.C ?? "N";
+  const I = input.I ?? "N";
+  const A = input.A ?? "N";
+  const iscBase = 1 - (1 - CIA_WEIGHT[C]) * (1 - CIA_WEIGHT[I]) * (1 - CIA_WEIGHT[A]);
+  let impact;
+  if (S === "U") {
+    impact = 6.42 * iscBase;
   } else {
-    const inScope = [];
-    const outScope = [];
-    for (const raw of scope.split(/[,\n]/)) {
-      const line = raw.trim();
-      if (!line)
-        continue;
-      if (line.startsWith("-"))
-        outScope.push(line.slice(1).trim());
-      else
-        inScope.push(line);
-    }
-    let host = target;
-    host = host.replace(/^https?:\/\//, "");
-    host = host.split("/")[0].split(":")[0];
-    let decided = false;
-    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
-    for (const exc of outScope) {
-      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
-        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
-        decided = true;
-        break;
-      }
-    }
-    if (!decided) {
-      for (const allowed of inScope) {
-        const a = allowed.replace(/\*/g, "");
-        if (!a)
-          continue;
-        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
-          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
-          decided = true;
-          break;
-        }
-      }
-    }
+    impact = 7.52 * (iscBase - 0.029) - 3.25 * Math.pow(iscBase - 0.02, 15);
   }
-  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
-  return result;
+  const exploitability = 8.22 * AV_WEIGHT[AV] * AC_WEIGHT[AC] * PR_WEIGHT[S][PR] * UI_WEIGHT[UI];
+  if (impact <= 0)
+    return 0;
+  if (S === "U") {
+    return roundup(Math.min(impact + exploitability, 10));
+  }
+  return roundup(Math.min(1.08 * (impact + exploitability), 10));
 }
-function classifySink(sink) {
-  if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
-    return "upload_weak_validation";
-  if (/unserialize/.test(sink))
-    return "unserialize_user_input";
-  if (/(exec\(|system\(|shell_exec|passthru|popen|proc_open)/.test(sink))
-    return "command_injection";
-  if (/(include|require)/.test(sink))
-    return "lfi_unvalidated_include";
-  if (/extract\(/.test(sink))
-    return "extract_without_exstr_skip";
-  if (/(\$wpdb|->query)/.test(sink))
-    return "sql_injection";
-  if (/(wp_remote_get|wp_remote_post|file_get_contents)/.test(sink))
-    return "ssrf_unvalidated_url";
-  if (/(eval\(|assert\(|create_function)/.test(sink))
-    return "unsafe_template_render";
-  return "";
+function cvssVector(input) {
+  const order = [
+    ["AV", input.AV ?? "N"],
+    ["AC", input.AC ?? "L"],
+    ["PR", input.PR ?? "N"],
+    ["UI", input.UI ?? "N"],
+    ["S", input.S ?? "U"],
+    ["C", input.C ?? "N"],
+    ["I", input.I ?? "N"],
+    ["A", input.A ?? "N"]
+  ];
+  return "CVSS:3.1/" + order.map(([k, v]) => `${k}:${v}`).join("/");
 }
-function enrichScan(path, maxFiles = 2000) {
-  const expanded = path.replace(/^~/, process.env.HOME ?? "~");
-  const files = iterSourceFiles(expanded, maxFiles);
-  const hits = [];
-  const sinkKinds = new Set;
-  for (const p of files) {
-    const r = scanFile(p);
-    for (const e of r.endpoints) {
-      hits.push({ type: "endpoint", file: r.file, line: e.line, detail: e.hook });
-    }
-    for (const s of r.sinks) {
-      hits.push({ type: "sink", file: r.file, line: s.line, detail: `${s.sink} -> ${s.class}` });
-      const kind = classifySink(s.sink);
-      if (kind)
-        sinkKinds.add(kind);
+function cvssSeverity(score) {
+  if (score === 0)
+    return "none";
+  if (score < 4)
+    return "low";
+  if (score < 7)
+    return "medium";
+  if (score < 9)
+    return "high";
+  return "critical";
+}
+function cvssAssess(input) {
+  const score = cvssBaseScore(input);
+  return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
+}
+
+// src/dedup.ts
+function rootCauseSignature(finding) {
+  const sinkType = (finding.sink?.type ?? "unknown").toLowerCase();
+  const sourceType = (finding.source?.type ?? "unknown").toLowerCase();
+  const cwe = (finding.classification?.cwe ?? "").toUpperCase();
+  return [sinkType, sourceType, cwe].filter(Boolean).join("|");
+}
+function dedupFindings(findings) {
+  const groups = new Map;
+  for (const f of findings) {
+    const sig = rootCauseSignature(f);
+    const existing = groups.get(sig);
+    if (existing) {
+      existing.count += 1;
+      existing.findings.push(f);
+    } else {
+      groups.set(sig, { signature: sig, count: 1, representative: f, findings: [f] });
     }
   }
-  const chains = loadChains();
-  const matched = [];
-  for (const c of chains) {
-    if ((c.required_findings ?? []).some((rf) => sinkKinds.has(rf))) {
-      matched.push({ chain_id: c.id, name: c.name, severity: c.severity, steps: c.steps.length });
-    }
+  return [...groups.values()];
+}
+function uniqueFindings(findings) {
+  return dedupFindings(findings).map((g) => g.representative);
+}
+
+// src/report.ts
+function summarize(findings) {
+  const byStatus = {};
+  const bySeverity = {};
+  let evidenceArtifacts = 0;
+  for (const f of findings) {
+    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
+    const sev = f.classification?.severity ?? "informational";
+    bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
+    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
   }
+  const groups = dedupFindings(findings);
   return {
-    root: expanded,
-    files_scanned: files.length,
-    hits: hits.slice(0, 2000),
-    sink_signals: [...sinkKinds].sort(),
-    matched_chains: matched
+    total_findings: findings.length,
+    unique_root_causes: groups.length,
+    by_status: byStatus,
+    by_severity: bySeverity,
+    confirmed: byStatus["confirmed"] ?? 0,
+    false_positives: byStatus["false_positive"] ?? 0,
+    evidence_artifacts: evidenceArtifacts
   };
 }
-function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000, remember = true) {
-  const report = {
-    target,
-    mode,
-    tiers: {},
-    findings: [],
-    scope: null,
-    memory: { captured: 0 }
-  };
-  const isPath = (() => {
-    try {
-      return existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
-    } catch {
-      return false;
-    }
-  })();
-  if (isPath) {
-    report.scope = { target, allowed: true, enforcement: "source-audit", reason: "local source path — no network scope gate" };
-  } else {
-    const sc = scopeCheck(target, scope, mode);
-    report.scope = sc;
-    if (!sc.allowed) {
-      report.status = "BLOCKED";
-      report.reason = sc.reason;
-      return report;
-    }
-  }
-  const blitz = enrichScan(target, maxFiles);
-  report.tiers = {
-    blitz: {
-      files_scanned: blitz.files_scanned,
-      hits: blitz.hits.length,
-      sink_signals: blitz.sink_signals,
-      matched_chains: blitz.matched_chains
-    }
-  };
-  const chains = loadChains();
-  const chainById = new Map(chains.map((c) => [c.id, c]));
-  const eagle = [];
-  for (const mc of blitz.matched_chains.slice(0, 10)) {
-    const chain = chainById.get(mc.chain_id);
-    if (!chain)
-      continue;
-    eagle.push({
-      chain_id: chain.id,
-      name: chain.name,
-      severity: chain.severity,
-      prerequisites: chain.required_findings,
-      recommended_tools: chain.tools ?? [],
-      tool_manuals: (chain.tools ?? []).map((t) => {
-        const m = findManual(t);
-        return m.found ? { tool: t, manual_name: m.name, preview: m.content.slice(0, 600) } : { tool: t, manual_name: null, preview: null };
-      }),
-      steps: chain.steps.map((s) => ({
-        order: s.order,
-        action: s.action,
-        tool_hint: s.tool_hint,
-        success_criteria: s.success_criteria,
-        invariant_check: s.invariant_check,
-        negative_control: s.negative_control
-      }))
-    });
+function severityLabel(sev) {
+  const s = sev.toUpperCase();
+  if (s === "CRITICAL")
+    return "\uD83D\uDD34 CRITICAL";
+  if (s === "HIGH")
+    return "\uD83D\uDFE0 HIGH";
+  if (s === "MEDIUM")
+    return "\uD83D\uDFE1 MEDIUM";
+  if (s === "LOW")
+    return "\uD83D\uDD35 LOW";
+  return "⚪ INFORMATIONAL";
+}
+function reportMarkdown(findings, opts = {}) {
+  const summary = summarize(findings);
+  const lines = [];
+  lines.push(`# ${opts.title ?? "Blitz Strike — Security Assessment Report"}`);
+  lines.push("");
+  lines.push(`- Scope: ${opts.scope ?? "(unset)"}`);
+  lines.push(`- Blitz Strike version: ${opts.version ?? "unknown"}`);
+  if (opts.include_timestamp)
+    lines.push(`- Generated: ${new Date().toISOString()}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`| Metric | Value |`);
+  lines.push(`|--------|-------|`);
+  lines.push(`| Total findings | ${summary.total_findings} |`);
+  lines.push(`| Unique root causes | ${summary.unique_root_causes} |`);
+  lines.push(`| Confirmed | ${summary.confirmed} |`);
+  lines.push(`| False positives | ${summary.false_positives} |`);
+  lines.push(`| Evidence artifacts | ${summary.evidence_artifacts} |`);
+  lines.push("");
+  lines.push("### By status");
+  lines.push("");
+  for (const [status, n] of Object.entries(summary.by_status).sort()) {
+    lines.push(`- ${status}: ${n}`);
   }
-  report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
-  const rank = { critical: 0, high: 1, medium: 2, low: 3 };
-  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
-  const findings = matchedSorted.map((f) => {
-    const chain = chainById.get(f.chain_id);
-    const severity = f.severity ?? "medium";
-    const finding = makeFinding({
-      title: f.name,
-      target: { type: "source", path: target },
-      severity,
-      source: { type: "static_sink_signal", name: f.chain_id },
-      sink: { type: f.chain_id, symbol: f.name },
-      chainId: f.chain_id,
-      chainName: f.name,
-      status: "hypothesis"
-    });
-    const ev = makeEvidence({
-      type: "sink_location",
-      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
-      sink: { chain_id: f.chain_id, name: f.name, severity },
-      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
-    });
-    finding.evidence.push(ev);
-    return finding;
-  });
-  report.findings = findings.map((f) => ({
-    id: f.id,
-    status: f.status,
-    title: f.title,
-    severity: f.classification.severity,
-    confidence: f.confidence,
-    confidence_level: f.confidence_level,
-    chain_id: f.chain.id,
-    evidence_count: f.evidence.length
-  }));
-  report.status = "COMPLETE";
-  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
-  if (remember) {
-    let captured = 0;
-    for (const mc of blitz.matched_chains) {
-      const chain = chainById.get(mc.chain_id);
-      const content = `Chain '${mc.chain_id}' (${mc.severity}) matched on target '${target}'. ` + `Detected sink signals: ${blitz.sink_signals.join(", ")}. ` + `Prerequisites: ${(chain?.required_findings ?? []).join(", ")}.`;
-      if (rememberIfAbsent(mc.chain_id, content, "pattern", [mc.severity, "chain"], "engagement", false)) {
-        captured++;
-      }
+  lines.push("");
+  lines.push("### By severity");
+  lines.push("");
+  for (const [sev, n] of Object.entries(summary.by_severity).sort()) {
+    lines.push(`- ${sev}: ${n}`);
+  }
+  lines.push("");
+  lines.push("## Findings");
+  lines.push("");
+  if (findings.length === 0) {
+    lines.push("_No findings._");
+    return lines.join(`
+`) + `
+`;
+  }
+  for (const f of findings) {
+    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
+    lines.push("");
+    lines.push(`- **Status**: \`${f.status}\``);
+    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
+    if (f.classification?.cwe)
+      lines.push(`- **CWE**: ${f.classification.cwe}`);
+    if (f.classification?.cvss_score != null)
+      lines.push(`- **CVSS**: ${f.classification.cvss_score} (${f.classification.cvss_vector ?? ""}) — ${cvssSeverity(f.classification.cvss_score)}`);
+    lines.push(`- **Source**: ${f.source?.type} \`${f.source?.name ?? ""}\``);
+    lines.push(`- **Sink**: ${f.sink?.type}${f.sink?.symbol ? ` \`${f.sink.symbol}\`` : ""}`);
+    if (f.target?.host || f.target?.endpoint)
+      lines.push(`- **Target**: ${[f.target.host, f.target.endpoint].filter(Boolean).join("")}`);
+    lines.push(`- **Evidence**: ${f.evidence?.length ?? 0} record(s)`);
+    if (f.remediation && Object.keys(f.remediation).length) {
+      lines.push(`- **Note**: ${JSON.stringify(f.remediation)}`);
     }
-    report.memory = { captured, deduped: blitz.matched_chains.length - captured };
+    lines.push("");
   }
-  return report;
+  return lines.join(`
+`) + `
+`;
 }
-function listChains() {
-  const chains = loadChains();
+function reportJson(findings, opts = {}) {
+  const summary = summarize(findings);
+  const payload = {
+    title: opts.title ?? "Blitz Strike — Security Assessment Report",
+    scope: opts.scope ?? null,
+    version: opts.version ?? null,
+    summary,
+    findings,
+    integrity: sha256(JSON.stringify({ summary, findings }))
+  };
+  return JSON.stringify(payload, null, 2);
+}
+
+// src/sarif.ts
+var SARIF_SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json";
+function sarifLevel(severity) {
+  const s = severity.toLowerCase();
+  if (s === "critical" || s === "high")
+    return "error";
+  if (s === "medium")
+    return "warning";
+  return "note";
+}
+function toSarif(findings, opts = {}) {
+  const tool = opts.tool ?? "Blitz Strike";
+  const uri = opts.uri ?? "https://github.com/shinthink/blitzstrike";
+  const ruleIds = [...new Set(findings.map((f) => f.ruleId))];
+  const rules = ruleIds.map((id) => ({
+    id,
+    name: id,
+    shortDescription: { text: id }
+  }));
+  const results = findings.map((f) => ({
+    ruleId: f.ruleId,
+    level: f.level,
+    message: { text: f.message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: f.file },
+          region: { startLine: Math.max(1, f.line) }
+        }
+      }
+    ]
+  }));
   return {
-    total: chains.length,
-    chains: chains.map((c) => ({
-      id: c.id,
-      name: c.name,
-      severity: c.severity,
-      steps: c.steps.length,
-      triggers: c.triggers
-    }))
+    version: "2.1.0",
+    $schema: SARIF_SCHEMA,
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: tool,
+            version: VERSION,
+            informationUri: uri,
+            rules
+          }
+        },
+        results
+      }
+    ]
   };
 }
 
-// src/catalog.ts
-import { readFileSync as readFileSync7, readdirSync as readdirSync2 } from "node:fs";
-import { join as join7 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { spawnSync } from "node:child_process";
-var ROOT2 = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
-var _toolsCache = null;
-var _skillsCache = null;
-function loadTools() {
-  if (_toolsCache)
-    return _toolsCache;
+// src/strike.ts
+var DEFAULT_TIMEOUT_MS = 15000;
+async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const controller = new AbortController;
+  const t = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const raw = JSON.parse(readFileSync7(join7(ROOT2, "tools-catalog.json"), "utf8"));
-    _toolsCache = raw.tools ?? [];
-  } catch {
-    _toolsCache = [];
+    const res = await fetch(url, {
+      method,
+      body: method === "POST" ? data : undefined,
+      headers: { "User-Agent": "blitzstrike/1.0", ...headers ?? {} },
+      signal: controller.signal,
+      redirect: "follow"
+    });
+    const body = await res.text();
+    const hdrs = {};
+    res.headers.forEach((v, k) => {
+      hdrs[k] = v;
+    });
+    return { status: res.status, body: body.slice(0, 20000), headers: hdrs };
+  } catch (e) {
+    return { status: 0, body: String(e), headers: {} };
+  } finally {
+    clearTimeout(t);
   }
-  return _toolsCache;
 }
-function loadSkills() {
-  if (_skillsCache)
-    return _skillsCache;
-  const dir = join7(ROOT2, "skills");
-  const out = [];
-  try {
-    for (const f of readdirSync2(dir)) {
-      if (!f.endsWith(".md"))
-        continue;
-      const p = join7(dir, f);
-      const text = readFileSync7(p, "utf8");
-      const descMatch = text.match(/^description:\s*(.+)$/m);
-      out.push({
-        name: f.replace(/\.md$/, ""),
-        file: f,
-        description: (descMatch?.[1] ?? "").trim().slice(0, 200),
-        size: text.length
-      });
-    }
-  } catch {}
-  _skillsCache = out;
-  return out;
+function defaultMarker() {
+  return `BS${Date.now().toString(36).toUpperCase()}${Math.random().toString(36).slice(2, 8).toUpperCase()}`;
 }
-function toolLookup(name) {
-  const tools = loadTools();
-  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!t) {
-    return {
-      found: false,
-      query: name,
-      suggestions: tools.filter((x) => x.name.includes(name.toLowerCase()) || name.toLowerCase().includes(x.name)).slice(0, 5).map((x) => x.name)
-    };
-  }
-  const manual = manualForTool(t.name);
-  const result = { found: true, tool: t };
-  if (manual && manual.content) {
-    result.manual = {
-      name: manual.name,
-      category: manual.category,
-      preview: manual.content.slice(0, 1500),
-      full_length: manual.content.length
-    };
-  } else {
-    result.manual = null;
-  }
-  return result;
+function inject(target, value, param) {
+  const placeholder = "{{MARKER}}";
+  if (target.includes(placeholder))
+    return target.split(placeholder).join(value);
+  if (target.includes("?"))
+    return `${target}&${param}=${encodeURIComponent(value)}`;
+  return `${target}?${param}=${encodeURIComponent(value)}`;
 }
-function listTools() {
-  const tools = loadTools();
-  const byCat = {};
-  for (const t of tools) {
-    (byCat[t.category] ??= []).push(t.name);
+async function strikeVerify(input) {
+  const method = input.method ?? "GET";
+  const param = input.param ?? "q";
+  const marker = input.marker ?? defaultMarker();
+  const control = input.control ?? defaultMarker();
+  const baseUrl = input.url;
+  const timeoutMs = input.timeout ?? DEFAULT_TIMEOUT_MS;
+  const baselineTarget = inject(baseUrl, "", param).replace(/[?&]q=$/, "").replace(/[?&]$/, "");
+  const markerTarget = inject(baseUrl, marker, param);
+  const controlTarget = inject(baseUrl, control, param);
+  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers, timeoutMs);
+  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers, timeoutMs);
+  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers, timeoutMs);
+  if (baseline.status === 0 || markerResp.status === 0) {
+    return {
+      status: "blocked",
+      marker_reflected: false,
+      control_reflected: false,
+      baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
+      marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
+      control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
+      reason: "request failed or target unreachable — cannot validate",
+      evidence: []
+    };
   }
-  return { total: tools.length, categories: byCat, tools: tools.map((t) => ({ name: t.name, category: t.category, description: t.description })) };
-}
-function skillLookup(topic) {
-  const skills = loadSkills();
-  const q = topic.toLowerCase();
-  const scored = skills.map((s) => {
-    const hay = `${s.name} ${s.description}`.toLowerCase();
-    const nameHit = s.name.includes(q);
-    const descHit = s.description.includes(q);
-    const wordHit = q.split(/\s+/).filter((w) => w && hay.includes(w)).length;
-    return { s, score: (nameHit ? 10 : 0) + (descHit ? 5 : 0) + wordHit * 2 };
-  }).filter((x) => x.score > 0).sort((a, b) => b.score - a.score);
-  if (scored.length === 0) {
-    return { found: false, query: topic, suggestions: skills.map((s) => s.name).slice(0, 10) };
+  const markerReflected = markerResp.body.includes(marker);
+  const controlReflected = controlResp.body.includes(control);
+  let status;
+  let reason;
+  if (markerReflected && !controlReflected) {
+    status = "confirmed";
+    reason = "marker reflected; negative control did not — the sink reflects attacker-controlled input (real finding)";
+  } else if (markerReflected && controlReflected) {
+    status = "false_positive";
+    reason = "marker AND negative control both reflected — behaviour is indistinguishable from benign reflection (likely false positive)";
+  } else if (!markerReflected && !controlReflected) {
+    status = "unconfirmed";
+    reason = "marker not reflected — reachability/exploitability could not be demonstrated live";
+  } else {
+    status = "unconfirmed";
+    reason = "negative control reflected but marker did not — inconsistent, requires deeper analysis";
   }
+  const evidence = [
+    {
+      type: "baseline_comparison",
+      description: `Baseline response (status ${baseline.status}) for ${redactSecrets(baselineTarget)}`,
+      artifacts: [{ name: "baseline", kind: "http_response", content: `${baseline.status}
+${baseline.body}` }]
+    },
+    {
+      type: "validation_result",
+      description: `Marker '${redactSecrets(marker)}' reflected=${markerReflected}; control reflected=${controlReflected}`,
+      artifacts: [{ name: "marker_response", kind: "http_response", content: `${markerResp.status}
+${markerResp.body}` }]
+    },
+    {
+      type: "negative_control",
+      description: `Negative control '${redactSecrets(control)}' reflected=${controlReflected}`,
+      artifacts: [{ name: "control_response", kind: "http_response", content: `${controlResp.status}
+${controlResp.body}` }]
+    }
+  ];
   return {
-    found: true,
-    matches: scored.slice(0, 5).map((x) => ({ name: x.s.name, description: x.s.description, file: x.s.file }))
+    status,
+    marker_reflected: markerReflected,
+    control_reflected: controlReflected,
+    baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
+    marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
+    control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
+    reason,
+    evidence
   };
 }
-function listSkills() {
-  const skills = loadSkills();
-  return { total: skills.length, skills: skills.map((s) => ({ name: s.name, description: s.description })) };
-}
-function readSkill(name) {
-  const skills = loadSkills();
-  const s = skills.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!s)
-    return { found: false, query: name };
-  try {
-    const text = readFileSync7(join7(ROOT2, "skills", s.file), "utf8");
-    return { found: true, name: s.name, content: text.slice(0, 12000) };
-  } catch {
-    return { found: false, query: name, error: "unreadable" };
-  }
-}
-function ensureTool(name) {
-  const tools = loadTools();
-  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!t) {
-    return { found: false, query: name, suggestions: tools.slice(0, 5).map((x) => x.name) };
-  }
-  const check = spawnSync(t.check_installed.command, { shell: true, timeout: 15000 });
-  if (check.status !== 127 && check.error === undefined) {
-    return { name: t.name, installed: true, action: "none", note: "already installed" };
+function resolveFinding(finding, verdict) {
+  let f = finding;
+  if (f.status === "hypothesis") {
+    f = transition(f, "validating");
   }
-  const platform = process.platform;
-  const cmd = t.install[platform] ?? t.install.linux;
-  if (!cmd) {
-    return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
+  switch (verdict.status) {
+    case "confirmed":
+      return confirmFinding(f, {
+        evidence: verdict.evidence,
+        negative_control: true,
+        baseline: true
+      });
+    case "false_positive":
+      return rejectFinding(f, "false_positive", verdict.reason, verdict.evidence);
+    case "blocked":
+      return rejectFinding(f, "blocked", verdict.reason, verdict.evidence);
+    case "unconfirmed":
+    case "likely":
+    default: {
+      return {
+        ...f,
+        validation: { performed: true, status: verdict.status === "likely" ? "likely" : "unconfirmed", negative_control: verdict.control_reflected === false, baseline: true },
+        remediation: { ...f.remediation, note: verdict.reason },
+        timestamps: { ...f.timestamps, updated: new Date().toISOString() }
+      };
+    }
   }
-  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
-  const ok = r.status === 0;
-  return {
-    name: t.name,
-    installed: ok,
-    action: "install",
-    command: cmd,
-    output: (r.stdout?.toString() ?? "").slice(-400) || (r.stderr?.toString() ?? "").slice(-400)
-  };
 }
 
-// src/intel.ts
-import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
-import { join as join8 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
-var INTEL = join8(ROOT3, "intelligence");
-function loadJson(name) {
-  const p = join8(INTEL, `${name}.json`);
-  if (!existsSync5(p))
-    return null;
+// src/orchestrator.ts
+var _chainsCache = null;
+function loadChains() {
+  if (_chainsCache)
+    return _chainsCache;
   try {
-    return JSON.parse(readFileSync8(p, "utf8"));
+    const dir = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
+    const path = join6(dir, "chains.json");
+    const raw = JSON.parse(readFileSync6(path, "utf8"));
+    _chainsCache = raw.chains ?? [];
+    return _chainsCache;
   } catch {
-    return null;
+    _chainsCache = [];
+    return [];
   }
 }
-function detectWaf(headers, body = "") {
-  const sigs = loadJson("waf_signatures");
-  if (!sigs)
-    return { detected: false, wafs: [], error: "waf_signatures.json not loaded" };
-  const headerSigs = sigs.header_signatures ?? [];
-  const bodySigs = sigs.body_signatures ?? [];
-  const matches = [];
-  const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
-  for (const s of headerSigs) {
-    const h = (s.header ?? "").toLowerCase();
-    const pattern = (s.pattern ?? "").toLowerCase();
-    if (!h)
-      continue;
-    if (pattern) {
-      const val = (headers[h] ?? headers[s.header ?? ""] ?? "").toLowerCase();
-      if (val.includes(pattern)) {
-        matches.push({ waf: s.waf, header: s.header, pattern: s.pattern, confidence: s.confidence, via: "header-value" });
-      }
-    } else {
-      if (headerKeys.includes(h)) {
-        matches.push({ waf: s.waf, header: s.header, confidence: s.confidence, via: "header-name" });
+function scopeCheck(target, scope = "", mode = "bug-bounty") {
+  let result;
+  if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
+    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
+  } else if (!scope.trim()) {
+    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
+  } else {
+    const inScope = [];
+    const outScope = [];
+    for (const raw of scope.split(/[,\n]/)) {
+      const line = raw.trim();
+      if (!line)
+        continue;
+      if (line.startsWith("-"))
+        outScope.push(line.slice(1).trim());
+      else
+        inScope.push(line);
+    }
+    let host = target;
+    host = host.replace(/^https?:\/\//, "");
+    host = host.split("/")[0].split(":")[0];
+    let decided = false;
+    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
+    for (const exc of outScope) {
+      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
+        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
+        decided = true;
+        break;
       }
     }
-  }
-  for (const s of bodySigs) {
-    const pattern = (s.pattern ?? "").toLowerCase();
-    if (pattern && body.toLowerCase().includes(pattern)) {
-      matches.push({ waf: s.waf, pattern: s.pattern, confidence: s.confidence, via: "body" });
+    if (!decided) {
+      for (const allowed of inScope) {
+        const a = allowed.replace(/\*/g, "");
+        if (!a)
+          continue;
+        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
+          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
+          decided = true;
+          break;
+        }
+      }
     }
   }
-  const byWaf = new Map;
-  for (const m of matches) {
-    const key = m.waf;
-    const prev = byWaf.get(key);
-    if (!prev || m.confidence > prev.confidence)
-      byWaf.set(key, m);
+  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
+  return result;
+}
+function classifySink(sink) {
+  if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
+    return "upload_weak_validation";
+  if (/unserialize/.test(sink))
+    return "unserialize_user_input";
+  if (/(exec\(|system\(|shell_exec|passthru|popen|proc_open)/.test(sink))
+    return "command_injection";
+  if (/(include|require)/.test(sink))
+    return "lfi_unvalidated_include";
+  if (/extract\(/.test(sink))
+    return "extract_without_exstr_skip";
+  if (/(\$wpdb|->query)/.test(sink))
+    return "sql_injection";
+  if (/(wp_remote_get|wp_remote_post|file_get_contents)/.test(sink))
+    return "ssrf_unvalidated_url";
+  if (/(eval\(|assert\(|create_function)/.test(sink))
+    return "unsafe_template_render";
+  return "";
+}
+function enrichScan(path, maxFiles = 2000) {
+  const expanded = path.replace(/^~/, process.env.HOME ?? "~");
+  const files = iterSourceFiles(expanded, maxFiles);
+  const hits = [];
+  const sinkKinds = new Set;
+  for (const p of files) {
+    const r = scanFile(p);
+    for (const e of r.endpoints) {
+      hits.push({ type: "endpoint", file: r.file, line: e.line, detail: e.hook });
+    }
+    for (const s of r.sinks) {
+      hits.push({ type: "sink", file: r.file, line: s.line, detail: `${s.sink} -> ${s.class}` });
+      const kind = classifySink(s.sink);
+      if (kind)
+        sinkKinds.add(kind);
+    }
+  }
+  const chains = loadChains();
+  const matched = [];
+  for (const c of chains) {
+    if ((c.required_findings ?? []).some((rf) => sinkKinds.has(rf))) {
+      matched.push({ chain_id: c.id, name: c.name, severity: c.severity, steps: c.steps.length });
+    }
   }
-  const detected = [...byWaf.values()].sort((a, b) => b.confidence - a.confidence);
   return {
-    detected: detected.length > 0,
-    wafs: detected,
-    block_status_codes: sigs.block_status_codes ?? []
+    root: expanded,
+    files_scanned: files.length,
+    hits: hits.slice(0, 2000),
+    sink_signals: [...sinkKinds].sort(),
+    matched_chains: matched
   };
 }
-function techCorrelation(tech) {
-  const data = loadJson("tech_correlations");
-  if (!data)
-    return { found: false, error: "tech_correlations.json not loaded" };
-  const key = tech.toLowerCase();
-  const entry = data[key];
-  if (!entry) {
-    const matches = Object.keys(data).filter((k) => k.includes(key) || key.includes(k)).slice(0, 5);
-    return { found: false, tech, suggestions: matches };
+function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000, remember = true) {
+  const report = {
+    target,
+    mode,
+    tiers: {},
+    findings: [],
+    scope: null,
+    memory: { captured: 0 }
+  };
+  const isPath = (() => {
+    try {
+      return existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+    } catch {
+      return false;
+    }
+  })();
+  if (isPath) {
+    report.scope = { target, allowed: true, enforcement: "source-audit", reason: "local source path — no network scope gate" };
+  } else {
+    const sc = scopeCheck(target, scope, mode);
+    report.scope = sc;
+    if (!sc.allowed) {
+      report.status = "BLOCKED";
+      report.reason = sc.reason;
+      return report;
+    }
   }
-  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? { vulns: entry.vulns, paths: entry.paths } };
-}
-function cveCorrelation(cveId) {
-  const data = loadJson("cve_correlations");
-  if (!data)
-    return { error: "cve_correlations.json not loaded" };
-  const key = cveId.toUpperCase();
-  const entry = data[key];
-  if (!entry)
-    return { found: false, cve: key, total_known: Object.keys(data).length };
-  return { found: true, cve: key, ...entry };
-}
-function portCorrelation(port) {
-  const data = loadJson("port_correlations");
-  if (!data)
-    return { error: "port_correlations.json not loaded" };
-  const key = String(port);
-  const entry = data[key];
-  if (!entry)
-    return { found: false, port: key, total_known: Object.keys(data).length };
-  return { found: true, port: key, ...entry };
-}
-function fuzzerPayloads(category) {
-  const data = loadJson("fuzzer_data");
-  if (!data)
-    return { error: "fuzzer_data.json not loaded" };
-  if (category) {
-    const c = data[category] ?? data[category.toUpperCase()];
-    return { category, found: Boolean(c), data: c ?? null };
+  const blitz = enrichScan(target, maxFiles);
+  report.tiers = {
+    blitz: {
+      files_scanned: blitz.files_scanned,
+      hits: blitz.hits.length,
+      sink_signals: blitz.sink_signals,
+      matched_chains: blitz.matched_chains
+    }
+  };
+  const chains = loadChains();
+  const chainById = new Map(chains.map((c) => [c.id, c]));
+  const eagle = [];
+  for (const mc of blitz.matched_chains.slice(0, 10)) {
+    const chain = chainById.get(mc.chain_id);
+    if (!chain)
+      continue;
+    eagle.push({
+      chain_id: chain.id,
+      name: chain.name,
+      severity: chain.severity,
+      prerequisites: chain.required_findings,
+      recommended_tools: chain.tools ?? [],
+      tool_manuals: (chain.tools ?? []).map((t) => {
+        const m = findManual(t);
+        return m.found ? { tool: t, manual_name: m.name, preview: m.content.slice(0, 600) } : { tool: t, manual_name: null, preview: null };
+      }),
+      steps: chain.steps.map((s) => ({
+        order: s.order,
+        action: s.action,
+        tool_hint: s.tool_hint,
+        success_criteria: s.success_criteria,
+        invariant_check: s.invariant_check,
+        negative_control: s.negative_control
+      }))
+    });
   }
-  return { categories: Object.keys(data), fuzz_points: data.FUZZ_POINTS ?? null, payloads: data.FUZZ_PAYLOADS ?? null };
-}
-function intelSummary() {
-  const waf = loadJson("waf_signatures");
-  const tech = loadJson("tech_correlations");
-  const cve = loadJson("cve_correlations");
-  const port = loadJson("port_correlations");
-  const fuzz = loadJson("fuzzer_data");
-  const av = loadJson("attack_vectors");
-  return {
-    waf_signatures: waf ? (waf.header_signatures?.length ?? 0) + (waf.body_signatures?.length ?? 0) : 0,
-    tech_correlations: tech ? Object.keys(tech).length : 0,
-    cve_correlations: cve ? Object.keys(cve).length : 0,
-    port_correlations: port ? Object.keys(port).length : 0,
-    fuzzer_categories: fuzz ? Object.keys(fuzz).length : 0,
-    payload_categories: listPayloadCategories().length,
-    nuclei_templates: countTemplates(),
-    attack_vector_categories: av ? av.categories.length : 0,
-    attack_vectors: av ? av.categories.reduce((n, c) => n + c.vectors.length, 0) : 0
+  report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
+  const rank = { critical: 0, high: 1, medium: 2, low: 3 };
+  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
+  const findings = matchedSorted.map((f) => {
+    const chain = chainById.get(f.chain_id);
+    const severity = f.severity ?? "medium";
+    const finding = makeFinding({
+      title: f.name,
+      target: { type: "source", path: target },
+      severity,
+      source: { type: "static_sink_signal", name: f.chain_id },
+      sink: { type: f.chain_id, symbol: f.name },
+      chainId: f.chain_id,
+      chainName: f.name,
+      status: "hypothesis"
+    });
+    const ev = makeEvidence({
+      type: "sink_location",
+      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
+      sink: { chain_id: f.chain_id, name: f.name, severity },
+      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
+    });
+    finding.evidence.push(ev);
+    return finding;
+  });
+  report.findings = findings.map((f) => ({
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    evidence_count: f.evidence.length
+  }));
+  const reportTitle = `Blitz Strike — Engagement Report (${target})`;
+  const reportMarkdownText = reportMarkdown(findings, { title: reportTitle, scope: target, version: VERSION });
+  const reportJsonText = reportJson(findings, { title: reportTitle, scope: target, version: VERSION });
+  const sarifDoc = toSarif(findings.map((f) => ({
+    ruleId: f.chain.id || f.classification.severity,
+    level: sarifLevel(f.classification.severity),
+    message: f.title,
+    file: typeof f.target.path === "string" ? f.target.path : target,
+    line: 1
+  })));
+  report.report = {
+    summary: JSON.parse(reportJsonText).summary ?? null,
+    markdown: reportMarkdownText,
+    json: reportJsonText,
+    sarif: sarifDoc
   };
+  report.status = "COMPLETE";
+  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
+  const executedState = "select_chain";
+  const scopeAllowed = report.scope?.allowed ?? false;
+  const plan = buildPlan(scopeAllowed, mode, executedState);
+  report.state = executedState;
+  report.state_description = stateDefinition(executedState).description;
+  report.plan = plan;
+  report.guidance = computeGuidance(executedState, scopeAllowed);
+  report.risk_policy = {
+    note: "High-risk actions (strike_verify, confirm_finding) require scope + are never run server-side automatically.",
+    gated: plan.filter((p) => !p.permitted).map((p) => p.tool)
+  };
+  if (remember) {
+    let captured = 0;
+    for (const mc of blitz.matched_chains) {
+      const chain = chainById.get(mc.chain_id);
+      const content = `Chain '${mc.chain_id}' (${mc.severity}) matched on target '${target}'. ` + `Detected sink signals: ${blitz.sink_signals.join(", ")}. ` + `Prerequisites: ${(chain?.required_findings ?? []).join(", ")}.`;
+      if (rememberIfAbsent(mc.chain_id, content, "pattern", [mc.severity, "chain"], "engagement", false)) {
+        captured++;
+      }
+    }
+    report.memory = { captured, deduped: blitz.matched_chains.length - captured };
+  }
+  return report;
 }
-function listAttackVectors() {
-  const data = loadJson("attack_vectors");
-  if (!data)
-    return { error: "attack_vectors.json not loaded" };
+function listChains() {
+  const chains = loadChains();
   return {
-    total_categories: data.categories.length,
-    total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
-    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length }))
+    total: chains.length,
+    chains: chains.map((c) => ({
+      id: c.id,
+      name: c.name,
+      severity: c.severity,
+      steps: c.steps.length,
+      triggers: c.triggers
+    }))
   };
 }
-function attackVectors(category) {
-  const data = loadJson("attack_vectors");
-  if (!data)
-    return { error: "attack_vectors.json not loaded" };
-  const q = category.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  const found = data.categories.find((c) => c.id === q || c.id.includes(q) || c.title.toLowerCase().includes(category.toLowerCase()));
-  if (!found) {
-    const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
-    return { found: false, query: category, suggestions: matches };
+var LIVE_SWEEP_PARAMS = ["q", "search", "query", "s", "id", "url", "redirect", "name", "page"];
+async function runLiveEngagement(url, scope = "", mode = "bug-bounty") {
+  const report = { target: url, mode, findings: [], scope: null, status: "" };
+  const sc = scopeCheck(url, scope, mode);
+  report.scope = sc;
+  if (!sc.allowed) {
+    report.status = "BLOCKED";
+    report.reason = sc.reason;
+    return report;
   }
-  return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
-}
-var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
-var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
-function payloadsDir() {
-  if (existsSync5(PACKAGE_PAYLOADS))
-    return PACKAGE_PAYLOADS;
-  return join8(DATA_ROOT, "payloads");
-}
-function templatesDir() {
-  if (existsSync5(PACKAGE_TEMPLATES))
-    return PACKAGE_TEMPLATES;
-  return join8(DATA_ROOT, "templates");
+  const findings = [];
+  for (const param of LIVE_SWEEP_PARAMS) {
+    const verdict = await strikeVerify({ url, param });
+    const finding = makeFinding({
+      title: `Reflected input in parameter '${param}'`,
+      target: { type: "web", host: url, endpoint: `?${param}=` },
+      severity: "medium",
+      cwe: "CWE-79",
+      cweName: "Cross-site Scripting",
+      source: { type: "request_parameter", name: param },
+      sink: { type: "reflected_input", symbol: param },
+      chainId: "reflected_input",
+      chainName: "Reflected input",
+      status: "hypothesis"
+    });
+    findings.push(resolveFinding(finding, verdict));
+  }
+  report.findings = findings.map((f) => ({
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    validation: f.validation
+  }));
+  const title = `Blitz Strike — Live Engagement (${url})`;
+  const markdown = reportMarkdown(findings, { title, scope: url, version: VERSION });
+  const json = reportJson(findings, { title, scope: url, version: VERSION });
+  report.report = {
+    summary: JSON.parse(json).summary ?? null,
+    markdown,
+    json,
+    sarif: toSarif(findings.map((f) => ({
+      ruleId: f.chain.id || f.classification.cwe || f.classification.severity,
+      level: sarifLevel(f.classification.severity),
+      message: f.title,
+      file: url,
+      line: 1
+    })))
+  };
+  report.status = "COMPLETE";
+  report.note = "Autonomous live marker sweep. Each parameter was validated with a marker + " + "negative control; confirmed reflections are real findings, everything else " + "is a hypothesis or false positive. Re-run with explicit strike_verify for " + "deeper per-endpoint validation.";
+  return report;
 }
-var PAYLOADS = payloadsDir();
-var TEMPLATES = templatesDir();
-function listPayloadCategories() {
+
+// src/catalog.ts
+import { readFileSync as readFileSync7, readdirSync as readdirSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { spawnSync } from "node:child_process";
+var ROOT2 = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
+var _toolsCache = null;
+var _skillsCache = null;
+function loadTools() {
+  if (_toolsCache)
+    return _toolsCache;
   try {
-    return readdirSync3(PAYLOADS, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+    const raw = JSON.parse(readFileSync7(join7(ROOT2, "tools-catalog.json"), "utf8"));
+    _toolsCache = raw.tools ?? [];
   } catch {
-    return [];
+    _toolsCache = [];
   }
+  return _toolsCache;
 }
-function payloadLookup(topic) {
-  const cats = listPayloadCategories();
-  const key = topic.toLowerCase();
-  const ALIASES = {
-    sqli: "sql injection",
-    xss: "xss injection",
-    ssrf: "server side request forgery",
-    ssti: "server side template injection",
-    jwt: "json web token",
-    lfi: "file inclusion",
-    rfi: "file inclusion",
-    xxe: "xxe injection",
-    idor: "insecure direct object references",
-    csrf: "cross-site request forgery",
-    cmdi: "command injection",
-    rce: "command injection",
-    cors: "cors misconfiguration",
-    crlf: "crlf injection",
-    prototype: "prototype pollution",
-    nosql: "nosql injection",
-    upload: "upload insecure files"
-  };
-  const normalized = ALIASES[key] ?? key;
-  const exact = cats.find((c) => c.toLowerCase() === normalized);
-  if (exact) {
-    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
+function loadSkills() {
+  if (_skillsCache)
+    return _skillsCache;
+  const dir = join7(ROOT2, "skills");
+  const out = [];
+  try {
+    for (const f of readdirSync2(dir)) {
+      if (!f.endsWith(".md"))
+        continue;
+      const p = join7(dir, f);
+      const text = readFileSync7(p, "utf8");
+      const descMatch = text.match(/^description:\s*(.+)$/m);
+      out.push({
+        name: f.replace(/\.md$/, ""),
+        file: f,
+        description: (descMatch?.[1] ?? "").trim().slice(0, 200),
+        size: text.length
+      });
+    }
+  } catch {}
+  _skillsCache = out;
+  return out;
+}
+function toolLookup(name) {
+  const tools = loadTools();
+  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!t) {
+    return {
+      found: false,
+      query: name,
+      suggestions: tools.filter((x) => x.name.includes(name.toLowerCase()) || name.toLowerCase().includes(x.name)).slice(0, 5).map((x) => x.name)
+    };
   }
-  const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
-  const matches = cats.filter((c) => {
-    const cl = c.toLowerCase();
-    if (cl.includes(normalized) || normalized.includes(cl))
-      return true;
-    return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
-  });
-  if (matches.length > 0) {
-    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
+  const manual = manualForTool(t.name);
+  const result = { found: true, tool: t };
+  if (manual && manual.content) {
+    result.manual = {
+      name: manual.name,
+      category: manual.category,
+      preview: manual.content.slice(0, 1500),
+      full_length: manual.content.length
+    };
+  } else {
+    result.manual = null;
   }
-  return { found: false, topic, suggestions: cats.slice(0, 20) };
+  return result;
 }
-function readPayload(category, file) {
-  const cats = listPayloadCategories();
-  const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
-  if (!exact)
-    return { found: false, category, suggestions: cats.slice(0, 20) };
-  const dir = join8(PAYLOADS, exact);
-  const files = listFiles(dir);
-  if (!file) {
-    const readme = files.find((f) => f.toLowerCase() === "readme.md");
-    if (readme) {
-      return { found: true, category: exact, file: readme, content: readFileSync8(join8(dir, readme), "utf8").slice(0, 20000) };
-    }
-    return { found: true, category: exact, files };
+function listTools() {
+  const tools = loadTools();
+  const byCat = {};
+  for (const t of tools) {
+    (byCat[t.category] ??= []).push(t.name);
   }
-  const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
-  if (!f)
-    return { found: false, category: exact, file, suggestions: files };
-  return { found: true, category: exact, file: f, content: readFileSync8(join8(dir, f), "utf8").slice(0, 20000) };
+  return { total: tools.length, categories: byCat, tools: tools.map((t) => ({ name: t.name, category: t.category, description: t.description })) };
 }
-function listFiles(dir) {
-  try {
-    return readdirSync3(dir).filter((f) => f.endsWith(".md") || f.endsWith(".txt") || f.endsWith(".yaml")).sort();
-  } catch {
-    return [];
+function skillLookup(topic) {
+  const skills = loadSkills();
+  const q = topic.toLowerCase();
+  const scored = skills.map((s) => {
+    const hay = `${s.name} ${s.description}`.toLowerCase();
+    const nameHit = s.name.includes(q);
+    const descHit = s.description.includes(q);
+    const wordHit = q.split(/\s+/).filter((w) => w && hay.includes(w)).length;
+    return { s, score: (nameHit ? 10 : 0) + (descHit ? 5 : 0) + wordHit * 2 };
+  }).filter((x) => x.score > 0).sort((a, b) => b.score - a.score);
+  if (scored.length === 0) {
+    return { found: false, query: topic, suggestions: skills.map((s) => s.name).slice(0, 10) };
   }
+  return {
+    found: true,
+    matches: scored.slice(0, 5).map((x) => ({ name: x.s.name, description: x.s.description, file: x.s.file }))
+  };
 }
-function countTemplates() {
+function listSkills() {
+  const skills = loadSkills();
+  return { total: skills.length, skills: skills.map((s) => ({ name: s.name, description: s.description })) };
+}
+function readSkill(name) {
+  const skills = loadSkills();
+  const s = skills.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!s)
+    return { found: false, query: name };
   try {
-    let n = 0;
-    const walk = (dir) => {
-      for (const e of readdirSync3(dir, { withFileTypes: true })) {
-        if (e.isDirectory())
-          walk(join8(dir, e.name));
-        else if (e.name.endsWith(".yaml"))
-          n++;
-      }
-    };
-    walk(TEMPLATES);
-    return n;
+    const text = readFileSync7(join7(ROOT2, "skills", s.file), "utf8");
+    return { found: true, name: s.name, content: text.slice(0, 12000) };
   } catch {
-    return 0;
+    return { found: false, query: name, error: "unreadable" };
   }
 }
-function templateLookup(topic, limit = 10) {
-  const key = topic.toLowerCase();
-  const hits = [];
-  const walk = (dir, depth = 0) => {
-    if (depth > 6 || hits.length >= limit * 3)
-      return;
-    let entries;
-    try {
-      entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      if (e.isDirectory())
-        walk(join8(dir, e.name), depth + 1);
-      else if (e.name.endsWith(".yaml")) {
-        const name = e.name.toLowerCase();
-        if (name.includes(key)) {
-          const full = join8(dir, e.name);
-          let id = "";
-          try {
-            const content = readFileSync8(full, "utf8");
-            const m = content.match(/^\s*id:\s*(.+)$/m);
-            if (m)
-              id = m[1].trim();
-          } catch {}
-          hits.push({ path: full.replace(ROOT3 + "/", ""), name: e.name, id });
-        }
-      }
-    }
+function ensureTool(name) {
+  const tools = loadTools();
+  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!t) {
+    return { found: false, query: name, suggestions: tools.slice(0, 5).map((x) => x.name) };
+  }
+  const check = spawnSync(t.check_installed.command, { shell: true, timeout: 15000 });
+  if (check.status !== 127 && check.error === undefined) {
+    return { name: t.name, installed: true, action: "none", note: "already installed" };
+  }
+  const platform = process.platform;
+  const cmd = t.install[platform] ?? t.install.linux;
+  if (!cmd) {
+    return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
+  }
+  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
+  const ok = r.status === 0;
+  return {
+    name: t.name,
+    installed: ok,
+    action: "install",
+    command: cmd,
+    output: (r.stdout?.toString() ?? "").slice(-400) || (r.stderr?.toString() ?? "").slice(-400)
   };
-  walk(TEMPLATES);
-  return { found: hits.length > 0, topic, count: hits.length, templates: hits.slice(0, limit) };
 }
 
-// src/active.ts
-var TIMEOUT_MS2 = 20000;
-async function httpFetch(url, init) {
-  const controller = new AbortController;
-  const t = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+// src/intel.ts
+import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { readdirSync as readdirSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var INTEL = join8(ROOT3, "intelligence");
+function loadJson(name) {
+  const p = join8(INTEL, `${name}.json`);
+  if (!existsSync5(p))
+    return null;
   try {
-    const res = await fetch(url, { ...init, signal: controller.signal, redirect: "follow" });
-    const body = await res.text();
-    const headers = {};
-    res.headers.forEach((v, k) => {
-      headers[k] = v;
-    });
-    return { status: res.status, headers, body: body.slice(0, 20000), ok: res.ok };
-  } catch (e) {
-    return { status: 0, headers: {}, body: String(e), ok: false };
-  } finally {
-    clearTimeout(t);
-  }
-}
-function normalizeTarget(target) {
-  let t = target.trim();
-  if (!/^https?:\/\//i.test(t))
-    t = `https://${t}`;
-  return t.replace(/\/+$/, "");
-}
-function extractTitle(body) {
-  const m = body.match(/<title[^>]*>([^<]+)<\/title>/i);
-  return m ? m[1].trim().slice(0, 200) : "";
-}
-function detectServer(headers) {
-  return headers["server"] ?? headers["x-powered-by"] ?? "";
-}
-function detectTechFromBody(body) {
-  const hits = [];
-  const sigs = [
-    [/wp-content|wp-includes|wp-json/i, "wordpress"],
-    [/wp-login\.php|wp-admin/i, "wordpress"],
-    [/powered by joomla|com_content/i, "joomla"],
-    [/laravel|_token|csrf-token/i, "laravel"],
-    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
-    [/angular|ng-version/i, "angular"],
-    [/vue|__vue__|v-data/i, "vue"],
-    [/django|csrftoken|__debug__/i, "django"],
-    [/ruby on rails|rails/i, "rails"],
-    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
-    [/phpBB|phpbb/i, "phpbb"],
-    [/mybb|mybb/i, "mybb"],
-    [/drupal|Drupal\.settings/i, "drupal"],
-    [/magento|Mage\./i, "magento"],
-    [/shopify|cdn\.shopify/i, "shopify"],
-    [/grafana|kibana|elastic/i, "grafana-kibana"]
-  ];
-  for (const [re, name] of sigs) {
-    if (re.test(body))
-      hits.push(name);
-  }
-  return [...new Set(hits)];
-}
-async function probeCommonPaths(base) {
-  const paths = [
-    "/robots.txt",
-    "/sitemap.xml",
-    "/.well-known/security.txt",
-    "/wp-login.php",
-    "/wp-admin/",
-    "/wp-json/",
-    "/administrator/",
-    "/admin/",
-    "/login",
-    "/api/",
-    "/.git/config",
-    "/.env",
-    "/config.php",
-    "/phpinfo.php",
-    "/swagger.json",
-    "/swagger-ui.html",
-    "/graphql",
-    "/actuator/health"
-  ];
-  const out = [];
-  for (const p of paths) {
-    const r = await httpFetch(`${base}${p}`, { method: "GET" });
-    out.push({ path: p, status: r.status });
+    return JSON.parse(readFileSync8(p, "utf8"));
+  } catch {
+    return null;
   }
-  return out;
 }
-async function activeScan(target, scope = "", mode = "bug-bounty", allowed = undefined) {
-  const base = normalizeTarget(target);
-  const host = (() => {
-    try {
-      return new URL(base).hostname;
-    } catch {
-      return target;
+function detectWaf(headers, body = "") {
+  const sigs = loadJson("waf_signatures");
+  if (!sigs)
+    return { detected: false, wafs: [], error: "waf_signatures.json not loaded" };
+  const headerSigs = sigs.header_signatures ?? [];
+  const bodySigs = sigs.body_signatures ?? [];
+  const matches = [];
+  const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
+  for (const s of headerSigs) {
+    const h = (s.header ?? "").toLowerCase();
+    const pattern = (s.pattern ?? "").toLowerCase();
+    if (!h)
+      continue;
+    if (pattern) {
+      const val = (headers[h] ?? headers[s.header ?? ""] ?? "").toLowerCase();
+      if (val.includes(pattern)) {
+        matches.push({ waf: s.waf, header: s.header, pattern: s.pattern, confidence: s.confidence, via: "header-value" });
+      }
+    } else {
+      if (headerKeys.includes(h)) {
+        matches.push({ waf: s.waf, header: s.header, confidence: s.confidence, via: "header-name" });
+      }
     }
-  })();
-  if (allowed === false) {
-    return {
-      target: base,
-      gated: true,
-      gate_reason: `active scanning not authorized for '${host}' (mode=${mode}, scope='${scope || "unset"}')`
-    };
   }
-  const result = { target: base, gated: false };
-  const root = await httpFetch(base);
-  if (root.status === 0) {
-    result.gated = true;
-    result.gate_reason = `could not reach ${base}: ${root.body.slice(0, 120)}`;
-    return result;
+  for (const s of bodySigs) {
+    const pattern = (s.pattern ?? "").toLowerCase();
+    if (pattern && body.toLowerCase().includes(pattern)) {
+      matches.push({ waf: s.waf, pattern: s.pattern, confidence: s.confidence, via: "body" });
+    }
   }
-  result.waf = detectWaf(root.headers, root.body);
-  const interestingHeaders = {};
-  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
-    if (root.headers[k])
-      interestingHeaders[k] = root.headers[k];
+  const byWaf = new Map;
+  for (const m of matches) {
+    const key = m.waf;
+    const prev = byWaf.get(key);
+    if (!prev || m.confidence > prev.confidence)
+      byWaf.set(key, m);
   }
-  result.fingerprint = {
-    status: root.status,
-    title: extractTitle(root.body),
-    server: detectServer(root.headers),
-    headers: interestingHeaders,
-    body_size: root.body.length
-  };
-  const techs = detectTechFromBody(root.body);
-  const serverTech = detectServer(root.headers);
-  result.tech = {
-    detected: techs,
-    server: serverTech,
-    correlations: techs.map((t) => techCorrelation(t)).filter((c) => c.found === true)
+  const detected = [...byWaf.values()].sort((a, b) => b.confidence - a.confidence);
+  return {
+    detected: detected.length > 0,
+    wafs: detected,
+    block_status_codes: sigs.block_status_codes ?? []
   };
-  result.endpoints = await probeCommonPaths(base);
-  const recs = [];
-  if (result.waf?.detected)
-    recs.push(`WAF detected (${result.waf.wafs?.map((w) => w.waf).join(", ")}) — apply WAF bypass before exploitation.`);
-  const interesting = result.endpoints?.filter((e) => e.status >= 200 && e.status < 400 && !e.path.includes(".well-known"));
-  if (interesting && interesting.length > 0) {
-    recs.push(`Live endpoints found: ${interesting.map((e) => e.path).join(", ")} — trace these with EAGLE-EYE / verify with STRIKE.`);
-  }
-  for (const c of result.tech?.correlations ?? []) {
-    recs.push(`Tech '${c.tech}' maps to known vuln classes: ${(c.vulns ?? []).slice(0, 3).join(", ")}`);
-  }
-  result.recommendations = recs;
-  return result;
 }
-
-// src/dataflow.ts
-init_scanner();
-import { readFileSync as readFileSync9 } from "node:fs";
-var SOURCES = {
-  $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
-  $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
-  $_REQUEST: { id: "http_request", label: "HTTP request (merged)", attacker_controlled: true },
-  $_COOKIE: { id: "http_cookie", label: "HTTP cookie", attacker_controlled: true },
-  $_FILES: { id: "uploaded_file", label: "Uploaded file", attacker_controlled: true },
-  $_SERVER: { id: "http_header", label: "HTTP header / server env", attacker_controlled: true },
-  "file_get_contents('php://input')": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
-  "php://input": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
-  json_decode: { id: "json_input", label: "JSON input", attacker_controlled: true },
-  getallheaders: { id: "http_header", label: "HTTP header", attacker_controlled: true },
-  $argv: { id: "cli_argument", label: "CLI argument", attacker_controlled: false },
-  getenv: { id: "environment_variable", label: "Environment variable", attacker_controlled: false },
-  "$wpdb->get_results": { id: "database_value", label: "Database value", attacker_controlled: false },
-  wp_remote_get: { id: "external_api", label: "External API data", attacker_controlled: false }
-};
-function classifySource(line) {
-  for (const [token, cls] of Object.entries(SOURCES)) {
-    if (line.includes(token))
-      return cls;
+function techCorrelation(tech) {
+  const data = loadJson("tech_correlations");
+  if (!data)
+    return { found: false, error: "tech_correlations.json not loaded" };
+  const key = tech.toLowerCase();
+  const entry = data[key];
+  if (!entry) {
+    const matches = Object.keys(data).filter((k) => k.includes(key) || key.includes(k)).slice(0, 5);
+    return { found: false, tech, suggestions: matches };
   }
-  return null;
+  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? { vulns: entry.vulns, paths: entry.paths } };
 }
-var SINK_CLASS_MAP = [
-  [/->query\(|\$wpdb->query|\$wpdb->get_var|\$wpdb->get_results|->whereRaw|->selectRaw/, { id: "sql_execution", category: "SQL execution", cwe: "CWE-89" }],
-  [/\beval\(|\bassert\(|\bcreate_function\(|\bcall_user_func\(|\bpreg_replace\(/, { id: "code_execution", category: "Dynamic evaluation / code execution", cwe: "CWE-94" }],
-  [/\bsystem\(|\bexec\(|\bshell_exec\(|\bpassthru\(|\bproc_open\(|\bpopen\(/, { id: "command_execution", category: "Command execution", cwe: "CWE-78" }],
-  [/\bmove_uploaded_file\(|\bfile_put_contents\(|\bfwrite\(|\bfopen\(|\bunlink\(/, { id: "file_operations", category: "File operations", cwe: "CWE-434" }],
-  [/\binclude\(|\brequire\(|\binclude_once\(|\brequire_once\(/, { id: "file_inclusion", category: "File inclusion", cwe: "CWE-98" }],
-  [/\bunserialize\(|\bmaybe_unserialize\(/, { id: "deserialization", category: "Deserialization", cwe: "CWE-502" }],
-  [/\bwp_remote_get\(|\bwp_remote_post\(|\bfile_get_contents\(|\bcurl_exec\(|\bcurl_setopt\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
-  [/\bheader\(|\bwp_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
-  [/echo\s|print\s|\bprintf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
-  [/\bsimplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
-  [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
-];
-function classifySink2(sink) {
-  for (const [re, cls] of SINK_CLASS_MAP) {
-    if (re.test(sink))
-      return cls;
-  }
-  return null;
+function cveCorrelation(cveId) {
+  const data = loadJson("cve_correlations");
+  if (!data)
+    return { error: "cve_correlations.json not loaded" };
+  const key = cveId.toUpperCase();
+  const entry = data[key];
+  if (!entry)
+    return { found: false, cve: key, total_known: Object.keys(data).length };
+  return { found: true, cve: key, ...entry };
 }
-var SANITIZERS = {
-  htmlspecialchars: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
-  esc_html: { id: "html_escape", label: "HTML escape", neutralizes: ["html_render"] },
-  esc_attr: { id: "html_escape", label: "HTML attribute escape", neutralizes: ["html_render"] },
-  htmlentities: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
-  esc_sql: { id: "sql_escape", label: "SQL escape", neutralizes: ["sql_execution"] },
-  "$wpdb->prepare": { id: "sql_prepare", label: "Prepared SQL statement", neutralizes: ["sql_execution"] },
-  "->prepare(": { id: "sql_prepare", label: "Prepared statement", neutralizes: ["sql_execution"] },
-  filter_var: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
-  filter_input: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
-  sanitize_text_field: { id: "wp_sanitize", label: "WordPress sanitize", neutralizes: ["html_render"] },
-  sanitize_file_name: { id: "wp_sanitize_file", label: "File-name sanitize", neutralizes: ["file_operations", "file_inclusion"] },
-  wp_verify_nonce: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
-  check_ajax_referer: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
-  escapeshellarg: { id: "shell_escape", label: "Shell argument escape", neutralizes: ["command_execution"] },
-  escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
-  intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
-  absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
-  "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
-};
-function findSanitizers(line) {
-  const out = [];
-  for (const [token, san] of Object.entries(SANITIZERS)) {
-    if (line.includes(token))
-      out.push(san);
+function portCorrelation(port) {
+  const data = loadJson("port_correlations");
+  if (!data)
+    return { error: "port_correlations.json not loaded" };
+  const key = String(port);
+  const entry = data[key];
+  if (!entry)
+    return { found: false, port: key, total_known: Object.keys(data).length };
+  return { found: true, port: key, ...entry };
+}
+function fuzzerPayloads(category) {
+  const data = loadJson("fuzzer_data");
+  if (!data)
+    return { error: "fuzzer_data.json not loaded" };
+  if (category) {
+    const c = data[category] ?? data[category.toUpperCase()];
+    return { category, found: Boolean(c), data: c ?? null };
   }
-  return out;
+  return { categories: Object.keys(data), fuzz_points: data.FUZZ_POINTS ?? null, payloads: data.FUZZ_PAYLOADS ?? null };
 }
-function isSanitized(sanitizers, sinkCategory) {
-  return sanitizers.some((s) => s.neutralizes.includes(sinkCategory) || s.neutralizes.includes("authorization"));
+function intelSummary() {
+  const waf = loadJson("waf_signatures");
+  const tech = loadJson("tech_correlations");
+  const cve = loadJson("cve_correlations");
+  const port = loadJson("port_correlations");
+  const fuzz = loadJson("fuzzer_data");
+  const av = loadJson("attack_vectors");
+  return {
+    waf_signatures: waf ? (waf.header_signatures?.length ?? 0) + (waf.body_signatures?.length ?? 0) : 0,
+    tech_correlations: tech ? Object.keys(tech).length : 0,
+    cve_correlations: cve ? Object.keys(cve).length : 0,
+    port_correlations: port ? Object.keys(port).length : 0,
+    fuzzer_categories: fuzz ? Object.keys(fuzz).length : 0,
+    payload_categories: listPayloadCategories().length,
+    nuclei_templates: countTemplates(),
+    attack_vector_categories: av ? av.categories.length : 0,
+    attack_vectors: av ? av.categories.reduce((n, c) => n + c.vectors.length, 0) : 0
+  };
 }
-function traceDataFlow(path) {
-  const scan = scanFile(path);
-  const result = { file: path, candidates: [], sanitized: [], authorized: [] };
-  if (scan.error)
-    return result;
-  let text;
+function listAttackVectors() {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  return {
+    total_categories: data.categories.length,
+    total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
+    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length }))
+  };
+}
+function attackVectors(category) {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  const q = category.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const found = data.categories.find((c) => c.id === q || c.id.includes(q) || c.title.toLowerCase().includes(category.toLowerCase()));
+  if (!found) {
+    const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
+    return { found: false, query: category, suggestions: matches };
+  }
+  return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
+}
+var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
+var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
+function payloadsDir() {
+  if (existsSync5(PACKAGE_PAYLOADS))
+    return PACKAGE_PAYLOADS;
+  return join8(DATA_ROOT, "payloads");
+}
+function templatesDir() {
+  if (existsSync5(PACKAGE_TEMPLATES))
+    return PACKAGE_TEMPLATES;
+  return join8(DATA_ROOT, "templates");
+}
+var PAYLOADS = payloadsDir();
+var TEMPLATES = templatesDir();
+function listPayloadCategories() {
   try {
-    text = readFileSync9(path, "utf8");
+    return readdirSync3(PAYLOADS, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
   } catch {
-    return result;
+    return [];
   }
-  const lines = text.split(`
-`);
-  const seen = new Set;
-  const sinks = scan.sinks.filter((s) => {
-    const cls = classifySink2(s.sink);
-    if (!cls)
-      return false;
-    const key = `${cls.id}|${s.line}`;
-    if (seen.has(key))
-      return false;
-    seen.add(key);
-    return true;
+}
+function payloadLookup(topic) {
+  const cats = listPayloadCategories();
+  const key = topic.toLowerCase();
+  const ALIASES = {
+    sqli: "sql injection",
+    xss: "xss injection",
+    ssrf: "server side request forgery",
+    ssti: "server side template injection",
+    jwt: "json web token",
+    lfi: "file inclusion",
+    rfi: "file inclusion",
+    xxe: "xxe injection",
+    idor: "insecure direct object references",
+    csrf: "cross-site request forgery",
+    cmdi: "command injection",
+    rce: "command injection",
+    cors: "cors misconfiguration",
+    crlf: "crlf injection",
+    prototype: "prototype pollution",
+    nosql: "nosql injection",
+    upload: "upload insecure files"
+  };
+  const normalized = ALIASES[key] ?? key;
+  const exact = cats.find((c) => c.toLowerCase() === normalized);
+  if (exact) {
+    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
+  }
+  const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
+  const matches = cats.filter((c) => {
+    const cl = c.toLowerCase();
+    if (cl.includes(normalized) || normalized.includes(cl))
+      return true;
+    return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
   });
-  for (const s of sinks) {
-    const sinkClass = classifySink2(s.sink);
-    const wideStart = Math.max(0, s.line - 15);
-    const wideWindow = lines.slice(wideStart, s.line).join(`
-`);
-    const sanitizerWindow = lines.slice(Math.max(0, s.line - 3), s.line + 1).join(`
-`);
-    const sinkLine = lines[s.line - 1] ?? "";
-    const prevLine = lines[s.line - 2] ?? "";
-    const authContext = sinkLine + `
-` + prevLine;
-    const source = classifySource(wideWindow);
-    const sanitizers = findSanitizers(sanitizerWindow);
-    const authGates = AUTH_GATES.filter((g) => authContext.includes(g));
-    const edge = {
-      source,
-      sanitizers,
-      auth_gates: authGates,
-      sink: sinkClass,
-      sink_line: s.line,
-      sink_token: s.sink
-    };
-    if (authGates.length > 0) {
-      result.authorized.push(edge);
-      continue;
-    }
-    if (isSanitized(sanitizers, sinkClass.id)) {
-      result.sanitized.push(edge);
-      continue;
-    }
-    result.candidates.push(edge);
+  if (matches.length > 0) {
+    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
   }
-  return result;
+  return { found: false, topic, suggestions: cats.slice(0, 20) };
 }
-function groupVariants(results) {
-  const groups = new Map;
-  for (const r of results) {
-    for (const c of r.candidates) {
-      const sig = `${c.sink?.category ?? "?"}|${c.source?.id ?? "unknown"}`;
-      const g = groups.get(sig);
-      if (g) {
-        g.occurrences += 1;
-        if (!g.files.includes(r.file))
-          g.files.push(r.file);
-      } else {
-        groups.set(sig, {
-          signature: sig,
-          root_cause: `unsanitized ${c.source?.label ?? "unknown"} reaching ${c.sink?.category ?? "sink"}`,
-          sink_category: c.sink?.category ?? "?",
-          cwe: c.sink?.cwe,
-          occurrences: 1,
-          files: [r.file]
-        });
-      }
+function readPayload(category, file) {
+  const cats = listPayloadCategories();
+  const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
+  if (!exact)
+    return { found: false, category, suggestions: cats.slice(0, 20) };
+  const dir = join8(PAYLOADS, exact);
+  const files = listFiles(dir);
+  if (!file) {
+    const readme = files.find((f) => f.toLowerCase() === "readme.md");
+    if (readme) {
+      return { found: true, category: exact, file: readme, content: readFileSync8(join8(dir, readme), "utf8").slice(0, 20000) };
     }
+    return { found: true, category: exact, files };
   }
-  return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
-}
-
-// src/taint.ts
-init_scanner();
-var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync10 } from "node:fs";
-var parser = new import_php_parser.Engine({
-  parser: { extractDoc: false, php7: true },
-  ast: { withPositions: true, withSource: false }
-});
-function isNode(v) {
-  return v && typeof v === "object" && typeof v.kind === "string";
+  const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
+  if (!f)
+    return { found: false, category: exact, file, suggestions: files };
+  return { found: true, category: exact, file: f, content: readFileSync8(join8(dir, f), "utf8").slice(0, 20000) };
 }
-function children(node) {
-  const out = [];
-  for (const k of Object.keys(node)) {
-    if (k === "loc")
-      continue;
-    const v = node[k];
-    if (Array.isArray(v)) {
-      for (const c of v)
-        if (isNode(c))
-          out.push(c);
-    } else if (isNode(v)) {
-      out.push(v);
-    }
+function listFiles(dir) {
+  try {
+    return readdirSync3(dir).filter((f) => f.endsWith(".md") || f.endsWith(".txt") || f.endsWith(".yaml")).sort();
+  } catch {
+    return [];
   }
-  return out;
 }
-function findKind(node, kind, out = []) {
-  if (!isNode(node))
-    return out;
-  if (node.kind === kind)
-    out.push(node);
-  for (const c of children(node))
-    findKind(c, kind, out);
-  return out;
-}
-function rootVarName(node) {
-  if (!isNode(node))
-    return null;
-  if (node.kind === "variable")
-    return node.name ?? null;
-  if (node.kind === "name")
-    return typeof node.name === "string" ? node.name : node.name?.name ?? null;
-  if (node.kind === "offsetlookup" || node.kind === "propertylookup")
-    return rootVarName(node.what);
-  return null;
-}
-function sourceOf(node) {
-  if (!isNode(node))
-    return null;
-  if (node.kind === "offsetlookup" && node.what?.kind === "variable") {
-    const n = node.what.name;
-    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
-      return "$" + n;
-  }
-  if (node.kind === "variable") {
-    const n = node.name;
-    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
-      return "$" + n;
-  }
-  if (node.kind === "call") {
-    const n = rootVarName(node.what);
-    if (n === "getallheaders")
-      return "getallheaders";
-    if (n === "file_get_contents" && JSON.stringify(node).includes("php://input"))
-      return "php://input";
-  }
-  return null;
-}
-function sinkClassOf(call) {
-  const what = call.what;
-  if (!isNode(what))
-    return null;
-  let token = "";
-  if (what.kind === "propertylookup") {
-    const base = rootVarName(what.what);
-    const method = what.offset?.name ?? what.offset?.value;
-    token = `${base}->${method}(`;
-  } else if (what.kind === "name") {
-    token = `${what.name}(`;
-  }
-  if (!token)
-    return null;
-  const cls = classifySink2(token) ?? classifySink2(what.name ?? "");
-  if (!cls)
-    return null;
-  return { token, cls };
-}
-function analyzeBlock(statements, env, summaries, findings, suppressed, params = [], file) {
-  for (const stmt of statements) {
-    if (!isNode(stmt))
-      continue;
-    const kind = stmt.kind;
-    if (kind === "expressionstatement") {
-      const expr = stmt.expression;
-      walkExpression(expr, env, summaries, findings, suppressed, file);
-    } else if (kind === "if") {
-      const ifEnv = new Map(env);
-      const bodyStmts = stmt.body?.kind === "block" ? stmt.body.children : [stmt.body];
-      analyzeBlock(bodyStmts, ifEnv, summaries, findings, suppressed, params, file);
-      if (stmt.alternate) {
-        const altEnv = new Map(env);
-        const altStmts = stmt.alternate.kind === "block" ? stmt.alternate.children : [stmt.alternate];
-        analyzeBlock(altStmts, altEnv, summaries, findings, suppressed, params, file);
-      }
-    } else if (kind === "block") {
-      analyzeBlock(stmt.children ?? [], env, summaries, findings, suppressed, params, file);
-    } else if (kind === "return" || kind === "echo" || kind === "print") {
-      walkExpression(stmt, env, summaries, findings, suppressed, file);
-    } else {
-      for (const c of children(stmt)) {
-        if (c.kind === "block" || c.kind === "if") {
-          analyzeBlock([c], new Map(env), summaries, findings, suppressed, params, file);
-        }
+function countTemplates() {
+  try {
+    let n = 0;
+    const walk = (dir) => {
+      for (const e of readdirSync3(dir, { withFileTypes: true })) {
+        if (e.isDirectory())
+          walk(join8(dir, e.name));
+        else if (e.name.endsWith(".yaml"))
+          n++;
       }
-    }
+    };
+    walk(TEMPLATES);
+    return n;
+  } catch {
+    return 0;
   }
 }
-function walkExpression(node, env, summaries, findings, suppressed, file) {
-  if (!isNode(node))
-    return;
-  if (node.kind === "assign") {
-    const varName = rootVarName(node.left);
-    const taint = evalTaint(node.right, env, summaries);
-    if (varName) {
-      env.set(varName, taint);
-    }
-    return;
-  }
-  if (node.kind === "call") {
-    const sink = sinkClassOf(node);
-    if (sink) {
-      const argTaints = node.arguments.map((a) => {
-        return evalTaint(a, env, summaries);
-      });
-      const tainted = argTaints.filter((t) => t.tainted);
-      if (tainted.length > 0) {
-        const sanitizers = tainted.flatMap((t) => t.sanitizers);
-        const inlineSan = findSanitizers(JSON.stringify(node));
-        const san = [...sanitizers, ...inlineSan].filter((s, i, arr) => arr.indexOf(s) === i);
-        const cls = sink.cls;
-        if (!isSanitized(san, cls.id)) {
-          findings.push({
-            sink: sink.token,
-            sink_line: node.loc?.start?.line ?? 0,
-            category: cls.category,
-            cwe: cls.cwe,
-            variables: tainted.map((t) => t.source ?? "var"),
-            source: tainted[0].source,
-            source_line: tainted[0].sourceLine,
-            sanitized: false,
-            sanitizers: san.map((s) => s.id),
-            auth_gated: false,
-            interprocedural: false
-          });
-        } else {
-          suppressed.n += 1;
-        }
-      }
-      for (const a of node.arguments)
-        walkExpression(a, env, summaries, findings, suppressed, file);
+function templateLookup(topic, limit = 10) {
+  const key = topic.toLowerCase();
+  const hits = [];
+  const walk = (dir, depth = 0) => {
+    if (depth > 6 || hits.length >= limit * 3)
       return;
-    }
-    const fnName = rootVarName(node.what);
-    if (fnName && summaries.has(fnName)) {
-      const sum = summaries.get(fnName);
-      const argTaints = node.arguments.map((a) => {
-        const v = a;
-        return evalTaint(v, env, summaries);
-      });
-      const taintedArgs = argTaints.filter((t) => t.tainted);
-      if (taintedArgs.length > 0 && sum.sinkParams.size > 0) {
-        const firstSink = [...sum.sinkParams.values()][0];
-        const cls = classifySink2(firstSink.sink);
-        if (cls) {
-          const san = [
-            ...taintedArgs.flatMap((t) => t.sanitizers),
-            ...[...sum.sanitizedParams.values()].flat()
-          ];
-          if (!isSanitized(san, cls.id)) {
-            findings.push({
-              sink: firstSink.sink,
-              sink_line: firstSink.line,
-              category: cls.category,
-              cwe: cls.cwe,
-              variables: taintedArgs.map((t) => t.source ?? "var"),
-              source: taintedArgs[0].source,
-              source_line: taintedArgs[0].sourceLine,
-              sanitized: false,
-              sanitizers: san.map((s) => s.id),
-              auth_gated: false,
-              interprocedural: true
-            });
-          } else {
-            suppressed.n += 1;
-          }
-        }
-      }
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
       return;
     }
-    for (const c of children(node))
-      walkExpression(c, env, summaries, findings, suppressed, file);
-    return;
-  }
-  if (node.kind === "echo" || node.kind === "print") {
-    const exprs = node.expressions ?? [node.expression];
-    for (const e of exprs) {
-      const cls = classifySink2(node.kind === "echo" ? "echo " : "print ");
-      const t = evalTaint(e, env, summaries);
-      if (t.tainted && cls) {
-        const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(e))];
-        if (!isSanitized(san, cls.id)) {
-          findings.push({
-            sink: node.kind + " ",
-            sink_line: node.loc?.start?.line ?? 0,
-            category: cls.category,
-            cwe: cls.cwe,
-            variables: [t.source ?? "var"],
-            source: t.source,
-            source_line: t.sourceLine,
-            sanitized: false,
-            sanitizers: san.map((s) => s.id),
-            auth_gated: false,
-            interprocedural: false
-          });
-        } else {
-          suppressed.n += 1;
+    for (const e of entries) {
+      if (e.isDirectory())
+        walk(join8(dir, e.name), depth + 1);
+      else if (e.name.endsWith(".yaml")) {
+        const name = e.name.toLowerCase();
+        if (name.includes(key)) {
+          const full = join8(dir, e.name);
+          let id = "";
+          try {
+            const content = readFileSync8(full, "utf8");
+            const m = content.match(/^\s*id:\s*(.+)$/m);
+            if (m)
+              id = m[1].trim();
+          } catch {}
+          hits.push({ path: full.replace(ROOT3 + "/", ""), name: e.name, id });
         }
       }
     }
-    return;
+  };
+  walk(TEMPLATES);
+  return { found: hits.length > 0, topic, count: hits.length, templates: hits.slice(0, limit) };
+}
+
+// src/active.ts
+var TIMEOUT_MS2 = 20000;
+async function httpFetch(url, init) {
+  const controller = new AbortController;
+  const t = setTimeout(() => controller.abort(), TIMEOUT_MS2);
+  try {
+    const res = await fetch(url, { ...init, signal: controller.signal, redirect: "follow" });
+    const body = await res.text();
+    const headers = {};
+    res.headers.forEach((v, k) => {
+      headers[k] = v;
+    });
+    return { status: res.status, headers, body: body.slice(0, 20000), ok: res.ok };
+  } catch (e) {
+    return { status: 0, headers: {}, body: String(e), ok: false };
+  } finally {
+    clearTimeout(t);
   }
-  for (const c of children(node))
-    walkExpression(c, env, summaries, findings, suppressed, file);
 }
-function evalTaint(node, env, summaries) {
-  if (!isNode(node))
-    return { tainted: false, sanitizers: [] };
-  const src = sourceOf(node);
-  if (src)
-    return { tainted: true, sanitizers: [], source: src, sourceLine: node.loc?.start?.line };
-  if (node.kind === "variable" || node.kind === "offsetlookup") {
-    const root = rootVarName(node);
-    if (root) {
-      const st = env.get(root);
-      if (st)
-        return { ...st };
-    }
-    if (node.kind === "offsetlookup") {
-      const whatTaint = evalTaint(node.what, env, summaries);
-      if (whatTaint.tainted)
-        return whatTaint;
-    }
-    return { tainted: false, sanitizers: [] };
-  }
-  if (node.kind === "call") {
-    const fnName = rootVarName(node.what);
-    const san = findSanitizers(fnName ? fnName + "(" : "");
-    if (san.length > 0) {
-      const inner = node.arguments.map((a) => evalTaint(a, env, summaries));
-      const tainted = inner.some((t) => t.tainted);
-      return {
-        tainted,
-        sanitizers: tainted ? [...inner.flatMap((t) => t.sanitizers), ...san] : [],
-        source: tainted ? inner.find((t) => t.tainted)?.source : undefined,
-        sourceLine: tainted ? inner.find((t) => t.tainted)?.sourceLine : undefined
-      };
-    }
-    if (fnName && summaries.has(fnName)) {
-      const sum = summaries.get(fnName);
-      const argTaints = node.arguments.map((a) => evalTaint(a, env, summaries));
-      const tainted = argTaints.filter((t) => t.tainted);
-      if (tainted.length > 0) {
-        const helperSan = [...sum.sanitizedParams.values()].flat();
-        return {
-          tainted: true,
-          sanitizers: [...tainted.flatMap((t) => t.sanitizers), ...helperSan],
-          source: tainted[0].source,
-          sourceLine: tainted[0].sourceLine
-        };
-      }
-    }
-    return { tainted: false, sanitizers: [] };
-  }
-  if (node.kind === "bin" || node.kind === "concat" || node.kind === "encapsed") {
-    const parts = children(node);
-    const taints = parts.map((p) => evalTaint(p, env, summaries));
-    const tainted = taints.find((t) => t.tainted);
-    if (tainted)
-      return { ...tainted, sanitizers: taints.flatMap((t) => t.sanitizers) };
-    return { tainted: false, sanitizers: [] };
+function normalizeTarget(target) {
+  let t = target.trim();
+  if (!/^https?:\/\//i.test(t))
+    t = `https://${t}`;
+  return t.replace(/\/+$/, "");
+}
+function extractTitle(body) {
+  const m = body.match(/<title[^>]*>([^<]+)<\/title>/i);
+  return m ? m[1].trim().slice(0, 200) : "";
+}
+function detectServer(headers) {
+  return headers["server"] ?? headers["x-powered-by"] ?? "";
+}
+function detectTechFromBody(body) {
+  const hits = [];
+  const sigs = [
+    [/wp-content|wp-includes|wp-json/i, "wordpress"],
+    [/wp-login\.php|wp-admin/i, "wordpress"],
+    [/powered by joomla|com_content/i, "joomla"],
+    [/laravel|_token|csrf-token/i, "laravel"],
+    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
+    [/angular|ng-version/i, "angular"],
+    [/vue|__vue__|v-data/i, "vue"],
+    [/django|csrftoken|__debug__/i, "django"],
+    [/ruby on rails|rails/i, "rails"],
+    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
+    [/phpBB|phpbb/i, "phpbb"],
+    [/mybb|mybb/i, "mybb"],
+    [/drupal|Drupal\.settings/i, "drupal"],
+    [/magento|Mage\./i, "magento"],
+    [/shopify|cdn\.shopify/i, "shopify"],
+    [/grafana|kibana|elastic/i, "grafana-kibana"]
+  ];
+  for (const [re, name] of sigs) {
+    if (re.test(body))
+      hits.push(name);
   }
-  if (node.kind === "encapsedpart") {
-    return evalTaint(node.expression, env, summaries);
+  return [...new Set(hits)];
+}
+async function probeCommonPaths(base) {
+  const paths = [
+    "/robots.txt",
+    "/sitemap.xml",
+    "/.well-known/security.txt",
+    "/wp-login.php",
+    "/wp-admin/",
+    "/wp-json/",
+    "/administrator/",
+    "/admin/",
+    "/login",
+    "/api/",
+    "/.git/config",
+    "/.env",
+    "/config.php",
+    "/phpinfo.php",
+    "/swagger.json",
+    "/swagger-ui.html",
+    "/graphql",
+    "/actuator/health"
+  ];
+  const out = [];
+  for (const p of paths) {
+    const r = await httpFetch(`${base}${p}`, { method: "GET" });
+    out.push({ path: p, status: r.status });
   }
-  return { tainted: false, sanitizers: [] };
+  return out;
 }
-function analyzeTaint(path) {
-  const result = { file: path, findings: [], suppressed: 0 };
-  let code;
-  try {
-    code = readFileSync10(path, "utf8");
-  } catch {
-    return result;
+async function activeScan(target, scope = "", mode = "bug-bounty", allowed = undefined) {
+  const base = normalizeTarget(target);
+  const host = (() => {
+    try {
+      return new URL(base).hostname;
+    } catch {
+      return target;
+    }
+  })();
+  if (allowed === false) {
+    return {
+      target: base,
+      gated: true,
+      gate_reason: `active scanning not authorized for '${host}' (mode=${mode}, scope='${scope || "unset"}')`
+    };
   }
-  let ast;
-  try {
-    ast = parser.parseCode(code, path);
-  } catch {
+  const result = { target: base, gated: false };
+  const root = await httpFetch(base);
+  if (root.status === 0) {
+    result.gated = true;
+    result.gate_reason = `could not reach ${base}: ${root.body.slice(0, 120)}`;
     return result;
   }
-  const functions = findKind(ast, "function");
-  const summaries = new Map;
-  for (const fn of functions) {
-    const name = typeof fn.name === "string" ? fn.name : fn.name?.name ?? "<anonymous>";
-    const params = (fn.arguments ?? []).map((a) => typeof a === "string" ? a : typeof a.name === "string" ? a.name : a.name?.name ?? "?");
-    const summary = { name, params, sinkParams: new Map, sanitizedParams: new Map };
-    const env = new Map;
-    for (const p of params)
-      env.set(p, { tainted: false, sanitizers: [] });
-    const calls = findKind(fn, "call");
-    for (const call of calls) {
-      const sink = sinkClassOf(call);
-      if (!sink)
-        continue;
-      const line = call.loc?.start?.line ?? 0;
-      const varsInCall = findKind(call, "variable").map((v) => v.name).filter(Boolean);
-      for (const v of varsInCall) {
-        if (params.includes(v))
-          summary.sinkParams.set(v, { sink: sink.token, line });
-      }
-      const san = findSanitizers(JSON.stringify(call));
-      for (const v of varsInCall) {
-        if (params.includes(v) && san.length > 0) {
-          summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
-        }
-      }
-    }
-    for (const ek of ["echo", "print"]) {
-      for (const en of findKind(fn, ek)) {
-        const line = en.loc?.start?.line ?? 0;
-        const vars = findKind(en, "variable").map((v) => v.name).filter(Boolean);
-        const san = findSanitizers(JSON.stringify(en));
-        for (const v of vars) {
-          if (params.includes(v)) {
-            summary.sinkParams.set(v, { sink: ek + " ", line });
-            if (san.length > 0) {
-              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
-            }
-          }
-        }
-      }
-    }
-    const assigns = findKind(fn, "assign");
-    for (const a of assigns) {
-      const san = findSanitizers(JSON.stringify(a.right));
-      if (san.length > 0) {
-        const lv = rootVarName(a.left);
-        if (lv && params.includes(lv)) {
-          summary.sanitizedParams.set(lv, [...summary.sanitizedParams.get(lv) ?? [], ...san]);
-        }
-      }
-    }
-    for (const ek of ["echo", "print"]) {
-      for (const en of findKind(fn, ek)) {
-        const san = findSanitizers(JSON.stringify(en));
-        if (san.length > 0) {
-          for (const v of findKind(en, "variable").map((v2) => v2.name).filter(Boolean)) {
-            if (params.includes(v)) {
-              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
-            }
-          }
-        }
-      }
-    }
-    summaries.set(name, summary);
+  result.waf = detectWaf(root.headers, root.body);
+  const interestingHeaders = {};
+  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
+    if (root.headers[k])
+      interestingHeaders[k] = root.headers[k];
   }
-  const topStmts = [];
-  const body = ast.children ?? [];
-  for (const s of body) {
-    if (isNode(s) && s.kind !== "function")
-      topStmts.push(s);
+  result.fingerprint = {
+    status: root.status,
+    title: extractTitle(root.body),
+    server: detectServer(root.headers),
+    headers: interestingHeaders,
+    body_size: root.body.length
+  };
+  const techs = detectTechFromBody(root.body);
+  const serverTech = detectServer(root.headers);
+  result.tech = {
+    detected: techs,
+    server: serverTech,
+    correlations: techs.map((t) => techCorrelation(t)).filter((c) => c.found === true)
+  };
+  result.endpoints = await probeCommonPaths(base);
+  const recs = [];
+  if (result.waf?.detected)
+    recs.push(`WAF detected (${result.waf.wafs?.map((w) => w.waf).join(", ")}) — apply WAF bypass before exploitation.`);
+  const interesting = result.endpoints?.filter((e) => e.status >= 200 && e.status < 400 && !e.path.includes(".well-known"));
+  if (interesting && interesting.length > 0) {
+    recs.push(`Live endpoints found: ${interesting.map((e) => e.path).join(", ")} — trace these with EAGLE-EYE / verify with STRIKE.`);
   }
-  const globalEnv = new Map;
-  const suppressRef = { n: 0 };
-  analyzeBlock(topStmts, globalEnv, summaries, result.findings, suppressRef, [], path);
-  result.suppressed = suppressRef.n;
+  for (const c of result.tech?.correlations ?? []) {
+    recs.push(`Tech '${c.tech}' maps to known vuln classes: ${(c.vulns ?? []).slice(0, 3).join(", ")}`);
+  }
+  result.recommendations = recs;
   return result;
 }
-function taintTree(root, maxFiles = 2000) {
-  const files = iterSourceFiles(root, maxFiles);
-  return files.map((f) => analyzeTaint(f));
-}
 
-// src/eagle2.ts
-var import_php_parser3 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync12 } from "node:fs";
+// src/dataflow.ts
 init_scanner();
+import { readFileSync as readFileSync9 } from "node:fs";
+var SOURCES = {
+  $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
+  $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
+  $_REQUEST: { id: "http_request", label: "HTTP request (merged)", attacker_controlled: true },
+  $_COOKIE: { id: "http_cookie", label: "HTTP cookie", attacker_controlled: true },
+  $_FILES: { id: "uploaded_file", label: "Uploaded file", attacker_controlled: true },
+  $_SERVER: { id: "http_header", label: "HTTP header / server env", attacker_controlled: true },
+  "file_get_contents('php://input')": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  "php://input": { id: "raw_body", label: "Raw request body", attacker_controlled: true },
+  json_decode: { id: "json_input", label: "JSON input", attacker_controlled: true },
+  getallheaders: { id: "http_header", label: "HTTP header", attacker_controlled: true },
+  $argv: { id: "cli_argument", label: "CLI argument", attacker_controlled: false },
+  getenv: { id: "environment_variable", label: "Environment variable", attacker_controlled: false },
+  "$wpdb->get_results": { id: "database_value", label: "Database value", attacker_controlled: false },
+  wp_remote_get: { id: "external_api", label: "External API data", attacker_controlled: false }
+};
+function classifySource(line) {
+  for (const [token, cls] of Object.entries(SOURCES)) {
+    if (line.includes(token))
+      return cls;
+  }
+  return null;
+}
+var SINK_CLASS_MAP = [
+  [/->query\(|\$wpdb->query|\$wpdb->get_var|\$wpdb->get_results|->whereRaw|->selectRaw/, { id: "sql_execution", category: "SQL execution", cwe: "CWE-89" }],
+  [/\beval\(|\bassert\(|\bcreate_function\(|\bcall_user_func\(|\bpreg_replace\(/, { id: "code_execution", category: "Dynamic evaluation / code execution", cwe: "CWE-94" }],
+  [/\bsystem\(|\bexec\(|\bshell_exec\(|\bpassthru\(|\bproc_open\(|\bpopen\(/, { id: "command_execution", category: "Command execution", cwe: "CWE-78" }],
+  [/\bmove_uploaded_file\(|\bfile_put_contents\(|\bfwrite\(|\bfopen\(|\bunlink\(/, { id: "file_operations", category: "File operations", cwe: "CWE-434" }],
+  [/\binclude\(|\brequire\(|\binclude_once\(|\brequire_once\(/, { id: "file_inclusion", category: "File inclusion", cwe: "CWE-98" }],
+  [/\bunserialize\(|\bmaybe_unserialize\(/, { id: "deserialization", category: "Deserialization", cwe: "CWE-502" }],
+  [/\bwp_remote_get\(|\bwp_remote_post\(|\bfile_get_contents\(|\bcurl_exec\(|\bcurl_setopt\(/, { id: "http_request", category: "HTTP request (SSRF)", cwe: "CWE-918" }],
+  [/\bheader\(|\bwp_redirect\(/, { id: "redirect", category: "Redirect handling", cwe: "CWE-601" }],
+  [/echo\s|print\s|\bprintf\(/, { id: "html_render", category: "HTML rendering (XSS)", cwe: "CWE-79" }],
+  [/\bsimplexml_load_string\(|new SimpleXMLElement|DOMDocument/, { id: "xml_processing", category: "XML processing (XXE)", cwe: "CWE-611" }],
+  [/\bZipArchive|\bPharData|->extractTo\(/, { id: "archive_extraction", category: "Archive extraction (zip slip)", cwe: "CWE-22" }]
+];
+function classifySink2(sink) {
+  for (const [re, cls] of SINK_CLASS_MAP) {
+    if (re.test(sink))
+      return cls;
+  }
+  return null;
+}
+var SANITIZERS = {
+  htmlspecialchars: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_html: { id: "html_escape", label: "HTML escape", neutralizes: ["html_render"] },
+  esc_attr: { id: "html_escape", label: "HTML attribute escape", neutralizes: ["html_render"] },
+  htmlentities: { id: "html_escape", label: "HTML entity encoding", neutralizes: ["html_render"] },
+  esc_sql: { id: "sql_escape", label: "SQL escape", neutralizes: ["sql_execution"] },
+  "$wpdb->prepare": { id: "sql_prepare", label: "Prepared SQL statement", neutralizes: ["sql_execution"] },
+  "->prepare(": { id: "sql_prepare", label: "Prepared statement", neutralizes: ["sql_execution"] },
+  filter_var: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  filter_input: { id: "filter_var", label: "Filter input", neutralizes: ["html_render", "sql_execution", "command_execution"] },
+  sanitize_text_field: { id: "wp_sanitize", label: "WordPress sanitize", neutralizes: ["html_render"] },
+  sanitize_file_name: { id: "wp_sanitize_file", label: "File-name sanitize", neutralizes: ["file_operations", "file_inclusion"] },
+  wp_verify_nonce: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  check_ajax_referer: { id: "nonce_check", label: "Nonce verification", neutralizes: ["authorization"] },
+  escapeshellarg: { id: "shell_escape", label: "Shell argument escape", neutralizes: ["command_execution"] },
+  escapeshellcmd: { id: "shell_escape", label: "Shell command escape", neutralizes: ["command_execution"] },
+  intval: { id: "int_cast", label: "Integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  absint: { id: "int_cast", label: "Absolute integer cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] },
+  "preg_replace.*FILTER": { id: "regex_filter", label: "Regex filter", neutralizes: ["html_render"] }
+};
+function findSanitizers(line) {
+  const out = [];
+  for (const [token, san] of Object.entries(SANITIZERS)) {
+    if (line.includes(token))
+      out.push(san);
+  }
+  return out;
+}
+function isSanitized(sanitizers, sinkCategory) {
+  return sanitizers.some((s) => s.neutralizes.includes(sinkCategory) || s.neutralizes.includes("authorization"));
+}
+function traceDataFlow(path) {
+  const scan = scanFile(path);
+  const result = { file: path, candidates: [], sanitized: [], authorized: [] };
+  if (scan.error)
+    return result;
+  let text;
+  try {
+    text = readFileSync9(path, "utf8");
+  } catch {
+    return result;
+  }
+  const lines = text.split(`
+`);
+  const seen = new Set;
+  const sinks = scan.sinks.filter((s) => {
+    const cls = classifySink2(s.sink);
+    if (!cls)
+      return false;
+    const key = `${cls.id}|${s.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+  for (const s of sinks) {
+    const sinkClass = classifySink2(s.sink);
+    const wideStart = Math.max(0, s.line - 15);
+    const wideWindow = lines.slice(wideStart, s.line).join(`
+`);
+    const sanitizerWindow = lines.slice(Math.max(0, s.line - 3), s.line + 1).join(`
+`);
+    const sinkLine = lines[s.line - 1] ?? "";
+    const prevLine = lines[s.line - 2] ?? "";
+    const authContext = sinkLine + `
+` + prevLine;
+    const source = classifySource(wideWindow);
+    const sanitizers = findSanitizers(sanitizerWindow);
+    const authGates = AUTH_GATES.filter((g) => authContext.includes(g));
+    const edge = {
+      source,
+      sanitizers,
+      auth_gates: authGates,
+      sink: sinkClass,
+      sink_line: s.line,
+      sink_token: s.sink
+    };
+    if (authGates.length > 0) {
+      result.authorized.push(edge);
+      continue;
+    }
+    if (isSanitized(sanitizers, sinkClass.id)) {
+      result.sanitized.push(edge);
+      continue;
+    }
+    result.candidates.push(edge);
+  }
+  return result;
+}
+function groupVariants(results) {
+  const groups = new Map;
+  for (const r of results) {
+    for (const c of r.candidates) {
+      const sig = `${c.sink?.category ?? "?"}|${c.source?.id ?? "unknown"}`;
+      const g = groups.get(sig);
+      if (g) {
+        g.occurrences += 1;
+        if (!g.files.includes(r.file))
+          g.files.push(r.file);
+      } else {
+        groups.set(sig, {
+          signature: sig,
+          root_cause: `unsanitized ${c.source?.label ?? "unknown"} reaching ${c.sink?.category ?? "sink"}`,
+          sink_category: c.sink?.category ?? "?",
+          cwe: c.sink?.cwe,
+          occurrences: 1,
+          files: [r.file]
+        });
+      }
+    }
+  }
+  return [...groups.values()].sort((a, b) => b.occurrences - a.occurrences);
+}
 
-// src/callgraph.ts
-var import_php_parser2 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync11 } from "node:fs";
-var parser2 = new import_php_parser2.Engine({
+// src/taint.ts
+init_scanner();
+var import_php_parser = __toESM(require_src(), 1);
+import { readFileSync as readFileSync10 } from "node:fs";
+var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
 });
-function isNode2(v) {
-  return !!v && typeof v === "object" && typeof v.kind === "string";
+function isNode(v) {
+  return v && typeof v === "object" && typeof v.kind === "string";
 }
-function children2(node) {
+function children(node) {
   const out = [];
   for (const k of Object.keys(node)) {
     if (k === "loc")
@@ -31617,201 +31772,397 @@ function children2(node) {
     const v = node[k];
     if (Array.isArray(v)) {
       for (const c of v)
-        if (isNode2(c))
+        if (isNode(c))
           out.push(c);
-    } else if (isNode2(v)) {
+    } else if (isNode(v)) {
       out.push(v);
     }
   }
   return out;
 }
-function nameOf(node) {
-  if (!isNode2(node))
+function findKind(node, kind, out = []) {
+  if (!isNode(node))
+    return out;
+  if (node.kind === kind)
+    out.push(node);
+  for (const c of children(node))
+    findKind(c, kind, out);
+  return out;
+}
+function rootVarName(node) {
+  if (!isNode(node))
     return null;
-  if (typeof node.name === "string")
-    return node.name;
-  if (isNode2(node.name))
-    return nameOf(node.name);
+  if (node.kind === "variable")
+    return node.name ?? null;
+  if (node.kind === "name")
+    return typeof node.name === "string" ? node.name : node.name?.name ?? null;
+  if (node.kind === "offsetlookup" || node.kind === "propertylookup")
+    return rootVarName(node.what);
   return null;
 }
-function nodeId(kind, name, cls) {
-  if (kind === "function")
-    return `func:${name}`;
-  if (kind === "method")
-    return `method:${cls ?? "?"}::${name}`;
-  return "main";
+function sourceOf(node) {
+  if (!isNode(node))
+    return null;
+  if (node.kind === "offsetlookup" && node.what?.kind === "variable") {
+    const n = node.what.name;
+    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
+      return "$" + n;
+  }
+  if (node.kind === "variable") {
+    const n = node.name;
+    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
+      return "$" + n;
+  }
+  if (node.kind === "call") {
+    const n = rootVarName(node.what);
+    if (n === "getallheaders")
+      return "getallheaders";
+    if (n === "file_get_contents" && JSON.stringify(node).includes("php://input"))
+      return "php://input";
+  }
+  return null;
 }
-function ensureNode(g, id, name, kind, file, line, cls) {
-  let n = g.nodes.get(id);
-  if (!n) {
-    n = { id, name, kind, class: cls, file, line, callees: new Set, callers: new Set };
-    g.nodes.set(id, n);
+function sinkClassOf(call) {
+  const what = call.what;
+  if (!isNode(what))
+    return null;
+  let token = "";
+  if (what.kind === "propertylookup") {
+    const base = rootVarName(what.what);
+    const method = what.offset?.name ?? what.offset?.value;
+    token = `${base}->${method}(`;
+  } else if (what.kind === "name") {
+    token = `${what.name}(`;
   }
-  return n;
+  if (!token)
+    return null;
+  const cls = classifySink2(token) ?? classifySink2(what.name ?? "");
+  if (!cls)
+    return null;
+  return { token, cls };
 }
-function addEdge(g, caller, callee, name, line, file) {
-  g.edges.push({ caller, callee, name, line, file });
-  const c = g.nodes.get(caller);
-  const t = g.nodes.get(callee);
-  if (c)
-    c.callees.add(callee);
-  if (t)
-    t.callers.add(caller);
-}
-function buildCallGraph(path) {
-  const g = { nodes: new Map, edges: [] };
-  let code;
-  try {
-    code = readFileSync11(path, "utf8");
-  } catch {
-    return g;
-  }
-  let ast;
-  try {
-    ast = parser2.parseCode(code, path);
-  } catch {
-    return g;
-  }
-  const mainId = nodeId("main", "main");
-  ensureNode(g, mainId, "<main>", "main", path, 0);
-  const funcs = [];
-  const methods = [];
-  walk(ast, path, (n, ctx) => {
-    if (n.kind === "function") {
-      const name = nameOf(n.name);
-      if (name)
-        funcs.push({ name, node: n });
-    } else if (n.kind === "method" && ctx.className) {
-      const mname = nameOf(n.name);
-      if (mname)
-        methods.push({ cls: ctx.className, name: mname, node: n });
+function analyzeBlock(statements, env, summaries, findings, suppressed, params = [], file) {
+  for (const stmt of statements) {
+    if (!isNode(stmt))
+      continue;
+    const kind = stmt.kind;
+    if (kind === "expressionstatement") {
+      const expr = stmt.expression;
+      walkExpression(expr, env, summaries, findings, suppressed, file);
+    } else if (kind === "if") {
+      const ifEnv = new Map(env);
+      const bodyStmts = stmt.body?.kind === "block" ? stmt.body.children : [stmt.body];
+      analyzeBlock(bodyStmts, ifEnv, summaries, findings, suppressed, params, file);
+      if (stmt.alternate) {
+        const altEnv = new Map(env);
+        const altStmts = stmt.alternate.kind === "block" ? stmt.alternate.children : [stmt.alternate];
+        analyzeBlock(altStmts, altEnv, summaries, findings, suppressed, params, file);
+      }
+    } else if (kind === "block") {
+      analyzeBlock(stmt.children ?? [], env, summaries, findings, suppressed, params, file);
+    } else if (kind === "return" || kind === "echo" || kind === "print") {
+      walkExpression(stmt, env, summaries, findings, suppressed, file);
+    } else {
+      for (const c of children(stmt)) {
+        if (c.kind === "block" || c.kind === "if") {
+          analyzeBlock([c], new Map(env), summaries, findings, suppressed, params, file);
+        }
+      }
     }
-  });
-  for (const f of funcs) {
-    const id = nodeId("function", f.name);
-    ensureNode(g, id, f.name, "function", path, f.node.loc?.start?.line ?? 0);
-  }
-  for (const m of methods) {
-    const id = nodeId("method", m.name, m.cls);
-    ensureNode(g, id, m.name, "method", path, m.node.loc?.start?.line ?? 0, m.cls);
-  }
-  walk(ast, path, (n, ctx) => {
-    if (n.kind !== "call")
-      return;
-    const line = n.loc?.start?.line ?? 0;
-    const callerId = ctx.enclosing ?? mainId;
-    resolveCall(g, n, callerId, ctx, path, line);
-  });
-  return g;
-}
-function walk(node, file, visit, ctx = {}) {
-  if (!isNode2(node))
-    return;
-  let childCtx = ctx;
-  if (node.kind === "class") {
-    childCtx = { ...ctx, className: nameOf(node.name) ?? undefined };
-  } else if (node.kind === "function") {
-    const name = nameOf(node.name);
-    childCtx = { ...ctx, enclosing: name ? nodeId("function", name) : ctx.enclosing };
-  } else if (node.kind === "method") {
-    const name = nameOf(node.name);
-    childCtx = { ...ctx, enclosing: name ? nodeId("method", name, ctx.className) : ctx.enclosing };
   }
-  visit(node, ctx);
-  for (const c of children2(node))
-    walk(c, file, visit, childCtx);
 }
-function resolveCall(g, call, callerId, ctx, file, line) {
-  const what = call.what;
-  if (!isNode2(what))
+function walkExpression(node, env, summaries, findings, suppressed, file) {
+  if (!isNode(node))
     return;
-  if (what.kind === "name") {
-    const fn = nameOf(what);
-    if (!fn)
-      return;
-    const id = nodeId("function", fn);
-    if (g.nodes.has(id)) {
-      addEdge(g, callerId, id, fn, line, file);
-    } else {
-      addEdge(g, callerId, `unknown:${fn}`, fn, line, file);
+  if (node.kind === "assign") {
+    const varName = rootVarName(node.left);
+    const taint = evalTaint(node.right, env, summaries);
+    if (varName) {
+      env.set(varName, taint);
     }
     return;
   }
-  if (what.kind === "staticlookup") {
-    const base = what.what;
-    const baseName = nameOf(base) ?? (isNode2(base) && base.kind === "variable" ? base.name : null);
-    const method = nameOf(what.offset);
-    if (!method)
+  if (node.kind === "call") {
+    const sink = sinkClassOf(node);
+    if (sink) {
+      const argTaints = node.arguments.map((a) => {
+        return evalTaint(a, env, summaries);
+      });
+      const tainted = argTaints.filter((t) => t.tainted);
+      if (tainted.length > 0) {
+        const sanitizers = tainted.flatMap((t) => t.sanitizers);
+        const inlineSan = findSanitizers(JSON.stringify(node));
+        const san = [...sanitizers, ...inlineSan].filter((s, i, arr) => arr.indexOf(s) === i);
+        const cls = sink.cls;
+        if (!isSanitized(san, cls.id)) {
+          findings.push({
+            sink: sink.token,
+            sink_line: node.loc?.start?.line ?? 0,
+            category: cls.category,
+            cwe: cls.cwe,
+            variables: tainted.map((t) => t.source ?? "var"),
+            source: tainted[0].source,
+            source_line: tainted[0].sourceLine,
+            sanitized: false,
+            sanitizers: san.map((s) => s.id),
+            auth_gated: false,
+            interprocedural: false
+          });
+        } else {
+          suppressed.n += 1;
+        }
+      }
+      for (const a of node.arguments)
+        walkExpression(a, env, summaries, findings, suppressed, file);
       return;
-    let cls = baseName;
-    if (cls === "self" || cls === "static")
-      cls = ctx.className ?? "?";
-    if (cls && cls !== "?") {
-      const id = nodeId("method", method, cls);
-      if (g.nodes.has(id))
-        addEdge(g, callerId, id, method, line, file);
     }
-    return;
-  }
-  if (what.kind === "propertylookup") {
-    const base = what.what;
-    const method = nameOf(what.offset);
-    if (!method)
-      return;
-    if (isNode2(base) && base.kind === "variable" && base.name === "this") {
-      if (ctx.className) {
-        const id = nodeId("method", method, ctx.className);
-        if (g.nodes.has(id))
-          addEdge(g, callerId, id, method, line, file);
+    const fnName = rootVarName(node.what);
+    if (fnName && summaries.has(fnName)) {
+      const sum = summaries.get(fnName);
+      const argTaints = node.arguments.map((a) => {
+        const v = a;
+        return evalTaint(v, env, summaries);
+      });
+      const taintedArgs = argTaints.filter((t) => t.tainted);
+      if (taintedArgs.length > 0 && sum.sinkParams.size > 0) {
+        const firstSink = [...sum.sinkParams.values()][0];
+        const cls = classifySink2(firstSink.sink);
+        if (cls) {
+          const san = [
+            ...taintedArgs.flatMap((t) => t.sanitizers),
+            ...[...sum.sanitizedParams.values()].flat()
+          ];
+          if (!isSanitized(san, cls.id)) {
+            findings.push({
+              sink: firstSink.sink,
+              sink_line: firstSink.line,
+              category: cls.category,
+              cwe: cls.cwe,
+              variables: taintedArgs.map((t) => t.source ?? "var"),
+              source: taintedArgs[0].source,
+              source_line: taintedArgs[0].sourceLine,
+              sanitized: false,
+              sanitizers: san.map((s) => s.id),
+              auth_gated: false,
+              interprocedural: true
+            });
+          } else {
+            suppressed.n += 1;
+          }
+        }
       }
       return;
     }
-    let matched = false;
-    for (const [id, n] of g.nodes) {
-      if (n.kind === "method" && n.name === method) {
-        addEdge(g, callerId, id, method, line, file);
-        matched = true;
+    for (const c of children(node))
+      walkExpression(c, env, summaries, findings, suppressed, file);
+    return;
+  }
+  if (node.kind === "echo" || node.kind === "print") {
+    const exprs = node.expressions ?? [node.expression];
+    for (const e of exprs) {
+      const cls = classifySink2(node.kind === "echo" ? "echo " : "print ");
+      const t = evalTaint(e, env, summaries);
+      if (t.tainted && cls) {
+        const san = [...t.sanitizers, ...findSanitizers(JSON.stringify(e))];
+        if (!isSanitized(san, cls.id)) {
+          findings.push({
+            sink: node.kind + " ",
+            sink_line: node.loc?.start?.line ?? 0,
+            category: cls.category,
+            cwe: cls.cwe,
+            variables: [t.source ?? "var"],
+            source: t.source,
+            source_line: t.sourceLine,
+            sanitized: false,
+            sanitizers: san.map((s) => s.id),
+            auth_gated: false,
+            interprocedural: false
+          });
+        } else {
+          suppressed.n += 1;
+        }
       }
     }
-    if (!matched)
-      addEdge(g, callerId, `unknown:${method}`, method, line, file);
     return;
   }
+  for (const c of children(node))
+    walkExpression(c, env, summaries, findings, suppressed, file);
 }
-function reachableFrom(g, entry) {
-  const seen = new Set;
-  const stack = [entry];
-  while (stack.length) {
-    const cur = stack.pop();
-    if (seen.has(cur))
-      continue;
-    seen.add(cur);
-    const n = g.nodes.get(cur);
-    if (!n)
-      continue;
-    for (const c of n.callees)
-      stack.push(c);
-  }
-  return seen;
+function evalTaint(node, env, summaries) {
+  if (!isNode(node))
+    return { tainted: false, sanitizers: [] };
+  const src = sourceOf(node);
+  if (src)
+    return { tainted: true, sanitizers: [], source: src, sourceLine: node.loc?.start?.line };
+  if (node.kind === "variable" || node.kind === "offsetlookup") {
+    const root = rootVarName(node);
+    if (root) {
+      const st = env.get(root);
+      if (st)
+        return { ...st };
+    }
+    if (node.kind === "offsetlookup") {
+      const whatTaint = evalTaint(node.what, env, summaries);
+      if (whatTaint.tainted)
+        return whatTaint;
+    }
+    return { tainted: false, sanitizers: [] };
+  }
+  if (node.kind === "call") {
+    const fnName = rootVarName(node.what);
+    const san = findSanitizers(fnName ? fnName + "(" : "");
+    if (san.length > 0) {
+      const inner = node.arguments.map((a) => evalTaint(a, env, summaries));
+      const tainted = inner.some((t) => t.tainted);
+      return {
+        tainted,
+        sanitizers: tainted ? [...inner.flatMap((t) => t.sanitizers), ...san] : [],
+        source: tainted ? inner.find((t) => t.tainted)?.source : undefined,
+        sourceLine: tainted ? inner.find((t) => t.tainted)?.sourceLine : undefined
+      };
+    }
+    if (fnName && summaries.has(fnName)) {
+      const sum = summaries.get(fnName);
+      const argTaints = node.arguments.map((a) => evalTaint(a, env, summaries));
+      const tainted = argTaints.filter((t) => t.tainted);
+      if (tainted.length > 0) {
+        const helperSan = [...sum.sanitizedParams.values()].flat();
+        return {
+          tainted: true,
+          sanitizers: [...tainted.flatMap((t) => t.sanitizers), ...helperSan],
+          source: tainted[0].source,
+          sourceLine: tainted[0].sourceLine
+        };
+      }
+    }
+    return { tainted: false, sanitizers: [] };
+  }
+  if (node.kind === "bin" || node.kind === "concat" || node.kind === "encapsed") {
+    const parts = children(node);
+    const taints = parts.map((p) => evalTaint(p, env, summaries));
+    const tainted = taints.find((t) => t.tainted);
+    if (tainted)
+      return { ...tainted, sanitizers: taints.flatMap((t) => t.sanitizers) };
+    return { tainted: false, sanitizers: [] };
+  }
+  if (node.kind === "encapsedpart") {
+    return evalTaint(node.expression, env, summaries);
+  }
+  return { tainted: false, sanitizers: [] };
 }
-function entryPoints(g) {
-  const entries = [];
-  for (const [id, n] of g.nodes) {
-    if (n.callers.size === 0)
-      entries.push(id);
+function analyzeTaint(path) {
+  const result = { file: path, findings: [], suppressed: 0 };
+  let code;
+  try {
+    code = readFileSync10(path, "utf8");
+  } catch {
+    return result;
   }
-  return entries;
+  let ast;
+  try {
+    ast = parser.parseCode(code, path);
+  } catch {
+    return result;
+  }
+  const functions = findKind(ast, "function");
+  const summaries = new Map;
+  for (const fn of functions) {
+    const name = typeof fn.name === "string" ? fn.name : fn.name?.name ?? "<anonymous>";
+    const params = (fn.arguments ?? []).map((a) => typeof a === "string" ? a : typeof a.name === "string" ? a.name : a.name?.name ?? "?");
+    const summary = { name, params, sinkParams: new Map, sanitizedParams: new Map };
+    const env = new Map;
+    for (const p of params)
+      env.set(p, { tainted: false, sanitizers: [] });
+    const calls = findKind(fn, "call");
+    for (const call of calls) {
+      const sink = sinkClassOf(call);
+      if (!sink)
+        continue;
+      const line = call.loc?.start?.line ?? 0;
+      const varsInCall = findKind(call, "variable").map((v) => v.name).filter(Boolean);
+      for (const v of varsInCall) {
+        if (params.includes(v))
+          summary.sinkParams.set(v, { sink: sink.token, line });
+      }
+      const san = findSanitizers(JSON.stringify(call));
+      for (const v of varsInCall) {
+        if (params.includes(v) && san.length > 0) {
+          summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
+        }
+      }
+    }
+    for (const ek of ["echo", "print"]) {
+      for (const en of findKind(fn, ek)) {
+        const line = en.loc?.start?.line ?? 0;
+        const vars = findKind(en, "variable").map((v) => v.name).filter(Boolean);
+        const san = findSanitizers(JSON.stringify(en));
+        for (const v of vars) {
+          if (params.includes(v)) {
+            summary.sinkParams.set(v, { sink: ek + " ", line });
+            if (san.length > 0) {
+              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
+            }
+          }
+        }
+      }
+    }
+    const assigns = findKind(fn, "assign");
+    for (const a of assigns) {
+      const san = findSanitizers(JSON.stringify(a.right));
+      if (san.length > 0) {
+        const lv = rootVarName(a.left);
+        if (lv && params.includes(lv)) {
+          summary.sanitizedParams.set(lv, [...summary.sanitizedParams.get(lv) ?? [], ...san]);
+        }
+      }
+    }
+    for (const ek of ["echo", "print"]) {
+      for (const en of findKind(fn, ek)) {
+        const san = findSanitizers(JSON.stringify(en));
+        if (san.length > 0) {
+          for (const v of findKind(en, "variable").map((v2) => v2.name).filter(Boolean)) {
+            if (params.includes(v)) {
+              summary.sanitizedParams.set(v, [...summary.sanitizedParams.get(v) ?? [], ...san]);
+            }
+          }
+        }
+      }
+    }
+    summaries.set(name, summary);
+  }
+  const topStmts = [];
+  const body = ast.children ?? [];
+  for (const s of body) {
+    if (isNode(s) && s.kind !== "function")
+      topStmts.push(s);
+  }
+  const globalEnv = new Map;
+  const suppressRef = { n: 0 };
+  analyzeBlock(topStmts, globalEnv, summaries, result.findings, suppressRef, [], path);
+  result.suppressed = suppressRef.n;
+  return result;
+}
+function taintTree(root, maxFiles = 2000) {
+  const files = iterSourceFiles(root, maxFiles);
+  return files.map((f) => analyzeTaint(f));
 }
 
 // src/eagle2.ts
-var parser3 = new import_php_parser3.Engine({
+var import_php_parser3 = __toESM(require_src(), 1);
+import { readFileSync as readFileSync12 } from "node:fs";
+init_scanner();
+
+// src/callgraph.ts
+var import_php_parser2 = __toESM(require_src(), 1);
+import { readFileSync as readFileSync11 } from "node:fs";
+var parser2 = new import_php_parser2.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
 });
-function isNode3(v) {
+function isNode2(v) {
   return !!v && typeof v === "object" && typeof v.kind === "string";
 }
-function children3(node) {
+function children2(node) {
   const out = [];
   for (const k of Object.keys(node)) {
     if (k === "loc")
@@ -31819,62 +32170,287 @@ function children3(node) {
     const v = node[k];
     if (Array.isArray(v)) {
       for (const c of v)
-        if (isNode3(c))
+        if (isNode2(c))
           out.push(c);
-    } else if (isNode3(v)) {
+    } else if (isNode2(v)) {
       out.push(v);
     }
   }
   return out;
 }
-function findKind2(node, kind, out = []) {
-  if (!isNode3(node))
-    return out;
-  if (node.kind === kind)
-    out.push(node);
-  for (const c of children3(node))
-    findKind2(c, kind, out);
-  return out;
-}
-function nameOf2(node) {
-  if (!isNode3(node))
+function nameOf(node) {
+  if (!isNode2(node))
     return null;
   if (typeof node.name === "string")
     return node.name;
-  if (isNode3(node.name))
-    return nameOf2(node.name);
+  if (isNode2(node.name))
+    return nameOf(node.name);
   return null;
 }
-function rootVarName2(node) {
-  if (!isNode3(node))
-    return null;
-  if (node.kind === "variable")
-    return node.name ?? null;
-  if (node.kind === "name")
-    return typeof node.name === "string" ? node.name : node.name?.name ?? null;
-  if (node.kind === "offsetlookup" || node.kind === "propertylookup")
-    return rootVarName2(node.what);
-  return null;
+function nodeId(kind, name, cls) {
+  if (kind === "function")
+    return `func:${name}`;
+  if (kind === "method")
+    return `method:${cls ?? "?"}::${name}`;
+  return "main";
 }
-function sourceOf2(node) {
-  if (!isNode3(node))
-    return null;
-  if (node.kind === "offsetlookup" && node.what?.kind === "variable") {
-    const n = node.what.name;
-    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
-      return "$" + n;
+function ensureNode(g, id, name, kind, file, line, cls) {
+  let n = g.nodes.get(id);
+  if (!n) {
+    n = { id, name, kind, class: cls, file, line, callees: new Set, callers: new Set };
+    g.nodes.set(id, n);
   }
-  if (node.kind === "variable") {
-    const n = node.name;
-    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
-      return "$" + n;
+  return n;
+}
+function addEdge(g, caller, callee, name, line, file) {
+  g.edges.push({ caller, callee, name, line, file });
+  const c = g.nodes.get(caller);
+  const t = g.nodes.get(callee);
+  if (c)
+    c.callees.add(callee);
+  if (t)
+    t.callers.add(caller);
+}
+function buildCallGraph(path) {
+  const g = { nodes: new Map, edges: [] };
+  let code;
+  try {
+    code = readFileSync11(path, "utf8");
+  } catch {
+    return g;
   }
-  if (node.kind === "call") {
-    const n = rootVarName2(node.what);
-    if (n === "getallheaders")
-      return "getallheaders";
-    if (n === "file_get_contents" && JSON.stringify(node).includes("php://input"))
-      return "php://input";
+  let ast;
+  try {
+    ast = parser2.parseCode(code, path);
+  } catch {
+    return g;
+  }
+  const mainId = nodeId("main", "main");
+  ensureNode(g, mainId, "<main>", "main", path, 0);
+  const funcs = [];
+  const methods = [];
+  walk(ast, path, (n, ctx) => {
+    if (n.kind === "function") {
+      const name = nameOf(n.name);
+      if (name)
+        funcs.push({ name, node: n });
+    } else if (n.kind === "method" && ctx.className) {
+      const mname = nameOf(n.name);
+      if (mname)
+        methods.push({ cls: ctx.className, name: mname, node: n });
+    }
+  });
+  for (const f of funcs) {
+    const id = nodeId("function", f.name);
+    ensureNode(g, id, f.name, "function", path, f.node.loc?.start?.line ?? 0);
+  }
+  for (const m of methods) {
+    const id = nodeId("method", m.name, m.cls);
+    ensureNode(g, id, m.name, "method", path, m.node.loc?.start?.line ?? 0, m.cls);
+  }
+  walk(ast, path, (n, ctx) => {
+    if (n.kind !== "call")
+      return;
+    const line = n.loc?.start?.line ?? 0;
+    const callerId = ctx.enclosing ?? mainId;
+    resolveCall(g, n, callerId, ctx, path, line);
+  });
+  return g;
+}
+function walk(node, file, visit, ctx = {}) {
+  if (!isNode2(node))
+    return;
+  let childCtx = ctx;
+  if (node.kind === "class") {
+    childCtx = { ...ctx, className: nameOf(node.name) ?? undefined };
+  } else if (node.kind === "function") {
+    const name = nameOf(node.name);
+    childCtx = { ...ctx, enclosing: name ? nodeId("function", name) : ctx.enclosing };
+  } else if (node.kind === "method") {
+    const name = nameOf(node.name);
+    childCtx = { ...ctx, enclosing: name ? nodeId("method", name, ctx.className) : ctx.enclosing };
+  }
+  visit(node, ctx);
+  for (const c of children2(node))
+    walk(c, file, visit, childCtx);
+}
+function resolveCall(g, call, callerId, ctx, file, line) {
+  const what = call.what;
+  if (!isNode2(what))
+    return;
+  if (what.kind === "name") {
+    const fn = nameOf(what);
+    if (!fn)
+      return;
+    const id = nodeId("function", fn);
+    if (g.nodes.has(id)) {
+      addEdge(g, callerId, id, fn, line, file);
+    } else {
+      addEdge(g, callerId, `unknown:${fn}`, fn, line, file);
+    }
+    return;
+  }
+  if (what.kind === "staticlookup") {
+    const base = what.what;
+    const baseName = nameOf(base) ?? (isNode2(base) && base.kind === "variable" ? base.name : null);
+    const method = nameOf(what.offset);
+    if (!method)
+      return;
+    let cls = baseName;
+    if (cls === "self" || cls === "static")
+      cls = ctx.className ?? "?";
+    if (cls && cls !== "?") {
+      const id = nodeId("method", method, cls);
+      if (g.nodes.has(id))
+        addEdge(g, callerId, id, method, line, file);
+    }
+    return;
+  }
+  if (what.kind === "propertylookup") {
+    const base = what.what;
+    const method = nameOf(what.offset);
+    if (!method)
+      return;
+    if (isNode2(base) && base.kind === "variable" && base.name === "this") {
+      if (ctx.className) {
+        const id = nodeId("method", method, ctx.className);
+        if (g.nodes.has(id))
+          addEdge(g, callerId, id, method, line, file);
+      }
+      return;
+    }
+    let matched = false;
+    for (const [id, n] of g.nodes) {
+      if (n.kind === "method" && n.name === method) {
+        addEdge(g, callerId, id, method, line, file);
+        matched = true;
+      }
+    }
+    if (!matched)
+      addEdge(g, callerId, `unknown:${method}`, method, line, file);
+    return;
+  }
+}
+function reachableFrom(g, entry) {
+  const seen = new Set;
+  const stack = [entry];
+  while (stack.length) {
+    const cur = stack.pop();
+    if (seen.has(cur))
+      continue;
+    seen.add(cur);
+    const n = g.nodes.get(cur);
+    if (!n)
+      continue;
+    for (const c of n.callees)
+      stack.push(c);
+  }
+  return seen;
+}
+function entryPoints(g) {
+  const entries = [];
+  for (const [id, n] of g.nodes) {
+    if (n.callers.size === 0)
+      entries.push(id);
+  }
+  return entries;
+}
+
+// src/cache.ts
+import { createHash as createHash3 } from "node:crypto";
+var mem = new Map;
+var hits = 0;
+var misses = 0;
+function cacheKey(kind, source) {
+  const h = createHash3("sha256").update(source).digest("hex").slice(0, 20);
+  return `${kind}:${VERSION}:${h}`;
+}
+function getCache(kind, source) {
+  const k = cacheKey(kind, source);
+  if (mem.has(k)) {
+    hits += 1;
+    return mem.get(k);
+  }
+  misses += 1;
+  return;
+}
+function setCache(kind, source, value) {
+  mem.set(cacheKey(kind, source), value);
+  return value;
+}
+
+// src/eagle2.ts
+var parser3 = new import_php_parser3.Engine({
+  parser: { extractDoc: false, php7: true },
+  ast: { withPositions: true, withSource: false }
+});
+function isNode3(v) {
+  return !!v && typeof v === "object" && typeof v.kind === "string";
+}
+function children3(node) {
+  const out = [];
+  for (const k of Object.keys(node)) {
+    if (k === "loc")
+      continue;
+    const v = node[k];
+    if (Array.isArray(v)) {
+      for (const c of v)
+        if (isNode3(c))
+          out.push(c);
+    } else if (isNode3(v)) {
+      out.push(v);
+    }
+  }
+  return out;
+}
+function findKind2(node, kind, out = []) {
+  if (!isNode3(node))
+    return out;
+  if (node.kind === kind)
+    out.push(node);
+  for (const c of children3(node))
+    findKind2(c, kind, out);
+  return out;
+}
+function nameOf2(node) {
+  if (!isNode3(node))
+    return null;
+  if (typeof node.name === "string")
+    return node.name;
+  if (isNode3(node.name))
+    return nameOf2(node.name);
+  return null;
+}
+function rootVarName2(node) {
+  if (!isNode3(node))
+    return null;
+  if (node.kind === "variable")
+    return node.name ?? null;
+  if (node.kind === "name")
+    return typeof node.name === "string" ? node.name : node.name?.name ?? null;
+  if (node.kind === "offsetlookup" || node.kind === "propertylookup")
+    return rootVarName2(node.what);
+  return null;
+}
+function sourceOf2(node) {
+  if (!isNode3(node))
+    return null;
+  if (node.kind === "offsetlookup" && node.what?.kind === "variable") {
+    const n = node.what.name;
+    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
+      return "$" + n;
+  }
+  if (node.kind === "variable") {
+    const n = node.name;
+    if (["_GET", "_POST", "_REQUEST", "_COOKIE", "_FILES", "_SERVER"].includes(n))
+      return "$" + n;
+  }
+  if (node.kind === "call") {
+    const n = rootVarName2(node.what);
+    if (n === "getallheaders")
+      return "getallheaders";
+    if (n === "file_get_contents" && JSON.stringify(node).includes("php://input"))
+      return "php://input";
   }
   return null;
 }
@@ -32230,6 +32806,15 @@ function resolveFuncId(name, summaries) {
   return null;
 }
 function analyzeDataFlow2(path) {
+  let cacheCode = "";
+  try {
+    cacheCode = readFileSync12(path, "utf8");
+  } catch {}
+  if (cacheCode) {
+    const cached = getCache("eagle2", cacheCode);
+    if (cached)
+      return cached;
+  }
   const cg = buildCallGraph(path);
   const entries = entryPoints(cg);
   const reachable = new Set;
@@ -32245,7 +32830,7 @@ function analyzeDataFlow2(path) {
   };
   let code;
   try {
-    code = readFileSync12(path, "utf8");
+    code = cacheCode || readFileSync12(path, "utf8");
   } catch {
     return result;
   }
@@ -32354,6 +32939,8 @@ function analyzeDataFlow2(path) {
         queue.push({ funcId: calleeId, param: calleeParam, source: item.source, sourceLine: item.sourceLine, viaReturn: false });
     }
   }
+  if (cacheCode)
+    setCache("eagle2", cacheCode, result);
   return result;
 }
 
@@ -51543,469 +52130,131 @@ function extractVersion(headers, body) {
     out.push({ product: "joomla", version: joomlaVer[1], evidence: `body: Joomla ${joomlaVer[1]}` });
   const drupalVer = /Drupal\s+([0-9][0-9.]*)/i.exec(body);
   if (drupalVer)
-    out.push({ product: "drupal", version: drupalVer[1], evidence: `body: Drupal ${drupalVer[1]}` });
-  const powered = headers["x-powered-by"] ?? "";
-  if (powered && !out.some((o) => powered.includes(o.product))) {
-    out.push({ product: powered.split("/")[0].toLowerCase(), version: powered.split("/")[1] ?? "unknown", evidence: powered });
-  }
-  return out;
-}
-function correlateIntel(techs, versionList, portList) {
-  const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
-  const versions = versionList.map((v) => ({
-    product: v.product,
-    version: v.version,
-    correlation: techCorrelation(v.product),
-    payload_lookup: payloadLookup(v.product),
-    template_lookup: templateLookup(v.product, 5)
-  }));
-  const ports = portList.map((p) => ({ port: p.port, service: p.service, ...portCorrelation(p.port) }));
-  return { tech, versions, ports };
-}
-async function liveRecon(target, includeActive = false) {
-  const base = normalizeTarget2(target);
-  const host = (() => {
-    try {
-      return new URL(base).hostname;
-    } catch {
-      return target;
-    }
-  })();
-  const root = await httpGet(base);
-  const interestingHeaders = {};
-  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
-    if (root.headers[k])
-      interestingHeaders[k] = root.headers[k];
-  }
-  const fingerprint = {
-    status: root.status,
-    title: (root.body.match(/<title[^>]*>([^<]+)<\/title>/i) ?? [])[1]?.trim().slice(0, 200) ?? "",
-    server: root.headers["server"] ?? root.headers["x-powered-by"] ?? "",
-    headers: interestingHeaders,
-    body_size: root.body.length
-  };
-  const waf = detectWaf(root.headers, root.body);
-  const techSig = [
-    [/wp-content|wp-includes|wp-json/i, "wordpress"],
-    [/wp-login\.php|wp-admin/i, "wordpress"],
-    [/powered by joomla|com_content/i, "joomla"],
-    [/laravel|_token|csrf-token/i, "laravel"],
-    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
-    [/angular|ng-version/i, "angular"],
-    [/vue|__vue__|v-data/i, "vue"],
-    [/django|csrftoken|__debug__/i, "django"],
-    [/ruby on rails|rails/i, "rails"],
-    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
-    [/phpBB|phpbb/i, "phpbb"],
-    [/mybb|mybb/i, "mybb"],
-    [/drupal|Drupal\.settings/i, "drupal"],
-    [/magento|Mage\./i, "magento"],
-    [/shopify|cdn\.shopify/i, "shopify"],
-    [/grafana|kibana|elastic/i, "grafana-kibana"],
-    [/node\.js|express/i, "nodejs"],
-    [/flask|werkzeug/i, "flask"],
-    [/spring|actuator/i, "spring"]
-  ];
-  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
-  const versions = extractVersion(root.headers, root.body);
-  const { links, scripts } = crawlLinks(base, root.body);
-  const { robots, sitemap } = await fetchRobotsAndSitemap(base);
-  const allUrls = [...links, ...scripts, ...robots, ...sitemap];
-  const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
-  const params = extractParams(allUrls);
-  const { subdomains } = await subdomainEnum(host);
-  const { found: dnsFindings } = await dnsBrute(host);
-  const { urls: wayback } = await waybackUrls(host);
-  const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
-  let openPorts = [];
-  if (includeActive && root.status > 0) {
-    const scan = await scanPorts(host);
-    openPorts = scan.map(({ port, service }) => ({ port, service }));
-  }
-  const intel = correlateIntel(techs, versions, openPorts);
-  const nextSteps = [];
-  if (waf.detected)
-    nextSteps.push(`WAF detected (${waf.wafs?.map((w) => w.waf).join(", ")}) — consult detect_waf + WAF bypass playbook before exploitation.`);
-  for (const t of techs) {
-    const c = techCorrelation(t);
-    if (c.found)
-      nextSteps.push(`Tech '${t}' maps to known vuln classes — read tech_correlation('${t}') and fetch nuclei templates with template_lookup('${t}').`);
-  }
-  for (const v of versions) {
-    nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
-  }
-  if (crawl.endpoints.length > 0)
-    nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
-  if (params.length > 0)
-    nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
-  if (subdomains.length > 0)
-    nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
-  if (dnsFindings.length > 0)
-    nextSteps.push(`DNS-resolved ${dnsFindings.length} hosts (${dnsFindings.map((d) => d.host).slice(0, 8).join(", ")}${dnsFindings.length > 8 ? "…" : ""}) — each is a live subdomain to recon.`);
-  if (wayback.length > 0)
-    nextSteps.push(`Wayback Machine surfaced ${wayback.length} historical URLs — mine them for hidden endpoints, old params, and forgotten pages; feed to taint_file/blitz_scan.`);
-  if (openPorts.length > 0)
-    nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
-  if (apiEndpoints.length > 0)
-    nextSteps.push(`API endpoints exposed (${apiEndpoints.map((e) => e.path).join(", ")}) — audit them with api-security playbook; check for BOLA/IDOR/auth gaps.`);
-  if (nextSteps.length === 0)
-    nextSteps.push("Nothing exposed on the surface — try subdomain enumeration, port scan (active), or request source access for EAGLE-EYE analysis.");
-  nextSteps.push("Every confirmed finding: record with finding_create, attach confidence_score, redact secrets. A hit is a hypothesis until verified.");
-  return {
-    target: base,
-    host,
-    fingerprint,
-    waf,
-    tech: { detected: techs, server: fingerprint.server },
-    versions,
-    crawl,
-    params,
-    subdomains,
-    dns_findings: dnsFindings,
-    wayback_urls: wayback,
-    api_endpoints: apiEndpoints,
-    open_ports: openPorts,
-    intel,
-    next_steps: nextSteps
-  };
-}
-
-// src/strike.ts
-var DEFAULT_TIMEOUT_MS = 15000;
-async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const controller = new AbortController;
-  const t = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetch(url, {
-      method,
-      body: method === "POST" ? data : undefined,
-      headers: { "User-Agent": "blitzstrike/1.0", ...headers ?? {} },
-      signal: controller.signal,
-      redirect: "follow"
-    });
-    const body = await res.text();
-    const hdrs = {};
-    res.headers.forEach((v, k) => {
-      hdrs[k] = v;
-    });
-    return { status: res.status, body: body.slice(0, 20000), headers: hdrs };
-  } catch (e) {
-    return { status: 0, body: String(e), headers: {} };
-  } finally {
-    clearTimeout(t);
-  }
-}
-function defaultMarker() {
-  return `BS${Date.now().toString(36).toUpperCase()}${Math.random().toString(36).slice(2, 8).toUpperCase()}`;
-}
-function inject(target, value, param) {
-  const placeholder = "{{MARKER}}";
-  if (target.includes(placeholder))
-    return target.split(placeholder).join(value);
-  if (target.includes("?"))
-    return `${target}&${param}=${encodeURIComponent(value)}`;
-  return `${target}?${param}=${encodeURIComponent(value)}`;
-}
-async function strikeVerify(input) {
-  const method = input.method ?? "GET";
-  const param = input.param ?? "q";
-  const marker = input.marker ?? defaultMarker();
-  const control = input.control ?? defaultMarker();
-  const baseUrl = input.url;
-  const timeoutMs = input.timeout ?? DEFAULT_TIMEOUT_MS;
-  const baselineTarget = inject(baseUrl, "", param).replace(/[?&]q=$/, "").replace(/[?&]$/, "");
-  const markerTarget = inject(baseUrl, marker, param);
-  const controlTarget = inject(baseUrl, control, param);
-  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers, timeoutMs);
-  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers, timeoutMs);
-  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers, timeoutMs);
-  if (baseline.status === 0 || markerResp.status === 0) {
-    return {
-      status: "blocked",
-      marker_reflected: false,
-      control_reflected: false,
-      baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
-      marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
-      control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
-      reason: "request failed or target unreachable — cannot validate",
-      evidence: []
-    };
-  }
-  const markerReflected = markerResp.body.includes(marker);
-  const controlReflected = controlResp.body.includes(control);
-  let status;
-  let reason;
-  if (markerReflected && !controlReflected) {
-    status = "confirmed";
-    reason = "marker reflected; negative control did not — the sink reflects attacker-controlled input (real finding)";
-  } else if (markerReflected && controlReflected) {
-    status = "false_positive";
-    reason = "marker AND negative control both reflected — behaviour is indistinguishable from benign reflection (likely false positive)";
-  } else if (!markerReflected && !controlReflected) {
-    status = "unconfirmed";
-    reason = "marker not reflected — reachability/exploitability could not be demonstrated live";
-  } else {
-    status = "unconfirmed";
-    reason = "negative control reflected but marker did not — inconsistent, requires deeper analysis";
-  }
-  const evidence = [
-    {
-      type: "baseline_comparison",
-      description: `Baseline response (status ${baseline.status}) for ${redactSecrets(baselineTarget)}`,
-      artifacts: [{ name: "baseline", kind: "http_response", content: `${baseline.status}
-${baseline.body}` }]
-    },
-    {
-      type: "validation_result",
-      description: `Marker '${redactSecrets(marker)}' reflected=${markerReflected}; control reflected=${controlReflected}`,
-      artifacts: [{ name: "marker_response", kind: "http_response", content: `${markerResp.status}
-${markerResp.body}` }]
-    },
-    {
-      type: "negative_control",
-      description: `Negative control '${redactSecrets(control)}' reflected=${controlReflected}`,
-      artifacts: [{ name: "control_response", kind: "http_response", content: `${controlResp.status}
-${controlResp.body}` }]
-    }
-  ];
-  return {
-    status,
-    marker_reflected: markerReflected,
-    control_reflected: controlReflected,
-    baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
-    marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
-    control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
-    reason,
-    evidence
-  };
-}
-function resolveFinding(finding, verdict) {
-  let f = finding;
-  if (f.status === "hypothesis") {
-    f = transition(f, "validating");
-  }
-  switch (verdict.status) {
-    case "confirmed":
-      return confirmFinding(f, {
-        evidence: verdict.evidence,
-        negative_control: true,
-        baseline: true
-      });
-    case "false_positive":
-      return rejectFinding(f, "false_positive", verdict.reason, verdict.evidence);
-    case "blocked":
-      return rejectFinding(f, "blocked", verdict.reason, verdict.evidence);
-    case "unconfirmed":
-    case "likely":
-    default: {
-      return {
-        ...f,
-        validation: { performed: true, status: verdict.status === "likely" ? "likely" : "unconfirmed", negative_control: verdict.control_reflected === false, baseline: true },
-        remediation: { ...f.remediation, note: verdict.reason },
-        timestamps: { ...f.timestamps, updated: new Date().toISOString() }
-      };
-    }
-  }
-}
-
-// src/cvss.ts
-var AV_WEIGHT = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
-var AC_WEIGHT = { L: 0.77, H: 0.44 };
-var PR_WEIGHT = {
-  U: { N: 0.85, L: 0.62, H: 0.27 },
-  C: { N: 0.85, L: 0.68, H: 0.5 }
-};
-var UI_WEIGHT = { N: 0.85, R: 0.62 };
-var CIA_WEIGHT = { H: 0.56, L: 0.22, N: 0 };
-function roundup(value) {
-  return Math.ceil(value * 10) / 10;
-}
-function cvssBaseScore(input) {
-  const AV = input.AV ?? "N";
-  const AC = input.AC ?? "L";
-  const PR = input.PR ?? "N";
-  const UI = input.UI ?? "N";
-  const S = input.S ?? "U";
-  const C = input.C ?? "N";
-  const I = input.I ?? "N";
-  const A = input.A ?? "N";
-  const iscBase = 1 - (1 - CIA_WEIGHT[C]) * (1 - CIA_WEIGHT[I]) * (1 - CIA_WEIGHT[A]);
-  let impact;
-  if (S === "U") {
-    impact = 6.42 * iscBase;
-  } else {
-    impact = 7.52 * (iscBase - 0.029) - 3.25 * Math.pow(iscBase - 0.02, 15);
-  }
-  const exploitability = 8.22 * AV_WEIGHT[AV] * AC_WEIGHT[AC] * PR_WEIGHT[S][PR] * UI_WEIGHT[UI];
-  if (impact <= 0)
-    return 0;
-  if (S === "U") {
-    return roundup(Math.min(impact + exploitability, 10));
-  }
-  return roundup(Math.min(1.08 * (impact + exploitability), 10));
-}
-function cvssVector(input) {
-  const order = [
-    ["AV", input.AV ?? "N"],
-    ["AC", input.AC ?? "L"],
-    ["PR", input.PR ?? "N"],
-    ["UI", input.UI ?? "N"],
-    ["S", input.S ?? "U"],
-    ["C", input.C ?? "N"],
-    ["I", input.I ?? "N"],
-    ["A", input.A ?? "N"]
-  ];
-  return "CVSS:3.1/" + order.map(([k, v]) => `${k}:${v}`).join("/");
-}
-function cvssSeverity(score) {
-  if (score === 0)
-    return "none";
-  if (score < 4)
-    return "low";
-  if (score < 7)
-    return "medium";
-  if (score < 9)
-    return "high";
-  return "critical";
-}
-function cvssAssess(input) {
-  const score = cvssBaseScore(input);
-  return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
-}
-
-// src/dedup.ts
-function rootCauseSignature(finding) {
-  const sinkType = (finding.sink?.type ?? "unknown").toLowerCase();
-  const sourceType = (finding.source?.type ?? "unknown").toLowerCase();
-  const cwe = (finding.classification?.cwe ?? "").toUpperCase();
-  return [sinkType, sourceType, cwe].filter(Boolean).join("|");
-}
-function dedupFindings(findings) {
-  const groups = new Map;
-  for (const f of findings) {
-    const sig = rootCauseSignature(f);
-    const existing = groups.get(sig);
-    if (existing) {
-      existing.count += 1;
-      existing.findings.push(f);
-    } else {
-      groups.set(sig, { signature: sig, count: 1, representative: f, findings: [f] });
-    }
+    out.push({ product: "drupal", version: drupalVer[1], evidence: `body: Drupal ${drupalVer[1]}` });
+  const powered = headers["x-powered-by"] ?? "";
+  if (powered && !out.some((o) => powered.includes(o.product))) {
+    out.push({ product: powered.split("/")[0].toLowerCase(), version: powered.split("/")[1] ?? "unknown", evidence: powered });
   }
-  return [...groups.values()];
+  return out;
 }
-function uniqueFindings(findings) {
-  return dedupFindings(findings).map((g) => g.representative);
+function correlateIntel(techs, versionList, portList) {
+  const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
+  const versions = versionList.map((v) => ({
+    product: v.product,
+    version: v.version,
+    correlation: techCorrelation(v.product),
+    payload_lookup: payloadLookup(v.product),
+    template_lookup: templateLookup(v.product, 5)
+  }));
+  const ports = portList.map((p) => ({ port: p.port, service: p.service, ...portCorrelation(p.port) }));
+  return { tech, versions, ports };
 }
-
-// src/report.ts
-function summarize(findings) {
-  const byStatus = {};
-  const bySeverity = {};
-  let evidenceArtifacts = 0;
-  for (const f of findings) {
-    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
-    const sev = f.classification?.severity ?? "informational";
-    bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
-    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+async function liveRecon(target, includeActive = false) {
+  const base = normalizeTarget2(target);
+  const host = (() => {
+    try {
+      return new URL(base).hostname;
+    } catch {
+      return target;
+    }
+  })();
+  const root = await httpGet(base);
+  const interestingHeaders = {};
+  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
+    if (root.headers[k])
+      interestingHeaders[k] = root.headers[k];
   }
-  const groups = dedupFindings(findings);
-  return {
-    total_findings: findings.length,
-    unique_root_causes: groups.length,
-    by_status: byStatus,
-    by_severity: bySeverity,
-    confirmed: byStatus["confirmed"] ?? 0,
-    false_positives: byStatus["false_positive"] ?? 0,
-    evidence_artifacts: evidenceArtifacts
+  const fingerprint = {
+    status: root.status,
+    title: (root.body.match(/<title[^>]*>([^<]+)<\/title>/i) ?? [])[1]?.trim().slice(0, 200) ?? "",
+    server: root.headers["server"] ?? root.headers["x-powered-by"] ?? "",
+    headers: interestingHeaders,
+    body_size: root.body.length
   };
-}
-function severityLabel(sev) {
-  const s = sev.toUpperCase();
-  if (s === "CRITICAL")
-    return "\uD83D\uDD34 CRITICAL";
-  if (s === "HIGH")
-    return "\uD83D\uDFE0 HIGH";
-  if (s === "MEDIUM")
-    return "\uD83D\uDFE1 MEDIUM";
-  if (s === "LOW")
-    return "\uD83D\uDD35 LOW";
-  return "⚪ INFORMATIONAL";
-}
-function reportMarkdown(findings, opts = {}) {
-  const summary = summarize(findings);
-  const lines = [];
-  lines.push(`# ${opts.title ?? "Blitz Strike — Security Assessment Report"}`);
-  lines.push("");
-  lines.push(`- Scope: ${opts.scope ?? "(unset)"}`);
-  lines.push(`- Blitz Strike version: ${opts.version ?? "unknown"}`);
-  if (opts.include_timestamp)
-    lines.push(`- Generated: ${new Date().toISOString()}`);
-  lines.push("");
-  lines.push("## Summary");
-  lines.push("");
-  lines.push(`| Metric | Value |`);
-  lines.push(`|--------|-------|`);
-  lines.push(`| Total findings | ${summary.total_findings} |`);
-  lines.push(`| Unique root causes | ${summary.unique_root_causes} |`);
-  lines.push(`| Confirmed | ${summary.confirmed} |`);
-  lines.push(`| False positives | ${summary.false_positives} |`);
-  lines.push(`| Evidence artifacts | ${summary.evidence_artifacts} |`);
-  lines.push("");
-  lines.push("### By status");
-  lines.push("");
-  for (const [status, n] of Object.entries(summary.by_status).sort()) {
-    lines.push(`- ${status}: ${n}`);
-  }
-  lines.push("");
-  lines.push("### By severity");
-  lines.push("");
-  for (const [sev, n] of Object.entries(summary.by_severity).sort()) {
-    lines.push(`- ${sev}: ${n}`);
+  const waf = detectWaf(root.headers, root.body);
+  const techSig = [
+    [/wp-content|wp-includes|wp-json/i, "wordpress"],
+    [/wp-login\.php|wp-admin/i, "wordpress"],
+    [/powered by joomla|com_content/i, "joomla"],
+    [/laravel|_token|csrf-token/i, "laravel"],
+    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
+    [/angular|ng-version/i, "angular"],
+    [/vue|__vue__|v-data/i, "vue"],
+    [/django|csrftoken|__debug__/i, "django"],
+    [/ruby on rails|rails/i, "rails"],
+    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
+    [/phpBB|phpbb/i, "phpbb"],
+    [/mybb|mybb/i, "mybb"],
+    [/drupal|Drupal\.settings/i, "drupal"],
+    [/magento|Mage\./i, "magento"],
+    [/shopify|cdn\.shopify/i, "shopify"],
+    [/grafana|kibana|elastic/i, "grafana-kibana"],
+    [/node\.js|express/i, "nodejs"],
+    [/flask|werkzeug/i, "flask"],
+    [/spring|actuator/i, "spring"]
+  ];
+  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
+  const versions = extractVersion(root.headers, root.body);
+  const { links, scripts } = crawlLinks(base, root.body);
+  const { robots, sitemap } = await fetchRobotsAndSitemap(base);
+  const allUrls = [...links, ...scripts, ...robots, ...sitemap];
+  const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
+  const params = extractParams(allUrls);
+  const { subdomains } = await subdomainEnum(host);
+  const { found: dnsFindings } = await dnsBrute(host);
+  const { urls: wayback } = await waybackUrls(host);
+  const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
+  let openPorts = [];
+  if (includeActive && root.status > 0) {
+    const scan = await scanPorts(host);
+    openPorts = scan.map(({ port, service }) => ({ port, service }));
   }
-  lines.push("");
-  lines.push("## Findings");
-  lines.push("");
-  if (findings.length === 0) {
-    lines.push("_No findings._");
-    return lines.join(`
-`) + `
-`;
+  const intel = correlateIntel(techs, versions, openPorts);
+  const nextSteps = [];
+  if (waf.detected)
+    nextSteps.push(`WAF detected (${waf.wafs?.map((w) => w.waf).join(", ")}) — consult detect_waf + WAF bypass playbook before exploitation.`);
+  for (const t of techs) {
+    const c = techCorrelation(t);
+    if (c.found)
+      nextSteps.push(`Tech '${t}' maps to known vuln classes — read tech_correlation('${t}') and fetch nuclei templates with template_lookup('${t}').`);
   }
-  for (const f of findings) {
-    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
-    lines.push("");
-    lines.push(`- **Status**: \`${f.status}\``);
-    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
-    if (f.classification?.cwe)
-      lines.push(`- **CWE**: ${f.classification.cwe}`);
-    if (f.classification?.cvss_score != null)
-      lines.push(`- **CVSS**: ${f.classification.cvss_score} (${f.classification.cvss_vector ?? ""}) — ${cvssSeverity(f.classification.cvss_score)}`);
-    lines.push(`- **Source**: ${f.source?.type} \`${f.source?.name ?? ""}\``);
-    lines.push(`- **Sink**: ${f.sink?.type}${f.sink?.symbol ? ` \`${f.sink.symbol}\`` : ""}`);
-    if (f.target?.host || f.target?.endpoint)
-      lines.push(`- **Target**: ${[f.target.host, f.target.endpoint].filter(Boolean).join("")}`);
-    lines.push(`- **Evidence**: ${f.evidence?.length ?? 0} record(s)`);
-    if (f.remediation && Object.keys(f.remediation).length) {
-      lines.push(`- **Note**: ${JSON.stringify(f.remediation)}`);
-    }
-    lines.push("");
+  for (const v of versions) {
+    nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
   }
-  return lines.join(`
-`) + `
-`;
-}
-function reportJson(findings, opts = {}) {
-  const summary = summarize(findings);
-  const payload = {
-    title: opts.title ?? "Blitz Strike — Security Assessment Report",
-    scope: opts.scope ?? null,
-    version: opts.version ?? null,
-    summary,
-    findings,
-    integrity: sha256(JSON.stringify({ summary, findings }))
+  if (crawl.endpoints.length > 0)
+    nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
+  if (params.length > 0)
+    nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
+  if (subdomains.length > 0)
+    nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
+  if (dnsFindings.length > 0)
+    nextSteps.push(`DNS-resolved ${dnsFindings.length} hosts (${dnsFindings.map((d) => d.host).slice(0, 8).join(", ")}${dnsFindings.length > 8 ? "…" : ""}) — each is a live subdomain to recon.`);
+  if (wayback.length > 0)
+    nextSteps.push(`Wayback Machine surfaced ${wayback.length} historical URLs — mine them for hidden endpoints, old params, and forgotten pages; feed to taint_file/blitz_scan.`);
+  if (openPorts.length > 0)
+    nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
+  if (apiEndpoints.length > 0)
+    nextSteps.push(`API endpoints exposed (${apiEndpoints.map((e) => e.path).join(", ")}) — audit them with api-security playbook; check for BOLA/IDOR/auth gaps.`);
+  if (nextSteps.length === 0)
+    nextSteps.push("Nothing exposed on the surface — try subdomain enumeration, port scan (active), or request source access for EAGLE-EYE analysis.");
+  nextSteps.push("Every confirmed finding: record with finding_create, attach confidence_score, redact secrets. A hit is a hypothesis until verified.");
+  return {
+    target: base,
+    host,
+    fingerprint,
+    waf,
+    tech: { detected: techs, server: fingerprint.server },
+    versions,
+    crawl,
+    params,
+    subdomains,
+    dns_findings: dnsFindings,
+    wayback_urls: wayback,
+    api_endpoints: apiEndpoints,
+    open_ports: openPorts,
+    intel,
+    next_steps: nextSteps
   };
-  return JSON.stringify(payload, null, 2);
 }
 
 // src/benchmark.ts
@@ -52248,7 +52497,7 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates).\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: full one-call audit (scope gate -> triage -> chain enrichment " + "  -> findings with tool manuals attached).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 85 playbooks (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates).\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 85 playbooks (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",
@@ -52437,7 +52686,7 @@ function createServer() {
   });
   server.registerTool("run_engagement", {
     title: "STRIKE full engagement",
-    description: "STRIKE: run a full 3-tier audit server-side (scope gate -> triage -> chain enrichment -> findings). One call.",
+    description: "STRIKE: run a full audit in ONE call (no babysitting). Source path -> scope gate -> triage -> chain enrichment -> findings -> inline report (markdown+JSON+SARIF). URL target -> autonomous live marker sweep (strike_verify per parameter) -> confirmed findings -> inline report. Scope-gated: URL targets require an authorized scope.",
     inputSchema: {
       target: string2().describe("Source path or URL"),
       scope: string2().optional().describe("Scope (for URL targets)"),
@@ -52446,7 +52695,8 @@ function createServer() {
       remember: boolean2().optional().describe("Auto-capture matched chains to memory (default true)")
     }
   }, async ({ target, scope, mode, max_files, remember }) => {
-    const r = runEngagement(target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
+    const isUrl = /^https?:\/\//i.test(target);
+    const r = isUrl ? await runLiveEngagement(target, scope ?? "", mode ?? "bug-bounty") : runEngagement(target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
     return {
       content: [{ type: "text", text: JSON.stringify(r) }]
     };
@@ -53164,12 +53414,89 @@ async function serve() {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync18, existsSync as existsSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "node:fs";
-import { join as join13, dirname as dirname2 } from "node:path";
+import { readFileSync as readFileSync20, existsSync as existsSync8, writeFileSync as writeFileSync5, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join15, dirname as dirname2 } from "node:path";
 import { homedir as homedir5 } from "node:os";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
 import { spawnSync as spawnSync3 } from "node:child_process";
+
+// src/release.ts
+import { readFileSync as readFileSync18, existsSync as existsSync7 } from "node:fs";
+import { join as join13 } from "node:path";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
+import { execSync as execSync2 } from "node:child_process";
 var ROOT7 = join13(fileURLToPath9(new URL(".", import.meta.url)), "..");
+function validateRelease() {
+  const checks = [];
+  checks.push({ name: "package.json version", ok: true, detail: VERSION });
+  try {
+    const changelog = readFileSync18(join13(ROOT7, "CHANGELOG.md"), "utf8");
+    const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
+    const changelogVersion = m?.[1] ?? null;
+    checks.push({
+      name: "CHANGELOG version",
+      ok: changelogVersion === VERSION,
+      detail: changelogVersion ?? "no version header found"
+    });
+  } catch {
+    checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
+  }
+  try {
+    const tag = execSync2("git describe --tags --abbrev=0", { cwd: ROOT7, encoding: "utf8" }).trim();
+    checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
+  } catch {
+    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git)", soft: true });
+  }
+  try {
+    const published = execSync2("npm view blitzstrike version", { encoding: "utf8", timeout: 8000 }).trim();
+    checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
+  } catch {
+    checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
+  }
+  checks.push({
+    name: "Lockfile",
+    ok: lockfilePresent(),
+    detail: lockfilePresent() ? "present (bun.lock / package-lock.json)" : "missing",
+    soft: true
+  });
+  return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
+}
+function lockfilePresent() {
+  return existsSync7(join13(ROOT7, "package-lock.json")) || existsSync7(join13(ROOT7, "bun.lock")) || existsSync7(join13(ROOT7, "bun.lockb"));
+}
+
+// src/dependency.ts
+import { readFileSync as readFileSync19 } from "node:fs";
+import { join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
+var ROOT8 = join14(fileURLToPath10(new URL(".", import.meta.url)), "..");
+function checkDependencies() {
+  let pkg = {};
+  try {
+    pkg = JSON.parse(readFileSync19(join14(ROOT8, "package.json"), "utf8"));
+  } catch {
+    return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
+  }
+  const installScriptNames = ["preinstall", "install", "postinstall", "prepare"];
+  const installScripts = installScriptNames.filter((n) => pkg.scripts?.[n]).map((n) => ({ name: n, command: pkg.scripts[n] }));
+  const allDeps = {
+    ...pkg.dependencies ?? {},
+    ...pkg.devDependencies ?? {},
+    ...pkg.peerDependencies ?? {},
+    ...pkg.optionalDependencies ?? {}
+  };
+  const gitDependencies = Object.entries(allDeps).filter(([, v]) => /^(git\+|git:|github:|gitlab:|bitbucket:|\w+:\/\/)/.test(v)).map(([name, v]) => `${name}@${v}`);
+  const total = Object.keys(allDeps).length;
+  return {
+    install_scripts: installScripts,
+    git_dependencies: gitDependencies,
+    total_dependencies: total,
+    safe: installScripts.length === 0 && gitDependencies.length === 0
+  };
+}
+
+// src/cli.ts
+var ROOT9 = join15(fileURLToPath11(new URL(".", import.meta.url)), "..");
 function which(cmd) {
   return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
 }
@@ -53204,13 +53531,27 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
-  const dataOk = existsSync7(join13(ROOT7, "chains.json")) && existsSync7(join13(ROOT7, "tools-catalog.json"));
+  const dataOk = existsSync8(join15(ROOT9, "chains.json")) && existsSync8(join15(ROOT9, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
     detail: dataOk ? "present" : "chains.json or tools-catalog.json missing",
     fix: dataOk ? undefined : "re-install blitzstrike"
   });
+  const release = validateRelease();
+  issues.push({
+    name: "Release metadata",
+    status: release.consistent ? "ok" : "fail",
+    detail: release.consistent ? `v${release.version} consistent` : release.checks.filter((c) => !c.ok && !c.soft).map((c) => c.name).join(", ") || "drift",
+    fix: release.consistent ? undefined : "align package.json version with the latest CHANGELOG entry"
+  });
+  const deps = checkDependencies();
+  issues.push({
+    name: "Dependency surface",
+    status: deps.safe ? "ok" : "warn",
+    detail: deps.safe ? `${deps.total_dependencies} deps, no install scripts` : `${deps.install_scripts.length} install script(s) + ${deps.git_dependencies.length} git dep(s)`,
+    fix: deps.safe ? undefined : "remove install-time scripts and git dependencies"
+  });
   const symbol = { ok: "OK  ", warn: "WARN", fail: "FAIL" };
   for (const i of issues) {
     console.log(`${symbol[i.status]}  ${i.name}  ${i.detail}`);
@@ -53232,21 +53573,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join13(ROOT7, "src", "index.ts");
-  if (which("bun") && existsSync7(src))
+  const src = join15(ROOT9, "src", "index.ts");
+  if (which("bun") && existsSync8(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join13(ROOT7, "dist", "index.js");
-  if (existsSync7(dist))
+  const dist = join15(ROOT9, "dist", "index.js");
+  if (existsSync8(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync18(p, "utf8"));
+    return JSON.parse(readFileSync20(p, "utf8"));
   } catch {
     return null;
   }
@@ -53254,7 +53595,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync7(dir))
+    if (!existsSync8(dir))
       mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -53267,7 +53608,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (_command, _args) => {
     const dir = dirname2(p);
-    if (!existsSync7(dir))
+    if (!existsSync8(dir))
       mkdirSync4(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -53279,26 +53620,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join13(ROOT7, "opencode-agents");
-  const dstDir = join13(homedir5(), ".config", "opencode", "agents");
-  if (!existsSync7(srcDir))
+  const srcDir = join15(ROOT9, "opencode-agents");
+  const dstDir = join15(homedir5(), ".config", "opencode", "agents");
+  if (!existsSync8(srcDir))
     return;
-  if (!existsSync7(dstDir))
+  if (!existsSync8(dstDir))
     mkdirSync4(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join13(srcDir, f);
-    const dst = join13(dstDir, f);
-    if (existsSync7(src)) {
-      writeFileSync5(dst, readFileSync18(src, "utf8"));
+    const src = join15(srcDir, f);
+    const dst = join15(dstDir, f);
+    if (existsSync8(src)) {
+      writeFileSync5(dst, readFileSync20(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync7(dir))
+    if (!existsSync8(dir))
       mkdirSync4(dir, { recursive: true });
-    let existing = existsSync7(p) ? readFileSync18(p, "utf8") : "";
+    let existing = existsSync8(p) ? readFileSync20(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -53315,9 +53656,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
-    if (!existsSync7(dir))
+    if (!existsSync8(dir))
       mkdirSync4(dir, { recursive: true });
-    let existing = existsSync7(p) ? readFileSync18(p, "utf8") : "";
+    let existing = existsSync8(p) ? readFileSync20(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -53344,74 +53685,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir5();
   const agents = [];
-  const claudeJson = join13(home, ".claude.json");
+  const claudeJson = join15(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync7(claudeJson) || which("claude"),
+    installed: () => existsSync8(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join13(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join15(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync7(claudeDesktop),
+    installed: () => existsSync8(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join13(home, ".cursor", "mcp.json");
+  const cursor = join15(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync7(join13(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync8(join15(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join13(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join15(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync7(join13(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync8(join15(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join13(home, ".codex", "config.toml");
+  const codex = join15(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync7(join13(home, ".codex")) || which("codex"),
+    installed: () => existsSync8(join15(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join13(home, ".hermes", "config.yaml");
+  const hermes = join15(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync7(join13(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync8(join15(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join13(home, ".gemini", "settings.json");
+  const gemini = join15(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync7(join13(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync8(join15(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join13(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join15(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync7(join13(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync8(join15(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join13(home, ".copilot", "mcp.json");
+  const copilot = join15(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync7(join13(home, ".copilot")),
+    installed: () => existsSync8(join15(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join13(home, ".cline", "mcp_settings.json");
+  const cline = join15(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync7(join13(home, ".cline")),
+    installed: () => existsSync8(join15(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -53455,15 +53796,15 @@ Registered with ${ok}/${installed.length} agent(s).`);
 }
 
 // src/index.ts
-import { readFileSync as readFileSync19, existsSync as existsSync8 } from "node:fs";
-import { join as join14 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
-var ROOT8 = join14(fileURLToPath10(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync21, existsSync as existsSync9 } from "node:fs";
+import { join as join16 } from "node:path";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
+var ROOT10 = join16(fileURLToPath12(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join14(ROOT8, "package.json");
-    if (existsSync8(p))
-      return JSON.parse(readFileSync19(p, "utf8")).version ?? "1.0.0";
+    const p = join16(ROOT10, "package.json");
+    if (existsSync9(p))
+      return JSON.parse(readFileSync21(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }