blitzstrike 1.0.43 → 1.0.44

package/dist/index.js

@@ -30319,654 +30319,1115 @@ function computeGuidance(state, scopeAllowed) {
   };
 }
 
-// src/orchestrator.ts
-var _chainsCache = null;
-function loadChains() {
-  if (_chainsCache)
-    return _chainsCache;
-  try {
-    const dir = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
-    const path = join6(dir, "chains.json");
-    const raw = JSON.parse(readFileSync6(path, "utf8"));
-    _chainsCache = raw.chains ?? [];
-    return _chainsCache;
-  } catch {
-    _chainsCache = [];
-    return [];
-  }
+// src/cvss.ts
+var AV_WEIGHT = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
+var AC_WEIGHT = { L: 0.77, H: 0.44 };
+var PR_WEIGHT = {
+  U: { N: 0.85, L: 0.62, H: 0.27 },
+  C: { N: 0.85, L: 0.68, H: 0.5 }
+};
+var UI_WEIGHT = { N: 0.85, R: 0.62 };
+var CIA_WEIGHT = { H: 0.56, L: 0.22, N: 0 };
+function roundup(value) {
+  return Math.ceil(value * 10) / 10;
 }
-function scopeCheck(target, scope = "", mode = "bug-bounty") {
-  let result;
-  if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
-    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
-  } else if (!scope.trim()) {
-    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
+function cvssBaseScore(input) {
+  const AV = input.AV ?? "N";
+  const AC = input.AC ?? "L";
+  const PR = input.PR ?? "N";
+  const UI = input.UI ?? "N";
+  const S = input.S ?? "U";
+  const C = input.C ?? "N";
+  const I = input.I ?? "N";
+  const A = input.A ?? "N";
+  const iscBase = 1 - (1 - CIA_WEIGHT[C]) * (1 - CIA_WEIGHT[I]) * (1 - CIA_WEIGHT[A]);
+  let impact;
+  if (S === "U") {
+    impact = 6.42 * iscBase;
   } else {
-    const inScope = [];
-    const outScope = [];
-    for (const raw of scope.split(/[,\n]/)) {
-      const line = raw.trim();
-      if (!line)
-        continue;
-      if (line.startsWith("-"))
-        outScope.push(line.slice(1).trim());
-      else
-        inScope.push(line);
-    }
-    let host = target;
-    host = host.replace(/^https?:\/\//, "");
-    host = host.split("/")[0].split(":")[0];
-    let decided = false;
-    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
-    for (const exc of outScope) {
-      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
-        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
-        decided = true;
-        break;
-      }
-    }
-    if (!decided) {
-      for (const allowed of inScope) {
-        const a = allowed.replace(/\*/g, "");
-        if (!a)
-          continue;
-        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
-          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
-          decided = true;
-          break;
-        }
-      }
-    }
+    impact = 7.52 * (iscBase - 0.029) - 3.25 * Math.pow(iscBase - 0.02, 15);
   }
-  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
-  return result;
+  const exploitability = 8.22 * AV_WEIGHT[AV] * AC_WEIGHT[AC] * PR_WEIGHT[S][PR] * UI_WEIGHT[UI];
+  if (impact <= 0)
+    return 0;
+  if (S === "U") {
+    return roundup(Math.min(impact + exploitability, 10));
+  }
+  return roundup(Math.min(1.08 * (impact + exploitability), 10));
 }
-function classifySink(sink) {
-  if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
-    return "upload_weak_validation";
-  if (/unserialize/.test(sink))
-    return "unserialize_user_input";
-  if (/(exec\(|system\(|shell_exec|passthru|popen|proc_open)/.test(sink))
-    return "command_injection";
-  if (/(include|require)/.test(sink))
-    return "lfi_unvalidated_include";
-  if (/extract\(/.test(sink))
-    return "extract_without_exstr_skip";
-  if (/(\$wpdb|->query)/.test(sink))
-    return "sql_injection";
-  if (/(wp_remote_get|wp_remote_post|file_get_contents)/.test(sink))
-    return "ssrf_unvalidated_url";
-  if (/(eval\(|assert\(|create_function)/.test(sink))
-    return "unsafe_template_render";
-  return "";
+function cvssVector(input) {
+  const order = [
+    ["AV", input.AV ?? "N"],
+    ["AC", input.AC ?? "L"],
+    ["PR", input.PR ?? "N"],
+    ["UI", input.UI ?? "N"],
+    ["S", input.S ?? "U"],
+    ["C", input.C ?? "N"],
+    ["I", input.I ?? "N"],
+    ["A", input.A ?? "N"]
+  ];
+  return "CVSS:3.1/" + order.map(([k, v]) => `${k}:${v}`).join("/");
 }
-function enrichScan(path, maxFiles = 2000) {
-  const expanded = path.replace(/^~/, process.env.HOME ?? "~");
-  const files = iterSourceFiles(expanded, maxFiles);
-  const hits = [];
-  const sinkKinds = new Set;
-  for (const p of files) {
-    const r = scanFile(p);
-    for (const e of r.endpoints) {
-      hits.push({ type: "endpoint", file: r.file, line: e.line, detail: e.hook });
-    }
-    for (const s of r.sinks) {
-      hits.push({ type: "sink", file: r.file, line: s.line, detail: `${s.sink} -> ${s.class}` });
-      const kind = classifySink(s.sink);
-      if (kind)
-        sinkKinds.add(kind);
+function cvssSeverity(score) {
+  if (score === 0)
+    return "none";
+  if (score < 4)
+    return "low";
+  if (score < 7)
+    return "medium";
+  if (score < 9)
+    return "high";
+  return "critical";
+}
+function cvssAssess(input) {
+  const score = cvssBaseScore(input);
+  return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
+}
+
+// src/dedup.ts
+function rootCauseSignature(finding) {
+  const sinkType = (finding.sink?.type ?? "unknown").toLowerCase();
+  const sourceType = (finding.source?.type ?? "unknown").toLowerCase();
+  const cwe = (finding.classification?.cwe ?? "").toUpperCase();
+  return [sinkType, sourceType, cwe].filter(Boolean).join("|");
+}
+function dedupFindings(findings) {
+  const groups = new Map;
+  for (const f of findings) {
+    const sig = rootCauseSignature(f);
+    const existing = groups.get(sig);
+    if (existing) {
+      existing.count += 1;
+      existing.findings.push(f);
+    } else {
+      groups.set(sig, { signature: sig, count: 1, representative: f, findings: [f] });
     }
   }
-  const chains = loadChains();
-  const matched = [];
-  for (const c of chains) {
-    if ((c.required_findings ?? []).some((rf) => sinkKinds.has(rf))) {
-      matched.push({ chain_id: c.id, name: c.name, severity: c.severity, steps: c.steps.length });
-    }
+  return [...groups.values()];
+}
+function uniqueFindings(findings) {
+  return dedupFindings(findings).map((g) => g.representative);
+}
+
+// src/report.ts
+function summarize(findings) {
+  const byStatus = {};
+  const bySeverity = {};
+  let evidenceArtifacts = 0;
+  for (const f of findings) {
+    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
+    const sev = f.classification?.severity ?? "informational";
+    bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
+    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
   }
+  const groups = dedupFindings(findings);
   return {
-    root: expanded,
-    files_scanned: files.length,
-    hits: hits.slice(0, 2000),
-    sink_signals: [...sinkKinds].sort(),
-    matched_chains: matched
+    total_findings: findings.length,
+    unique_root_causes: groups.length,
+    by_status: byStatus,
+    by_severity: bySeverity,
+    confirmed: byStatus["confirmed"] ?? 0,
+    false_positives: byStatus["false_positive"] ?? 0,
+    evidence_artifacts: evidenceArtifacts
   };
 }
-function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000, remember = true) {
-  const report = {
-    target,
-    mode,
-    tiers: {},
-    findings: [],
-    scope: null,
-    memory: { captured: 0 }
-  };
-  const isPath = (() => {
-    try {
-      return existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
-    } catch {
-      return false;
-    }
-  })();
-  if (isPath) {
-    report.scope = { target, allowed: true, enforcement: "source-audit", reason: "local source path — no network scope gate" };
-  } else {
-    const sc = scopeCheck(target, scope, mode);
-    report.scope = sc;
-    if (!sc.allowed) {
-      report.status = "BLOCKED";
-      report.reason = sc.reason;
-      return report;
-    }
-  }
-  const blitz = enrichScan(target, maxFiles);
-  report.tiers = {
-    blitz: {
-      files_scanned: blitz.files_scanned,
-      hits: blitz.hits.length,
-      sink_signals: blitz.sink_signals,
-      matched_chains: blitz.matched_chains
-    }
-  };
-  const chains = loadChains();
-  const chainById = new Map(chains.map((c) => [c.id, c]));
-  const eagle = [];
-  for (const mc of blitz.matched_chains.slice(0, 10)) {
-    const chain = chainById.get(mc.chain_id);
-    if (!chain)
-      continue;
-    eagle.push({
-      chain_id: chain.id,
-      name: chain.name,
-      severity: chain.severity,
-      prerequisites: chain.required_findings,
-      recommended_tools: chain.tools ?? [],
-      tool_manuals: (chain.tools ?? []).map((t) => {
-        const m = findManual(t);
-        return m.found ? { tool: t, manual_name: m.name, preview: m.content.slice(0, 600) } : { tool: t, manual_name: null, preview: null };
-      }),
-      steps: chain.steps.map((s) => ({
-        order: s.order,
-        action: s.action,
-        tool_hint: s.tool_hint,
-        success_criteria: s.success_criteria,
-        invariant_check: s.invariant_check,
-        negative_control: s.negative_control
-      }))
-    });
+function severityLabel(sev) {
+  const s = sev.toUpperCase();
+  if (s === "CRITICAL")
+    return "\uD83D\uDD34 CRITICAL";
+  if (s === "HIGH")
+    return "\uD83D\uDFE0 HIGH";
+  if (s === "MEDIUM")
+    return "\uD83D\uDFE1 MEDIUM";
+  if (s === "LOW")
+    return "\uD83D\uDD35 LOW";
+  return "⚪ INFORMATIONAL";
+}
+function reportMarkdown(findings, opts = {}) {
+  const summary = summarize(findings);
+  const lines = [];
+  lines.push(`# ${opts.title ?? "Blitz Strike — Security Assessment Report"}`);
+  lines.push("");
+  lines.push(`- Scope: ${opts.scope ?? "(unset)"}`);
+  lines.push(`- Blitz Strike version: ${opts.version ?? "unknown"}`);
+  if (opts.include_timestamp)
+    lines.push(`- Generated: ${new Date().toISOString()}`);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`| Metric | Value |`);
+  lines.push(`|--------|-------|`);
+  lines.push(`| Total findings | ${summary.total_findings} |`);
+  lines.push(`| Unique root causes | ${summary.unique_root_causes} |`);
+  lines.push(`| Confirmed | ${summary.confirmed} |`);
+  lines.push(`| False positives | ${summary.false_positives} |`);
+  lines.push(`| Evidence artifacts | ${summary.evidence_artifacts} |`);
+  lines.push("");
+  lines.push("### By status");
+  lines.push("");
+  for (const [status, n] of Object.entries(summary.by_status).sort()) {
+    lines.push(`- ${status}: ${n}`);
   }
-  report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
-  const rank = { critical: 0, high: 1, medium: 2, low: 3 };
-  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
-  const findings = matchedSorted.map((f) => {
-    const chain = chainById.get(f.chain_id);
-    const severity = f.severity ?? "medium";
-    const finding = makeFinding({
-      title: f.name,
-      target: { type: "source", path: target },
-      severity,
-      source: { type: "static_sink_signal", name: f.chain_id },
-      sink: { type: f.chain_id, symbol: f.name },
-      chainId: f.chain_id,
-      chainName: f.name,
-      status: "hypothesis"
-    });
-    const ev = makeEvidence({
-      type: "sink_location",
-      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
-      sink: { chain_id: f.chain_id, name: f.name, severity },
-      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
-    });
-    finding.evidence.push(ev);
-    return finding;
-  });
-  report.findings = findings.map((f) => ({
-    id: f.id,
-    status: f.status,
-    title: f.title,
-    severity: f.classification.severity,
-    confidence: f.confidence,
-    confidence_level: f.confidence_level,
-    chain_id: f.chain.id,
-    evidence_count: f.evidence.length
-  }));
-  report.status = "COMPLETE";
-  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
-  const executedState = "select_chain";
-  const scopeAllowed = report.scope?.allowed ?? false;
-  const plan = buildPlan(scopeAllowed, mode, executedState);
-  report.state = executedState;
-  report.state_description = stateDefinition(executedState).description;
-  report.plan = plan;
-  report.guidance = computeGuidance(executedState, scopeAllowed);
-  report.risk_policy = {
-    note: "High-risk actions (strike_verify, confirm_finding) require scope + are never run server-side automatically.",
-    gated: plan.filter((p) => !p.permitted).map((p) => p.tool)
-  };
-  if (remember) {
-    let captured = 0;
-    for (const mc of blitz.matched_chains) {
-      const chain = chainById.get(mc.chain_id);
-      const content = `Chain '${mc.chain_id}' (${mc.severity}) matched on target '${target}'. ` + `Detected sink signals: ${blitz.sink_signals.join(", ")}. ` + `Prerequisites: ${(chain?.required_findings ?? []).join(", ")}.`;
-      if (rememberIfAbsent(mc.chain_id, content, "pattern", [mc.severity, "chain"], "engagement", false)) {
-        captured++;
-      }
+  lines.push("");
+  lines.push("### By severity");
+  lines.push("");
+  for (const [sev, n] of Object.entries(summary.by_severity).sort()) {
+    lines.push(`- ${sev}: ${n}`);
+  }
+  lines.push("");
+  lines.push("## Findings");
+  lines.push("");
+  if (findings.length === 0) {
+    lines.push("_No findings._");
+    return lines.join(`
+`) + `
+`;
+  }
+  for (const f of findings) {
+    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
+    lines.push("");
+    lines.push(`- **Status**: \`${f.status}\``);
+    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
+    if (f.classification?.cwe)
+      lines.push(`- **CWE**: ${f.classification.cwe}`);
+    if (f.classification?.cvss_score != null)
+      lines.push(`- **CVSS**: ${f.classification.cvss_score} (${f.classification.cvss_vector ?? ""}) — ${cvssSeverity(f.classification.cvss_score)}`);
+    lines.push(`- **Source**: ${f.source?.type} \`${f.source?.name ?? ""}\``);
+    lines.push(`- **Sink**: ${f.sink?.type}${f.sink?.symbol ? ` \`${f.sink.symbol}\`` : ""}`);
+    if (f.target?.host || f.target?.endpoint)
+      lines.push(`- **Target**: ${[f.target.host, f.target.endpoint].filter(Boolean).join("")}`);
+    lines.push(`- **Evidence**: ${f.evidence?.length ?? 0} record(s)`);
+    if (f.remediation && Object.keys(f.remediation).length) {
+      lines.push(`- **Note**: ${JSON.stringify(f.remediation)}`);
     }
-    report.memory = { captured, deduped: blitz.matched_chains.length - captured };
+    lines.push("");
   }
-  return report;
+  return lines.join(`
+`) + `
+`;
 }
-function listChains() {
-  const chains = loadChains();
+function reportJson(findings, opts = {}) {
+  const summary = summarize(findings);
+  const payload = {
+    title: opts.title ?? "Blitz Strike — Security Assessment Report",
+    scope: opts.scope ?? null,
+    version: opts.version ?? null,
+    summary,
+    findings,
+    integrity: sha256(JSON.stringify({ summary, findings }))
+  };
+  return JSON.stringify(payload, null, 2);
+}
+
+// src/sarif.ts
+var SARIF_SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json";
+function sarifLevel(severity) {
+  const s = severity.toLowerCase();
+  if (s === "critical" || s === "high")
+    return "error";
+  if (s === "medium")
+    return "warning";
+  return "note";
+}
+function toSarif(findings, opts = {}) {
+  const tool = opts.tool ?? "Blitz Strike";
+  const uri = opts.uri ?? "https://github.com/shinthink/blitzstrike";
+  const ruleIds = [...new Set(findings.map((f) => f.ruleId))];
+  const rules = ruleIds.map((id) => ({
+    id,
+    name: id,
+    shortDescription: { text: id }
+  }));
+  const results = findings.map((f) => ({
+    ruleId: f.ruleId,
+    level: f.level,
+    message: { text: f.message },
+    locations: [
+      {
+        physicalLocation: {
+          artifactLocation: { uri: f.file },
+          region: { startLine: Math.max(1, f.line) }
+        }
+      }
+    ]
+  }));
   return {
-    total: chains.length,
-    chains: chains.map((c) => ({
-      id: c.id,
-      name: c.name,
-      severity: c.severity,
-      steps: c.steps.length,
-      triggers: c.triggers
-    }))
+    version: "2.1.0",
+    $schema: SARIF_SCHEMA,
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: tool,
+            version: VERSION,
+            informationUri: uri,
+            rules
+          }
+        },
+        results
+      }
+    ]
   };
 }
 
-// src/catalog.ts
-import { readFileSync as readFileSync7, readdirSync as readdirSync2 } from "node:fs";
-import { join as join7 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { spawnSync } from "node:child_process";
-var ROOT2 = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
-var _toolsCache = null;
-var _skillsCache = null;
-function loadTools() {
-  if (_toolsCache)
-    return _toolsCache;
+// src/strike.ts
+var DEFAULT_TIMEOUT_MS = 15000;
+async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  const controller = new AbortController;
+  const t = setTimeout(() => controller.abort(), timeoutMs);
   try {
-    const raw = JSON.parse(readFileSync7(join7(ROOT2, "tools-catalog.json"), "utf8"));
-    _toolsCache = raw.tools ?? [];
-  } catch {
-    _toolsCache = [];
+    const res = await fetch(url, {
+      method,
+      body: method === "POST" ? data : undefined,
+      headers: { "User-Agent": "blitzstrike/1.0", ...headers ?? {} },
+      signal: controller.signal,
+      redirect: "follow"
+    });
+    const body = await res.text();
+    const hdrs = {};
+    res.headers.forEach((v, k) => {
+      hdrs[k] = v;
+    });
+    return { status: res.status, body: body.slice(0, 20000), headers: hdrs };
+  } catch (e) {
+    return { status: 0, body: String(e), headers: {} };
+  } finally {
+    clearTimeout(t);
   }
-  return _toolsCache;
 }
-function loadSkills() {
-  if (_skillsCache)
-    return _skillsCache;
-  const dir = join7(ROOT2, "skills");
-  const out = [];
-  try {
-    for (const f of readdirSync2(dir)) {
-      if (!f.endsWith(".md"))
-        continue;
-      const p = join7(dir, f);
-      const text = readFileSync7(p, "utf8");
-      const descMatch = text.match(/^description:\s*(.+)$/m);
-      out.push({
-        name: f.replace(/\.md$/, ""),
-        file: f,
-        description: (descMatch?.[1] ?? "").trim().slice(0, 200),
-        size: text.length
-      });
-    }
-  } catch {}
-  _skillsCache = out;
-  return out;
+function defaultMarker() {
+  return `BS${Date.now().toString(36).toUpperCase()}${Math.random().toString(36).slice(2, 8).toUpperCase()}`;
 }
-function toolLookup(name) {
-  const tools = loadTools();
-  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!t) {
-    return {
-      found: false,
-      query: name,
-      suggestions: tools.filter((x) => x.name.includes(name.toLowerCase()) || name.toLowerCase().includes(x.name)).slice(0, 5).map((x) => x.name)
-    };
-  }
-  const manual = manualForTool(t.name);
-  const result = { found: true, tool: t };
-  if (manual && manual.content) {
-    result.manual = {
-      name: manual.name,
-      category: manual.category,
-      preview: manual.content.slice(0, 1500),
-      full_length: manual.content.length
-    };
-  } else {
-    result.manual = null;
-  }
-  return result;
+function inject(target, value, param) {
+  const placeholder = "{{MARKER}}";
+  if (target.includes(placeholder))
+    return target.split(placeholder).join(value);
+  if (target.includes("?"))
+    return `${target}&${param}=${encodeURIComponent(value)}`;
+  return `${target}?${param}=${encodeURIComponent(value)}`;
 }
-function listTools() {
-  const tools = loadTools();
-  const byCat = {};
-  for (const t of tools) {
-    (byCat[t.category] ??= []).push(t.name);
+async function strikeVerify(input) {
+  const method = input.method ?? "GET";
+  const param = input.param ?? "q";
+  const marker = input.marker ?? defaultMarker();
+  const control = input.control ?? defaultMarker();
+  const baseUrl = input.url;
+  const timeoutMs = input.timeout ?? DEFAULT_TIMEOUT_MS;
+  const baselineTarget = inject(baseUrl, "", param).replace(/[?&]q=$/, "").replace(/[?&]$/, "");
+  const markerTarget = inject(baseUrl, marker, param);
+  const controlTarget = inject(baseUrl, control, param);
+  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers, timeoutMs);
+  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers, timeoutMs);
+  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers, timeoutMs);
+  if (baseline.status === 0 || markerResp.status === 0) {
+    return {
+      status: "blocked",
+      marker_reflected: false,
+      control_reflected: false,
+      baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
+      marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
+      control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
+      reason: "request failed or target unreachable — cannot validate",
+      evidence: []
+    };
   }
-  return { total: tools.length, categories: byCat, tools: tools.map((t) => ({ name: t.name, category: t.category, description: t.description })) };
-}
-function skillLookup(topic) {
-  const skills = loadSkills();
-  const q = topic.toLowerCase();
-  const scored = skills.map((s) => {
-    const hay = `${s.name} ${s.description}`.toLowerCase();
-    const nameHit = s.name.includes(q);
-    const descHit = s.description.includes(q);
-    const wordHit = q.split(/\s+/).filter((w) => w && hay.includes(w)).length;
-    return { s, score: (nameHit ? 10 : 0) + (descHit ? 5 : 0) + wordHit * 2 };
-  }).filter((x) => x.score > 0).sort((a, b) => b.score - a.score);
-  if (scored.length === 0) {
-    return { found: false, query: topic, suggestions: skills.map((s) => s.name).slice(0, 10) };
+  const markerReflected = markerResp.body.includes(marker);
+  const controlReflected = controlResp.body.includes(control);
+  let status;
+  let reason;
+  if (markerReflected && !controlReflected) {
+    status = "confirmed";
+    reason = "marker reflected; negative control did not — the sink reflects attacker-controlled input (real finding)";
+  } else if (markerReflected && controlReflected) {
+    status = "false_positive";
+    reason = "marker AND negative control both reflected — behaviour is indistinguishable from benign reflection (likely false positive)";
+  } else if (!markerReflected && !controlReflected) {
+    status = "unconfirmed";
+    reason = "marker not reflected — reachability/exploitability could not be demonstrated live";
+  } else {
+    status = "unconfirmed";
+    reason = "negative control reflected but marker did not — inconsistent, requires deeper analysis";
   }
+  const evidence = [
+    {
+      type: "baseline_comparison",
+      description: `Baseline response (status ${baseline.status}) for ${redactSecrets(baselineTarget)}`,
+      artifacts: [{ name: "baseline", kind: "http_response", content: `${baseline.status}
+${baseline.body}` }]
+    },
+    {
+      type: "validation_result",
+      description: `Marker '${redactSecrets(marker)}' reflected=${markerReflected}; control reflected=${controlReflected}`,
+      artifacts: [{ name: "marker_response", kind: "http_response", content: `${markerResp.status}
+${markerResp.body}` }]
+    },
+    {
+      type: "negative_control",
+      description: `Negative control '${redactSecrets(control)}' reflected=${controlReflected}`,
+      artifacts: [{ name: "control_response", kind: "http_response", content: `${controlResp.status}
+${controlResp.body}` }]
+    }
+  ];
   return {
-    found: true,
-    matches: scored.slice(0, 5).map((x) => ({ name: x.s.name, description: x.s.description, file: x.s.file }))
+    status,
+    marker_reflected: markerReflected,
+    control_reflected: controlReflected,
+    baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
+    marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
+    control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
+    reason,
+    evidence
   };
 }
-function listSkills() {
-  const skills = loadSkills();
-  return { total: skills.length, skills: skills.map((s) => ({ name: s.name, description: s.description })) };
-}
-function readSkill(name) {
-  const skills = loadSkills();
-  const s = skills.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!s)
-    return { found: false, query: name };
-  try {
-    const text = readFileSync7(join7(ROOT2, "skills", s.file), "utf8");
-    return { found: true, name: s.name, content: text.slice(0, 12000) };
-  } catch {
-    return { found: false, query: name, error: "unreadable" };
-  }
-}
-function ensureTool(name) {
-  const tools = loadTools();
-  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!t) {
-    return { found: false, query: name, suggestions: tools.slice(0, 5).map((x) => x.name) };
-  }
-  const check = spawnSync(t.check_installed.command, { shell: true, timeout: 15000 });
-  if (check.status !== 127 && check.error === undefined) {
-    return { name: t.name, installed: true, action: "none", note: "already installed" };
+function resolveFinding(finding, verdict) {
+  let f = finding;
+  if (f.status === "hypothesis") {
+    f = transition(f, "validating");
   }
-  const platform = process.platform;
-  const cmd = t.install[platform] ?? t.install.linux;
-  if (!cmd) {
-    return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
+  switch (verdict.status) {
+    case "confirmed":
+      return confirmFinding(f, {
+        evidence: verdict.evidence,
+        negative_control: true,
+        baseline: true
+      });
+    case "false_positive":
+      return rejectFinding(f, "false_positive", verdict.reason, verdict.evidence);
+    case "blocked":
+      return rejectFinding(f, "blocked", verdict.reason, verdict.evidence);
+    case "unconfirmed":
+    case "likely":
+    default: {
+      return {
+        ...f,
+        validation: { performed: true, status: verdict.status === "likely" ? "likely" : "unconfirmed", negative_control: verdict.control_reflected === false, baseline: true },
+        remediation: { ...f.remediation, note: verdict.reason },
+        timestamps: { ...f.timestamps, updated: new Date().toISOString() }
+      };
+    }
   }
-  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
-  const ok = r.status === 0;
-  return {
-    name: t.name,
-    installed: ok,
-    action: "install",
-    command: cmd,
-    output: (r.stdout?.toString() ?? "").slice(-400) || (r.stderr?.toString() ?? "").slice(-400)
-  };
 }
 
-// src/intel.ts
-import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
-import { join as join8 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
-var INTEL = join8(ROOT3, "intelligence");
-function loadJson(name) {
-  const p = join8(INTEL, `${name}.json`);
-  if (!existsSync5(p))
-    return null;
+// src/orchestrator.ts
+var _chainsCache = null;
+function loadChains() {
+  if (_chainsCache)
+    return _chainsCache;
   try {
-    return JSON.parse(readFileSync8(p, "utf8"));
+    const dir = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
+    const path = join6(dir, "chains.json");
+    const raw = JSON.parse(readFileSync6(path, "utf8"));
+    _chainsCache = raw.chains ?? [];
+    return _chainsCache;
   } catch {
-    return null;
+    _chainsCache = [];
+    return [];
   }
 }
-function detectWaf(headers, body = "") {
-  const sigs = loadJson("waf_signatures");
-  if (!sigs)
-    return { detected: false, wafs: [], error: "waf_signatures.json not loaded" };
-  const headerSigs = sigs.header_signatures ?? [];
-  const bodySigs = sigs.body_signatures ?? [];
-  const matches = [];
-  const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
-  for (const s of headerSigs) {
-    const h = (s.header ?? "").toLowerCase();
-    const pattern = (s.pattern ?? "").toLowerCase();
-    if (!h)
-      continue;
-    if (pattern) {
-      const val = (headers[h] ?? headers[s.header ?? ""] ?? "").toLowerCase();
-      if (val.includes(pattern)) {
-        matches.push({ waf: s.waf, header: s.header, pattern: s.pattern, confidence: s.confidence, via: "header-value" });
-      }
-    } else {
-      if (headerKeys.includes(h)) {
-        matches.push({ waf: s.waf, header: s.header, confidence: s.confidence, via: "header-name" });
+function scopeCheck(target, scope = "", mode = "bug-bounty") {
+  let result;
+  if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
+    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
+  } else if (!scope.trim()) {
+    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
+  } else {
+    const inScope = [];
+    const outScope = [];
+    for (const raw of scope.split(/[,\n]/)) {
+      const line = raw.trim();
+      if (!line)
+        continue;
+      if (line.startsWith("-"))
+        outScope.push(line.slice(1).trim());
+      else
+        inScope.push(line);
+    }
+    let host = target;
+    host = host.replace(/^https?:\/\//, "");
+    host = host.split("/")[0].split(":")[0];
+    let decided = false;
+    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
+    for (const exc of outScope) {
+      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
+        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
+        decided = true;
+        break;
       }
     }
-  }
-  for (const s of bodySigs) {
-    const pattern = (s.pattern ?? "").toLowerCase();
-    if (pattern && body.toLowerCase().includes(pattern)) {
-      matches.push({ waf: s.waf, pattern: s.pattern, confidence: s.confidence, via: "body" });
+    if (!decided) {
+      for (const allowed of inScope) {
+        const a = allowed.replace(/\*/g, "");
+        if (!a)
+          continue;
+        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
+          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
+          decided = true;
+          break;
+        }
+      }
     }
   }
-  const byWaf = new Map;
-  for (const m of matches) {
-    const key = m.waf;
-    const prev = byWaf.get(key);
-    if (!prev || m.confidence > prev.confidence)
-      byWaf.set(key, m);
+  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
+  return result;
+}
+function classifySink(sink) {
+  if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
+    return "upload_weak_validation";
+  if (/unserialize/.test(sink))
+    return "unserialize_user_input";
+  if (/(exec\(|system\(|shell_exec|passthru|popen|proc_open)/.test(sink))
+    return "command_injection";
+  if (/(include|require)/.test(sink))
+    return "lfi_unvalidated_include";
+  if (/extract\(/.test(sink))
+    return "extract_without_exstr_skip";
+  if (/(\$wpdb|->query)/.test(sink))
+    return "sql_injection";
+  if (/(wp_remote_get|wp_remote_post|file_get_contents)/.test(sink))
+    return "ssrf_unvalidated_url";
+  if (/(eval\(|assert\(|create_function)/.test(sink))
+    return "unsafe_template_render";
+  return "";
+}
+function enrichScan(path, maxFiles = 2000) {
+  const expanded = path.replace(/^~/, process.env.HOME ?? "~");
+  const files = iterSourceFiles(expanded, maxFiles);
+  const hits = [];
+  const sinkKinds = new Set;
+  for (const p of files) {
+    const r = scanFile(p);
+    for (const e of r.endpoints) {
+      hits.push({ type: "endpoint", file: r.file, line: e.line, detail: e.hook });
+    }
+    for (const s of r.sinks) {
+      hits.push({ type: "sink", file: r.file, line: s.line, detail: `${s.sink} -> ${s.class}` });
+      const kind = classifySink(s.sink);
+      if (kind)
+        sinkKinds.add(kind);
+    }
+  }
+  const chains = loadChains();
+  const matched = [];
+  for (const c of chains) {
+    if ((c.required_findings ?? []).some((rf) => sinkKinds.has(rf))) {
+      matched.push({ chain_id: c.id, name: c.name, severity: c.severity, steps: c.steps.length });
+    }
   }
-  const detected = [...byWaf.values()].sort((a, b) => b.confidence - a.confidence);
   return {
-    detected: detected.length > 0,
-    wafs: detected,
-    block_status_codes: sigs.block_status_codes ?? []
+    root: expanded,
+    files_scanned: files.length,
+    hits: hits.slice(0, 2000),
+    sink_signals: [...sinkKinds].sort(),
+    matched_chains: matched
   };
 }
-function techCorrelation(tech) {
-  const data = loadJson("tech_correlations");
-  if (!data)
-    return { found: false, error: "tech_correlations.json not loaded" };
-  const key = tech.toLowerCase();
-  const entry = data[key];
-  if (!entry) {
-    const matches = Object.keys(data).filter((k) => k.includes(key) || key.includes(k)).slice(0, 5);
-    return { found: false, tech, suggestions: matches };
+function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000, remember = true) {
+  const report = {
+    target,
+    mode,
+    tiers: {},
+    findings: [],
+    scope: null,
+    memory: { captured: 0 }
+  };
+  const isPath = (() => {
+    try {
+      return existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+    } catch {
+      return false;
+    }
+  })();
+  if (isPath) {
+    report.scope = { target, allowed: true, enforcement: "source-audit", reason: "local source path — no network scope gate" };
+  } else {
+    const sc = scopeCheck(target, scope, mode);
+    report.scope = sc;
+    if (!sc.allowed) {
+      report.status = "BLOCKED";
+      report.reason = sc.reason;
+      return report;
+    }
   }
-  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? { vulns: entry.vulns, paths: entry.paths } };
-}
-function cveCorrelation(cveId) {
-  const data = loadJson("cve_correlations");
-  if (!data)
-    return { error: "cve_correlations.json not loaded" };
-  const key = cveId.toUpperCase();
-  const entry = data[key];
-  if (!entry)
-    return { found: false, cve: key, total_known: Object.keys(data).length };
-  return { found: true, cve: key, ...entry };
-}
-function portCorrelation(port) {
-  const data = loadJson("port_correlations");
-  if (!data)
-    return { error: "port_correlations.json not loaded" };
-  const key = String(port);
-  const entry = data[key];
-  if (!entry)
-    return { found: false, port: key, total_known: Object.keys(data).length };
-  return { found: true, port: key, ...entry };
-}
-function fuzzerPayloads(category) {
-  const data = loadJson("fuzzer_data");
-  if (!data)
-    return { error: "fuzzer_data.json not loaded" };
-  if (category) {
-    const c = data[category] ?? data[category.toUpperCase()];
-    return { category, found: Boolean(c), data: c ?? null };
+  const blitz = enrichScan(target, maxFiles);
+  report.tiers = {
+    blitz: {
+      files_scanned: blitz.files_scanned,
+      hits: blitz.hits.length,
+      sink_signals: blitz.sink_signals,
+      matched_chains: blitz.matched_chains
+    }
+  };
+  const chains = loadChains();
+  const chainById = new Map(chains.map((c) => [c.id, c]));
+  const eagle = [];
+  for (const mc of blitz.matched_chains.slice(0, 10)) {
+    const chain = chainById.get(mc.chain_id);
+    if (!chain)
+      continue;
+    eagle.push({
+      chain_id: chain.id,
+      name: chain.name,
+      severity: chain.severity,
+      prerequisites: chain.required_findings,
+      recommended_tools: chain.tools ?? [],
+      tool_manuals: (chain.tools ?? []).map((t) => {
+        const m = findManual(t);
+        return m.found ? { tool: t, manual_name: m.name, preview: m.content.slice(0, 600) } : { tool: t, manual_name: null, preview: null };
+      }),
+      steps: chain.steps.map((s) => ({
+        order: s.order,
+        action: s.action,
+        tool_hint: s.tool_hint,
+        success_criteria: s.success_criteria,
+        invariant_check: s.invariant_check,
+        negative_control: s.negative_control
+      }))
+    });
   }
-  return { categories: Object.keys(data), fuzz_points: data.FUZZ_POINTS ?? null, payloads: data.FUZZ_PAYLOADS ?? null };
-}
-function intelSummary() {
-  const waf = loadJson("waf_signatures");
-  const tech = loadJson("tech_correlations");
-  const cve = loadJson("cve_correlations");
-  const port = loadJson("port_correlations");
-  const fuzz = loadJson("fuzzer_data");
-  const av = loadJson("attack_vectors");
-  return {
-    waf_signatures: waf ? (waf.header_signatures?.length ?? 0) + (waf.body_signatures?.length ?? 0) : 0,
-    tech_correlations: tech ? Object.keys(tech).length : 0,
-    cve_correlations: cve ? Object.keys(cve).length : 0,
-    port_correlations: port ? Object.keys(port).length : 0,
-    fuzzer_categories: fuzz ? Object.keys(fuzz).length : 0,
-    payload_categories: listPayloadCategories().length,
-    nuclei_templates: countTemplates(),
-    attack_vector_categories: av ? av.categories.length : 0,
-    attack_vectors: av ? av.categories.reduce((n, c) => n + c.vectors.length, 0) : 0
+  report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
+  const rank = { critical: 0, high: 1, medium: 2, low: 3 };
+  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
+  const findings = matchedSorted.map((f) => {
+    const chain = chainById.get(f.chain_id);
+    const severity = f.severity ?? "medium";
+    const finding = makeFinding({
+      title: f.name,
+      target: { type: "source", path: target },
+      severity,
+      source: { type: "static_sink_signal", name: f.chain_id },
+      sink: { type: f.chain_id, symbol: f.name },
+      chainId: f.chain_id,
+      chainName: f.name,
+      status: "hypothesis"
+    });
+    const ev = makeEvidence({
+      type: "sink_location",
+      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
+      sink: { chain_id: f.chain_id, name: f.name, severity },
+      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
+    });
+    finding.evidence.push(ev);
+    return finding;
+  });
+  report.findings = findings.map((f) => ({
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    evidence_count: f.evidence.length
+  }));
+  const reportTitle = `Blitz Strike — Engagement Report (${target})`;
+  const reportMarkdownText = reportMarkdown(findings, { title: reportTitle, scope: target, version: VERSION });
+  const reportJsonText = reportJson(findings, { title: reportTitle, scope: target, version: VERSION });
+  const sarifDoc = toSarif(findings.map((f) => ({
+    ruleId: f.chain.id || f.classification.severity,
+    level: sarifLevel(f.classification.severity),
+    message: f.title,
+    file: typeof f.target.path === "string" ? f.target.path : target,
+    line: 1
+  })));
+  report.report = {
+    summary: JSON.parse(reportJsonText).summary ?? null,
+    markdown: reportMarkdownText,
+    json: reportJsonText,
+    sarif: sarifDoc
+  };
+  report.status = "COMPLETE";
+  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
+  const executedState = "select_chain";
+  const scopeAllowed = report.scope?.allowed ?? false;
+  const plan = buildPlan(scopeAllowed, mode, executedState);
+  report.state = executedState;
+  report.state_description = stateDefinition(executedState).description;
+  report.plan = plan;
+  report.guidance = computeGuidance(executedState, scopeAllowed);
+  report.risk_policy = {
+    note: "High-risk actions (strike_verify, confirm_finding) require scope + are never run server-side automatically.",
+    gated: plan.filter((p) => !p.permitted).map((p) => p.tool)
   };
+  if (remember) {
+    let captured = 0;
+    for (const mc of blitz.matched_chains) {
+      const chain = chainById.get(mc.chain_id);
+      const content = `Chain '${mc.chain_id}' (${mc.severity}) matched on target '${target}'. ` + `Detected sink signals: ${blitz.sink_signals.join(", ")}. ` + `Prerequisites: ${(chain?.required_findings ?? []).join(", ")}.`;
+      if (rememberIfAbsent(mc.chain_id, content, "pattern", [mc.severity, "chain"], "engagement", false)) {
+        captured++;
+      }
+    }
+    report.memory = { captured, deduped: blitz.matched_chains.length - captured };
+  }
+  return report;
 }
-function listAttackVectors() {
-  const data = loadJson("attack_vectors");
-  if (!data)
-    return { error: "attack_vectors.json not loaded" };
+function listChains() {
+  const chains = loadChains();
   return {
-    total_categories: data.categories.length,
-    total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
-    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length }))
+    total: chains.length,
+    chains: chains.map((c) => ({
+      id: c.id,
+      name: c.name,
+      severity: c.severity,
+      steps: c.steps.length,
+      triggers: c.triggers
+    }))
   };
 }
-function attackVectors(category) {
-  const data = loadJson("attack_vectors");
-  if (!data)
-    return { error: "attack_vectors.json not loaded" };
-  const q = category.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  const found = data.categories.find((c) => c.id === q || c.id.includes(q) || c.title.toLowerCase().includes(category.toLowerCase()));
-  if (!found) {
-    const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
-    return { found: false, query: category, suggestions: matches };
+var LIVE_SWEEP_PARAMS = ["q", "search", "query", "s", "id", "url", "redirect", "name", "page"];
+async function runLiveEngagement(url, scope = "", mode = "bug-bounty") {
+  const report = { target: url, mode, findings: [], scope: null, status: "" };
+  const sc = scopeCheck(url, scope, mode);
+  report.scope = sc;
+  if (!sc.allowed) {
+    report.status = "BLOCKED";
+    report.reason = sc.reason;
+    return report;
   }
-  return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
-}
-var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
-var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
-function payloadsDir() {
-  if (existsSync5(PACKAGE_PAYLOADS))
-    return PACKAGE_PAYLOADS;
-  return join8(DATA_ROOT, "payloads");
-}
-function templatesDir() {
-  if (existsSync5(PACKAGE_TEMPLATES))
-    return PACKAGE_TEMPLATES;
-  return join8(DATA_ROOT, "templates");
+  const findings = [];
+  for (const param of LIVE_SWEEP_PARAMS) {
+    const verdict = await strikeVerify({ url, param });
+    const finding = makeFinding({
+      title: `Reflected input in parameter '${param}'`,
+      target: { type: "web", host: url, endpoint: `?${param}=` },
+      severity: "medium",
+      cwe: "CWE-79",
+      cweName: "Cross-site Scripting",
+      source: { type: "request_parameter", name: param },
+      sink: { type: "reflected_input", symbol: param },
+      chainId: "reflected_input",
+      chainName: "Reflected input",
+      status: "hypothesis"
+    });
+    findings.push(resolveFinding(finding, verdict));
+  }
+  report.findings = findings.map((f) => ({
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    validation: f.validation
+  }));
+  const title = `Blitz Strike — Live Engagement (${url})`;
+  const markdown = reportMarkdown(findings, { title, scope: url, version: VERSION });
+  const json = reportJson(findings, { title, scope: url, version: VERSION });
+  report.report = {
+    summary: JSON.parse(json).summary ?? null,
+    markdown,
+    json,
+    sarif: toSarif(findings.map((f) => ({
+      ruleId: f.chain.id || f.classification.cwe || f.classification.severity,
+      level: sarifLevel(f.classification.severity),
+      message: f.title,
+      file: url,
+      line: 1
+    })))
+  };
+  report.status = "COMPLETE";
+  report.note = "Autonomous live marker sweep. Each parameter was validated with a marker + " + "negative control; confirmed reflections are real findings, everything else " + "is a hypothesis or false positive. Re-run with explicit strike_verify for " + "deeper per-endpoint validation.";
+  return report;
 }
-var PAYLOADS = payloadsDir();
-var TEMPLATES = templatesDir();
-function listPayloadCategories() {
+
+// src/catalog.ts
+import { readFileSync as readFileSync7, readdirSync as readdirSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
+import { spawnSync } from "node:child_process";
+var ROOT2 = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
+var _toolsCache = null;
+var _skillsCache = null;
+function loadTools() {
+  if (_toolsCache)
+    return _toolsCache;
   try {
-    return readdirSync3(PAYLOADS, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+    const raw = JSON.parse(readFileSync7(join7(ROOT2, "tools-catalog.json"), "utf8"));
+    _toolsCache = raw.tools ?? [];
   } catch {
-    return [];
+    _toolsCache = [];
   }
+  return _toolsCache;
 }
-function payloadLookup(topic) {
-  const cats = listPayloadCategories();
-  const key = topic.toLowerCase();
-  const ALIASES = {
-    sqli: "sql injection",
-    xss: "xss injection",
-    ssrf: "server side request forgery",
-    ssti: "server side template injection",
-    jwt: "json web token",
-    lfi: "file inclusion",
-    rfi: "file inclusion",
-    xxe: "xxe injection",
-    idor: "insecure direct object references",
-    csrf: "cross-site request forgery",
-    cmdi: "command injection",
-    rce: "command injection",
-    cors: "cors misconfiguration",
-    crlf: "crlf injection",
-    prototype: "prototype pollution",
-    nosql: "nosql injection",
-    upload: "upload insecure files"
-  };
-  const normalized = ALIASES[key] ?? key;
-  const exact = cats.find((c) => c.toLowerCase() === normalized);
-  if (exact) {
-    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
+function loadSkills() {
+  if (_skillsCache)
+    return _skillsCache;
+  const dir = join7(ROOT2, "skills");
+  const out = [];
+  try {
+    for (const f of readdirSync2(dir)) {
+      if (!f.endsWith(".md"))
+        continue;
+      const p = join7(dir, f);
+      const text = readFileSync7(p, "utf8");
+      const descMatch = text.match(/^description:\s*(.+)$/m);
+      out.push({
+        name: f.replace(/\.md$/, ""),
+        file: f,
+        description: (descMatch?.[1] ?? "").trim().slice(0, 200),
+        size: text.length
+      });
+    }
+  } catch {}
+  _skillsCache = out;
+  return out;
+}
+function toolLookup(name) {
+  const tools = loadTools();
+  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!t) {
+    return {
+      found: false,
+      query: name,
+      suggestions: tools.filter((x) => x.name.includes(name.toLowerCase()) || name.toLowerCase().includes(x.name)).slice(0, 5).map((x) => x.name)
+    };
   }
-  const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
-  const matches = cats.filter((c) => {
-    const cl = c.toLowerCase();
-    if (cl.includes(normalized) || normalized.includes(cl))
-      return true;
-    return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
-  });
-  if (matches.length > 0) {
-    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
+  const manual = manualForTool(t.name);
+  const result = { found: true, tool: t };
+  if (manual && manual.content) {
+    result.manual = {
+      name: manual.name,
+      category: manual.category,
+      preview: manual.content.slice(0, 1500),
+      full_length: manual.content.length
+    };
+  } else {
+    result.manual = null;
   }
-  return { found: false, topic, suggestions: cats.slice(0, 20) };
+  return result;
 }
-function readPayload(category, file) {
-  const cats = listPayloadCategories();
-  const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
-  if (!exact)
-    return { found: false, category, suggestions: cats.slice(0, 20) };
-  const dir = join8(PAYLOADS, exact);
-  const files = listFiles(dir);
-  if (!file) {
-    const readme = files.find((f) => f.toLowerCase() === "readme.md");
-    if (readme) {
-      return { found: true, category: exact, file: readme, content: readFileSync8(join8(dir, readme), "utf8").slice(0, 20000) };
-    }
-    return { found: true, category: exact, files };
+function listTools() {
+  const tools = loadTools();
+  const byCat = {};
+  for (const t of tools) {
+    (byCat[t.category] ??= []).push(t.name);
   }
-  const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
-  if (!f)
-    return { found: false, category: exact, file, suggestions: files };
-  return { found: true, category: exact, file: f, content: readFileSync8(join8(dir, f), "utf8").slice(0, 20000) };
+  return { total: tools.length, categories: byCat, tools: tools.map((t) => ({ name: t.name, category: t.category, description: t.description })) };
 }
-function listFiles(dir) {
+function skillLookup(topic) {
+  const skills = loadSkills();
+  const q = topic.toLowerCase();
+  const scored = skills.map((s) => {
+    const hay = `${s.name} ${s.description}`.toLowerCase();
+    const nameHit = s.name.includes(q);
+    const descHit = s.description.includes(q);
+    const wordHit = q.split(/\s+/).filter((w) => w && hay.includes(w)).length;
+    return { s, score: (nameHit ? 10 : 0) + (descHit ? 5 : 0) + wordHit * 2 };
+  }).filter((x) => x.score > 0).sort((a, b) => b.score - a.score);
+  if (scored.length === 0) {
+    return { found: false, query: topic, suggestions: skills.map((s) => s.name).slice(0, 10) };
+  }
+  return {
+    found: true,
+    matches: scored.slice(0, 5).map((x) => ({ name: x.s.name, description: x.s.description, file: x.s.file }))
+  };
+}
+function listSkills() {
+  const skills = loadSkills();
+  return { total: skills.length, skills: skills.map((s) => ({ name: s.name, description: s.description })) };
+}
+function readSkill(name) {
+  const skills = loadSkills();
+  const s = skills.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!s)
+    return { found: false, query: name };
   try {
-    return readdirSync3(dir).filter((f) => f.endsWith(".md") || f.endsWith(".txt") || f.endsWith(".yaml")).sort();
+    const text = readFileSync7(join7(ROOT2, "skills", s.file), "utf8");
+    return { found: true, name: s.name, content: text.slice(0, 12000) };
   } catch {
-    return [];
+    return { found: false, query: name, error: "unreadable" };
   }
 }
-function countTemplates() {
+function ensureTool(name) {
+  const tools = loadTools();
+  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!t) {
+    return { found: false, query: name, suggestions: tools.slice(0, 5).map((x) => x.name) };
+  }
+  const check = spawnSync(t.check_installed.command, { shell: true, timeout: 15000 });
+  if (check.status !== 127 && check.error === undefined) {
+    return { name: t.name, installed: true, action: "none", note: "already installed" };
+  }
+  const platform = process.platform;
+  const cmd = t.install[platform] ?? t.install.linux;
+  if (!cmd) {
+    return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
+  }
+  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
+  const ok = r.status === 0;
+  return {
+    name: t.name,
+    installed: ok,
+    action: "install",
+    command: cmd,
+    output: (r.stdout?.toString() ?? "").slice(-400) || (r.stderr?.toString() ?? "").slice(-400)
+  };
+}
+
+// src/intel.ts
+import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
+import { join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { readdirSync as readdirSync3 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var INTEL = join8(ROOT3, "intelligence");
+function loadJson(name) {
+  const p = join8(INTEL, `${name}.json`);
+  if (!existsSync5(p))
+    return null;
   try {
-    let n = 0;
-    const walk = (dir) => {
-      for (const e of readdirSync3(dir, { withFileTypes: true })) {
-        if (e.isDirectory())
-          walk(join8(dir, e.name));
-        else if (e.name.endsWith(".yaml"))
-          n++;
-      }
-    };
-    walk(TEMPLATES);
-    return n;
+    return JSON.parse(readFileSync8(p, "utf8"));
   } catch {
-    return 0;
+    return null;
   }
 }
-function templateLookup(topic, limit = 10) {
-  const key = topic.toLowerCase();
-  const hits = [];
-  const walk = (dir, depth = 0) => {
-    if (depth > 6 || hits.length >= limit * 3)
-      return;
-    let entries;
-    try {
-      entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      if (e.isDirectory())
+function detectWaf(headers, body = "") {
+  const sigs = loadJson("waf_signatures");
+  if (!sigs)
+    return { detected: false, wafs: [], error: "waf_signatures.json not loaded" };
+  const headerSigs = sigs.header_signatures ?? [];
+  const bodySigs = sigs.body_signatures ?? [];
+  const matches = [];
+  const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
+  for (const s of headerSigs) {
+    const h = (s.header ?? "").toLowerCase();
+    const pattern = (s.pattern ?? "").toLowerCase();
+    if (!h)
+      continue;
+    if (pattern) {
+      const val = (headers[h] ?? headers[s.header ?? ""] ?? "").toLowerCase();
+      if (val.includes(pattern)) {
+        matches.push({ waf: s.waf, header: s.header, pattern: s.pattern, confidence: s.confidence, via: "header-value" });
+      }
+    } else {
+      if (headerKeys.includes(h)) {
+        matches.push({ waf: s.waf, header: s.header, confidence: s.confidence, via: "header-name" });
+      }
+    }
+  }
+  for (const s of bodySigs) {
+    const pattern = (s.pattern ?? "").toLowerCase();
+    if (pattern && body.toLowerCase().includes(pattern)) {
+      matches.push({ waf: s.waf, pattern: s.pattern, confidence: s.confidence, via: "body" });
+    }
+  }
+  const byWaf = new Map;
+  for (const m of matches) {
+    const key = m.waf;
+    const prev = byWaf.get(key);
+    if (!prev || m.confidence > prev.confidence)
+      byWaf.set(key, m);
+  }
+  const detected = [...byWaf.values()].sort((a, b) => b.confidence - a.confidence);
+  return {
+    detected: detected.length > 0,
+    wafs: detected,
+    block_status_codes: sigs.block_status_codes ?? []
+  };
+}
+function techCorrelation(tech) {
+  const data = loadJson("tech_correlations");
+  if (!data)
+    return { found: false, error: "tech_correlations.json not loaded" };
+  const key = tech.toLowerCase();
+  const entry = data[key];
+  if (!entry) {
+    const matches = Object.keys(data).filter((k) => k.includes(key) || key.includes(k)).slice(0, 5);
+    return { found: false, tech, suggestions: matches };
+  }
+  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? { vulns: entry.vulns, paths: entry.paths } };
+}
+function cveCorrelation(cveId) {
+  const data = loadJson("cve_correlations");
+  if (!data)
+    return { error: "cve_correlations.json not loaded" };
+  const key = cveId.toUpperCase();
+  const entry = data[key];
+  if (!entry)
+    return { found: false, cve: key, total_known: Object.keys(data).length };
+  return { found: true, cve: key, ...entry };
+}
+function portCorrelation(port) {
+  const data = loadJson("port_correlations");
+  if (!data)
+    return { error: "port_correlations.json not loaded" };
+  const key = String(port);
+  const entry = data[key];
+  if (!entry)
+    return { found: false, port: key, total_known: Object.keys(data).length };
+  return { found: true, port: key, ...entry };
+}
+function fuzzerPayloads(category) {
+  const data = loadJson("fuzzer_data");
+  if (!data)
+    return { error: "fuzzer_data.json not loaded" };
+  if (category) {
+    const c = data[category] ?? data[category.toUpperCase()];
+    return { category, found: Boolean(c), data: c ?? null };
+  }
+  return { categories: Object.keys(data), fuzz_points: data.FUZZ_POINTS ?? null, payloads: data.FUZZ_PAYLOADS ?? null };
+}
+function intelSummary() {
+  const waf = loadJson("waf_signatures");
+  const tech = loadJson("tech_correlations");
+  const cve = loadJson("cve_correlations");
+  const port = loadJson("port_correlations");
+  const fuzz = loadJson("fuzzer_data");
+  const av = loadJson("attack_vectors");
+  return {
+    waf_signatures: waf ? (waf.header_signatures?.length ?? 0) + (waf.body_signatures?.length ?? 0) : 0,
+    tech_correlations: tech ? Object.keys(tech).length : 0,
+    cve_correlations: cve ? Object.keys(cve).length : 0,
+    port_correlations: port ? Object.keys(port).length : 0,
+    fuzzer_categories: fuzz ? Object.keys(fuzz).length : 0,
+    payload_categories: listPayloadCategories().length,
+    nuclei_templates: countTemplates(),
+    attack_vector_categories: av ? av.categories.length : 0,
+    attack_vectors: av ? av.categories.reduce((n, c) => n + c.vectors.length, 0) : 0
+  };
+}
+function listAttackVectors() {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  return {
+    total_categories: data.categories.length,
+    total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
+    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length }))
+  };
+}
+function attackVectors(category) {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  const q = category.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const found = data.categories.find((c) => c.id === q || c.id.includes(q) || c.title.toLowerCase().includes(category.toLowerCase()));
+  if (!found) {
+    const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
+    return { found: false, query: category, suggestions: matches };
+  }
+  return { found: true, id: found.id, title: found.title, count: found.vectors.length, vectors: found.vectors };
+}
+var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
+var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
+function payloadsDir() {
+  if (existsSync5(PACKAGE_PAYLOADS))
+    return PACKAGE_PAYLOADS;
+  return join8(DATA_ROOT, "payloads");
+}
+function templatesDir() {
+  if (existsSync5(PACKAGE_TEMPLATES))
+    return PACKAGE_TEMPLATES;
+  return join8(DATA_ROOT, "templates");
+}
+var PAYLOADS = payloadsDir();
+var TEMPLATES = templatesDir();
+function listPayloadCategories() {
+  try {
+    return readdirSync3(PAYLOADS, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
+  } catch {
+    return [];
+  }
+}
+function payloadLookup(topic) {
+  const cats = listPayloadCategories();
+  const key = topic.toLowerCase();
+  const ALIASES = {
+    sqli: "sql injection",
+    xss: "xss injection",
+    ssrf: "server side request forgery",
+    ssti: "server side template injection",
+    jwt: "json web token",
+    lfi: "file inclusion",
+    rfi: "file inclusion",
+    xxe: "xxe injection",
+    idor: "insecure direct object references",
+    csrf: "cross-site request forgery",
+    cmdi: "command injection",
+    rce: "command injection",
+    cors: "cors misconfiguration",
+    crlf: "crlf injection",
+    prototype: "prototype pollution",
+    nosql: "nosql injection",
+    upload: "upload insecure files"
+  };
+  const normalized = ALIASES[key] ?? key;
+  const exact = cats.find((c) => c.toLowerCase() === normalized);
+  if (exact) {
+    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
+  }
+  const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
+  const matches = cats.filter((c) => {
+    const cl = c.toLowerCase();
+    if (cl.includes(normalized) || normalized.includes(cl))
+      return true;
+    return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
+  });
+  if (matches.length > 0) {
+    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
+  }
+  return { found: false, topic, suggestions: cats.slice(0, 20) };
+}
+function readPayload(category, file) {
+  const cats = listPayloadCategories();
+  const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
+  if (!exact)
+    return { found: false, category, suggestions: cats.slice(0, 20) };
+  const dir = join8(PAYLOADS, exact);
+  const files = listFiles(dir);
+  if (!file) {
+    const readme = files.find((f) => f.toLowerCase() === "readme.md");
+    if (readme) {
+      return { found: true, category: exact, file: readme, content: readFileSync8(join8(dir, readme), "utf8").slice(0, 20000) };
+    }
+    return { found: true, category: exact, files };
+  }
+  const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
+  if (!f)
+    return { found: false, category: exact, file, suggestions: files };
+  return { found: true, category: exact, file: f, content: readFileSync8(join8(dir, f), "utf8").slice(0, 20000) };
+}
+function listFiles(dir) {
+  try {
+    return readdirSync3(dir).filter((f) => f.endsWith(".md") || f.endsWith(".txt") || f.endsWith(".yaml")).sort();
+  } catch {
+    return [];
+  }
+}
+function countTemplates() {
+  try {
+    let n = 0;
+    const walk = (dir) => {
+      for (const e of readdirSync3(dir, { withFileTypes: true })) {
+        if (e.isDirectory())
+          walk(join8(dir, e.name));
+        else if (e.name.endsWith(".yaml"))
+          n++;
+      }
+    };
+    walk(TEMPLATES);
+    return n;
+  } catch {
+    return 0;
+  }
+}
+function templateLookup(topic, limit = 10) {
+  const key = topic.toLowerCase();
+  const hits = [];
+  const walk = (dir, depth = 0) => {
+    if (depth > 6 || hits.length >= limit * 3)
+      return;
+    let entries;
+    try {
+      entries = readdirSync3(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      if (e.isDirectory())
         walk(join8(dir, e.name), depth + 1);
       else if (e.name.endsWith(".yaml")) {
         const name = e.name.toLowerCase();
@@ -51632,506 +52093,168 @@ var API_PATHS = [
   "/api-docs",
   "/v2/api-docs",
   "/v3/api-docs",
-  "/graphql",
-  "/graphiql",
-  "/actuator",
-  "/actuator/health",
-  "/actuator/env",
-  "/api/swagger.json",
-  "/docs",
-  "/redoc"
-];
-async function discoverApi(base) {
-  const out = [];
-  for (const p of API_PATHS) {
-    const r = await httpGet(`${base}${p}`);
-    if (r.status >= 200 && r.status < 400) {
-      out.push({ path: p, status: r.status, body_size: r.body.length });
-    }
-  }
-  return out;
-}
-function extractVersion(headers, body) {
-  const out = [];
-  const server = headers["server"] ?? headers["x-powered-by"] ?? "";
-  const serverVer = /^(nginx|apache|microsoft-iis|openresty|liteSpeed|caddy)\/?([0-9][0-9.\-]*)?/i.exec(server);
-  if (serverVer) {
-    out.push({ product: serverVer[1].toLowerCase(), version: serverVer[2] ?? "unknown", evidence: server });
-  }
-  const phpVer = /php\/([0-9][0-9.\-]*)/i.exec(server);
-  if (phpVer)
-    out.push({ product: "php", version: phpVer[1], evidence: server });
-  const wpVer = /content="WordPress\s+([0-9][0-9.]*)/i.exec(body);
-  if (wpVer)
-    out.push({ product: "wordpress", version: wpVer[1], evidence: `meta generator: WordPress ${wpVer[1]}` });
-  const joomlaVer = /Joomla!?\s*([0-9][0-9.]*)/i.exec(body);
-  if (joomlaVer)
-    out.push({ product: "joomla", version: joomlaVer[1], evidence: `body: Joomla ${joomlaVer[1]}` });
-  const drupalVer = /Drupal\s+([0-9][0-9.]*)/i.exec(body);
-  if (drupalVer)
-    out.push({ product: "drupal", version: drupalVer[1], evidence: `body: Drupal ${drupalVer[1]}` });
-  const powered = headers["x-powered-by"] ?? "";
-  if (powered && !out.some((o) => powered.includes(o.product))) {
-    out.push({ product: powered.split("/")[0].toLowerCase(), version: powered.split("/")[1] ?? "unknown", evidence: powered });
-  }
-  return out;
-}
-function correlateIntel(techs, versionList, portList) {
-  const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
-  const versions = versionList.map((v) => ({
-    product: v.product,
-    version: v.version,
-    correlation: techCorrelation(v.product),
-    payload_lookup: payloadLookup(v.product),
-    template_lookup: templateLookup(v.product, 5)
-  }));
-  const ports = portList.map((p) => ({ port: p.port, service: p.service, ...portCorrelation(p.port) }));
-  return { tech, versions, ports };
-}
-async function liveRecon(target, includeActive = false) {
-  const base = normalizeTarget2(target);
-  const host = (() => {
-    try {
-      return new URL(base).hostname;
-    } catch {
-      return target;
-    }
-  })();
-  const root = await httpGet(base);
-  const interestingHeaders = {};
-  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
-    if (root.headers[k])
-      interestingHeaders[k] = root.headers[k];
-  }
-  const fingerprint = {
-    status: root.status,
-    title: (root.body.match(/<title[^>]*>([^<]+)<\/title>/i) ?? [])[1]?.trim().slice(0, 200) ?? "",
-    server: root.headers["server"] ?? root.headers["x-powered-by"] ?? "",
-    headers: interestingHeaders,
-    body_size: root.body.length
-  };
-  const waf = detectWaf(root.headers, root.body);
-  const techSig = [
-    [/wp-content|wp-includes|wp-json/i, "wordpress"],
-    [/wp-login\.php|wp-admin/i, "wordpress"],
-    [/powered by joomla|com_content/i, "joomla"],
-    [/laravel|_token|csrf-token/i, "laravel"],
-    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
-    [/angular|ng-version/i, "angular"],
-    [/vue|__vue__|v-data/i, "vue"],
-    [/django|csrftoken|__debug__/i, "django"],
-    [/ruby on rails|rails/i, "rails"],
-    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
-    [/phpBB|phpbb/i, "phpbb"],
-    [/mybb|mybb/i, "mybb"],
-    [/drupal|Drupal\.settings/i, "drupal"],
-    [/magento|Mage\./i, "magento"],
-    [/shopify|cdn\.shopify/i, "shopify"],
-    [/grafana|kibana|elastic/i, "grafana-kibana"],
-    [/node\.js|express/i, "nodejs"],
-    [/flask|werkzeug/i, "flask"],
-    [/spring|actuator/i, "spring"]
-  ];
-  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
-  const versions = extractVersion(root.headers, root.body);
-  const { links, scripts } = crawlLinks(base, root.body);
-  const { robots, sitemap } = await fetchRobotsAndSitemap(base);
-  const allUrls = [...links, ...scripts, ...robots, ...sitemap];
-  const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
-  const params = extractParams(allUrls);
-  const { subdomains } = await subdomainEnum(host);
-  const { found: dnsFindings } = await dnsBrute(host);
-  const { urls: wayback } = await waybackUrls(host);
-  const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
-  let openPorts = [];
-  if (includeActive && root.status > 0) {
-    const scan = await scanPorts(host);
-    openPorts = scan.map(({ port, service }) => ({ port, service }));
-  }
-  const intel = correlateIntel(techs, versions, openPorts);
-  const nextSteps = [];
-  if (waf.detected)
-    nextSteps.push(`WAF detected (${waf.wafs?.map((w) => w.waf).join(", ")}) — consult detect_waf + WAF bypass playbook before exploitation.`);
-  for (const t of techs) {
-    const c = techCorrelation(t);
-    if (c.found)
-      nextSteps.push(`Tech '${t}' maps to known vuln classes — read tech_correlation('${t}') and fetch nuclei templates with template_lookup('${t}').`);
-  }
-  for (const v of versions) {
-    nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
-  }
-  if (crawl.endpoints.length > 0)
-    nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
-  if (params.length > 0)
-    nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
-  if (subdomains.length > 0)
-    nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
-  if (dnsFindings.length > 0)
-    nextSteps.push(`DNS-resolved ${dnsFindings.length} hosts (${dnsFindings.map((d) => d.host).slice(0, 8).join(", ")}${dnsFindings.length > 8 ? "…" : ""}) — each is a live subdomain to recon.`);
-  if (wayback.length > 0)
-    nextSteps.push(`Wayback Machine surfaced ${wayback.length} historical URLs — mine them for hidden endpoints, old params, and forgotten pages; feed to taint_file/blitz_scan.`);
-  if (openPorts.length > 0)
-    nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
-  if (apiEndpoints.length > 0)
-    nextSteps.push(`API endpoints exposed (${apiEndpoints.map((e) => e.path).join(", ")}) — audit them with api-security playbook; check for BOLA/IDOR/auth gaps.`);
-  if (nextSteps.length === 0)
-    nextSteps.push("Nothing exposed on the surface — try subdomain enumeration, port scan (active), or request source access for EAGLE-EYE analysis.");
-  nextSteps.push("Every confirmed finding: record with finding_create, attach confidence_score, redact secrets. A hit is a hypothesis until verified.");
-  return {
-    target: base,
-    host,
-    fingerprint,
-    waf,
-    tech: { detected: techs, server: fingerprint.server },
-    versions,
-    crawl,
-    params,
-    subdomains,
-    dns_findings: dnsFindings,
-    wayback_urls: wayback,
-    api_endpoints: apiEndpoints,
-    open_ports: openPorts,
-    intel,
-    next_steps: nextSteps
-  };
-}
-
-// src/strike.ts
-var DEFAULT_TIMEOUT_MS = 15000;
-async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEOUT_MS) {
-  const controller = new AbortController;
-  const t = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const res = await fetch(url, {
-      method,
-      body: method === "POST" ? data : undefined,
-      headers: { "User-Agent": "blitzstrike/1.0", ...headers ?? {} },
-      signal: controller.signal,
-      redirect: "follow"
-    });
-    const body = await res.text();
-    const hdrs = {};
-    res.headers.forEach((v, k) => {
-      hdrs[k] = v;
-    });
-    return { status: res.status, body: body.slice(0, 20000), headers: hdrs };
-  } catch (e) {
-    return { status: 0, body: String(e), headers: {} };
-  } finally {
-    clearTimeout(t);
-  }
-}
-function defaultMarker() {
-  return `BS${Date.now().toString(36).toUpperCase()}${Math.random().toString(36).slice(2, 8).toUpperCase()}`;
-}
-function inject(target, value, param) {
-  const placeholder = "{{MARKER}}";
-  if (target.includes(placeholder))
-    return target.split(placeholder).join(value);
-  if (target.includes("?"))
-    return `${target}&${param}=${encodeURIComponent(value)}`;
-  return `${target}?${param}=${encodeURIComponent(value)}`;
-}
-async function strikeVerify(input) {
-  const method = input.method ?? "GET";
-  const param = input.param ?? "q";
-  const marker = input.marker ?? defaultMarker();
-  const control = input.control ?? defaultMarker();
-  const baseUrl = input.url;
-  const timeoutMs = input.timeout ?? DEFAULT_TIMEOUT_MS;
-  const baselineTarget = inject(baseUrl, "", param).replace(/[?&]q=$/, "").replace(/[?&]$/, "");
-  const markerTarget = inject(baseUrl, marker, param);
-  const controlTarget = inject(baseUrl, control, param);
-  const baseline = await httpRequest(baselineTarget, method, input.data, input.headers, timeoutMs);
-  const markerResp = await httpRequest(markerTarget, method, input.data, input.headers, timeoutMs);
-  const controlResp = await httpRequest(controlTarget, method, input.data, input.headers, timeoutMs);
-  if (baseline.status === 0 || markerResp.status === 0) {
-    return {
-      status: "blocked",
-      marker_reflected: false,
-      control_reflected: false,
-      baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
-      marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
-      control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
-      reason: "request failed or target unreachable — cannot validate",
-      evidence: []
-    };
-  }
-  const markerReflected = markerResp.body.includes(marker);
-  const controlReflected = controlResp.body.includes(control);
-  let status;
-  let reason;
-  if (markerReflected && !controlReflected) {
-    status = "confirmed";
-    reason = "marker reflected; negative control did not — the sink reflects attacker-controlled input (real finding)";
-  } else if (markerReflected && controlReflected) {
-    status = "false_positive";
-    reason = "marker AND negative control both reflected — behaviour is indistinguishable from benign reflection (likely false positive)";
-  } else if (!markerReflected && !controlReflected) {
-    status = "unconfirmed";
-    reason = "marker not reflected — reachability/exploitability could not be demonstrated live";
-  } else {
-    status = "unconfirmed";
-    reason = "negative control reflected but marker did not — inconsistent, requires deeper analysis";
-  }
-  const evidence = [
-    {
-      type: "baseline_comparison",
-      description: `Baseline response (status ${baseline.status}) for ${redactSecrets(baselineTarget)}`,
-      artifacts: [{ name: "baseline", kind: "http_response", content: `${baseline.status}
-${baseline.body}` }]
-    },
-    {
-      type: "validation_result",
-      description: `Marker '${redactSecrets(marker)}' reflected=${markerReflected}; control reflected=${controlReflected}`,
-      artifacts: [{ name: "marker_response", kind: "http_response", content: `${markerResp.status}
-${markerResp.body}` }]
-    },
-    {
-      type: "negative_control",
-      description: `Negative control '${redactSecrets(control)}' reflected=${controlReflected}`,
-      artifacts: [{ name: "control_response", kind: "http_response", content: `${controlResp.status}
-${controlResp.body}` }]
-    }
-  ];
-  return {
-    status,
-    marker_reflected: markerReflected,
-    control_reflected: controlReflected,
-    baseline: { status: baseline.status, body_preview: redactSecrets(baseline.body.slice(0, 400)), body_hash: sha256(baseline.body) },
-    marker_response: { status: markerResp.status, body_preview: redactSecrets(markerResp.body.slice(0, 400)), body_hash: sha256(markerResp.body) },
-    control_response: { status: controlResp.status, body_preview: redactSecrets(controlResp.body.slice(0, 400)), body_hash: sha256(controlResp.body) },
-    reason,
-    evidence
-  };
-}
-function resolveFinding(finding, verdict) {
-  let f = finding;
-  if (f.status === "hypothesis") {
-    f = transition(f, "validating");
-  }
-  switch (verdict.status) {
-    case "confirmed":
-      return confirmFinding(f, {
-        evidence: verdict.evidence,
-        negative_control: true,
-        baseline: true
-      });
-    case "false_positive":
-      return rejectFinding(f, "false_positive", verdict.reason, verdict.evidence);
-    case "blocked":
-      return rejectFinding(f, "blocked", verdict.reason, verdict.evidence);
-    case "unconfirmed":
-    case "likely":
-    default: {
-      return {
-        ...f,
-        validation: { performed: true, status: verdict.status === "likely" ? "likely" : "unconfirmed", negative_control: verdict.control_reflected === false, baseline: true },
-        remediation: { ...f.remediation, note: verdict.reason },
-        timestamps: { ...f.timestamps, updated: new Date().toISOString() }
-      };
-    }
-  }
-}
-
-// src/cvss.ts
-var AV_WEIGHT = { N: 0.85, A: 0.62, L: 0.55, P: 0.2 };
-var AC_WEIGHT = { L: 0.77, H: 0.44 };
-var PR_WEIGHT = {
-  U: { N: 0.85, L: 0.62, H: 0.27 },
-  C: { N: 0.85, L: 0.68, H: 0.5 }
-};
-var UI_WEIGHT = { N: 0.85, R: 0.62 };
-var CIA_WEIGHT = { H: 0.56, L: 0.22, N: 0 };
-function roundup(value) {
-  return Math.ceil(value * 10) / 10;
-}
-function cvssBaseScore(input) {
-  const AV = input.AV ?? "N";
-  const AC = input.AC ?? "L";
-  const PR = input.PR ?? "N";
-  const UI = input.UI ?? "N";
-  const S = input.S ?? "U";
-  const C = input.C ?? "N";
-  const I = input.I ?? "N";
-  const A = input.A ?? "N";
-  const iscBase = 1 - (1 - CIA_WEIGHT[C]) * (1 - CIA_WEIGHT[I]) * (1 - CIA_WEIGHT[A]);
-  let impact;
-  if (S === "U") {
-    impact = 6.42 * iscBase;
-  } else {
-    impact = 7.52 * (iscBase - 0.029) - 3.25 * Math.pow(iscBase - 0.02, 15);
-  }
-  const exploitability = 8.22 * AV_WEIGHT[AV] * AC_WEIGHT[AC] * PR_WEIGHT[S][PR] * UI_WEIGHT[UI];
-  if (impact <= 0)
-    return 0;
-  if (S === "U") {
-    return roundup(Math.min(impact + exploitability, 10));
-  }
-  return roundup(Math.min(1.08 * (impact + exploitability), 10));
-}
-function cvssVector(input) {
-  const order = [
-    ["AV", input.AV ?? "N"],
-    ["AC", input.AC ?? "L"],
-    ["PR", input.PR ?? "N"],
-    ["UI", input.UI ?? "N"],
-    ["S", input.S ?? "U"],
-    ["C", input.C ?? "N"],
-    ["I", input.I ?? "N"],
-    ["A", input.A ?? "N"]
-  ];
-  return "CVSS:3.1/" + order.map(([k, v]) => `${k}:${v}`).join("/");
-}
-function cvssSeverity(score) {
-  if (score === 0)
-    return "none";
-  if (score < 4)
-    return "low";
-  if (score < 7)
-    return "medium";
-  if (score < 9)
-    return "high";
-  return "critical";
-}
-function cvssAssess(input) {
-  const score = cvssBaseScore(input);
-  return { score, vector: cvssVector(input), severity: cvssSeverity(score) };
-}
-
-// src/dedup.ts
-function rootCauseSignature(finding) {
-  const sinkType = (finding.sink?.type ?? "unknown").toLowerCase();
-  const sourceType = (finding.source?.type ?? "unknown").toLowerCase();
-  const cwe = (finding.classification?.cwe ?? "").toUpperCase();
-  return [sinkType, sourceType, cwe].filter(Boolean).join("|");
-}
-function dedupFindings(findings) {
-  const groups = new Map;
-  for (const f of findings) {
-    const sig = rootCauseSignature(f);
-    const existing = groups.get(sig);
-    if (existing) {
-      existing.count += 1;
-      existing.findings.push(f);
-    } else {
-      groups.set(sig, { signature: sig, count: 1, representative: f, findings: [f] });
+  "/graphql",
+  "/graphiql",
+  "/actuator",
+  "/actuator/health",
+  "/actuator/env",
+  "/api/swagger.json",
+  "/docs",
+  "/redoc"
+];
+async function discoverApi(base) {
+  const out = [];
+  for (const p of API_PATHS) {
+    const r = await httpGet(`${base}${p}`);
+    if (r.status >= 200 && r.status < 400) {
+      out.push({ path: p, status: r.status, body_size: r.body.length });
     }
   }
-  return [...groups.values()];
-}
-function uniqueFindings(findings) {
-  return dedupFindings(findings).map((g) => g.representative);
+  return out;
 }
-
-// src/report.ts
-function summarize(findings) {
-  const byStatus = {};
-  const bySeverity = {};
-  let evidenceArtifacts = 0;
-  for (const f of findings) {
-    byStatus[f.status] = (byStatus[f.status] ?? 0) + 1;
-    const sev = f.classification?.severity ?? "informational";
-    bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
-    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+function extractVersion(headers, body) {
+  const out = [];
+  const server = headers["server"] ?? headers["x-powered-by"] ?? "";
+  const serverVer = /^(nginx|apache|microsoft-iis|openresty|liteSpeed|caddy)\/?([0-9][0-9.\-]*)?/i.exec(server);
+  if (serverVer) {
+    out.push({ product: serverVer[1].toLowerCase(), version: serverVer[2] ?? "unknown", evidence: server });
   }
-  const groups = dedupFindings(findings);
-  return {
-    total_findings: findings.length,
-    unique_root_causes: groups.length,
-    by_status: byStatus,
-    by_severity: bySeverity,
-    confirmed: byStatus["confirmed"] ?? 0,
-    false_positives: byStatus["false_positive"] ?? 0,
-    evidence_artifacts: evidenceArtifacts
-  };
+  const phpVer = /php\/([0-9][0-9.\-]*)/i.exec(server);
+  if (phpVer)
+    out.push({ product: "php", version: phpVer[1], evidence: server });
+  const wpVer = /content="WordPress\s+([0-9][0-9.]*)/i.exec(body);
+  if (wpVer)
+    out.push({ product: "wordpress", version: wpVer[1], evidence: `meta generator: WordPress ${wpVer[1]}` });
+  const joomlaVer = /Joomla!?\s*([0-9][0-9.]*)/i.exec(body);
+  if (joomlaVer)
+    out.push({ product: "joomla", version: joomlaVer[1], evidence: `body: Joomla ${joomlaVer[1]}` });
+  const drupalVer = /Drupal\s+([0-9][0-9.]*)/i.exec(body);
+  if (drupalVer)
+    out.push({ product: "drupal", version: drupalVer[1], evidence: `body: Drupal ${drupalVer[1]}` });
+  const powered = headers["x-powered-by"] ?? "";
+  if (powered && !out.some((o) => powered.includes(o.product))) {
+    out.push({ product: powered.split("/")[0].toLowerCase(), version: powered.split("/")[1] ?? "unknown", evidence: powered });
+  }
+  return out;
 }
-function severityLabel(sev) {
-  const s = sev.toUpperCase();
-  if (s === "CRITICAL")
-    return "\uD83D\uDD34 CRITICAL";
-  if (s === "HIGH")
-    return "\uD83D\uDFE0 HIGH";
-  if (s === "MEDIUM")
-    return "\uD83D\uDFE1 MEDIUM";
-  if (s === "LOW")
-    return "\uD83D\uDD35 LOW";
-  return "⚪ INFORMATIONAL";
+function correlateIntel(techs, versionList, portList) {
+  const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
+  const versions = versionList.map((v) => ({
+    product: v.product,
+    version: v.version,
+    correlation: techCorrelation(v.product),
+    payload_lookup: payloadLookup(v.product),
+    template_lookup: templateLookup(v.product, 5)
+  }));
+  const ports = portList.map((p) => ({ port: p.port, service: p.service, ...portCorrelation(p.port) }));
+  return { tech, versions, ports };
 }
-function reportMarkdown(findings, opts = {}) {
-  const summary = summarize(findings);
-  const lines = [];
-  lines.push(`# ${opts.title ?? "Blitz Strike — Security Assessment Report"}`);
-  lines.push("");
-  lines.push(`- Scope: ${opts.scope ?? "(unset)"}`);
-  lines.push(`- Blitz Strike version: ${opts.version ?? "unknown"}`);
-  if (opts.include_timestamp)
-    lines.push(`- Generated: ${new Date().toISOString()}`);
-  lines.push("");
-  lines.push("## Summary");
-  lines.push("");
-  lines.push(`| Metric | Value |`);
-  lines.push(`|--------|-------|`);
-  lines.push(`| Total findings | ${summary.total_findings} |`);
-  lines.push(`| Unique root causes | ${summary.unique_root_causes} |`);
-  lines.push(`| Confirmed | ${summary.confirmed} |`);
-  lines.push(`| False positives | ${summary.false_positives} |`);
-  lines.push(`| Evidence artifacts | ${summary.evidence_artifacts} |`);
-  lines.push("");
-  lines.push("### By status");
-  lines.push("");
-  for (const [status, n] of Object.entries(summary.by_status).sort()) {
-    lines.push(`- ${status}: ${n}`);
+async function liveRecon(target, includeActive = false) {
+  const base = normalizeTarget2(target);
+  const host = (() => {
+    try {
+      return new URL(base).hostname;
+    } catch {
+      return target;
+    }
+  })();
+  const root = await httpGet(base);
+  const interestingHeaders = {};
+  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
+    if (root.headers[k])
+      interestingHeaders[k] = root.headers[k];
   }
-  lines.push("");
-  lines.push("### By severity");
-  lines.push("");
-  for (const [sev, n] of Object.entries(summary.by_severity).sort()) {
-    lines.push(`- ${sev}: ${n}`);
+  const fingerprint = {
+    status: root.status,
+    title: (root.body.match(/<title[^>]*>([^<]+)<\/title>/i) ?? [])[1]?.trim().slice(0, 200) ?? "",
+    server: root.headers["server"] ?? root.headers["x-powered-by"] ?? "",
+    headers: interestingHeaders,
+    body_size: root.body.length
+  };
+  const waf = detectWaf(root.headers, root.body);
+  const techSig = [
+    [/wp-content|wp-includes|wp-json/i, "wordpress"],
+    [/wp-login\.php|wp-admin/i, "wordpress"],
+    [/powered by joomla|com_content/i, "joomla"],
+    [/laravel|_token|csrf-token/i, "laravel"],
+    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
+    [/angular|ng-version/i, "angular"],
+    [/vue|__vue__|v-data/i, "vue"],
+    [/django|csrftoken|__debug__/i, "django"],
+    [/ruby on rails|rails/i, "rails"],
+    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
+    [/phpBB|phpbb/i, "phpbb"],
+    [/mybb|mybb/i, "mybb"],
+    [/drupal|Drupal\.settings/i, "drupal"],
+    [/magento|Mage\./i, "magento"],
+    [/shopify|cdn\.shopify/i, "shopify"],
+    [/grafana|kibana|elastic/i, "grafana-kibana"],
+    [/node\.js|express/i, "nodejs"],
+    [/flask|werkzeug/i, "flask"],
+    [/spring|actuator/i, "spring"]
+  ];
+  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
+  const versions = extractVersion(root.headers, root.body);
+  const { links, scripts } = crawlLinks(base, root.body);
+  const { robots, sitemap } = await fetchRobotsAndSitemap(base);
+  const allUrls = [...links, ...scripts, ...robots, ...sitemap];
+  const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
+  const params = extractParams(allUrls);
+  const { subdomains } = await subdomainEnum(host);
+  const { found: dnsFindings } = await dnsBrute(host);
+  const { urls: wayback } = await waybackUrls(host);
+  const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
+  let openPorts = [];
+  if (includeActive && root.status > 0) {
+    const scan = await scanPorts(host);
+    openPorts = scan.map(({ port, service }) => ({ port, service }));
   }
-  lines.push("");
-  lines.push("## Findings");
-  lines.push("");
-  if (findings.length === 0) {
-    lines.push("_No findings._");
-    return lines.join(`
-`) + `
-`;
+  const intel = correlateIntel(techs, versions, openPorts);
+  const nextSteps = [];
+  if (waf.detected)
+    nextSteps.push(`WAF detected (${waf.wafs?.map((w) => w.waf).join(", ")}) — consult detect_waf + WAF bypass playbook before exploitation.`);
+  for (const t of techs) {
+    const c = techCorrelation(t);
+    if (c.found)
+      nextSteps.push(`Tech '${t}' maps to known vuln classes — read tech_correlation('${t}') and fetch nuclei templates with template_lookup('${t}').`);
   }
-  for (const f of findings) {
-    lines.push(`### ${f.id} — ${f.title} [${severityLabel(f.classification?.severity ?? "informational")}]`);
-    lines.push("");
-    lines.push(`- **Status**: \`${f.status}\``);
-    lines.push(`- **Confidence**: ${f.confidence} (${f.confidence_level})`);
-    if (f.classification?.cwe)
-      lines.push(`- **CWE**: ${f.classification.cwe}`);
-    if (f.classification?.cvss_score != null)
-      lines.push(`- **CVSS**: ${f.classification.cvss_score} (${f.classification.cvss_vector ?? ""}) — ${cvssSeverity(f.classification.cvss_score)}`);
-    lines.push(`- **Source**: ${f.source?.type} \`${f.source?.name ?? ""}\``);
-    lines.push(`- **Sink**: ${f.sink?.type}${f.sink?.symbol ? ` \`${f.sink.symbol}\`` : ""}`);
-    if (f.target?.host || f.target?.endpoint)
-      lines.push(`- **Target**: ${[f.target.host, f.target.endpoint].filter(Boolean).join("")}`);
-    lines.push(`- **Evidence**: ${f.evidence?.length ?? 0} record(s)`);
-    if (f.remediation && Object.keys(f.remediation).length) {
-      lines.push(`- **Note**: ${JSON.stringify(f.remediation)}`);
-    }
-    lines.push("");
+  for (const v of versions) {
+    nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
   }
-  return lines.join(`
-`) + `
-`;
-}
-function reportJson(findings, opts = {}) {
-  const summary = summarize(findings);
-  const payload = {
-    title: opts.title ?? "Blitz Strike — Security Assessment Report",
-    scope: opts.scope ?? null,
-    version: opts.version ?? null,
-    summary,
-    findings,
-    integrity: sha256(JSON.stringify({ summary, findings }))
+  if (crawl.endpoints.length > 0)
+    nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
+  if (params.length > 0)
+    nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
+  if (subdomains.length > 0)
+    nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
+  if (dnsFindings.length > 0)
+    nextSteps.push(`DNS-resolved ${dnsFindings.length} hosts (${dnsFindings.map((d) => d.host).slice(0, 8).join(", ")}${dnsFindings.length > 8 ? "…" : ""}) — each is a live subdomain to recon.`);
+  if (wayback.length > 0)
+    nextSteps.push(`Wayback Machine surfaced ${wayback.length} historical URLs — mine them for hidden endpoints, old params, and forgotten pages; feed to taint_file/blitz_scan.`);
+  if (openPorts.length > 0)
+    nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
+  if (apiEndpoints.length > 0)
+    nextSteps.push(`API endpoints exposed (${apiEndpoints.map((e) => e.path).join(", ")}) — audit them with api-security playbook; check for BOLA/IDOR/auth gaps.`);
+  if (nextSteps.length === 0)
+    nextSteps.push("Nothing exposed on the surface — try subdomain enumeration, port scan (active), or request source access for EAGLE-EYE analysis.");
+  nextSteps.push("Every confirmed finding: record with finding_create, attach confidence_score, redact secrets. A hit is a hypothesis until verified.");
+  return {
+    target: base,
+    host,
+    fingerprint,
+    waf,
+    tech: { detected: techs, server: fingerprint.server },
+    versions,
+    crawl,
+    params,
+    subdomains,
+    dns_findings: dnsFindings,
+    wayback_urls: wayback,
+    api_endpoints: apiEndpoints,
+    open_ports: openPorts,
+    intel,
+    next_steps: nextSteps
   };
-  return JSON.stringify(payload, null, 2);
 }
 
 // src/benchmark.ts
@@ -52374,7 +52497,7 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates).\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: full one-call audit (scope gate -> triage -> chain enrichment " + "  -> findings with tool manuals attached).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 85 playbooks (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates).\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 85 playbooks (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",
@@ -52563,7 +52686,7 @@ function createServer() {
   });
   server.registerTool("run_engagement", {
     title: "STRIKE full engagement",
-    description: "STRIKE: run a full 3-tier audit server-side (scope gate -> triage -> chain enrichment -> findings). One call.",
+    description: "STRIKE: run a full audit in ONE call (no babysitting). Source path -> scope gate -> triage -> chain enrichment -> findings -> inline report (markdown+JSON+SARIF). URL target -> autonomous live marker sweep (strike_verify per parameter) -> confirmed findings -> inline report. Scope-gated: URL targets require an authorized scope.",
     inputSchema: {
       target: string2().describe("Source path or URL"),
       scope: string2().optional().describe("Scope (for URL targets)"),
@@ -52572,7 +52695,8 @@ function createServer() {
       remember: boolean2().optional().describe("Auto-capture matched chains to memory (default true)")
     }
   }, async ({ target, scope, mode, max_files, remember }) => {
-    const r = runEngagement(target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
+    const isUrl = /^https?:\/\//i.test(target);
+    const r = isUrl ? await runLiveEngagement(target, scope ?? "", mode ?? "bug-bounty") : runEngagement(target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
     return {
       content: [{ type: "text", text: JSON.stringify(r) }]
     };