blitzstrike 1.0.49 → 1.0.52

package/CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.52] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 12: browser automation agent)
+
+- **Browser Automation Agent** (`src/browser-agent.ts`, §16):
+  - Session-based (one persistent page) so multi-step flows work.
+  - Ops: `open`/`navigate`/`click`/`type`/`evaluate`/`screenshot`/`back`/`forward`/
+    `get_cookie`/`set_cookie`, plus `detectAuthForm()` and `browserDiagnostics()`.
+  - Graceful degradation — every op reports `unavailable` when `playwright-core`
+    (optional peer) is missing, never throws.
+- New `@browser` mission agent (URL-scope-gated) — detects login forms and JS
+  runtime errors and emits auth-flow hypotheses.
+- New MCP tool `browser_agent` (session ops + detect_auth_form + diagnostics + close).
+
+## [1.0.51] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 11: adversarial reviewer)
+
+- **Adversarial Reviewer** (`src/mission/reviewer.ts`, §15):
+  - `reviewFinding()` — challenges a hypothesis with the ten §15 questions
+    (reachability, auth required, authorization elsewhere, middleware, attacker
+    control, sink reachability, caching, reproducibility, negative control,
+    impact accuracy), each a deterministic check against evidence + Security Graph.
+  - Returns CONFIRMED / REJECTED / NEEDS_MORE_EVIDENCE.
+  - `reviewValidated()` — reviews every validated hypothesis in a mission.
+- `@reviewer` now uses the full §15 review (rejects on any hard fail; demands
+  more evidence when supporting signals are too weak).
+
+## [1.0.50] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 10: cross-agent memory)
+
+- **Cross-agent Memory** (`src/mission/memory.ts`, §20):
+  - `persistMissionMemory()` — persists confirmed findings (verified),
+    rejected findings, and failed approaches (with `future_policy`) into the
+    long-term memory store; pending hypotheses are NOT persisted (unverified).
+  - `recallForTarget()` — retrieves memory relevant to a target, to seed a
+    fresh mission.
+- Mission Control's `finalize` now persists reusable knowledge and records the
+  saved/deduped count in `memory_refs`.
+
 ## [1.0.49] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 9: failure recovery)

package/dist/index.js

@@ -17722,6 +17722,219 @@ var init_universal_taint = __esm(() => {
   extensionMap = new Map;
 });
 
+// src/browser-agent.ts
+async function ensureChromium2() {
+  if (chromiumCache2)
+    return chromiumCache2;
+  try {
+    chromiumCache2 = await import("playwright-core");
+    return chromiumCache2;
+  } catch {
+    return null;
+  }
+}
+async function ensureSession() {
+  if (page)
+    return { available: true };
+  const chr = await ensureChromium2();
+  if (!chr)
+    return { available: false, reason: "playwright-core not installed (optional peer dependency)" };
+  try {
+    browser = await chr.chromium.launch({ headless: true });
+    page = await browser.newPage();
+    page.on("console", (m) => {
+      const msg = m;
+      if (msg.type() === "error")
+        consoleErrors.push(msg.text());
+    });
+    page.on("pageerror", (e) => pageErrors.push(String(e)));
+    return { available: true };
+  } catch (e) {
+    return { available: false, reason: e instanceof Error ? e.message : String(e) };
+  }
+}
+function unavailable2(op, reason) {
+  return { op, ok: false, unavailable: true, detail: reason };
+}
+function fail(op, e) {
+  return { op, ok: false, unavailable: false, detail: e instanceof Error ? e.message : String(e) };
+}
+async function browserOpen(url) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("open", s.reason ?? "unavailable");
+  try {
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 20000 });
+    return { op: "open", ok: true, unavailable: false, detail: `opened ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("open", e);
+  }
+}
+async function browserNavigate(url) {
+  return browserOpen(url);
+}
+async function browserClick(selector) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("click", s.reason ?? "unavailable");
+  try {
+    await page.click(selector);
+    return { op: "click", ok: true, unavailable: false, detail: `clicked ${selector}` };
+  } catch (e) {
+    return fail("click", e);
+  }
+}
+async function browserType(selector, text) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("type", s.reason ?? "unavailable");
+  try {
+    await page.fill(selector, text);
+    return { op: "type", ok: true, unavailable: false, detail: `typed into ${selector}` };
+  } catch (e) {
+    return fail("type", e);
+  }
+}
+async function browserEvaluate(js) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("evaluate", s.reason ?? "unavailable");
+  try {
+    const value = await page.evaluate((code) => {
+      const fn = new Function(`"use strict"; return (${code})`)();
+      return typeof fn === "function" ? fn() : fn;
+    }, js);
+    return { op: "evaluate", ok: true, unavailable: false, detail: "evaluated", value };
+  } catch (e) {
+    return fail("evaluate", e);
+  }
+}
+async function browserScreenshot(path) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("screenshot", s.reason ?? "unavailable");
+  try {
+    const buf = await page.screenshot(path ? { path } : {});
+    return { op: "screenshot", ok: true, unavailable: false, detail: path ? `saved ${path}` : "captured (in-memory)", value: path ? undefined : buf.byteLength };
+  } catch (e) {
+    return fail("screenshot", e);
+  }
+}
+async function browserBack() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("back", s.reason ?? "unavailable");
+  try {
+    await page.goBack();
+    return { op: "back", ok: true, unavailable: false, detail: `back to ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("back", e);
+  }
+}
+async function browserForward() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("forward", s.reason ?? "unavailable");
+  try {
+    await page.goForward();
+    return { op: "forward", ok: true, unavailable: false, detail: `forward to ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("forward", e);
+  }
+}
+async function browserGetCookie(name) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("get_cookie", s.reason ?? "unavailable");
+  try {
+    const cookies = await page.context().cookies();
+    const hit = cookies.filter((c) => c.name === name);
+    return { op: "get_cookie", ok: true, unavailable: false, detail: hit.length ? "found" : "not found", value: hit };
+  } catch (e) {
+    return fail("get_cookie", e);
+  }
+}
+async function browserSetCookie(name, value) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("set_cookie", s.reason ?? "unavailable");
+  try {
+    const url = page.url();
+    await page.context().addCookies([{ name, value, url }]);
+    return { op: "set_cookie", ok: true, unavailable: false, detail: `set ${name}` };
+  } catch (e) {
+    return fail("set_cookie", e);
+  }
+}
+async function browserClose() {
+  if (browser) {
+    await browser.close().catch(() => {
+      return;
+    });
+    browser = null;
+    page = null;
+  }
+}
+async function detectAuthForm() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("evaluate", s.reason ?? "unavailable");
+  try {
+    const value = await page.evaluate(() => {
+      const forms = Array.from(document.querySelectorAll("form"));
+      const loginForm = forms.find((f) => /login|signin|auth/i.test(f.action || "") || f.querySelector('input[type="password"]'));
+      if (!loginForm)
+        return { found: false };
+      const userField = loginForm.querySelector('input[type="email"], input[type="text"], input[name*="user"], input[name*="email"], input[name*="login"]');
+      const passField = loginForm.querySelector('input[type="password"]');
+      return {
+        found: true,
+        action: loginForm.action || "(self)",
+        has_user: Boolean(userField),
+        has_pass: Boolean(passField),
+        user_selector: userField ? `input[name="${userField.name || ""}"], input[type="${userField.type}"]` : null,
+        pass_selector: passField ? 'input[type="password"]' : null
+      };
+    });
+    return { op: "evaluate", ok: true, unavailable: false, detail: value.found ? "login form detected" : "no login form", value };
+  } catch (e) {
+    return fail("evaluate", e);
+  }
+}
+async function browserAgent(op, args = []) {
+  switch (op) {
+    case "open":
+      return browserOpen(args[0] ?? "");
+    case "navigate":
+      return browserNavigate(args[0] ?? "");
+    case "click":
+      return browserClick(args[0] ?? "");
+    case "type":
+      return browserType(args[0] ?? "", args[1] ?? "");
+    case "evaluate":
+      return browserEvaluate(args[0] ?? "");
+    case "screenshot":
+      return browserScreenshot(args[0] || undefined);
+    case "back":
+      return browserBack();
+    case "forward":
+      return browserForward();
+    case "get_cookie":
+      return browserGetCookie(args[0] ?? "");
+    case "set_cookie":
+      return browserSetCookie(args[0] ?? "", args[1] ?? "");
+  }
+}
+function browserDiagnostics() {
+  return { console_errors: [...consoleErrors], page_errors: [...pageErrors] };
+}
+var chromiumCache2 = null, browser = null, page = null, consoleErrors, pageErrors;
+var init_browser_agent = __esm(() => {
+  init_evidence();
+  consoleErrors = [];
+  pageErrors = [];
+});
+
 // src/sync.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync16, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync3 } from "node:fs";
 import { join as join12 } from "node:path";
@@ -18258,6 +18471,92 @@ var init_planner = __esm(() => {
   RISK_PENALTY = { low: 0, medium: 0.1, high: 0.2 };
 });
 
+// src/mission/reviewer.ts
+function checkAll(h, mission) {
+  const ev = h.evidence.toLowerCase();
+  const sinkNode = mission.graph.nodes.find((n) => n.properties && n.properties.hypothesis === h.id);
+  const reachable = sinkNode ? incoming(mission.graph, sinkNode.id).length > 0 : false;
+  return [
+    {
+      id: "reachable_code",
+      question: "Is the vulnerable code actually reachable?",
+      verdict: reachable ? "pass" : "unknown",
+      note: reachable ? "sink has an incoming flow edge" : "no flow edge in the graph"
+    },
+    {
+      id: "auth_required",
+      question: "Is authentication required?",
+      verdict: /auth-gated|auth_required|login required/i.test(ev) ? "pass" : "unknown",
+      note: /auth-gated|auth_required|login required/i.test(ev) ? "auth gate detected" : "no auth gate signal"
+    },
+    {
+      id: "authz_elsewhere",
+      question: "Is authorization enforced elsewhere?",
+      verdict: /missing_authorization/i.test(h.type) ? "fail" : "unknown",
+      note: /missing_authorization/i.test(h.type) ? "no authorization boundary detected" : "not an authorization finding"
+    },
+    {
+      id: "middleware",
+      question: "Is there middleware protection?",
+      verdict: /sanitized|middleware|waf|firewall/i.test(ev) ? "pass" : "unknown",
+      note: /sanitized|middleware|waf|firewall/i.test(ev) ? "sanitizer/middleware present" : "no protection signal"
+    },
+    {
+      id: "attacker_controlled",
+      question: "Is the input actually attacker-controlled?",
+      verdict: /attacker-controlled|user input|\$_(get|post|request|cookie)/i.test(ev) ? "pass" : "unknown",
+      note: /attacker-controlled|user input|\$_(get|post|request|cookie)/i.test(ev) ? "input is attacker-controlled" : "input provenance unclear"
+    },
+    {
+      id: "sink_reachable",
+      question: "Is the sink reachable?",
+      verdict: sinkNode ? "pass" : "unknown",
+      note: sinkNode ? "sink node present in graph" : "sink not mapped in graph"
+    },
+    {
+      id: "caching",
+      question: "Is the observed behavior caused by caching?",
+      verdict: /cache|etag|304/i.test(ev) ? "fail" : "unknown",
+      note: /cache|etag|304/i.test(ev) ? "possible cache artifact" : "no cache signal"
+    },
+    {
+      id: "reproducible",
+      question: "Is the exploit reproducible?",
+      verdict: /verdict=confirmed|reproducible|marker/i.test(ev) ? "pass" : "unknown",
+      note: /verdict=confirmed|reproducible|marker/i.test(ev) ? "live validation performed" : "no live validation"
+    },
+    {
+      id: "negative_control",
+      question: "Does the negative control remain inert?",
+      verdict: /control (not|did not|inert)|control=false|verdict=confirmed/i.test(ev) ? "pass" : /control.*reflected|benign echo|false_positive/i.test(ev) ? "fail" : "unknown",
+      note: /benign echo|false_positive/i.test(ev) ? "control also reflected" : /verdict=confirmed/i.test(ev) ? "control inert" : "no negative control"
+    },
+    {
+      id: "impact_accurate",
+      question: "Is the impact accurately classified?",
+      verdict: /cwe-\d+/i.test(h.potential_impact) || h.potential_impact !== "unspecified" ? "pass" : "unknown",
+      note: h.potential_impact !== "unspecified" ? `impact: ${h.potential_impact}` : "impact unspecified"
+    }
+  ];
+}
+function reviewFinding(h, mission) {
+  const questions = checkAll(h, mission);
+  const fails = questions.filter((q) => q.verdict === "fail").length;
+  const passes = questions.filter((q) => q.verdict === "pass").length;
+  let outcome;
+  if (fails > 0)
+    outcome = "REJECTED";
+  else if (passes < 3)
+    outcome = "NEEDS_MORE_EVIDENCE";
+  else
+    outcome = "CONFIRMED";
+  return { hypothesis_id: h.id, outcome, questions };
+}
+function reviewValidated(mission) {
+  return mission.hypotheses.filter((h) => h.status === "validated").map((h) => reviewFinding(h, mission));
+}
+var init_reviewer = () => {};
+
 // src/agents.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 function emptyGraph() {
@@ -18273,9 +18572,10 @@ function sourceFiles(root, max = 500) {
 function agentFor(type) {
   return AGENTS[type];
 }
-var reconAgent, webAgent, sourceAgent, analysisAgent, authAgent, validatorAgent, reviewerAgent, reporterAgent, mobileAgent, cloudAgent, commanderAgent, apiAgent, AGENTS;
+var reconAgent, webAgent, sourceAgent, analysisAgent, authAgent, validatorAgent, reviewerAgent, browserAgent2, reporterAgent, mobileAgent, cloudAgent, commanderAgent, apiAgent, AGENTS;
 var init_agents = __esm(() => {
   init_planner();
+  init_reviewer();
   init_orchestrator();
   init_scanner();
   init_eagle2();
@@ -18455,25 +18755,64 @@ var init_agents = __esm(() => {
     responsibility: "Challenge findings before confirmation (reachability, auth, controls).",
     tools: ["read_skill", "eagle_eye2"],
     async execute(_task, ctx) {
-      const outcomes = [];
+      const results = reviewValidated(ctx.mission);
       const hypotheses = [];
-      for (const h of ctx.mission.hypotheses) {
-        if (h.status !== "validated")
+      for (const r of results) {
+        if (r.outcome !== "REJECTED")
           continue;
-        const sinkNode = ctx.mission.graph.nodes.find((n) => n.properties && n.properties.hypothesis === h.id);
-        const reachable = sinkNode ? incoming(ctx.mission.graph, sinkNode.id).length > 0 : false;
-        let outcome = "CONFIRMED";
-        if (!reachable)
-          outcome = "NEEDS_MORE_EVIDENCE";
-        else if (h.confidence < 0.3)
-          outcome = "REJECTED";
-        else if (!/reachability|verification|proof|negative control/i.test(h.required_validation))
-          outcome = "NEEDS_MORE_EVIDENCE";
-        outcomes.push({ hypothesis: h.id, outcome });
-        if (outcome === "REJECTED")
-          hypotheses.push(rejectHypothesis(h, "adversarial review: confidence below threshold"));
-      }
-      return { ok: true, output: { outcomes }, hypotheses, graph: emptyGraph() };
+        const h = ctx.mission.hypotheses.find((x) => x.id === r.hypothesis_id);
+        if (h) {
+          const failIds = r.questions.filter((q) => q.verdict === "fail").map((q) => q.id).join(", ");
+          hypotheses.push(rejectHypothesis(h, `adversarial review rejected: ${failIds || "unexplainable"}`));
+        }
+      }
+      return { ok: true, output: { outcomes: results.map((r) => ({ id: r.hypothesis_id, outcome: r.outcome })) }, hypotheses, graph: emptyGraph() };
+    }
+  };
+  browserAgent2 = {
+    type: "browser",
+    responsibility: "Drive a real browser to detect DOM issues and auth flows.",
+    tools: ["browser_open", "browser_click", "browser_type", "browser_evaluate", "browser_screenshot", "browser_navigate", "browser_back", "browser_forward", "browser_get_cookie", "browser_set_cookie"],
+    async execute(_task, ctx) {
+      if (!/^https?:\/\//i.test(ctx.mission.target) || !ctx.scopeAllowed) {
+        return { ok: false, output: {}, hypotheses: [], graph: emptyGraph(), error: "browser agent requires an authorized URL target" };
+      }
+      await Promise.resolve().then(() => init_browser_agent());
+      const opened = await browserOpen(ctx.mission.target);
+      if (opened.unavailable) {
+        return { ok: false, output: {}, hypotheses: [], graph: emptyGraph(), error: opened.detail };
+      }
+      const auth = await detectAuthForm();
+      const diag = browserDiagnostics();
+      await browserClose();
+      const hypotheses = [];
+      const authInfo = auth.value ?? {};
+      if (authInfo.found) {
+        hypotheses.push(makeHypothesis({
+          type: "auth_flow_detected",
+          target: ctx.mission.target,
+          evidence: `login form detected (user_field=${authInfo.has_user}, pass_field=${authInfo.has_pass})`,
+          confidence: 0.6,
+          required_validation: "login flow",
+          potential_impact: "auth boundary"
+        }));
+      }
+      if (diag.console_errors.length > 0 || diag.page_errors.length > 0) {
+        hypotheses.push(makeHypothesis({
+          type: "js_runtime_error",
+          target: ctx.mission.target,
+          evidence: `console_errors=${diag.console_errors.length} page_errors=${diag.page_errors.length}`,
+          confidence: 0.4,
+          required_validation: "review",
+          potential_impact: "unspecified"
+        }));
+      }
+      return {
+        ok: true,
+        output: { opened: opened.ok, auth_form: authInfo.found ?? false, console_errors: diag.console_errors.length, page_errors: diag.page_errors.length },
+        hypotheses,
+        graph: emptyGraph()
+      };
     }
   };
   reporterAgent = {
@@ -18586,7 +18925,8 @@ ${m.hypotheses.map((h) => `- [${h.status}] ${h.type} @ ${h.target} (confidence $
     analysis: analysisAgent,
     validator: validatorAgent,
     reviewer: reviewerAgent,
-    reporter: reporterAgent
+    reporter: reporterAgent,
+    browser: browserAgent2
   };
 });
 
@@ -18712,10 +19052,39 @@ var init_recovery = __esm(() => {
     analysis: ["source"],
     validator: ["reviewer"],
     reviewer: ["validator"],
-    reporter: []
+    reporter: [],
+    browser: ["web"]
   };
 });
 
+// src/mission/memory.ts
+function recordHypothesisOutcome(type, target, status, evidence) {
+  return remember(`finding:${type}`, `[${status}] ${type} @ ${target}: ${evidence}`, status === "validated" ? "signature" : "lesson", [type.toLowerCase(), status], "mission", status === "validated").saved === true;
+}
+function recordFailedApproach(fa) {
+  return remember(`failed:${fa.technique}`, `${fa.technique} failed (${fa.category}): ${fa.reason} — ${fa.future_policy}`, "lesson", ["failed", fa.category], "mission", false).saved === true;
+}
+function persistMissionMemory(mission) {
+  let attempted = 0;
+  let saved = 0;
+  for (const h of mission.hypotheses) {
+    if (h.status !== "validated" && h.status !== "rejected")
+      continue;
+    attempted += 1;
+    if (recordHypothesisOutcome(h.type, h.target, h.status, h.evidence))
+      saved += 1;
+  }
+  for (const fa of mission.failed_approaches) {
+    attempted += 1;
+    if (recordFailedApproach(fa))
+      saved += 1;
+  }
+  return { saved, deduped: attempted - saved };
+}
+var init_memory2 = __esm(() => {
+  init_memory();
+});
+
 // src/mission/control.ts
 import { existsSync as existsSync8, statSync as statSync4 } from "node:fs";
 function scopeAllowed(mission) {
@@ -18878,6 +19247,10 @@ function finalize2(mission) {
     tasks: allResolved(m.tasks) ? 1 : 0,
     hypotheses_validated: m.hypotheses.length > 0 ? m.hypotheses.filter((h) => h.status === "validated").length / m.hypotheses.length : 0
   };
+  const mem = persistMissionMemory(m);
+  if (mem.saved > 0) {
+    m = { ...m, memory_refs: [...m.memory_refs, `persisted:${mem.saved} (${mem.deduped} deduped)`] };
+  }
   return saveMission(m);
 }
 async function startMission(target, mode, opts = {}) {
@@ -18900,6 +19273,7 @@ var init_control = __esm(() => {
   init_planner();
   init_coverage();
   init_recovery();
+  init_memory2();
   MODE_PROFILES = {
     web: { agents: ["recon", "web", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
     api: { agents: ["recon", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
@@ -53008,6 +53382,7 @@ async function browserValidate(check, target, payload) {
 }
 
 // src/server.ts
+init_browser_agent();
 init_universal_taint();
 
 // src/guidance.ts
@@ -54571,6 +54946,28 @@ function createServer() {
     const result = await browserValidate(check, target, payload);
     return { content: [{ type: "text", text: JSON.stringify(result) }] };
   });
+  server.registerTool("browser_agent", {
+    title: "Browser automation agent (session)",
+    description: "PHASE 12: drive a real headless-Chromium session. Ops: open, navigate, click, type, evaluate, screenshot, back, forward, get_cookie, set_cookie, plus detect_auth_form, diagnostics, close. Enables multi-step flows (login/MFA) and DOM issue detection. Requires playwright-core (optional peer dependency).",
+    inputSchema: {
+      op: _enum(["open", "navigate", "click", "type", "evaluate", "screenshot", "back", "forward", "get_cookie", "set_cookie", "detect_auth_form", "diagnostics", "close"]),
+      args: array(string2()).optional().describe("Positional args (url, selector, text, js, cookie name/value, screenshot path)")
+    }
+  }, async ({ op, args }) => {
+    if (op === "detect_auth_form") {
+      const r = await detectAuthForm();
+      return { content: [{ type: "text", text: JSON.stringify(r) }] };
+    }
+    if (op === "diagnostics") {
+      return { content: [{ type: "text", text: JSON.stringify(browserDiagnostics()) }] };
+    }
+    if (op === "close") {
+      await browserClose();
+      return { content: [{ type: "text", text: JSON.stringify({ ok: true, detail: "session closed" }) }] };
+    }
+    const r = await browserAgent(op, args ?? []);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
   server.registerTool("taint_tree", {
     title: "Whole-tree taint scan",
     description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.49",
+  "version": "1.0.52",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {