blitzstrike 1.0.59 → 1.0.64

package/CHANGELOG.md

@@ -5,6 +5,75 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.64] — 2026-09-13
+
+### Added — agent-native skills (LLM-driven orchestration doctrine)
+
+Six skills that teach the LLM agent how to drive Blitz Strike's deterministic
+tools end-to-end (the "LLM is the brain, Blitz Strike is the hands" model):
+
+- `bs-orchestrate-engagement` — the full cycle: scope → recon → analyze →
+  verify → review → report, no-babysitting.
+- `bs-scope-gate` — hard scope/authorization gate before any live action.
+- `bs-source-audit` — drive taint + route-confusion + complex-bugs analyzers.
+- `bs-verify-finding` — marker + negative-control live verification.
+- `bs-adversarial-review` — the ten §15 questions + confidence + dedup.
+- `bs-write-report` — submission-ready report (root cause, CVSS, remediation).
+
+Plus `docs/ARCHITECTURE-AUDIT.md` — the Mission Control → LLM-driven toolbelt
+classification (TOOL / SKILL / REDUNDANT).
+
+## [1.0.63] — 2026-09-13
+
+### Added — complex-bug detection (`src/complex-bugs.ts`)
+
+Three "hard" vulnerability classes beyond source→sink taint:
+
+- **Deserialization → POP gadget chain** — `unserialize()` of attacker-controlled
+  data when a magic method (`__destruct`/`__wakeup`/`__toString`/`__invoke`/`__call`)
+  is present in the file (object injection → RCE pivot).
+- **Type juggling** — loose comparison (`==`/`!=`) of user input against a
+  hash/secret (PHP `0e…` collision auth bypass); strict `===` is ignored.
+- **Mass assignment** — `extract()` of request data without `EXTR_SKIP`, or
+  `parse_str()` of user input (variable injection).
+
+Wired into the `@source` agent as `vulnerability` graph nodes. Added a
+`php-complex` fixture to the enterprise benchmark.
+
+## [1.0.62] — 2026-09-13
+
+### Added — route-confusion & dispatch-abuse detection
+
+New vulnerability class distinct from source→sink taint (`src/route-confusion.ts`):
+detects when the routing/dispatch layer lets an attacker reach an unintended
+handler or control which handler runs.
+
+- `dynamic_dispatch` — attacker-controlled callback/route (`call_user_func`,
+  `forward`, `dispatch`, `resolve_route`, `invoke`).
+- `dynamic_method_call` — `$obj->$method()` / `$class::$method()`.
+- `dynamic_include` — `include`/`require` of a variable (LFI via route).
+- `batch_forwarding` — a loop over sub-requests that forwards to inner handlers
+  without a per-route authorization re-check.
+- `route_normalization_gap` — route matching against user input without path
+  normalization (strtolower/rtrim/urldecode).
+
+Wired into the `@source` agent; findings become `route` nodes in the security
+graph. Added a WordPress-style batch-endpoint fixture to the enterprise
+benchmark (`wp-batch-route`).
+
+## [1.0.60] — 2026-09-13
+
+### Added — deeper taint-flow coverage
+
+- **Method-call resolution** (`calleeName`) — `$obj->method()` now resolves to
+  its method definition for interprocedural taint, not the object variable.
+- **Built-in taint propagation** — `implode`/`join`/`sprintf`/`str_replace` and
+  other array→string/format built-ins now carry taint through to the sink.
+- **Cast handling** — `(array)`/`(string)` casts propagate taint (a string can
+  still carry a payload); `(int)`/`(float)` casts act as an int_cast sanitizer.
+- New corpus fixtures covering conditional-sanitizer bypass on array→SQL
+  interpolation (`php-int-cast-bypass-vuln`/`-fixed`).
+
 ## [1.0.59] — 2026-09-13
 
 ### Added — enterprise-grade detection + benchmark

package/bench/corpus/php-int-cast-bypass-fixed.md

@@ -0,0 +1,20 @@
+- id: php-int-cast-bypass-fixed
+- language: php
+- vulnerable: false
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      $ids = implode( ",", array_map( "intval", (array) $params["ids"] ) );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/corpus/php-int-cast-bypass-vuln.md

@@ -0,0 +1,23 @@
+- id: php-int-cast-bypass-vuln
+- language: php
+- vulnerable: true
+- sink_type: sql_execution
+```php
+<?php
+class Query {
+  public function run($params) {
+    $where = "";
+    if ( ! empty( $params["ids"] ) ) {
+      if ( is_array( $params["ids"] ) ) {
+        $params["ids"] = array_map( "intval", $params["ids"] );
+      }
+      $ids = implode( ",", (array) $params["ids"] );
+      $where .= " AND id NOT IN ($ids) ";
+    }
+    return $db->query("SELECT * FROM t WHERE 1=1 $where");
+  }
+}
+$q = $_GET;
+$w = new Query();
+$w->run($q);
+```

package/bench/enterprise/php-complex/plugin.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Plugin helper (simplified) with multiple complex-bug patterns.
+ */
+
+// 1. Deserialization → object injection (magic method present)
+function restore_session($payload) {
+    $data = $_POST['data'];
+    $obj  = unserialize($data);
+    return $obj;
+}
+
+class CacheManager {
+    public function __destruct() {
+        // Magic method — a POP gadget can pivot object injection to RCE here.
+        system("rm -rf /tmp/cache");
+    }
+}
+
+// 2. Type juggling — loose comparison of user input against a hash
+function verify_signature() {
+    $sig    = $_GET['sig'];
+    $secret = get_option('signing_secret');
+    if ($sig == $secret) {          // <-- loose == , 0e... collision bypass
+        return true;
+    }
+    return false;
+}
+
+// 3. Mass assignment — extract() of request data without EXTR_SKIP
+function bootstrap_options() {
+    extract($_REQUEST);             // <-- variable injection
+    return $admin;                  // $admin is attacker-controlled
+}

package/bench/enterprise/wp-batch-route/batch.php

@@ -0,0 +1,43 @@
+<?php
+/**
+ * REST API batch endpoint (simplified) — forwards to inner handlers.
+ *
+ * The `/batch` route is registered WITHOUT a permission_callback, so it is
+ * reachable unauthenticated. A malformed nested request desynchronizes the
+ * batch router, letting an attacker reach handlers they should not.
+ */
+
+add_action('rest_api_init', function () {
+    register_rest_route('my/v1', '/batch', array(
+        'methods'             => 'POST',
+        'callback'            => 'handle_batch',
+        'permission_callback' => '__return_true', // <-- no real authz check
+    ));
+});
+
+function handle_batch($request) {
+    $operations = $request['requests'];
+    $responses  = array();
+
+    foreach ($operations as $op) {
+        $route    = $op['route'];
+        $handler  = resolve_route($route);
+        $responses[] = $handler($op['params']);
+    }
+
+    return $responses;
+}
+
+function resolve_route($route) {
+    $registry = array(
+        'users'   => 'get_users',
+        'posts'   => 'get_posts',
+        'options' => 'get_options',
+    );
+    return $registry[$route];
+}
+
+function get_users($params) {
+    global $wpdb;
+    return $wpdb->get_results("SELECT * FROM users WHERE id = " . $params['id']);
+}

package/dist/index.js

@@ -17104,6 +17104,15 @@ function rootVarName2(node) {
     return rootVarName2(node.what);
   return null;
 }
+function calleeName(what) {
+  if (!isNode3(what))
+    return null;
+  if (what.kind === "name")
+    return typeof what.name === "string" ? what.name : what.name?.name ?? null;
+  if (what.kind === "propertylookup" || what.kind === "staticlookup")
+    return what.offset?.name ?? what.offset?.value ?? null;
+  return null;
+}
 function sourceOf2(node) {
   if (!isNode3(node))
     return null;
@@ -17268,6 +17277,14 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
   const src = sourceOf2(node);
   if (src)
     return { tainted: true, sources: [src], sanitizers: [], sourceLine: node.loc?.start?.line };
+  if (node.kind === "cast") {
+    const inner = analyzeExpr(node.expr, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
+    const castType = String(node.type ?? "");
+    if (/^(int|integer|bool|boolean|float|double)$/i.test(castType) && inner.tainted) {
+      return { ...inner, sanitizers: [...inner.sanitizers, { id: "int_cast", label: "Numeric cast", neutralizes: ["sql_execution", "command_execution", "file_inclusion"] }] };
+    }
+    return inner;
+  }
   if (node.kind === "assign") {
     const byref = node.operator === "=&";
     const rhs = analyzeExpr(node.right, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
@@ -17315,8 +17332,11 @@ function analyzeExpr(node, env, summary, ctx, taintedParam, props, activeAuth, s
         analyzeExpr(a, env, summary, ctx, taintedParam, props, activeAuth, summaries, validating);
       return taintedArgs.length > 0 ? mergeTaint(...taintedArgs) : CLEAN;
     }
-    const fnName = rootVarName2(node.what);
+    const fnName = calleeName(node.what);
     if (fnName) {
+      if (TAINT_PROPAGATING_BUILTINS.has(fnName) && taintedArgs.length > 0) {
+        return mergeTaint(...taintedArgs);
+      }
       const san = findSanitizers(fnName + "(");
       if (san.length > 0) {
         if (taintedArgs.length > 0) {
@@ -17575,7 +17595,7 @@ function analyzeDataFlow2(path) {
   const seen = new Set;
   const mainCalls = topStmts.flatMap((s) => findKind2(s, "call"));
   for (const call of mainCalls) {
-    const fnName = rootVarName2(call.what);
+    const fnName = calleeName(call.what);
     if (!fnName || sinkClassOf2(call))
       continue;
     const target = resolveFuncId(fnName, summaries);
@@ -17662,7 +17682,7 @@ function analyzeDataFlow2(path) {
     setCache("eagle2", cacheCode, result);
   return result;
 }
-var import_php_parser3, parser3, CLEAN, VALIDATION_GATES;
+var import_php_parser3, parser3, TAINT_PROPAGATING_BUILTINS, CLEAN, VALIDATION_GATES;
 var init_eagle2 = __esm(() => {
   init_dataflow();
   init_scanner();
@@ -17673,6 +17693,33 @@ var init_eagle2 = __esm(() => {
     parser: { extractDoc: false, php7: true },
     ast: { withPositions: true, withSource: false }
   });
+  TAINT_PROPAGATING_BUILTINS = new Set([
+    "implode",
+    "join",
+    "sprintf",
+    "vsprintf",
+    "str_replace",
+    "str_ireplace",
+    "substr",
+    "mb_substr",
+    "substr_replace",
+    "trim",
+    "ltrim",
+    "rtrim",
+    "strtolower",
+    "strtoupper",
+    "ucfirst",
+    "lcfirst",
+    "urldecode",
+    "rawurldecode",
+    "base64_decode",
+    "html_entity_decode",
+    "stripslashes",
+    "addslashes",
+    "strval",
+    "preg_quote",
+    "nl2br"
+  ]);
   CLEAN = { tainted: false, sources: [], sanitizers: [] };
   VALIDATION_GATES = ["in_array", "preg_match", "ctype_digit", "ctype_alnum", "is_numeric"];
 });
@@ -37002,6 +37049,269 @@ function reviewValidated(mission) {
 }
 var init_reviewer = () => {};
 
+// src/route-confusion.ts
+function lines(code) {
+  return code.split(`
+`);
+}
+function lineNo(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function userControlled(scope) {
+  return SOURCE_TOKENS.test(scope);
+}
+function detectDynamicDispatch(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_DISPATCH_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_DISPATCH_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_dispatch",
+      category: "Route confusion (user-controlled dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` invoked with an attacker-controlled callback/route — the request selects the handler.`
+    });
+  }
+}
+function detectDynamicMethod(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_METHOD_RE.lastIndex = 0;
+  let m;
+  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_method_call",
+      category: "Route confusion (dynamic method dispatch)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
+    });
+  }
+}
+function detectDynamicInclude(code, file, out) {
+  const ls = lines(code);
+  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!userControlled(l) && !userControlled(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "dynamic_include",
+      category: "Route confusion (dynamic file include)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
+    });
+  }
+}
+function detectBatchForwarding(code, file, out) {
+  BATCH_LOOP_RE.lastIndex = 0;
+  let m;
+  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const body = lines(code).slice(ln, ln + 8).join(`
+`);
+    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
+    if (!forwards)
+      continue;
+    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
+    out.push({
+      file,
+      line: ln,
+      type: "batch_forwarding",
+      category: "Route confusion (batch/proxy forwarding)",
+      severity: rechecks ? "medium" : "high",
+      evidence: lines(code)[ln - 1]?.trim() ?? "",
+      detail: rechecks ? "Batch/proxy loop forwards to inner handlers — auth is re-checked in scope, but verify it applies per-route." : "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
+    });
+  }
+}
+function detectRouteNormalization(code, file, out) {
+  const ls = lines(code);
+  for (let i = 0;i < ls.length; i++) {
+    const l = ls[i];
+    if (!ROUTE_MATCH_RE.test(l))
+      continue;
+    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
+`);
+    if (!userControlled(scope))
+      continue;
+    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
+      continue;
+    out.push({
+      file,
+      line: i + 1,
+      type: "route_normalization_gap",
+      category: "Route confusion (missing path normalization)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
+    });
+  }
+}
+function detectRouteConfusion(code, file) {
+  const out = [];
+  detectDynamicDispatch(code, file, out);
+  detectDynamicMethod(code, file, out);
+  detectDynamicInclude(code, file, out);
+  detectBatchForwarding(code, file, out);
+  detectRouteNormalization(code, file, out);
+  return out;
+}
+var SOURCE_TOKENS, DYNAMIC_DISPATCH_RE, DYNAMIC_METHOD_RE, BATCH_LOOP_RE, ROUTE_MATCH_RE, NORMALIZERS;
+var init_route_confusion = __esm(() => {
+  SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
+  DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
+  DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
+  BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
+  ROUTE_MATCH_RE = /\b(preg_match|preg_match_all|strpos|stripos|str_contains)\s*\(/i;
+  NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
+});
+
+// src/complex-bugs.ts
+function lines2(code) {
+  return code.split(`
+`);
+}
+function lineNo2(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function detectDeserialization(code, file, out) {
+  if (!MAGIC_METHODS.test(code))
+    return;
+  const ls = lines2(code);
+  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "deserialization",
+      category: "Deserialization → POP gadget chain",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+    });
+  }
+}
+function detectTypeJuggling(code, file, out) {
+  const ls = lines2(code);
+  const re = /(?<![=!<>])(==|!=)(?!=)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    const hasSource = SOURCE_TOKENS2.test(l) || SOURCE_TOKENS2.test(scope);
+    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
+    if (!hasSource || !hasHash)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "type_juggling",
+      category: "Type juggling (loose comparison)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
+    });
+  }
+}
+function detectMassAssignment(code, file, out) {
+  const ls = lines2(code);
+  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
+  let m;
+  while ((m = extractRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
+    });
+  }
+  const parseRe = /\bparse_str\s*\(/g;
+  while ((m = parseRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "`parse_str()` of user input into the symbol table — variable injection."
+    });
+  }
+}
+function detectComplexBugs(code, file) {
+  const out = [];
+  detectDeserialization(code, file, out);
+  detectTypeJuggling(code, file, out);
+  detectMassAssignment(code, file, out);
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+var SOURCE_TOKENS2, MAGIC_METHODS;
+var init_complex_bugs = __esm(() => {
+  SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data)|getParameter\(|req\.(query|body|params)/;
+  MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
+});
+
 // src/agents.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 function emptyGraph() {
@@ -37025,6 +37335,8 @@ var init_agents = __esm(() => {
   init_scanner();
   init_eagle2();
   init_universal_taint();
+  init_route_confusion();
+  init_complex_bugs();
   init_adapters();
   init_active();
   init_strike();
@@ -37109,6 +37421,44 @@ var init_agents = __esm(() => {
           graph = addEdge2(graph, tid, sinkId, "flows_to");
         }
       }
+      for (const f of files.filter((x) => /\.php$/i.test(x))) {
+        let code;
+        try {
+          code = readFileSync18(f, "utf8");
+        } catch {
+          continue;
+        }
+        for (const rc of detectRouteConfusion(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: rc.category,
+            target: `${f}:${rc.line}`,
+            evidence: rc.detail,
+            confidence: rc.severity === "high" ? 0.7 : 0.5,
+            required_validation: "confirm reachability of the dispatch/route with attacker-controlled input",
+            potential_impact: "route confusion / authorization bypass"
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `route:${f}:${rc.line}:${rc.type}`;
+          graph = upsertNode(graph, nodeId, "route", { file: f, line: rc.line, type: rc.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "routes_to");
+        }
+        for (const cb of detectComplexBugs(code, f).slice(0, 50)) {
+          const hyp = makeHypothesis({
+            type: cb.category,
+            target: `${f}:${cb.line}`,
+            evidence: cb.detail,
+            confidence: cb.severity === "high" ? 0.7 : 0.55,
+            required_validation: "confirm the payload reaches the sink and is exploitable",
+            potential_impact: cb.type
+          });
+          hypotheses.push(hyp);
+          findings += 1;
+          const nodeId = `complex:${f}:${cb.line}:${cb.type}`;
+          graph = upsertNode(graph, nodeId, "vulnerability", { file: f, line: cb.line, type: cb.type, hypothesis: hyp.id });
+          graph = addEdge2(graph, tid, nodeId, "vulnerable_to");
+        }
+      }
       return { ok: true, output: { files: files.length, findings }, hypotheses, graph };
     }
   };
@@ -38044,6 +38394,20 @@ var init_enterprise_benchmark = __esm(() => {
       expected_vulns: 2,
       expected_sinks: ["sql_execution", "command_execution"],
       safe_tokens: ["prepareStatement", "PreparedStatement"]
+    },
+    {
+      id: "wp-batch-route",
+      dir: join17(ROOT10, "wp-batch-route"),
+      expected_vulns: 1,
+      expected_sinks: ["Route confusion"],
+      safe_tokens: []
+    },
+    {
+      id: "php-complex",
+      dir: join17(ROOT10, "php-complex"),
+      expected_vulns: 4,
+      expected_sinks: ["Deserialization", "Type juggling", "Mass assignment"],
+      safe_tokens: []
     }
   ];
 });

package/docs/ARCHITECTURE-AUDIT.md

@@ -0,0 +1,88 @@
+# Architecture Audit — Mission Control → LLM-Driven Toolbelt
+
+Step 1 of the OMOP-alignment refactor. Every Mission Control component is
+classified into one of:
+
+- **TOOL** — a deterministic check the LLM calls via MCP (produces a result the
+  LLM reasons over).
+- **SKILL** — "how to run the pentest" doctrine/knowledge the LLM loads
+  (becomes `SKILL.md`).
+- **DATA** — static knowledge (patterns/chains/correlations) kept as-is.
+- **REDUNDANT** — deterministic orchestration that duplicates what the LLM
+  already does; remove or fold into a TOOL/SKILL.
+
+The guiding principle: **the LLM is the brain; Blitz Strike is the deterministic
+hands + knowledge + guardrails.** A deterministic "self-driving loop" that tries
+to BE the brain is the anti-pattern being removed.
+
+---
+
+## src/mission/ — classification
+
+| File | Component | Verdict | Why |
+|------|-----------|---------|-----|
+| `types.ts` | shared types (Mission/Task/Hypothesis/Budget/Graph) | **DATA** | Type contracts. Reshape `Mission`→`Engagement` later, but keep as the shared layer. |
+| `state.ts` | `createMission`/`save`/`load`/`list`/`delete` | **TOOL** | Persistence is useful — repurpose as *engagement/finding state* the LLM drives, not an "autonomous mission" blob. |
+| `taskgraph.ts` | `schedule`/`nextBatch`/`allResolved` | **REDUNDANT** | Task scheduling is the LLM's plan-agent job. |
+| `graph.ts` | Security Graph (nodes/edges/stats/merge) | **TOOL** | The finding-relationship graph is genuinely useful for the LLM to track + query. |
+| `hypothesis.ts` | Hypothesis Engine (make/validate/reject/merge) | **TOOL** | Core moat — evidence-first `observation→hypothesis→validated→rejected` lifecycle. LLM calls these per finding. |
+| `control.ts` | `runMission` loop + `buildInitialTasks` + `replan` | **REDUNDANT** | The self-driving scheduler loop — the LLM drives this instead. |
+| `control.ts` | `scopeAllowed` | **TOOL** | Scope guardrail (keep + expose as a check the LLM MUST call before live actions). |
+| `planner.ts` | `ATTACK_BRANCHES` + escalation graph | **SKILL** | Knowledge: which attack branches/escapes exist. Becomes `SKILL.md` + data. |
+| `planner.ts` | `planNextActions` (ranking) | **TOOL** | Deterministic confidence×value−risk ranking the LLM can use as a hint. |
+| `coverage.ts` | `computeCoverage`/`coverageGaps` | **TOOL** | LLM calls to find un-covered dimensions. `COVERAGE_DIMENSIONS` → **SKILL**. |
+| `recovery.ts` | `diagnoseError`/`recoveryDecision` | **TOOL** | LLM calls on failure to pick retry/alternative. `AGENT_ALTERNATIVES` → **SKILL**. |
+| `memory.ts` | `persistMissionMemory`/`recallForTarget` | **TOOL** | Cross-session memory (keep — the LLM's long-term finding store). |
+| `reviewer.ts` | `reviewFinding`/`reviewValidated` (10 questions) | **TOOL** | Adversarial reviewer — key moat. LLM calls before CONFIRMING a finding. |
+| `router.ts` | `routeTask`/`AGENT_TIER` | **REDUNDANT** | Model routing is the LLM platform's own job (or a small TOOL hint). |
+| `budget.ts` | `budgetStatus`/`budgetOverrun`/`consumeTasks` | **TOOL** | LLM calls to check budget. The "terminate on overrun" auto-decision is **REDUNDANT**. |
+| `termination.ts` | `evaluateTermination`/`applyTermination` | **REDUNDANT** | The LLM decides when to stop; the 7 reasons → **SKILL** doctrine. |
+| `benchmark.ts` + `enterprise-benchmark.ts` | benchmark runners | **DATA/QA** | Keep — not runtime brain; QA harness. |
+| `cli.ts` | `mission` CLI subcommands | **REDUNDANT** | Deterministic-brain CLI. Optional standalone fallback; LLM drives via MCP. |
+| `mcp.ts` | `registerMissionTools` (mission_start/status/…) | **REDUNDANT** | Replace with skill/tool MCP tools (the LLM drives granular tools). |
+
+## src/agents.ts — 13 agents
+
+Each agent is a deterministic executor = orchestration (REDUNDANT) + detection
+calls (TOOL). The agent's *responsibility + tool list* becomes a **SKILL**.
+
+| Agent | Repurpose as SKILL | Kept as TOOL |
+|-------|--------------------|--------------|
+| `commander` | orchestration doctrine (plan → delegate → verify → report) | — (LLM is the commander) |
+| `recon` | passive recon doctrine | `activeScan`/`live_recon` (already MCP tools) |
+| `web` | live web-attack doctrine | `strike_verify`/`browser_validate` |
+| `api` | API recon/authz doctrine | `api` detection tools |
+| `source` | source-audit doctrine | `analyzeDataFlow2` + `detectRouteConfusion` + `detectComplexBugs` |
+| `auth` | auth-gap doctrine | auth detection |
+| `analysis` | multi-language taint doctrine | `analyzeTaintUniversal` |
+| `validator` | verification doctrine (marker + negative) | `strikeVerify` |
+| `reviewer` | adversarial-review doctrine | `reviewFinding` (TOOL above) |
+| `reporter` | report-writing doctrine | report generator |
+| `browser` | browser-session doctrine | `browser-agent.ts` (session ops) |
+| `mobile` | mobile RE doctrine | mobile analysis |
+| `cloud` | cloud-enum doctrine | cloud tools |
+
+## src/browser-agent.ts
+
+Session-based browser automation → **TOOL** (LLM calls `browser_agent` op).
+Keep as-is.
+
+## src/server.ts (69 MCP tools)
+
+**KEEP** — the deterministic analysis/verification/evidence tools are the moat.
+Add `instructions` + `next_steps` per tool for LLM ergonomics.
+
+---
+
+## Net outcome
+
+- **Keep as TOOL (moat):** taint engine, universal taint, route-confusion,
+  complex-bugs, strike_verify, hypothesis engine, security graph, adversarial
+  reviewer, coverage, recovery, budget-status, memory, scope gate, browser agent.
+- **Become SKILL:** 13 agent doctrines, reviewer 10-questions, coverage
+  dimensions, attack branches, escalation graph, termination reasons, recovery
+  alternatives.
+- **Remove (REDUNDANT):** `runMission` loop, task scheduler, replan, model
+  router, termination auto-decision, `mission` CLI, `registerMissionTools`.
+
+The deterministic analysis stays; the deterministic *orchestration* goes.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.59",
+  "version": "1.0.64",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-adversarial-review.md

@@ -0,0 +1,42 @@
+---
+name: adversarial-review
+description: Use before confirming a verified finding as real. Run the ten adversarial questions, score confidence, dedup shared-root findings, and reject anything that does not survive. This is the anti-hallucination gate between "hypothesis" and "confirmed finding".
+---
+
+# Adversarial review (anti-hallucination gate)
+
+"A hypothesis is not a finding. AI reasoning is not evidence. Severity is not
+confidence." Before any finding is confirmed, attack it from every angle.
+
+## The ten questions (§15)
+
+For each finding, answer these with evidence — not vibes:
+
+1. Is the vulnerable code actually **reachable**?
+2. Is **authentication** required (and did we account for it)?
+3. Is **authorization** enforced elsewhere (would the attacker be blocked)?
+4. Is there **middleware/WAF/sanitizer** protection?
+5. Is the input actually **attacker-controlled**?
+6. Is the **sink** reachable from that input?
+7. Is the observed behavior just **caching** (ETag/304)?
+8. Is the exploit **reproducible** (marker confirmed, not one-off)?
+9. Does the **negative control** remain inert?
+10. Is the **impact** accurately classified (CWE/CVSS, not inflated)?
+
+## Verdict
+
+- Any **fail** → REJECTED. Drop it, do not soften it.
+- Fewer than 3 clear **passes** → NEEDS_MORE_EVIDENCE. Go back to `verify-finding`.
+- 3+ passes, 0 fails → CONFIRMED.
+
+## Scoring + dedup
+
+- `confidence_score` — deterministic weighted confidence (evidence, verification,
+  reachability). Do not invent a confidence number.
+- `dedup_findings` — collapse findings that share a root cause before reporting.
+- `finding_transition` — advance only via the strict lifecycle.
+
+## Why
+
+A false positive costs the user their reputation. Rejecting a real bug is
+recoverable (it stays in memory); reporting a fake one is not.

package/skills/bs-orchestrate-engagement.md

@@ -0,0 +1,42 @@
+---
+name: orchestrate-engagement
+description: Use when the user asks for a full security engagement ("fullscan", "audit this", "pentest this", "scan my target") or any end-to-end assessment. You are the orchestrator — Blitz Strike provides the deterministic analysis and verification tools you drive. Run recon → analyze → verify → review → report without babysitting.
+---
+
+# Orchestrate an engagement (no-babysitting)
+
+You are the brain. Blitz Strike is the hands. Drive the full cycle with the
+deterministic MCP tools; never guess a finding — produce it from tool output.
+
+## The cycle
+
+1. **Scope gate (always first).** Call `scope_check` before any live action.
+   A target outside scope or without authorization → refuse, record, stop.
+   Static source paths on disk are always in-scope; live URLs require an
+   explicit scope.
+
+2. **Recon (passive-first).** For a live target: `live_recon` (fingerprint, WAF,
+   endpoints, tech). For a source tree: `blitz_scan` (entry points + sinks),
+   `detect_framework`, `list_attack_vectors`.
+
+3. **Analyze.** Source → `source-audit` skill (taint + route-confusion +
+   complex-bugs). Live → `active_scan` / `enrich_scan`. Consult `tech_correlation`
+   / `cve_correlation` / `nvd_lookup` to map tech → known weakness classes.
+
+4. **Verify.** Every hypothesis must pass `verify-finding` before it is a finding.
+   "Detection is not proof."
+
+5. **Review.** Every verified finding passes `adversarial-review` before it is
+   confirmed. "A hypothesis is not a finding."
+
+6. **Report.** Emit `generate_report` + `cvss_score` + `write-report`.
+
+## Rules
+
+- One hypothesis per finding; `finding_create` + `finding_transition` for the
+  strict lifecycle (candidate → confirmed → rejected).
+- `dedup_findings` before reporting — collapse shared-root duplicates.
+- Persist hard-won knowledge with `remember`; recall it with `memory_lookup`
+  before re-discovering the same target/pattern.
+- You are the orchestrator — do not try to reimplement planning in prose; pick
+  tools, act, and let tool output drive the next step.

package/skills/bs-scope-gate.md

@@ -0,0 +1,32 @@
+---
+name: scope-gate
+description: Use BEFORE any live action against a target (recon, scanning, exploitation, verification). Enforce scope and authorization boundaries — never touch a target outside the declared scope, and never run live actions against a target the user has not authorized.
+---
+
+# Scope gate
+
+Scope is non-negotiable and cannot be bypassed. Before any live HTTP request,
+port scan, or exploitation step, resolve the boundary deterministically.
+
+## Procedure
+
+1. Call `scope_check` with the target. It returns in-scope / out-of-scope / needs-authorization.
+
+2. **Local source paths** are always in-scope (static analysis of code on disk).
+   Live URLs, IPs, and domains require an explicit, user-declared scope.
+
+3. If `scope_check` says out-of-scope or authorization is missing → **refuse and
+   record.** Do not probe, do not "just check one thing," do not find a bypass.
+
+## Red lines
+
+- Malicious / third-party infrastructure ("cari pelaku") → hold, static analysis
+  + takedown only. Never live-probe.
+- Authorized research targets → live action is fine, but only within the scope
+  the user declared.
+- A finding that depends on out-of-scope action is not a finding — drop it.
+
+## Why
+
+"Scope cannot be bypassed." A tool that ignores scope is worse than a tool that
+misses a bug. The gate is a hard invariant, not a suggestion.

package/skills/bs-source-audit.md

@@ -0,0 +1,50 @@
+---
+name: source-audit
+description: Use when auditing source code (PHP/JS/Python/Java/etc.) for vulnerabilities — static source→sink taint, route confusion/dispatch abuse, deserialization, type juggling, and mass assignment. This is Blitz Strike's deterministic static-analysis moat, distinct from live/dynamic testing.
+---
+
+# Source audit (deterministic static analysis)
+
+Drive Blitz Strike's static analyzers over a source tree and turn each hit into a
+hypothesis. Do not hand-guess; let the tools produce the source→sink evidence.
+
+## Workflow
+
+1. **Map the tree.** `blitz_scan <root>` — entry points (nopriv hooks, REST
+   routes, controllers) + sink inventory per file. `detect_framework` per file
+   to know what conventions apply.
+
+2. **Trace data flow.** For each source→sink candidate:
+   - `taint_file` / `taint_scan` — variable-level taint tracking per file.
+   - `eagle_eye2` — whole-program interprocedural taint (PHP, method-call aware).
+   - `trace_data_flow` — classify sources vs sinks across a file.
+   - `variant_analysis` — group data-flow candidates by shared root cause.
+
+3. **Escalate.** `enrich_scan` — match detected sinks to escalation chains
+   (SQLi → RCE, upload → shell, LFI → RCE). `list_chains` to see the full
+   escalation taxonomy. `tech_correlation` for framework-specific weaknesses.
+
+4. **Deep/complex classes.** Beyond plain taint, look for:
+   - **Route confusion** — `call_user_func`, `$obj->$method()`, batch/proxy
+     forwarding, dynamic include, route match without normalization.
+   - **Deserialization → POP chain** — `unserialize` + `__destruct`/`__wakeup`/
+     `__toString` present.
+   - **Type juggling** — loose `==`/`!=` of user input vs hash/secret.
+   - **Mass assignment** — `extract()` without EXTR_SKIP, `parse_str()` of input.
+
+5. **Correlate.** `cve_correlation` + `nvd_lookup` for the framework/pattern to
+   confirm the weakness class is real and known.
+
+## Pitfalls
+
+- A sink is not a finding — a sink **reached by attacker-controlled input** is a
+  hypothesis. Check the source provenance before reporting.
+- Framework accessors are sources too (`$request->input()`, `request.GET`,
+  `@RequestParam`), not just `$_GET`.
+- Parameterized queries, integer casts (`intval`/`absint`/`(int)`), and ORM calls
+  are neutralizers — do not flag a sink that is actually sanitized.
+
+## Output
+
+Every confirmed sink → `finding_create` with the source→sink chain as evidence,
+then `finding_transition` candidate → validated after `verify-finding`.

package/skills/bs-verify-finding.md

@@ -0,0 +1,38 @@
+---
+name: verify-finding
+description: Use when you have a hypothesis and need to prove it is a real, exploitable finding before reporting it. Live verification with a marker + negative control — never report an unverified hypothesis as a finding.
+---
+
+# Verify a finding (marker + negative control)
+
+"Detection is not proof." A static hit or a scan match is a hypothesis until it
+is live-verified with a distinguishable marker and an inert negative control.
+
+## Procedure
+
+1. **Pick the right verifier.**
+   - Live HTTP → `strike_verify` (sends a payload, checks for a unique marker).
+   - Browser/DOM (XSS, auth flows) → `browser_validate`.
+
+2. **Marker, not echo.** Use a unique, nonce-like marker (`blitzstrike-<rand>`)
+   that cannot be a benign echo. If the response reflects it, that is the signal.
+
+3. **Negative control.** Send a payload that is structurally similar but MUST NOT
+   trigger (a wrong param, a harmless value). If the control ALSO reflects the
+   marker, it is a `false_positive` — the app echoes everything, not exploitable.
+
+4. **Interpret.**
+   - Marker reflected + control inert → `verdict=confirmed`, attach evidence.
+   - Marker reflected + control also reflected → `false_positive`, reject.
+   - Nothing → retry once, then `NEEDS_MORE_EVIDENCE`.
+
+5. **Record.** `finding_attach_evidence` (redacted, SHA-256 tagged) +
+   `finding_transition` to validated/rejected. Use `redact` on any secret before
+   it is persisted.
+
+## Pitfalls
+
+- Never verify by "looks right" — the marker/control pair is the only proof.
+- A blind RCE without a callback channel: tunnel the callback (public tunnel,
+  no local IP) and observe it arrive — that is the proof.
+- Keep evidence redacted; raw secrets must never be persisted.

package/skills/bs-write-report.md

@@ -0,0 +1,33 @@
+---
+name: write-report
+description: Use when finalizing confirmed findings into a submission-ready report (bug bounty, pentest deliverable, or audit). Produce a report with root cause, reproduction, CVSS, impact, and remediation — indistinguishable from a top-tier human hunter.
+---
+
+# Write the report
+
+Turn confirmed findings into a submission-ready deliverable. A triager should
+not be able to tell an agent wrote it.
+
+## Structure per finding
+
+1. **Title + summary** — one line, precise, no clickbait.
+2. **Root cause** — the exact code path (source → sink), not a generic description.
+3. **Reproduction steps** — exact request(s) + the marker/control proof from
+   `verify-finding`.
+4. **Impact** — what an attacker actually gains (data, RCE, account takeover).
+5. **CVSS** — `cvss_score` with the correct vector string; do not inflate.
+6. **Remediation** — concrete, implementable, framework-appropriate.
+
+## Tools
+
+- `generate_report` — deterministic markdown/JSON report from the findings.
+- `cvss_score` — deterministic CVSS v3.1 vector.
+- `redact` — strip passwords/keys/tokens/cookies before any output.
+- `finding_attach_evidence` — link the redacted, SHA-256-tagged evidence.
+
+## Rules
+
+- Only CONFIRMED findings (passed `adversarial-review`) go in the report.
+- No false-positive spam, no "low-hanging fruit" filler.
+- Never include raw secrets, API keys, or live session tokens.
+- Group by root cause; a report full of duplicates reads as noise.