blitzstrike 1.0.64 → 1.0.65

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.65] — 2026-09-13
+
+### Fixed — breadth-scanner false positives (live MCP verification)
+
+Found via an LLM-driven verification run (agent → `blitz_scan`/`eagle_eye2`):
+
+- **Sink tokens in comments/strings no longer reported.** `scanFile`/
+  `traceFunction`/`grepInFunctions` now match against a comment- and
+  string-literal-stripped view of the source (positions + line numbers
+  preserved). A `// use extract($_REQUEST)` comment or a
+  `"https://…/system("` string is not a sink.
+- Rebuilt `dist/` so the fix ships in the published bundle (a long-running MCP
+  server must be restarted to pick up new `dist/` code — skills load fresh from
+  `skills/`, but compiled engine code is loaded once at startup).
+
 ## [1.0.64] — 2026-09-13
 
 ### Added — agent-native skills (LLM-driven orchestration doctrine)

package/dist/index.js

@@ -6944,6 +6944,65 @@ function lineno(text, pos) {
   }
   return n;
 }
+function stripComments(text) {
+  const out = text.split("");
+  const n = text.length;
+  let i = 0;
+  while (i < n) {
+    const c = text[i];
+    const nc = text[i + 1];
+    if (c === "'" || c === '"') {
+      const q = c;
+      out[i] = " ";
+      i++;
+      while (i < n && text[i] !== q) {
+        if (text[i] === "\\") {
+          out[i] = " ";
+          i++;
+          if (i < n)
+            out[i] = " ";
+          i++;
+          continue;
+        }
+        if (text[i] !== `
+`)
+          out[i] = " ";
+        i++;
+      }
+      if (i < n)
+        out[i] = " ";
+      i++;
+      continue;
+    }
+    if (c === "/" && nc === "/" || c === "#") {
+      while (i < n && text[i] !== `
+`) {
+        out[i] = " ";
+        i++;
+      }
+      continue;
+    }
+    if (c === "/" && nc === "*") {
+      out[i] = " ";
+      out[i + 1] = " ";
+      i += 2;
+      while (i < n && !(text[i] === "*" && text[i + 1] === "/")) {
+        if (text[i] !== `
+`)
+          out[i] = " ";
+        i++;
+      }
+      if (i < n) {
+        out[i] = " ";
+        out[i + 1] = " ";
+        i += 2;
+      }
+      continue;
+    }
+    i++;
+  }
+  return out.join("");
+}
 function iterSourceFiles(root, maxFiles = 5000) {
   const out = [];
   const walk = (dir) => {
@@ -7005,23 +7064,24 @@ function scanFile(path) {
   } catch {
     return { file: path, endpoints: [], sinks: [], auth_gates_present: [], error: "unreadable" };
   }
+  const code = stripComments(text);
   const endpoints = [];
   for (const hook of NOPRIV_HOOKS) {
     const re = new RegExp(escapeRegExp(hook), "g");
     let m;
-    while ((m = re.exec(text)) !== null) {
-      endpoints.push({ hook, line: lineno(text, m.index) });
+    while ((m = re.exec(code)) !== null) {
+      endpoints.push({ hook, line: lineno(code, m.index) });
     }
   }
   const sinks = [];
   for (const [sink, bugclass] of Object.entries(SINKS)) {
     const re = new RegExp(escapeRegExp(sink), "g");
     let m;
-    while ((m = re.exec(text)) !== null) {
-      sinks.push({ sink, class: bugclass, line: lineno(text, m.index) });
+    while ((m = re.exec(code)) !== null) {
+      sinks.push({ sink, class: bugclass, line: lineno(code, m.index) });
     }
   }
-  const gates = AUTH_GATES.filter((g) => text.includes(g));
+  const gates = AUTH_GATES.filter((g) => code.includes(g));
   const lines = text.split(`
 `).length;
   return { file: path, lines, endpoints, sinks, auth_gates_present: gates };
@@ -7042,22 +7102,23 @@ function traceFunction(path, symbol) {
       continue;
     const [start, end] = bounds;
     const body = text.slice(start, end);
+    const bodyCode = stripComments(body);
     const bodyStartLine = lineno(text, start);
     const bodyEndLine = lineno(text, end);
     const innerSinks = [];
     for (const [sink, bugclass] of Object.entries(SINKS)) {
       const re = new RegExp(escapeRegExp(sink), "g");
       let sm;
-      while ((sm = re.exec(body)) !== null) {
+      while ((sm = re.exec(bodyCode)) !== null) {
         innerSinks.push({
           sink,
           class: bugclass,
-          line: bodyStartLine + body.slice(0, sm.index).split(`
+          line: bodyStartLine + bodyCode.slice(0, sm.index).split(`
 `).length - 1
         });
       }
     }
-    const innerGates = AUTH_GATES.filter((g) => body.includes(g));
+    const innerGates = AUTH_GATES.filter((g) => bodyCode.includes(g));
     results.push({
       line: bodyStartLine,
       line_end: bodyEndLine,
@@ -7085,11 +7146,12 @@ function grepInFunctions(root, sink, maxHits = 50) {
     } catch {
       continue;
     }
+    const code = stripComments(text);
     const re = new RegExp(escapeRegExp(sink), "g");
     let m;
-    while ((m = re.exec(text)) !== null) {
-      const line = lineno(text, m.index);
-      const head = text.slice(0, m.index);
+    while ((m = re.exec(code)) !== null) {
+      const line = lineno(code, m.index);
+      const head = code.slice(0, m.index);
       const funcRe = /function\s+&?\w+\s*\(/g;
       const funcs = [];
       let fm;
@@ -7098,10 +7160,10 @@ function grepInFunctions(root, sink, maxHits = 50) {
       if (funcs.length === 0)
         continue;
       const fstart = funcs[funcs.length - 1].index;
-      const bounds = findFunctionBounds(text, fstart);
+      const bounds = findFunctionBounds(code, fstart);
       if (!bounds || !(bounds[0] <= m.index && m.index < bounds[1]))
         continue;
-      const body = text.slice(bounds[0], bounds[1]);
+      const body = code.slice(bounds[0], bounds[1]);
       const gates = AUTH_GATES.filter((g) => body.includes(g));
       hits.push({
         file: p,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.64",
+  "version": "1.0.65",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {