blitzstrike 1.0.77 → 1.0.81

package/CHANGELOG.md

@@ -5,6 +5,57 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.81] — 2026-09-13
+
+### Added — bypass techniques + chain doctrine
+
+- New `bypass_lookup` MCP tool + `intelligence/bypass_techniques.json`: concrete
+  bypass techniques for WAF, input filter/sanitizer, auth (401/403), and
+  rate-limit/captcha defenses (encoding, case, comment insertion, chunked,
+  null byte, double-encoding, verb tampering, header spoofing, …) with examples,
+  plus alias resolution (`403` → auth, `firewall` → waf).
+- PERSISTENCE doctrine now tells a driving LLM to call `bypass_lookup` when a
+  probe is blocked, and to chain findings (a low-severity hit usually escalates
+  — match it to a multi-stage chain instead of stopping at the first vuln).
+
+## [1.0.80] — 2026-09-13
+
+### Added — full no-babysitting doctrine (resource map + persistence)
+
+- MCP `instructions` gained a "RESOURCE MAP" section teaching a driving LLM the
+  decision tree: TOOL acts, PLAYBOOK is the campaign plan for a target type,
+  SKILL is phase/technique doctrine, MANUAL is one-tool reference, PAYLOAD is
+  attack payloads, INTELLIGENCE is knowledge — and when to reach for each.
+- Added a "PERSISTENCE" section: complex bugs do not give up — vary probes,
+  re-run on empty output, challenge sanitizers, keep unconfirmed hypotheses,
+  trace the full chain. Updated resource counts (17 playbooks, 317 manuals,
+  66 payload collections).
+- `bs-orchestrate-engagement` now tells the agent to read the matching playbook
+  for the target type and carries the same persistence rule.
+
+## [1.0.79] — 2026-09-13
+
+### Fixed — scheme-less URL routing
+
+- `classifyTarget` now recognizes URLs without a scheme: a bare domain, IP, or
+  host:port (`example.com`, `192.168.1.1`, `example.com:8080`) is classified as
+  live and gets `https://` auto-prepended; a bare code filename (`myfile.php`)
+  is classified as source. `run_engagement` uses it, so a scheme-less URL routes
+  to the live pipeline without the caller normalizing it.
+- Routing doctrine (skill + MCP `instructions`) updated to state that a URL
+  often carries no `http://`/`https://` prefix.
+
+## [1.0.78] — 2026-09-13
+
+### Added — automatic target routing (URL vs source)
+
+- `bs-orchestrate-engagement` now leads with a "Target routing" table: a URL
+  or bare hostname → live engagement (scope-gated); a filesystem path / code
+  extension → source audit — classified automatically, no need to ask.
+- MCP `instructions` gained a "0. ROUTE BY TARGET" step so a driving LLM
+  auto-classifies the target and routes to the live or source pipeline without
+  being told.
+
 ## [1.0.77] — 2026-09-13
 
 ### Fixed — explicit tool argument names in doctrine

package/dist/index.js

@@ -30824,6 +30824,21 @@ function formatPlanChecklist(plan) {
   return rows.join(`
 `);
 }
+function classifyTarget(target) {
+  if (/^https?:\/\//i.test(target))
+    return { kind: "live", target };
+  try {
+    if (existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
+      return { kind: "source", target };
+    }
+  } catch {}
+  const CODE_EXT = /\.(php|phtml|py|js|ts|jsx|tsx|java|rb|go|c|cpp|cs|swift|kt|rs|pl|sh|sql|html|vue|m|mm)$/i;
+  if (CODE_EXT.test(target) && !target.includes("/")) {
+    return { kind: "source", target };
+  }
+  const host = /^[\w.-]+\.[a-zA-Z]{2,}(:\d+)?([/?#].*)?$/.test(target) || /^\d{1,3}(\.\d{1,3}){3}(:\d+)?$/.test(target);
+  return { kind: "live", target: host ? `https://${target}` : target };
+}
 var _chainsCache = null;
 function loadChains() {
   if (_chainsCache)
@@ -31567,6 +31582,48 @@ function templateLookup(topic, limit = 10) {
   walk(TEMPLATES);
   return { found: hits.length > 0, topic, count: hits.length, templates: hits.slice(0, limit) };
 }
+var BYPASS_ALIASES = {
+  "403": "auth",
+  "401": "auth",
+  forbidden: "auth",
+  "auth bypass": "auth",
+  authorization: "auth",
+  acl: "auth",
+  access: "auth",
+  waf: "waf",
+  firewall: "waf",
+  modsecurity: "waf",
+  cloudflare: "waf",
+  filter: "filter",
+  sanitizer: "filter",
+  blacklist: "filter",
+  whitelist: "filter",
+  validation: "filter",
+  input: "filter",
+  "rate limit": "rate_limit",
+  ratelimit: "rate_limit",
+  captcha: "rate_limit",
+  bot: "rate_limit",
+  "bot protection": "rate_limit"
+};
+function bypassLookup(defense) {
+  const data = loadJson("bypass_techniques");
+  if (!data)
+    return { found: false, error: "bypass_techniques.json not found" };
+  const cats = data.categories;
+  if (!defense) {
+    return {
+      found: true,
+      categories: cats.map((c) => ({ id: c.id, defense: c.defense, techniques: c.techniques.length }))
+    };
+  }
+  const key = defense.toLowerCase();
+  const norm = BYPASS_ALIASES[key] ?? key;
+  const match = cats.find((c) => c.id === norm || c.defense.toLowerCase().includes(norm) || norm.includes(c.id));
+  if (!match)
+    return { found: false, defense, suggestions: cats.map((c) => c.id) };
+  return { found: true, defense: match.defense, techniques: match.techniques };
+}
 
 // src/active.ts
 var TIMEOUT_MS2 = 20000;
@@ -53328,7 +53385,9 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (WP/PHP 0-day, AD, " + "  malware, mobile, cloud, etc.).\\n" + "- read_playbook / read_tool_manual / list_manuals: 270 tool manuals + engagement " + "  playbooks.\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + `- INTELLIGENCE = knowledge (chains, attack vectors, CVE/tech mapping).\\n
+` + "PERSISTENCE (complex bugs - do not give up):\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
+` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding usually escalates. list_chains and match it " + "  to a multi-stage chain (SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell) instead " + "  of stopping at the first vuln.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",
@@ -53526,8 +53585,8 @@ function createServer() {
       remember: boolean2().optional().describe("Auto-capture matched chains to memory (default true)")
     }
   }, async ({ target, scope, mode, max_files, remember }) => {
-    const isUrl = /^https?:\/\//i.test(target);
-    const r = isUrl ? await runLiveEngagement(target, scope ?? "", mode ?? "bug-bounty") : runEngagement(target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
+    const cls = classifyTarget(target);
+    const r = cls.kind === "live" ? await runLiveEngagement(cls.target, scope ?? "", mode ?? "bug-bounty") : runEngagement(cls.target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
     const banner = typeof r.banner === "string" ? r.banner : "";
     const planText = Array.isArray(r.plan) && r.plan.length ? `
 
@@ -53815,6 +53874,15 @@ ${statusLine}` : statusLine },
   }, async ({ topic }) => {
     return { content: [{ type: "text", text: JSON.stringify(payloadLookup(topic)) }] };
   });
+  server.registerTool("bypass_lookup", {
+    title: "Look up bypass techniques",
+    description: "INTEL: return bypass techniques for a defense that is blocking a probe. Pass a defense/context (waf, firewall, filter, sanitizer, blacklist, 403/401, auth, captcha, rate limit) and get concrete techniques (encoding, case, comment insertion, chunked, null byte, double-encoding, verb tampering, header spoofing, ...) with examples. Use it when a strike_verify probe is blocked instead of giving up.",
+    inputSchema: {
+      defense: string2().optional().describe("Defense/context to bypass: waf, filter, sanitizer, blacklist, 403/401/auth, captcha, rate limit. Omit to list all categories.")
+    }
+  }, async ({ defense }) => {
+    return { content: [{ type: "text", text: JSON.stringify(bypassLookup(defense)) }] };
+  });
   server.registerTool("read_payload", {
     title: "Read a payload collection",
     description: "INTEL: read the full payload collection for a category (or a specific file).",

package/intelligence/bypass_techniques.json

@@ -0,0 +1,53 @@
+{
+  "_comment": "Bypass techniques for when a probe is blocked by a defense (WAF, filter/sanitizer, auth gate, rate-limit). Look up the matching defense and apply the technique instead of giving up.",
+  "categories": [
+    {
+      "id": "waf",
+      "defense": "WAF / web application firewall",
+      "techniques": [
+        {"id": "encoding", "name": "Encoding", "how": "URL-encode, double-encode, or unicode-escape the payload so the signature never matches.", "example": "%2527%2520OR%25201%253D1"},
+        {"id": "case", "name": "Case variation", "how": "Alternate keyword case to evade case-sensitive signatures.", "example": "SeLeCt * FrOm users"},
+        {"id": "comment", "name": "Inline comments", "how": "Insert inline comments inside keywords to split the signature.", "example": "UN/**/ION SE/**/LECT"},
+        {"id": "separator", "name": "Separator variation", "how": "Swap spaces for tabs/newlines/alternative separators.", "example": "SELECT%0a*%0aFROM"},
+        {"id": "concat", "name": "String concatenation", "how": "Break the payload into concatenated fragments.", "example": "se'||'lect"},
+        {"id": "chunked", "name": "Chunked / HTTP smuggling", "how": "Split the payload across chunked-encoding or HTTP/2 boundaries to bypass inspection."},
+        {"id": "param_pollution", "name": "Parameter pollution", "how": "Send duplicate parameters; the WAF checks one, the app uses the other.", "example": "id=1&id=1' OR '1'='1"}
+      ]
+    },
+    {
+      "id": "filter",
+      "defense": "Input filter / sanitizer / blacklist",
+      "techniques": [
+        {"id": "null_byte", "name": "Null byte", "how": "Insert a null byte to truncate validation while the sink reads past it.", "example": "file.php%00.jpg"},
+        {"id": "double_encode", "name": "Double encoding", "how": "Encode twice; the filter decodes once, the sink decodes again.", "example": "%252e%252e%252f"},
+        {"id": "unicode", "name": "Unicode / normalization", "how": "Use fullwidth, overlong UTF-8, or unicode lookalikes the filter misses.", "example": "＜script＞ or %c0%af"},
+        {"id": "case_mix", "name": "Case mixing", "how": "Bypass blacklists with mixed case when the filter is case-sensitive.", "example": "<ScRiPt>"},
+        {"id": "whitespace", "name": "Whitespace / padding", "how": "Insert spaces/tabs/newlines the filter strips or ignores.", "example": "<scr ipt>"},
+        {"id": "nested", "name": "Nested / recursive", "how": "Nest a blocked token inside an allowed one so the filter strips one layer.", "example": "<scr<script>ipt>"},
+        {"id": "cast_truncate", "name": "Cast / length truncation", "how": "Exploit int cast or length truncation that drops the dangerous tail.", "example": "1e99 (loose comparison to 1)"}
+      ]
+    },
+    {
+      "id": "auth",
+      "defense": "Authentication / authorization (401/403)",
+      "techniques": [
+        {"id": "path_traversal", "name": "Path normalization", "how": "Bypass path-based ACL with traversal or encoding.", "example": "/admin/../admin, /admin%2f, /admin/.;/"},
+        {"id": "verb", "name": "HTTP verb tampering", "how": "Switch the method (GET->POST, add X-HTTP-Method-Override).", "example": "GET /admin -> POST /admin"},
+        {"id": "header", "name": "Header spoofing", "how": "Spoof X-Forwarded-For / X-Real-IP / X-Original-URL to appear internal.", "example": "X-Original-URL: /admin"},
+        {"id": "case_path", "name": "Case / suffix", "how": "Vary case or append suffix to dodge exact-match rules.", "example": "/Admin, /admin/.json, /admin/."},
+        {"id": "param", "name": "Parameter override", "how": "Override auth via a second parameter or body field the backend trusts.", "example": "user=guest&user=admin"}
+      ]
+    },
+    {
+      "id": "rate_limit",
+      "defense": "Rate limit / captcha / bot protection",
+      "techniques": [
+        {"id": "rotation", "name": "IP / header rotation", "how": "Rotate source IP or spoof client headers to evade per-IP limits.", "example": "X-Forwarded-For: 1.2.3.4"},
+        {"id": "slow", "name": "Low-and-slow", "how": "Stay under the threshold with pacing + jitter."},
+        {"id": "header_spoof", "name": "Header spoofing", "how": "Spoof User-Agent / Referer to look like a real browser."},
+        {"id": "token_reuse", "name": "Token/session reuse", "how": "Reuse a valid session/token across requests to skip per-request checks."},
+        {"id": "burst", "name": "Burst vs window", "how": "Exploit the difference between per-second and per-window limits."}
+      ]
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.77",
+  "version": "1.0.81",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-orchestrate-engagement.md

@@ -8,6 +8,32 @@ description: Use when the user asks for a full security engagement ("fullscan",
 You are the brain. Blitz Strike is the hands. Drive the full cycle with the
 deterministic MCP tools; never guess a finding — produce it from tool output.
 
+## Target routing (auto-detect first — no need to ask)
+
+Classify the target before any tool call. This is automatic, driven by the
+shape of what the user gave you. A URL often has NO `http://`/`https://` prefix
+— a bare domain, IP, or host:port is still a live target:
+
+| Target shape | Flow |
+|---|---|
+| URL — with or without scheme (`https://x.com`, `x.com`, `sub.x.com/path`, `x.com:8080`, `192.168.1.1`) | **Live** — `scope_check` (authorization) → `live_recon` → `active_scan` → `strike_verify` → report |
+| Filesystem path (exists on disk, or starts `/` `./` `../` `~`, or ends in a code extension `.php` `.py` `.js` `.ts` `.java` …) | **Source** — `blitz_scan` → `eagle_eye2` → `complex_scan`/`route_scan` → report |
+
+Rule of thumb: check "is it a filesystem path?" FIRST (exists on disk, or a
+code extension). If it is NOT a path, treat it as a live host — prepend
+`https://` when the scheme is missing (`example.com` → `https://example.com`)
+and confirm scope before any request.
+
+`run_engagement` auto-detects both internally (path on disk → source pipeline;
+anything else → live, scope-gated). For the granular sub-agent flow, route the
+workstreams yourself: URL → live workstreams, path → source workstreams.
+
+After routing, read the matching playbook (`read_playbook`) for the target type
+— `web-application`, `api-security`, `source-code-audit`, `active-directory`,
+`mobile-application`, `external-attack-surface` — it is the campaign plan for
+that type. Load the phase skill (`source-audit`, `verify-finding`, …) for the
+step you are on. Do not improvise a plan the playbook already spells out.
+
 ## The cycle
 
 1. **Scope gate (always first).** Call `scope_check` before any live action.
@@ -78,6 +104,11 @@ user sees you working, not a silent tool call.
 
 ## Rules
 
+- **Persist — complex bugs do not give up.** A failed probe is not "not
+  vulnerable" (vary sinks, params, encodings); empty output is not "no
+  findings" (re-run or escalate to `route_scan`/`complex_scan`); a "sanitized"
+  sink is not safe until you challenge the sanitizer (loose `==`, missing
+  `EXTR_SKIP`, cast truncation). Keep unconfirmed work as hypotheses.
 - One hypothesis per finding; `finding_create` + `finding_transition` for the
   strict lifecycle (candidate → confirmed → rejected).
 - `dedup_findings` before reporting — collapse shared-root duplicates.