blitzstrike 1.1.7 → 1.3.0

package/dist/index.js

@@ -29762,9 +29762,9 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync6, existsSync as existsSync4, statSync as statSync2 } from "node:fs";
-import { join as join6 } from "node:path";
-import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readFileSync as readFileSync7, existsSync as existsSync5, statSync as statSync2 } from "node:fs";
+import { join as join7 } from "node:path";
+import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/memory.ts
 import { readFileSync as readFileSync2, appendFileSync, mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -30786,1084 +30786,1626 @@ function resolveFinding(finding, verdict) {
   }
 }
 
-// src/orchestrator.ts
-var ENGAGEMENT_STAGES = ["scope", "recon", "analyze", "verify", "review", "report"];
-function engagementBanner(target, mode) {
-  return [
-    "⚡ BLITZ engagement — orchestrator in control",
-    `   target:  ${target}`,
-    `   mode:    ${mode}`,
-    `   stages:  ${ENGAGEMENT_STAGES.join(" → ")}`
-  ].join(`
-`);
+// src/intel.ts
+import { readFileSync as readFileSync6, existsSync as existsSync4 } from "node:fs";
+import { join as join6 } from "node:path";
+import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { readdirSync as readdirSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+var ROOT2 = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
+var INTEL = join6(ROOT2, "intelligence");
+function loadJson(name) {
+  const p = join6(INTEL, `${name}.json`);
+  if (!existsSync4(p))
+    return null;
+  try {
+    return JSON.parse(readFileSync6(p, "utf8"));
+  } catch {
+    return null;
+  }
 }
-function formatStatus(opts) {
-  const lines = [];
-  const idx = opts.phase ? ENGAGEMENT_STAGES.indexOf(opts.phase) : -1;
-  lines.push(`BLITZ engagement${idx >= 0 ? ` — ${opts.phase} (${idx + 1}/${ENGAGEMENT_STAGES.length})` : ""}`);
-  if (idx >= 0) {
-    lines.push(`   stages: ${ENGAGEMENT_STAGES.map((s, i) => i < idx ? `${s} ✓` : i === idx ? `${s} ▶` : `${s} ☐`).join("  ")}`);
+function detectWaf(headers, body = "") {
+  const sigs = loadJson("waf_signatures");
+  if (!sigs)
+    return { detected: false, wafs: [], error: "waf_signatures.json not loaded" };
+  const headerSigs = sigs.header_signatures ?? [];
+  const bodySigs = sigs.body_signatures ?? [];
+  const matches = [];
+  const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
+  for (const s of headerSigs) {
+    const h = (s.header ?? "").toLowerCase();
+    const pattern = (s.pattern ?? "").toLowerCase();
+    if (!h)
+      continue;
+    if (pattern) {
+      const val = (headers[h] ?? headers[s.header ?? ""] ?? "").toLowerCase();
+      if (val.includes(pattern)) {
+        matches.push({ waf: s.waf, header: s.header, pattern: s.pattern, confidence: s.confidence, via: "header-value" });
+      }
+    } else {
+      if (headerKeys.includes(h)) {
+        matches.push({ waf: s.waf, header: s.header, confidence: s.confidence, via: "header-name" });
+      }
+    }
   }
-  if (opts.findings) {
-    const f = opts.findings;
-    lines.push(`   findings: ${[`${f.detected ?? 0} detected`, `${f.hypothesis ?? 0} hypothesis`, `${f.confirmed ?? 0} confirmed`, `${f.false_positive ?? 0} false_positive`].join(" · ")}`);
+  for (const s of bodySigs) {
+    const pattern = (s.pattern ?? "").toLowerCase();
+    if (pattern && body.toLowerCase().includes(pattern)) {
+      matches.push({ waf: s.waf, pattern: s.pattern, confidence: s.confidence, via: "body" });
+    }
   }
-  if (opts.tasks && opts.tasks.length) {
-    lines.push(`   tasks: ${opts.tasks.map((t) => `${t.objective} (${t.status})`).join(" · ")}`);
+  const byWaf = new Map;
+  for (const m of matches) {
+    const key = m.waf;
+    const prev = byWaf.get(key);
+    if (!prev || m.confidence > prev.confidence)
+      byWaf.set(key, m);
   }
-  return lines.join(`
-`);
+  const detected = [...byWaf.values()].sort((a, b) => b.confidence - a.confidence);
+  return {
+    detected: detected.length > 0,
+    wafs: detected,
+    block_status_codes: sigs.block_status_codes ?? []
+  };
 }
-function formatPlanChecklist(plan) {
-  const mark = (s) => s === "done" ? "✓" : s === "pending" ? "☐" : "▶";
-  const items = plan.map((p) => `[${mark(p.status)}] ${p.state}`);
-  const rows = [];
-  for (let i = 0;i < items.length; i += 3) {
-    rows.push("   " + items.slice(i, i + 3).map((s) => s.padEnd(22)).join(""));
+function techCorrelation(tech) {
+  const data = loadJson("tech_correlations");
+  if (!data)
+    return { found: false, error: "tech_correlations.json not loaded" };
+  const key = tech.toLowerCase();
+  const entry = data[key];
+  if (!entry) {
+    const matches = Object.keys(data).filter((k) => k.includes(key) || key.includes(k)).slice(0, 5);
+    return { found: false, tech, suggestions: matches };
   }
-  return rows.join(`
-`);
+  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? { vulns: entry.vulns, paths: entry.paths } };
 }
-function classifyTarget(target) {
-  if (/^https?:\/\//i.test(target))
-    return { kind: "live", target };
-  try {
-    if (existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
-      return { kind: "source", target };
-    }
-  } catch {}
-  const CODE_EXT = /\.(php|phtml|py|js|ts|jsx|tsx|java|rb|go|c|cpp|cs|swift|kt|rs|pl|sh|sql|html|vue|m|mm)$/i;
-  if (CODE_EXT.test(target) && !target.includes("/")) {
-    return { kind: "source", target };
+function cveCorrelation(cveId) {
+  const data = loadJson("cve_correlations");
+  if (!data)
+    return { error: "cve_correlations.json not loaded" };
+  const key = cveId.toUpperCase();
+  const entry = data[key];
+  if (!entry)
+    return { found: false, cve: key, total_known: Object.keys(data).length };
+  return { found: true, cve: key, ...entry };
+}
+function portCorrelation(port) {
+  const data = loadJson("port_correlations");
+  if (!data)
+    return { error: "port_correlations.json not loaded" };
+  const key = String(port);
+  const entry = data[key];
+  if (!entry)
+    return { found: false, port: key, total_known: Object.keys(data).length };
+  return { found: true, port: key, ...entry };
+}
+function fuzzerPayloads(category) {
+  const data = loadJson("fuzzer_data");
+  if (!data)
+    return { error: "fuzzer_data.json not loaded" };
+  if (category) {
+    const c = data[category] ?? data[category.toUpperCase()];
+    return { category, found: Boolean(c), data: c ?? null };
   }
-  const host = /^[\w.-]+\.[a-zA-Z]{2,}(:\d+)?([/?#].*)?$/.test(target) || /^\d{1,3}(\.\d{1,3}){3}(:\d+)?$/.test(target);
-  return { kind: "live", target: host ? `https://${target}` : target };
+  return { categories: Object.keys(data), fuzz_points: data.FUZZ_POINTS ?? null, payloads: data.FUZZ_PAYLOADS ?? null };
 }
-var _chainsCache = null;
-function loadChains() {
-  if (_chainsCache)
-    return _chainsCache;
+function intelSummary() {
+  const waf = loadJson("waf_signatures");
+  const tech = loadJson("tech_correlations");
+  const cve = loadJson("cve_correlations");
+  const port = loadJson("port_correlations");
+  const fuzz = loadJson("fuzzer_data");
+  const av = loadJson("attack_vectors");
+  return {
+    waf_signatures: waf ? (waf.header_signatures?.length ?? 0) + (waf.body_signatures?.length ?? 0) : 0,
+    tech_correlations: tech ? Object.keys(tech).length : 0,
+    cve_correlations: cve ? Object.keys(cve).length : 0,
+    port_correlations: port ? Object.keys(port).length : 0,
+    fuzzer_categories: fuzz ? Object.keys(fuzz).length : 0,
+    payload_categories: listPayloadCategories().length,
+    nuclei_templates: countTemplates(),
+    attack_vector_categories: av ? av.categories.length : 0,
+    attack_vectors: av ? av.categories.reduce((n, c) => n + c.vectors.length, 0) : 0
+  };
+}
+function listAttackVectors() {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  return {
+    total_categories: data.categories.length,
+    total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
+    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length, focus: c.focus ?? "" }))
+  };
+}
+function attackVectors(category) {
+  const data = loadJson("attack_vectors");
+  if (!data)
+    return { error: "attack_vectors.json not loaded" };
+  const q = category.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const found = data.categories.find((c) => c.id === q || c.id.includes(q) || c.title.toLowerCase().includes(category.toLowerCase()));
+  if (!found) {
+    const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
+    return { found: false, query: category, suggestions: matches };
+  }
+  return { found: true, id: found.id, title: found.title, focus: found.focus ?? "", count: found.vectors.length, vectors: found.vectors };
+}
+var PACKAGE_PAYLOADS = join6(ROOT2, "payloads");
+var PACKAGE_TEMPLATES = join6(ROOT2, "templates");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join6(homedir3(), ".blitzstrike", "data");
+function payloadsDir() {
+  if (existsSync4(PACKAGE_PAYLOADS))
+    return PACKAGE_PAYLOADS;
+  return join6(DATA_ROOT, "payloads");
+}
+function templatesDir() {
+  if (existsSync4(PACKAGE_TEMPLATES))
+    return PACKAGE_TEMPLATES;
+  return join6(DATA_ROOT, "templates");
+}
+var PAYLOADS = payloadsDir();
+var TEMPLATES = templatesDir();
+function listPayloadCategories() {
   try {
-    const dir = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
-    const path = join6(dir, "chains.json");
-    const raw = JSON.parse(readFileSync6(path, "utf8"));
-    _chainsCache = raw.chains ?? [];
-    return _chainsCache;
+    return readdirSync2(PAYLOADS, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
   } catch {
-    _chainsCache = [];
     return [];
   }
 }
-function scopeCheck(target, scope = "", mode = "bug-bounty") {
-  if (target.startsWith("/") || target.startsWith("./") || target.startsWith("../") || target.startsWith("~") || /^[a-zA-Z]:[\\/]/.test(target)) {
-    return { target, allowed: true, enforcement: "off", reason: "static source path — always in-scope" };
+function payloadLookup(topic) {
+  const cats = listPayloadCategories();
+  const key = topic.toLowerCase();
+  const ALIASES = {
+    sqli: "sql injection",
+    xss: "xss injection",
+    ssrf: "server side request forgery",
+    ssti: "server side template injection",
+    jwt: "json web token",
+    lfi: "file inclusion",
+    rfi: "file inclusion",
+    xxe: "xxe injection",
+    idor: "insecure direct object references",
+    csrf: "cross-site request forgery",
+    cmdi: "command injection",
+    rce: "command injection",
+    cors: "cors misconfiguration",
+    crlf: "crlf injection",
+    prototype: "prototype pollution",
+    nosql: "nosql injection",
+    upload: "upload insecure files"
+  };
+  const normalized = ALIASES[key] ?? key;
+  const exact = cats.find((c) => c.toLowerCase() === normalized);
+  if (exact) {
+    return { found: true, category: exact, files: listFiles(join6(PAYLOADS, exact)) };
   }
-  let result;
-  if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
-    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
-  } else if (!scope.trim()) {
-    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
-  } else {
-    const inScope = [];
-    const outScope = [];
-    for (const raw of scope.split(/[,\n]/)) {
-      const line = raw.trim();
-      if (!line)
-        continue;
-      if (line.startsWith("-"))
-        outScope.push(line.slice(1).trim());
-      else
-        inScope.push(line);
+  const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
+  const matches = cats.filter((c) => {
+    const cl = c.toLowerCase();
+    if (cl.includes(normalized) || normalized.includes(cl))
+      return true;
+    return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
+  });
+  if (matches.length > 0) {
+    return { found: true, category: matches[0], files: listFiles(join6(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
+  }
+  return { found: false, topic, suggestions: cats.slice(0, 20) };
+}
+function readPayload(category, file) {
+  const cats = listPayloadCategories();
+  const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
+  if (!exact)
+    return { found: false, category, suggestions: cats.slice(0, 20) };
+  const dir = join6(PAYLOADS, exact);
+  const files = listFiles(dir);
+  if (!file) {
+    const readme = files.find((f) => f.toLowerCase() === "readme.md");
+    if (readme) {
+      return { found: true, category: exact, file: readme, content: readFileSync6(join6(dir, readme), "utf8").slice(0, 20000) };
     }
-    let host = target;
-    host = host.replace(/^https?:\/\//, "");
-    host = host.split("/")[0].split(":")[0];
-    let decided = false;
-    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
-    for (const exc of outScope) {
-      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
-        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
-        decided = true;
-        break;
+    return { found: true, category: exact, files };
+  }
+  const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
+  if (!f)
+    return { found: false, category: exact, file, suggestions: files };
+  return { found: true, category: exact, file: f, content: readFileSync6(join6(dir, f), "utf8").slice(0, 20000) };
+}
+function listFiles(dir) {
+  try {
+    return readdirSync2(dir).filter((f) => f.endsWith(".md") || f.endsWith(".txt") || f.endsWith(".yaml")).sort();
+  } catch {
+    return [];
+  }
+}
+function countTemplates() {
+  try {
+    let n = 0;
+    const walk = (dir) => {
+      for (const e of readdirSync2(dir, { withFileTypes: true })) {
+        if (e.isDirectory())
+          walk(join6(dir, e.name));
+        else if (e.name.endsWith(".yaml"))
+          n++;
       }
+    };
+    walk(TEMPLATES);
+    return n;
+  } catch {
+    return 0;
+  }
+}
+function templateLookup(topic, limit = 10) {
+  const key = topic.toLowerCase();
+  const hits = [];
+  const walk = (dir, depth = 0) => {
+    if (depth > 6 || hits.length >= limit * 3)
+      return;
+    let entries;
+    try {
+      entries = readdirSync2(dir, { withFileTypes: true });
+    } catch {
+      return;
     }
-    if (!decided) {
-      for (const allowed of inScope) {
-        const a = allowed.replace(/\*/g, "");
-        if (!a)
-          continue;
-        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
-          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
-          decided = true;
-          break;
+    for (const e of entries) {
+      if (e.isDirectory())
+        walk(join6(dir, e.name), depth + 1);
+      else if (e.name.endsWith(".yaml")) {
+        const name = e.name.toLowerCase();
+        if (name.includes(key)) {
+          const full = join6(dir, e.name);
+          let id = "";
+          try {
+            const content = readFileSync6(full, "utf8");
+            const m = content.match(/^\s*id:\s*(.+)$/m);
+            if (m)
+              id = m[1].trim();
+          } catch {}
+          hits.push({ path: full.replace(ROOT2 + "/", ""), name: e.name, id });
         }
       }
     }
+  };
+  walk(TEMPLATES);
+  return { found: hits.length > 0, topic, count: hits.length, templates: hits.slice(0, limit) };
+}
+var BYPASS_ALIASES = {
+  "403": "auth",
+  "401": "auth",
+  forbidden: "auth",
+  "auth bypass": "auth",
+  authorization: "auth",
+  acl: "auth",
+  access: "auth",
+  waf: "waf",
+  firewall: "waf",
+  modsecurity: "waf",
+  cloudflare: "waf",
+  filter: "filter",
+  sanitizer: "filter",
+  blacklist: "filter",
+  whitelist: "filter",
+  validation: "filter",
+  input: "filter",
+  "rate limit": "rate_limit",
+  ratelimit: "rate_limit",
+  captcha: "rate_limit",
+  bot: "rate_limit",
+  "bot protection": "rate_limit"
+};
+function bypassLookup(defense) {
+  const data = loadJson("bypass_techniques");
+  if (!data)
+    return { found: false, error: "bypass_techniques.json not found" };
+  const cats = data.categories;
+  if (!defense) {
+    return {
+      found: true,
+      categories: cats.map((c) => ({ id: c.id, defense: c.defense, techniques: c.techniques.length }))
+    };
   }
-  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
-  return result;
+  const key = defense.toLowerCase();
+  const norm = BYPASS_ALIASES[key] ?? key;
+  const match = cats.find((c) => c.id === norm || c.defense.toLowerCase().includes(norm) || norm.includes(c.id));
+  if (!match)
+    return { found: false, defense, suggestions: cats.map((c) => c.id) };
+  return { found: true, defense: match.defense, techniques: match.techniques };
 }
-function classifySink(sink) {
-  if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
-    return "upload_weak_validation";
-  if (/unserialize/.test(sink))
-    return "unserialize_user_input";
-  if (/(exec\(|system\(|shell_exec|passthru|popen|proc_open)/.test(sink))
-    return "command_injection";
-  if (/(include|require)/.test(sink))
-    return "lfi_unvalidated_include";
-  if (/extract\(/.test(sink))
-    return "extract_without_exstr_skip";
-  if (/(\$wpdb|->query)/.test(sink))
-    return "sql_injection";
-  if (/(wp_remote_get|wp_remote_post|file_get_contents)/.test(sink))
-    return "ssrf_unvalidated_url";
-  if (/(eval\(|assert\(|create_function)/.test(sink))
-    return "unsafe_template_render";
-  return "";
+function chainLinks() {
+  const data = loadJson("chain_links");
+  if (!data)
+    return { found: false, error: "chain_links.json not found" };
+  return { found: true, total: data.links.length, links: data.links };
 }
-function enrichScan(path, maxFiles = 2000) {
-  const expanded = path.replace(/^~/, process.env.HOME ?? "~");
-  const files = iterSourceFiles(expanded, maxFiles);
-  const hits = [];
-  const sinkKinds = new Set;
-  for (const p of files) {
-    const r = scanFile(p);
-    for (const e of r.endpoints) {
-      hits.push({ type: "endpoint", file: r.file, line: e.line, detail: e.hook });
-    }
-    for (const s of r.sinks) {
-      hits.push({ type: "sink", file: r.file, line: s.line, detail: `${s.sink} -> ${s.class}` });
-      const kind = classifySink(s.sink);
-      if (kind)
-        sinkKinds.add(kind);
-    }
+function retryGuidance(signal) {
+  const data = loadJson("retry_guidance");
+  if (!data)
+    return { found: false, error: "retry_guidance.json not found" };
+  if (!signal) {
+    return {
+      found: true,
+      modes: data.modes.map((m) => ({ id: m.id, signal: m.signal, actions: m.actions.length }))
+    };
   }
-  const chains = loadChains();
-  const matched = [];
-  for (const c of chains) {
-    if ((c.required_findings ?? []).some((rf) => sinkKinds.has(rf))) {
-      matched.push({ chain_id: c.id, name: c.name, severity: c.severity, steps: c.steps.length });
-    }
+  const ALIASES = {
+    empty: "empty_output",
+    "no output": "empty_output",
+    stale: "empty_output",
+    blocked: "blocked",
+    waf: "blocked",
+    filter: "blocked",
+    firewall: "blocked",
+    sanitized: "sanitized",
+    sanitizer: "sanitized",
+    neutralized: "sanitized",
+    subagent: "subagent_failed",
+    "sub-agent": "subagent_failed",
+    delegate: "subagent_failed",
+    model: "model_failed",
+    "rate limit": "model_failed",
+    ratelimit: "model_failed",
+    quota: "model_failed",
+    context: "model_failed",
+    unconfirmed: "unconfirmed",
+    "not confirmed": "unconfirmed",
+    low: "low_severity",
+    "low severity": "low_severity"
+  };
+  const key = signal.toLowerCase().trim();
+  const norm = ALIASES[key] ?? key.replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
+  const match = data.modes.find((m) => m.id === norm || norm.includes(m.id) || m.id.includes(norm));
+  if (!match)
+    return { found: false, signal, suggestions: data.modes.map((m) => m.id) };
+  return { found: true, mode: match.id, signal: match.signal, actions: match.actions };
+}
+function orchestration(part) {
+  const data = loadJson("orchestration");
+  if (!data)
+    return { found: false, error: "orchestration.json not found" };
+  if (!part) {
+    return {
+      found: true,
+      phases: data.lifecycle.map((p) => ({ phase: p.phase, name: p.name })),
+      team: data.team.map((r) => ({ id: r.id, name: r.name }))
+    };
   }
+  const q = part.toLowerCase();
+  if (q === "lifecycle" || q === "phases")
+    return { found: true, lifecycle: data.lifecycle };
+  if (q === "team" || q === "roles")
+    return { found: true, team: data.team };
+  if (q === "handoff")
+    return { found: true, handoff: data.handoff };
+  if (q === "termination" || q === "done")
+    return { found: true, termination: data.termination };
+  const phase = data.lifecycle.find((p) => String(p.phase) === q);
+  if (phase)
+    return { found: true, ...phase };
+  const role = data.team.find((r) => String(r.id) === q);
+  if (role)
+    return { found: true, ...role };
   return {
-    root: expanded,
-    files_scanned: files.length,
-    hits: hits.slice(0, 2000),
-    sink_signals: [...sinkKinds].sort(),
-    matched_chains: matched
+    found: false,
+    part,
+    suggestions: ["lifecycle", "team", "handoff", "termination", ...data.lifecycle.map((p) => String(p.phase)), ...data.team.map((r) => String(r.id))]
   };
 }
-function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000, remember = true) {
-  const report = {
-    banner: engagementBanner(target, mode),
-    target,
-    mode,
-    tiers: {},
-    findings: [],
-    scope: null,
-    memory: { captured: 0 }
-  };
-  const isPath = (() => {
-    try {
-      return existsSync4(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
-    } catch {
-      return false;
-    }
-  })();
-  if (isPath) {
-    report.scope = { target, allowed: true, enforcement: "source-audit", reason: "local source path — no network scope gate" };
-  } else {
-    const sc = scopeCheck(target, scope, mode);
-    report.scope = sc;
-    if (!sc.allowed) {
-      report.status = "BLOCKED";
-      report.reason = sc.reason;
-      return report;
-    }
-  }
-  const blitz = enrichScan(target, maxFiles);
-  report.tiers = {
-    blitz: {
-      files_scanned: blitz.files_scanned,
-      hits: blitz.hits.length,
-      sink_signals: blitz.sink_signals,
-      matched_chains: blitz.matched_chains
-    }
-  };
-  const chains = loadChains();
-  const chainById = new Map(chains.map((c) => [c.id, c]));
-  const eagle = [];
-  for (const mc of blitz.matched_chains.slice(0, 10)) {
-    const chain = chainById.get(mc.chain_id);
-    if (!chain)
-      continue;
-    eagle.push({
-      chain_id: chain.id,
-      name: chain.name,
-      severity: chain.severity,
-      prerequisites: chain.required_findings,
-      recommended_tools: chain.tools ?? [],
-      tool_manuals: (chain.tools ?? []).map((t) => {
-        const m = findManual(t);
-        return m.found ? { tool: t, manual_name: m.name, preview: m.content.slice(0, 600) } : { tool: t, manual_name: null, preview: null };
-      }),
-      steps: chain.steps.map((s) => ({
-        order: s.order,
-        action: s.action,
-        tool_hint: s.tool_hint,
-        success_criteria: s.success_criteria,
-        invariant_check: s.invariant_check,
-        negative_control: s.negative_control
-      }))
-    });
+function modelFallback(signal) {
+  const data = loadJson("model_fallback");
+  if (!data)
+    return { found: false, error: "model_fallback.json not found" };
+  if (!signal) {
+    return {
+      found: true,
+      error_classes: data.error_classes.map((c) => ({ id: c.id, retryable: c.retryable, backoff: c.backoff })),
+      fallback_chain: data.fallback_chain,
+      backoff: data.backoff
+    };
   }
-  report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
-  const rank = { critical: 0, high: 1, medium: 2, low: 3 };
-  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
-  const findings = matchedSorted.map((f) => {
-    const chain = chainById.get(f.chain_id);
-    const severity = f.severity ?? "medium";
-    const finding = makeFinding({
-      title: f.name,
-      target: { type: "source", path: target },
-      severity,
-      source: { type: "static_sink_signal", name: f.chain_id },
-      sink: { type: f.chain_id, symbol: f.name },
-      chainId: f.chain_id,
-      chainName: f.name,
-      status: "hypothesis"
-    });
-    const ev = makeEvidence({
-      type: "sink_location",
-      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
-      sink: { chain_id: f.chain_id, name: f.name, severity },
-      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
-    });
-    finding.evidence.push(ev);
-    return finding;
-  });
-  report.findings = findings.map((f) => ({
-    id: f.id,
-    status: f.status,
-    title: f.title,
-    severity: f.classification.severity,
-    confidence: f.confidence,
-    confidence_level: f.confidence_level,
-    chain_id: f.chain.id,
-    evidence_count: f.evidence.length
-  }));
-  const reportTitle = `Blitz Strike — Engagement Report (${target})`;
-  const reportMarkdownText = reportMarkdown(findings, { title: reportTitle, scope: target, version: VERSION });
-  const reportJsonText = reportJson(findings, { title: reportTitle, scope: target, version: VERSION });
-  const sarifDoc = toSarif(findings.map((f) => ({
-    ruleId: f.chain.id || f.classification.severity,
-    level: sarifLevel(f.classification.severity),
-    message: f.title,
-    file: typeof f.target.path === "string" ? f.target.path : target,
-    line: 1
-  })));
-  report.report = {
-    summary: JSON.parse(reportJsonText).summary ?? null,
-    markdown: reportMarkdownText,
-    json: reportJsonText,
-    sarif: sarifDoc
-  };
-  report.status = "COMPLETE";
-  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
-  const executedState = "select_chain";
-  const scopeAllowed = report.scope?.allowed ?? false;
-  const plan = buildPlan(scopeAllowed, mode, executedState);
-  report.state = executedState;
-  report.state_description = stateDefinition(executedState).description;
-  report.plan = plan;
-  report.guidance = computeGuidance(executedState, scopeAllowed);
-  report.risk_policy = {
-    note: "High-risk actions (strike_verify, confirm_finding) require scope + are never run server-side automatically.",
-    gated: plan.filter((p) => !p.permitted).map((p) => p.tool)
-  };
-  if (remember) {
-    let captured = 0;
-    for (const mc of blitz.matched_chains) {
-      const chain = chainById.get(mc.chain_id);
-      const content = `Chain '${mc.chain_id}' (${mc.severity}) matched on target '${target}'. ` + `Detected sink signals: ${blitz.sink_signals.join(", ")}. ` + `Prerequisites: ${(chain?.required_findings ?? []).join(", ")}.`;
-      if (rememberIfAbsent(mc.chain_id, content, "pattern", [mc.severity, "chain"], "engagement", false)) {
-        captured++;
-      }
+  const q = signal.toLowerCase();
+  for (const c of data.error_classes) {
+    if (c.signals.some((s) => q.includes(s.toLowerCase()))) {
+      return {
+        found: true,
+        class: c.id,
+        retryable: c.retryable,
+        backoff: c.backoff,
+        action: c.action,
+        fallback_chain: data.fallback_chain,
+        backoff_schedule: c.backoff ? data.backoff : null
+      };
     }
-    report.memory = { captured, deduped: blitz.matched_chains.length - captured };
   }
-  return report;
+  return { found: false, signal, suggestions: data.error_classes.map((c) => c.id) };
 }
-function listChains() {
-  const chains = loadChains();
+function doctrineMap(part) {
+  const data = loadJson("doctrine_map");
+  if (!data)
+    return { found: false, error: "doctrine_map.json not found" };
+  if (!part) {
+    return {
+      found: true,
+      phases: data.phases.map((p) => ({ phase: p.phase, skill: p.skill, wstg: p.wstg })),
+      cross_cutting: data.cross_cutting
+    };
+  }
+  const q = part.toLowerCase();
+  const phase = data.phases.find((p) => String(p.phase) === q);
+  if (phase)
+    return { found: true, ...phase };
+  if (q === "cross_cutting" || q === "cross" || q === "moments") {
+    return { found: true, cross_cutting: data.cross_cutting };
+  }
   return {
-    total: chains.length,
-    chains: chains.map((c) => ({
-      id: c.id,
-      name: c.name,
-      severity: c.severity,
-      steps: c.steps.length,
-      triggers: c.triggers
-    }))
+    found: false,
+    part,
+    suggestions: ["cross_cutting", ...data.phases.map((p) => String(p.phase))]
   };
 }
-var LIVE_SWEEP_PARAMS = ["q", "search", "query", "s", "id", "url", "redirect", "name", "page"];
-async function runLiveEngagement(url, scope = "", mode = "bug-bounty") {
-  const report = { banner: engagementBanner(url, mode), target: url, mode, findings: [], scope: null, status: "" };
-  const sc = scopeCheck(url, scope, mode);
-  report.scope = sc;
-  const findings = [];
-  for (const param of LIVE_SWEEP_PARAMS) {
-    const verdict = await strikeVerify({ url, param });
-    const finding = makeFinding({
-      title: `Reflected input in parameter '${param}'`,
-      target: { type: "web", host: url, endpoint: `?${param}=` },
-      severity: "medium",
-      cwe: "CWE-79",
-      cweName: "Cross-site Scripting",
-      source: { type: "request_parameter", name: param },
-      sink: { type: "reflected_input", symbol: param },
-      chainId: "reflected_input",
-      chainName: "Reflected input",
-      status: "hypothesis"
-    });
-    findings.push(resolveFinding(finding, verdict));
+function wstgMap(category) {
+  const data = loadJson("wstg_map");
+  if (!data)
+    return { found: false, error: "wstg_map.json not found" };
+  if (!category) {
+    return {
+      found: true,
+      categories: data.categories.map((c) => ({ wstg: c.wstg, name: c.name, phase: c.phase, skill: c.skill }))
+    };
   }
-  report.findings = findings.map((f) => ({
-    id: f.id,
-    status: f.status,
-    title: f.title,
-    severity: f.classification.severity,
-    confidence: f.confidence,
-    confidence_level: f.confidence_level,
-    chain_id: f.chain.id,
-    validation: f.validation
-  }));
-  const title = `Blitz Strike — Live Engagement (${url})`;
-  const markdown = reportMarkdown(findings, { title, scope: url, version: VERSION });
-  const json = reportJson(findings, { title, scope: url, version: VERSION });
-  report.report = {
-    summary: JSON.parse(json).summary ?? null,
-    markdown,
-    json,
-    sarif: toSarif(findings.map((f) => ({
-      ruleId: f.chain.id || f.classification.cwe || f.classification.severity,
-      level: sarifLevel(f.classification.severity),
-      message: f.title,
-      file: url,
-      line: 1
-    })))
-  };
-  report.status = "COMPLETE";
-  report.note = "Autonomous live marker sweep. Each parameter was validated with a marker + " + "negative control; confirmed reflections are real findings, everything else " + "is a hypothesis or false positive. Re-run with explicit strike_verify for " + "deeper per-endpoint validation.";
-  return report;
+  const q = category.toUpperCase();
+  const c = data.categories.find((x) => String(x.wstg).toUpperCase() === q || String(x.name).toLowerCase().includes(category.toLowerCase()) || String(x.wstg).toUpperCase().includes(q));
+  if (c)
+    return { found: true, ...c };
+  return { found: false, category, suggestions: data.categories.map((x) => String(x.wstg)) };
 }
-
-// src/catalog.ts
-import { readFileSync as readFileSync7, readdirSync as readdirSync2 } from "node:fs";
-import { join as join7 } from "node:path";
-import { fileURLToPath as fileURLToPath4 } from "node:url";
-import { spawnSync } from "node:child_process";
-var ROOT2 = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
-var _toolsCache = null;
-var _skillsCache = null;
-function loadTools() {
-  if (_toolsCache)
-    return _toolsCache;
-  try {
-    const raw = JSON.parse(readFileSync7(join7(ROOT2, "tools-catalog.json"), "utf8"));
-    _toolsCache = raw.tools ?? [];
-  } catch {
-    _toolsCache = [];
+function techniqueLookup(cls) {
+  const data = loadJson("techniques");
+  if (!data)
+    return { found: false, error: "techniques.json not found" };
+  if (!cls) {
+    return {
+      found: true,
+      classes: data.classes.map((c) => ({ id: c.id, name: c.name }))
+    };
   }
-  return _toolsCache;
+  const q = cls.toLowerCase();
+  const c = data.classes.find((x) => String(x.id).toLowerCase() === q || String(x.id).toLowerCase().includes(q) || String(x.name).toLowerCase().includes(q));
+  if (c)
+    return { found: true, ...c };
+  return { found: false, cls, suggestions: data.classes.map((x) => String(x.id)) };
 }
-function loadSkills() {
-  if (_skillsCache)
-    return _skillsCache;
-  const dir = join7(ROOT2, "skills");
-  const out = [];
-  try {
-    for (const f of readdirSync2(dir)) {
-      if (!f.endsWith(".md"))
-        continue;
-      const p = join7(dir, f);
-      const text = readFileSync7(p, "utf8");
-      const descMatch = text.match(/^description:\s*(.+)$/m);
-      out.push({
-        name: f.replace(/\.md$/, ""),
-        file: f,
-        description: (descMatch?.[1] ?? "").trim().slice(0, 200),
-        size: text.length
-      });
-    }
-  } catch {}
-  _skillsCache = out;
-  return out;
+function frameworkTricks(framework) {
+  const data = loadJson("framework_tricks");
+  if (!data)
+    return { found: false, error: "framework_tricks.json not found" };
+  if (!framework) {
+    return { found: true, frameworks: data.frameworks.map((f) => ({ framework: f.framework })) };
+  }
+  const q = framework.toLowerCase();
+  const f = data.frameworks.find((x) => String(x.framework).toLowerCase().includes(q));
+  if (f)
+    return { found: true, ...f };
+  return { found: false, framework, suggestions: data.frameworks.map((x) => String(x.framework)) };
 }
-function toolLookup(name) {
-  const tools = loadTools();
-  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!t) {
+function resourceLookup(category) {
+  const data = loadJson("resources");
+  if (!data)
+    return { found: false, error: "resources.json not found" };
+  if (!category) {
     return {
-      found: false,
-      query: name,
-      suggestions: tools.filter((x) => x.name.includes(name.toLowerCase()) || name.toLowerCase().includes(x.name)).slice(0, 5).map((x) => x.name)
-    };
-  }
-  const manual = manualForTool(t.name);
-  const result = { found: true, tool: t };
-  if (manual && manual.content) {
-    result.manual = {
-      name: manual.name,
-      category: manual.category,
-      preview: manual.content.slice(0, 1500),
-      full_length: manual.content.length
+      found: true,
+      resources: data.resources.map((r) => ({ id: r.id, name: r.name, category: r.category, use_when: r.use_when }))
     };
-  } else {
-    result.manual = null;
   }
-  return result;
+  const q = category.toLowerCase();
+  const matches = data.resources.filter((r) => String(r.category).toLowerCase() === q || String(r.id).toLowerCase().includes(q) || String(r.name).toLowerCase().includes(q) || String(r.use_when).toLowerCase().includes(q));
+  if (matches.length > 0)
+    return { found: true, matches };
+  return { found: false, category, suggestions: [...new Set(data.resources.map((r) => String(r.category)))] };
 }
-function listTools() {
-  const tools = loadTools();
-  const byCat = {};
-  for (const t of tools) {
-    (byCat[t.category] ??= []).push(t.name);
+function taxonomy(kind, query) {
+  if (kind === "api" || kind === "api_top10" || kind === "owasp-api") {
+    const data = loadJson("api_top10");
+    if (!data)
+      return { found: false, error: "api_top10.json not found" };
+    if (!query)
+      return { found: true, risks: data.risks };
+    const q = query.toLowerCase();
+    const r = data.risks.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (r)
+      return { found: true, ...r };
+    return { found: false, query, suggestions: data.risks.map((x) => String(x.id)) };
   }
-  return { total: tools.length, categories: byCat, tools: tools.map((t) => ({ name: t.name, category: t.category, description: t.description })) };
-}
-function skillLookup(topic) {
-  const skills = loadSkills();
-  const q = topic.toLowerCase();
-  const scored = skills.map((s) => {
-    const hay = `${s.name} ${s.description}`.toLowerCase();
-    const nameHit = s.name.includes(q);
-    const descHit = s.description.includes(q);
-    const wordHit = q.split(/\s+/).filter((w) => w && hay.includes(w)).length;
-    return { s, score: (nameHit ? 10 : 0) + (descHit ? 5 : 0) + wordHit * 2 };
-  }).filter((x) => x.score > 0).sort((a, b) => b.score - a.score);
-  if (scored.length === 0) {
-    return { found: false, query: topic, suggestions: skills.map((s) => s.name).slice(0, 10) };
+  if (kind === "cwe" || kind === "weakness") {
+    const data = loadJson("cwe_map");
+    if (!data)
+      return { found: false, error: "cwe_map.json not found" };
+    if (!query)
+      return { found: true, mapping: data.mapping };
+    const q = query.toLowerCase();
+    const m = data.mapping.filter((x) => String(x.id).toLowerCase().includes(q) || String(x.cwe).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (m.length > 0)
+      return { found: true, matches: m };
+    return { found: false, query, suggestions: data.mapping.map((x) => String(x.id)) };
+  }
+  if (kind === "web" || kind === "owasp" || kind === "top10" || kind === "web_top10") {
+    const data = loadJson("owasp_top10");
+    if (!data)
+      return { found: false, error: "owasp_top10.json not found" };
+    if (!query)
+      return { found: true, risks: data.risks };
+    const q = query.toLowerCase();
+    const r = data.risks.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (r)
+      return { found: true, ...r };
+    return { found: false, query, suggestions: data.risks.map((x) => String(x.id)) };
+  }
+  if (kind === "asvs" || kind === "verification") {
+    const data = loadJson("asvs");
+    if (!data)
+      return { found: false, error: "asvs.json not found" };
+    if (!query)
+      return { found: true, chapters: data.chapters };
+    const q = query.toLowerCase();
+    const c = data.chapters.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
+    if (c)
+      return { found: true, ...c };
+    return { found: false, query, suggestions: data.chapters.map((x) => String(x.id)) };
   }
   return {
-    found: true,
-    matches: scored.slice(0, 5).map((x) => ({ name: x.s.name, description: x.s.description, file: x.s.file }))
+    found: false,
+    error: "unknown taxonomy kind",
+    usage: "taxonomy(kind='web'|'api'|'cwe'|'asvs', query?)"
   };
 }
-function listSkills() {
-  const skills = loadSkills();
-  return { total: skills.length, skills: skills.map((s) => ({ name: s.name, description: s.description })) };
-}
-function readSkill(name) {
-  const skills = loadSkills();
-  const s = skills.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!s)
-    return { found: false, query: name };
+
+// src/live-recon.ts
+import { resolve4 } from "node:dns/promises";
+import { connect } from "node:net";
+var HTTP_TIMEOUT_MS = 20000;
+async function httpGet(url, opts = {}) {
+  const controller = new AbortController;
+  const t = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
   try {
-    const text = readFileSync7(join7(ROOT2, "skills", s.file), "utf8");
-    return { found: true, name: s.name, content: text.slice(0, 12000) };
-  } catch {
-    return { found: false, query: name, error: "unreadable" };
+    const res = await fetch(url, { signal: controller.signal, redirect: opts.redirect ?? "follow" });
+    const body = await res.text();
+    const headers = {};
+    res.headers.forEach((v, k) => {
+      headers[k] = v;
+    });
+    return { status: res.status, headers, body: body.slice(0, 50000), ok: res.ok };
+  } catch (e) {
+    return { status: 0, headers: {}, body: String(e), ok: false };
+  } finally {
+    clearTimeout(t);
   }
 }
-function ensureTool(name) {
-  const tools = loadTools();
-  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
-  if (!t) {
-    return { found: false, query: name, suggestions: tools.slice(0, 5).map((x) => x.name) };
+function normalizeTarget(target) {
+  let t = target.trim();
+  if (!/^https?:\/\//i.test(t))
+    t = `https://${t}`;
+  return t.replace(/\/+$/, "");
+}
+function crawlLinks(base, body) {
+  const links = [];
+  const scripts = [];
+  const hrefRe = /<a[^>]+href=["']([^"'#]+)["']/gi;
+  const scriptRe = /<script[^>]+src=["']([^"'#]+)["']/gi;
+  let m;
+  while ((m = hrefRe.exec(body)) !== null) {
+    let u = m[1];
+    if (u.startsWith("/"))
+      u = base + u;
+    else if (!/^https?:\/\//i.test(u))
+      u = base + "/" + u;
+    links.push(u);
   }
-  const check = spawnSync(t.check_installed.command, { shell: true, timeout: 15000 });
-  if (check.status !== 127 && check.error === undefined) {
-    return { name: t.name, installed: true, action: "none", note: "already installed" };
+  while ((m = scriptRe.exec(body)) !== null) {
+    let u = m[1];
+    if (u.startsWith("/"))
+      u = base + u;
+    else if (!/^https?:\/\//i.test(u))
+      u = base + "/" + u;
+    scripts.push(u);
   }
-  const platform = process.platform;
-  const cmd = t.install[platform] ?? t.install.linux;
-  if (!cmd) {
-    return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
+  return { links, scripts };
+}
+async function fetchRobotsAndSitemap(base) {
+  const robots = [];
+  const sitemap = [];
+  const rob = await httpGet(`${base}/robots.txt`);
+  if (rob.status === 200) {
+    for (const line of rob.body.split(`
+`)) {
+      const sm = line.match(/^Sitemap:\s*(.+)$/i);
+      if (sm)
+        sitemap.push(sm[1].trim());
+      const allow = line.match(/^(?:Allow|Disallow):\s*(.+)$/i);
+      if (allow && !allow[1].includes("*"))
+        robots.push(base + allow[1].trim());
+    }
   }
-  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
-  const ok = r.status === 0;
-  return {
-    name: t.name,
-    installed: ok,
-    action: "install",
-    command: cmd,
-    output: (r.stdout?.toString() ?? "").slice(-400) || (r.stderr?.toString() ?? "").slice(-400)
-  };
+  const sm = await httpGet(`${base}/sitemap.xml`);
+  if (sm.status === 200 && sm.body.includes("<loc>")) {
+    const locRe = /<loc>([^<]+)<\/loc>/gi;
+    let m;
+    while ((m = locRe.exec(sm.body)) !== null)
+      sitemap.push(m[1].trim());
+  }
+  return { robots, sitemap };
 }
-
-// src/intel.ts
-import { readFileSync as readFileSync8, existsSync as existsSync5 } from "node:fs";
-import { join as join8 } from "node:path";
-import { fileURLToPath as fileURLToPath5 } from "node:url";
-import { readdirSync as readdirSync3 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
-var INTEL = join8(ROOT3, "intelligence");
-function loadJson(name) {
-  const p = join8(INTEL, `${name}.json`);
-  if (!existsSync5(p))
-    return null;
-  try {
-    return JSON.parse(readFileSync8(p, "utf8"));
-  } catch {
-    return null;
+function extractParams(urls) {
+  const params = new Set;
+  for (const u of urls) {
+    try {
+      const q = new URL(u).searchParams;
+      for (const k of q.keys())
+        params.add(k);
+    } catch {}
   }
+  return [...params];
 }
-function detectWaf(headers, body = "") {
-  const sigs = loadJson("waf_signatures");
-  if (!sigs)
-    return { detected: false, wafs: [], error: "waf_signatures.json not loaded" };
-  const headerSigs = sigs.header_signatures ?? [];
-  const bodySigs = sigs.body_signatures ?? [];
-  const matches = [];
-  const headerKeys = Object.keys(headers).map((k) => k.toLowerCase());
-  for (const s of headerSigs) {
-    const h = (s.header ?? "").toLowerCase();
-    const pattern = (s.pattern ?? "").toLowerCase();
-    if (!h)
+async function subdomainEnum(domain) {
+  const out = new Set;
+  try {
+    const url = `https://crt.sh/?q=%25.${encodeURIComponent(domain)}&output=json`;
+    const r = await httpGet(url);
+    if (r.status === 200 && r.body.startsWith("[")) {
+      const data = JSON.parse(r.body);
+      for (const entry of data) {
+        for (const field of (entry.name_value ?? "").split(`
+`)) {
+          const name = field.trim().toLowerCase();
+          if (name && name.endsWith(domain.toLowerCase()) && !name.includes("*"))
+            out.add(name);
+        }
+      }
+    }
+  } catch {}
+  return { subdomains: [...out].sort(), source: "crt.sh (certificate transparency)" };
+}
+async function waybackUrls(domain) {
+  const out = new Set;
+  const url = `https://web.archive.org/cdx/search/cdx?url=*.${encodeURIComponent(domain)}/*&output=json&fl=original&collapse=urlkey&limit=500`;
+  try {
+    const controller = new AbortController;
+    const t = setTimeout(() => controller.abort(), 60000);
+    const res = await fetch(url, { signal: controller.signal, redirect: "manual" });
+    const body = await res.text();
+    clearTimeout(t);
+    if (body.startsWith("[[")) {
+      const data = JSON.parse(body);
+      for (let i = 1;i < data.length; i++) {
+        const u = data[i]?.[0];
+        if (u && typeof u === "string" && u.includes(domain))
+          out.add(u);
+      }
+    }
+  } catch {}
+  return { urls: [...out].slice(0, 500), source: "web.archive.org (Wayback CDX)" };
+}
+var COMMON_SUBDOMAINS = [
+  "www",
+  "mail",
+  "ftp",
+  "api",
+  "dev",
+  "staging",
+  "test",
+  "admin",
+  "portal",
+  "app",
+  "blog",
+  "shop",
+  "store",
+  "cdn",
+  "static",
+  "assets",
+  "img",
+  "images",
+  "secure",
+  "vpn",
+  "remote",
+  "webmail",
+  "smtp",
+  "pop",
+  "imap",
+  "ns1",
+  "ns2",
+  "dns",
+  "db",
+  "database",
+  "mysql",
+  "git",
+  "gitlab",
+  "jenkins",
+  "ci",
+  "jira",
+  "wiki",
+  "docs",
+  "help",
+  "support",
+  "status",
+  "monitor",
+  "grafana",
+  "kibana",
+  "backup",
+  "old",
+  "beta",
+  "demo",
+  "sandbox",
+  "internal",
+  "intranet"
+];
+async function dnsBrute(domain) {
+  const found = [];
+  const base = domain.toLowerCase();
+  const seen = new Set([base, "www." + base]);
+  for (const prefix of COMMON_SUBDOMAINS) {
+    const host = `${prefix}.${base}`;
+    if (seen.has(host))
       continue;
-    if (pattern) {
-      const val = (headers[h] ?? headers[s.header ?? ""] ?? "").toLowerCase();
-      if (val.includes(pattern)) {
-        matches.push({ waf: s.waf, header: s.header, pattern: s.pattern, confidence: s.confidence, via: "header-value" });
+    seen.add(host);
+    try {
+      const ips = await resolve4(host);
+      if (ips.length > 0)
+        found.push({ host, ips });
+    } catch {}
+  }
+  return { found, source: "DNS resolution (common subdomain prefixes)" };
+}
+var COMMON_PORTS = [
+  [21, "ftp"],
+  [22, "ssh"],
+  [25, "smtp"],
+  [53, "dns"],
+  [80, "http"],
+  [110, "pop3"],
+  [135, "msrpc"],
+  [139, "netbios"],
+  [143, "imap"],
+  [443, "https"],
+  [445, "smb"],
+  [993, "imaps"],
+  [995, "pop3s"],
+  [1433, "mssql"],
+  [1521, "oracle"],
+  [3306, "mysql"],
+  [3389, "rdp"],
+  [5432, "postgres"],
+  [6379, "redis"],
+  [8080, "http-alt"],
+  [8443, "https-alt"],
+  [9000, "app"],
+  [9090, "app"],
+  [9200, "elasticsearch"],
+  [11211, "memcached"],
+  [27017, "mongodb"]
+];
+function tcpProbe(host, port, timeout = 2000) {
+  return new Promise((resolve) => {
+    const socket = connect({ host, port, timeout });
+    socket.once("connect", () => {
+      socket.destroy();
+      resolve(true);
+    });
+    socket.once("timeout", () => {
+      socket.destroy();
+      resolve(false);
+    });
+    socket.once("error", () => {
+      socket.destroy();
+      resolve(false);
+    });
+  });
+}
+async function scanPorts(host) {
+  const results = [];
+  for (const [port, service] of COMMON_PORTS) {
+    const open = await tcpProbe(host, port);
+    if (open) {
+      const corr = portCorrelation(port);
+      results.push({ port, service, open: true, correlation: corr });
+    }
+  }
+  return results;
+}
+var API_PATHS = [
+  "/swagger.json",
+  "/swagger-ui.html",
+  "/openapi.json",
+  "/api-docs",
+  "/v2/api-docs",
+  "/v3/api-docs",
+  "/graphql",
+  "/graphiql",
+  "/actuator",
+  "/actuator/health",
+  "/actuator/env",
+  "/api/swagger.json",
+  "/docs",
+  "/redoc"
+];
+async function discoverApi(base) {
+  const out = [];
+  for (const p of API_PATHS) {
+    const r = await httpGet(`${base}${p}`);
+    if (r.status >= 200 && r.status < 400) {
+      out.push({ path: p, status: r.status, body_size: r.body.length });
+    }
+  }
+  return out;
+}
+function extractVersion(headers, body) {
+  const out = [];
+  const server = headers["server"] ?? headers["x-powered-by"] ?? "";
+  const serverVer = /^(nginx|apache|microsoft-iis|openresty|liteSpeed|caddy)\/?([0-9][0-9.\-]*)?/i.exec(server);
+  if (serverVer) {
+    out.push({ product: serverVer[1].toLowerCase(), version: serverVer[2] ?? "unknown", evidence: server });
+  }
+  const phpVer = /php\/([0-9][0-9.\-]*)/i.exec(server);
+  if (phpVer)
+    out.push({ product: "php", version: phpVer[1], evidence: server });
+  const wpVer = /content="WordPress\s+([0-9][0-9.]*)/i.exec(body);
+  if (wpVer)
+    out.push({ product: "wordpress", version: wpVer[1], evidence: `meta generator: WordPress ${wpVer[1]}` });
+  const joomlaVer = /Joomla!?\s*([0-9][0-9.]*)/i.exec(body);
+  if (joomlaVer)
+    out.push({ product: "joomla", version: joomlaVer[1], evidence: `body: Joomla ${joomlaVer[1]}` });
+  const drupalVer = /Drupal\s+([0-9][0-9.]*)/i.exec(body);
+  if (drupalVer)
+    out.push({ product: "drupal", version: drupalVer[1], evidence: `body: Drupal ${drupalVer[1]}` });
+  const powered = headers["x-powered-by"] ?? "";
+  if (powered && !out.some((o) => powered.includes(o.product))) {
+    out.push({ product: powered.split("/")[0].toLowerCase(), version: powered.split("/")[1] ?? "unknown", evidence: powered });
+  }
+  return out;
+}
+function correlateIntel(techs, versionList, portList) {
+  const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
+  const versions = versionList.map((v) => ({
+    product: v.product,
+    version: v.version,
+    correlation: techCorrelation(v.product),
+    payload_lookup: payloadLookup(v.product),
+    template_lookup: templateLookup(v.product, 5)
+  }));
+  const ports = portList.map((p) => ({ port: p.port, service: p.service, ...portCorrelation(p.port) }));
+  return { tech, versions, ports };
+}
+async function liveRecon(target, includeActive = false) {
+  const base = normalizeTarget(target);
+  const host = (() => {
+    try {
+      return new URL(base).hostname;
+    } catch {
+      return target;
+    }
+  })();
+  const root = await httpGet(base);
+  const interestingHeaders = {};
+  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
+    if (root.headers[k])
+      interestingHeaders[k] = root.headers[k];
+  }
+  const fingerprint = {
+    status: root.status,
+    title: (root.body.match(/<title[^>]*>([^<]+)<\/title>/i) ?? [])[1]?.trim().slice(0, 200) ?? "",
+    server: root.headers["server"] ?? root.headers["x-powered-by"] ?? "",
+    headers: interestingHeaders,
+    body_size: root.body.length
+  };
+  const waf = detectWaf(root.headers, root.body);
+  const techSig = [
+    [/wp-content|wp-includes|wp-json/i, "wordpress"],
+    [/wp-login\.php|wp-admin/i, "wordpress"],
+    [/powered by joomla|com_content/i, "joomla"],
+    [/laravel|_token|csrf-token/i, "laravel"],
+    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
+    [/angular|ng-version/i, "angular"],
+    [/vue|__vue__|v-data/i, "vue"],
+    [/django|csrftoken|__debug__/i, "django"],
+    [/ruby on rails|rails/i, "rails"],
+    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
+    [/phpBB|phpbb/i, "phpbb"],
+    [/mybb|mybb/i, "mybb"],
+    [/drupal|Drupal\.settings/i, "drupal"],
+    [/magento|Mage\./i, "magento"],
+    [/shopify|cdn\.shopify/i, "shopify"],
+    [/grafana|kibana|elastic/i, "grafana-kibana"],
+    [/node\.js|express/i, "nodejs"],
+    [/flask|werkzeug/i, "flask"],
+    [/spring|actuator/i, "spring"]
+  ];
+  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
+  const versions = extractVersion(root.headers, root.body);
+  const { links, scripts } = crawlLinks(base, root.body);
+  const { robots, sitemap } = await fetchRobotsAndSitemap(base);
+  const allUrls = [...links, ...scripts, ...robots, ...sitemap];
+  const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
+  const params = extractParams(allUrls);
+  const { subdomains } = await subdomainEnum(host);
+  const { found: dnsFindings } = await dnsBrute(host);
+  const { urls: wayback } = await waybackUrls(host);
+  const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
+  let openPorts = [];
+  if (includeActive && root.status > 0) {
+    const scan = await scanPorts(host);
+    openPorts = scan.map(({ port, service }) => ({ port, service }));
+  }
+  const intel = correlateIntel(techs, versions, openPorts);
+  const nextSteps = [];
+  if (waf.detected)
+    nextSteps.push(`WAF detected (${waf.wafs?.map((w) => w.waf).join(", ")}) — consult detect_waf + WAF bypass playbook before exploitation.`);
+  for (const t of techs) {
+    const c = techCorrelation(t);
+    if (c.found)
+      nextSteps.push(`Tech '${t}' maps to known vuln classes — read tech_correlation('${t}') and fetch nuclei templates with template_lookup('${t}').`);
+  }
+  for (const v of versions) {
+    nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
+  }
+  if (crawl.endpoints.length > 0)
+    nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
+  if (params.length > 0)
+    nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
+  if (subdomains.length > 0)
+    nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
+  if (dnsFindings.length > 0)
+    nextSteps.push(`DNS-resolved ${dnsFindings.length} hosts (${dnsFindings.map((d) => d.host).slice(0, 8).join(", ")}${dnsFindings.length > 8 ? "…" : ""}) — each is a live subdomain to recon.`);
+  if (wayback.length > 0)
+    nextSteps.push(`Wayback Machine surfaced ${wayback.length} historical URLs — mine them for hidden endpoints, old params, and forgotten pages; feed to taint_file/blitz_scan.`);
+  if (openPorts.length > 0)
+    nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
+  if (apiEndpoints.length > 0)
+    nextSteps.push(`API endpoints exposed (${apiEndpoints.map((e) => e.path).join(", ")}) — audit them with api-security playbook; check for BOLA/IDOR/auth gaps.`);
+  if (nextSteps.length === 0)
+    nextSteps.push("Nothing exposed on the surface — try subdomain enumeration, port scan (active), or request source access for EAGLE-EYE analysis.");
+  nextSteps.push("Every confirmed finding: record with finding_create, attach confidence_score, redact secrets. A hit is a hypothesis until verified.");
+  return {
+    target: base,
+    host,
+    fingerprint,
+    waf,
+    tech: { detected: techs, server: fingerprint.server },
+    versions,
+    crawl,
+    params,
+    subdomains,
+    dns_findings: dnsFindings,
+    wayback_urls: wayback,
+    api_endpoints: apiEndpoints,
+    open_ports: openPorts,
+    intel,
+    next_steps: nextSteps
+  };
+}
+
+// src/orchestrator.ts
+var ENGAGEMENT_STAGES = ["scope", "recon", "analyze", "verify", "review", "report"];
+function engagementBanner(target, mode) {
+  return [
+    "⚡ BLITZ engagement — orchestrator in control",
+    `   target:  ${target}`,
+    `   mode:    ${mode}`,
+    `   stages:  ${ENGAGEMENT_STAGES.join(" → ")}`
+  ].join(`
+`);
+}
+function formatStatus(opts) {
+  const lines = [];
+  const idx = opts.phase ? ENGAGEMENT_STAGES.indexOf(opts.phase) : -1;
+  lines.push(`BLITZ engagement${idx >= 0 ? ` — ${opts.phase} (${idx + 1}/${ENGAGEMENT_STAGES.length})` : ""}`);
+  if (idx >= 0) {
+    lines.push(`   stages: ${ENGAGEMENT_STAGES.map((s, i) => i < idx ? `${s} ✓` : i === idx ? `${s} ▶` : `${s} ☐`).join("  ")}`);
+  }
+  if (opts.findings) {
+    const f = opts.findings;
+    lines.push(`   findings: ${[`${f.detected ?? 0} detected`, `${f.hypothesis ?? 0} hypothesis`, `${f.confirmed ?? 0} confirmed`, `${f.false_positive ?? 0} false_positive`].join(" · ")}`);
+  }
+  if (opts.tasks && opts.tasks.length) {
+    lines.push(`   tasks: ${opts.tasks.map((t) => `${t.objective} (${t.status})`).join(" · ")}`);
+  }
+  return lines.join(`
+`);
+}
+function formatPlanChecklist(plan) {
+  const mark = (s) => s === "done" ? "✓" : s === "pending" ? "☐" : "▶";
+  const items = plan.map((p) => `[${mark(p.status)}] ${p.state}`);
+  const rows = [];
+  for (let i = 0;i < items.length; i += 3) {
+    rows.push("   " + items.slice(i, i + 3).map((s) => s.padEnd(22)).join(""));
+  }
+  return rows.join(`
+`);
+}
+function classifyTarget(target) {
+  if (/^https?:\/\//i.test(target))
+    return { kind: "live", target };
+  try {
+    if (existsSync5(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
+      return { kind: "source", target };
+    }
+  } catch {}
+  const CODE_EXT = /\.(php|phtml|py|js|ts|jsx|tsx|java|rb|go|c|cpp|cs|swift|kt|rs|pl|sh|sql|html|vue|m|mm)$/i;
+  if (CODE_EXT.test(target) && !target.includes("/")) {
+    return { kind: "source", target };
+  }
+  const host = /^[\w.-]+\.[a-zA-Z]{2,}(:\d+)?([/?#].*)?$/.test(target) || /^\d{1,3}(\.\d{1,3}){3}(:\d+)?$/.test(target);
+  return { kind: "live", target: host ? `https://${target}` : target };
+}
+var _chainsCache = null;
+function loadChains() {
+  if (_chainsCache)
+    return _chainsCache;
+  try {
+    const dir = join7(fileURLToPath4(new URL(".", import.meta.url)), "..");
+    const path = join7(dir, "chains.json");
+    const raw = JSON.parse(readFileSync7(path, "utf8"));
+    _chainsCache = raw.chains ?? [];
+    return _chainsCache;
+  } catch {
+    _chainsCache = [];
+    return [];
+  }
+}
+function scopeCheck(target, scope = "", mode = "bug-bounty") {
+  if (target.startsWith("/") || target.startsWith("./") || target.startsWith("../") || target.startsWith("~") || /^[a-zA-Z]:[\\/]/.test(target)) {
+    return { target, allowed: true, enforcement: "off", reason: "static source path — always in-scope" };
+  }
+  let result;
+  if (mode === "ctf" || mode === "reverse-engineering" || mode === "offensive") {
+    result = { target, allowed: true, enforcement: "off", reason: `mode=${mode} disables scope enforcement` };
+  } else if (!scope.trim()) {
+    result = { target, allowed: false, enforcement: "strict", reason: "no scope provided; refusing active testing" };
+  } else {
+    const inScope = [];
+    const outScope = [];
+    for (const raw of scope.split(/[,\n]/)) {
+      const line = raw.trim();
+      if (!line)
+        continue;
+      if (line.startsWith("-"))
+        outScope.push(line.slice(1).trim());
+      else
+        inScope.push(line);
+    }
+    let host = target;
+    host = host.replace(/^https?:\/\//, "");
+    host = host.split("/")[0].split(":")[0];
+    let decided = false;
+    result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' not in scope` };
+    for (const exc of outScope) {
+      if (exc && (host.includes(exc) || host.endsWith("." + exc.replace(/^\./, "")))) {
+        result = { target, allowed: false, enforcement: "strict", reason: `target '${host}' is explicitly out of scope (${exc})` };
+        decided = true;
+        break;
       }
-    } else {
-      if (headerKeys.includes(h)) {
-        matches.push({ waf: s.waf, header: s.header, confidence: s.confidence, via: "header-name" });
+    }
+    if (!decided) {
+      for (const allowed of inScope) {
+        const a = allowed.replace(/\*/g, "");
+        if (!a)
+          continue;
+        if (host.includes(a) || host.endsWith("." + a.replace(/^\./, ""))) {
+          result = { target, allowed: true, enforcement: "strict", reason: `matched in-scope pattern '${allowed}'` };
+          decided = true;
+          break;
+        }
       }
     }
   }
-  for (const s of bodySigs) {
-    const pattern = (s.pattern ?? "").toLowerCase();
-    if (pattern && body.toLowerCase().includes(pattern)) {
-      matches.push({ waf: s.waf, pattern: s.pattern, confidence: s.confidence, via: "body" });
+  recordAudit("scope_checked", { tool: "scope", target, result: result.allowed ? "allowed" : "denied" });
+  return result;
+}
+function classifySink(sink) {
+  if (/(move_uploaded_file|file_put_contents|fwrite)/.test(sink))
+    return "upload_weak_validation";
+  if (/unserialize/.test(sink))
+    return "unserialize_user_input";
+  if (/(exec\(|system\(|shell_exec|passthru|popen|proc_open)/.test(sink))
+    return "command_injection";
+  if (/(include|require)/.test(sink))
+    return "lfi_unvalidated_include";
+  if (/extract\(/.test(sink))
+    return "extract_without_exstr_skip";
+  if (/(\$wpdb|->query)/.test(sink))
+    return "sql_injection";
+  if (/(wp_remote_get|wp_remote_post|file_get_contents)/.test(sink))
+    return "ssrf_unvalidated_url";
+  if (/(eval\(|assert\(|create_function)/.test(sink))
+    return "unsafe_template_render";
+  return "";
+}
+function enrichScan(path, maxFiles = 2000) {
+  const expanded = path.replace(/^~/, process.env.HOME ?? "~");
+  const files = iterSourceFiles(expanded, maxFiles);
+  const hits = [];
+  const sinkKinds = new Set;
+  for (const p of files) {
+    const r = scanFile(p);
+    for (const e of r.endpoints) {
+      hits.push({ type: "endpoint", file: r.file, line: e.line, detail: e.hook });
+    }
+    for (const s of r.sinks) {
+      hits.push({ type: "sink", file: r.file, line: s.line, detail: `${s.sink} -> ${s.class}` });
+      const kind = classifySink(s.sink);
+      if (kind)
+        sinkKinds.add(kind);
+    }
+  }
+  const chains = loadChains();
+  const matched = [];
+  for (const c of chains) {
+    if ((c.required_findings ?? []).some((rf) => sinkKinds.has(rf))) {
+      matched.push({ chain_id: c.id, name: c.name, severity: c.severity, steps: c.steps.length });
     }
   }
-  const byWaf = new Map;
-  for (const m of matches) {
-    const key = m.waf;
-    const prev = byWaf.get(key);
-    if (!prev || m.confidence > prev.confidence)
-      byWaf.set(key, m);
-  }
-  const detected = [...byWaf.values()].sort((a, b) => b.confidence - a.confidence);
-  return {
-    detected: detected.length > 0,
-    wafs: detected,
-    block_status_codes: sigs.block_status_codes ?? []
-  };
-}
-function techCorrelation(tech) {
-  const data = loadJson("tech_correlations");
-  if (!data)
-    return { found: false, error: "tech_correlations.json not loaded" };
-  const key = tech.toLowerCase();
-  const entry = data[key];
-  if (!entry) {
-    const matches = Object.keys(data).filter((k) => k.includes(key) || key.includes(k)).slice(0, 5);
-    return { found: false, tech, suggestions: matches };
-  }
-  return { found: true, tech: key, vulns: entry.vulns ?? [], paths: entry.paths ?? [], detection: entry.detection ?? { vulns: entry.vulns, paths: entry.paths } };
-}
-function cveCorrelation(cveId) {
-  const data = loadJson("cve_correlations");
-  if (!data)
-    return { error: "cve_correlations.json not loaded" };
-  const key = cveId.toUpperCase();
-  const entry = data[key];
-  if (!entry)
-    return { found: false, cve: key, total_known: Object.keys(data).length };
-  return { found: true, cve: key, ...entry };
-}
-function portCorrelation(port) {
-  const data = loadJson("port_correlations");
-  if (!data)
-    return { error: "port_correlations.json not loaded" };
-  const key = String(port);
-  const entry = data[key];
-  if (!entry)
-    return { found: false, port: key, total_known: Object.keys(data).length };
-  return { found: true, port: key, ...entry };
-}
-function fuzzerPayloads(category) {
-  const data = loadJson("fuzzer_data");
-  if (!data)
-    return { error: "fuzzer_data.json not loaded" };
-  if (category) {
-    const c = data[category] ?? data[category.toUpperCase()];
-    return { category, found: Boolean(c), data: c ?? null };
-  }
-  return { categories: Object.keys(data), fuzz_points: data.FUZZ_POINTS ?? null, payloads: data.FUZZ_PAYLOADS ?? null };
-}
-function intelSummary() {
-  const waf = loadJson("waf_signatures");
-  const tech = loadJson("tech_correlations");
-  const cve = loadJson("cve_correlations");
-  const port = loadJson("port_correlations");
-  const fuzz = loadJson("fuzzer_data");
-  const av = loadJson("attack_vectors");
   return {
-    waf_signatures: waf ? (waf.header_signatures?.length ?? 0) + (waf.body_signatures?.length ?? 0) : 0,
-    tech_correlations: tech ? Object.keys(tech).length : 0,
-    cve_correlations: cve ? Object.keys(cve).length : 0,
-    port_correlations: port ? Object.keys(port).length : 0,
-    fuzzer_categories: fuzz ? Object.keys(fuzz).length : 0,
-    payload_categories: listPayloadCategories().length,
-    nuclei_templates: countTemplates(),
-    attack_vector_categories: av ? av.categories.length : 0,
-    attack_vectors: av ? av.categories.reduce((n, c) => n + c.vectors.length, 0) : 0
+    root: expanded,
+    files_scanned: files.length,
+    hits: hits.slice(0, 2000),
+    sink_signals: [...sinkKinds].sort(),
+    matched_chains: matched
   };
 }
-function listAttackVectors() {
-  const data = loadJson("attack_vectors");
-  if (!data)
-    return { error: "attack_vectors.json not loaded" };
-  return {
-    total_categories: data.categories.length,
-    total_vectors: data.categories.reduce((n, c) => n + c.vectors.length, 0),
-    categories: data.categories.map((c) => ({ id: c.id, title: c.title, count: c.vectors.length, focus: c.focus ?? "" }))
+function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000, remember = true) {
+  const report = {
+    banner: engagementBanner(target, mode),
+    target,
+    mode,
+    tiers: {},
+    findings: [],
+    scope: null,
+    memory: { captured: 0 }
   };
-}
-function attackVectors(category) {
-  const data = loadJson("attack_vectors");
-  if (!data)
-    return { error: "attack_vectors.json not loaded" };
-  const q = category.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  const found = data.categories.find((c) => c.id === q || c.id.includes(q) || c.title.toLowerCase().includes(category.toLowerCase()));
-  if (!found) {
-    const matches = data.categories.filter((c) => c.title.toLowerCase().includes(category.toLowerCase()) || c.id.includes(q)).slice(0, 5).map((c) => c.id);
-    return { found: false, query: category, suggestions: matches };
+  const isPath = (() => {
+    try {
+      return existsSync5(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+    } catch {
+      return false;
+    }
+  })();
+  if (isPath) {
+    report.scope = { target, allowed: true, enforcement: "source-audit", reason: "local source path — no network scope gate" };
+  } else {
+    const sc = scopeCheck(target, scope, mode);
+    report.scope = sc;
+    if (!sc.allowed) {
+      report.status = "BLOCKED";
+      report.reason = sc.reason;
+      return report;
+    }
   }
-  return { found: true, id: found.id, title: found.title, focus: found.focus ?? "", count: found.vectors.length, vectors: found.vectors };
-}
-var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
-var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir3(), ".blitzstrike", "data");
-function payloadsDir() {
-  if (existsSync5(PACKAGE_PAYLOADS))
-    return PACKAGE_PAYLOADS;
-  return join8(DATA_ROOT, "payloads");
-}
-function templatesDir() {
-  if (existsSync5(PACKAGE_TEMPLATES))
-    return PACKAGE_TEMPLATES;
-  return join8(DATA_ROOT, "templates");
-}
-var PAYLOADS = payloadsDir();
-var TEMPLATES = templatesDir();
-function listPayloadCategories() {
-  try {
-    return readdirSync3(PAYLOADS, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
-  } catch {
-    return [];
+  const blitz = enrichScan(target, maxFiles);
+  report.tiers = {
+    blitz: {
+      files_scanned: blitz.files_scanned,
+      hits: blitz.hits.length,
+      sink_signals: blitz.sink_signals,
+      matched_chains: blitz.matched_chains
+    }
+  };
+  const chains = loadChains();
+  const chainById = new Map(chains.map((c) => [c.id, c]));
+  const eagle = [];
+  for (const mc of blitz.matched_chains.slice(0, 10)) {
+    const chain = chainById.get(mc.chain_id);
+    if (!chain)
+      continue;
+    eagle.push({
+      chain_id: chain.id,
+      name: chain.name,
+      severity: chain.severity,
+      prerequisites: chain.required_findings,
+      recommended_tools: chain.tools ?? [],
+      tool_manuals: (chain.tools ?? []).map((t) => {
+        const m = findManual(t);
+        return m.found ? { tool: t, manual_name: m.name, preview: m.content.slice(0, 600) } : { tool: t, manual_name: null, preview: null };
+      }),
+      steps: chain.steps.map((s) => ({
+        order: s.order,
+        action: s.action,
+        tool_hint: s.tool_hint,
+        success_criteria: s.success_criteria,
+        invariant_check: s.invariant_check,
+        negative_control: s.negative_control
+      }))
+    });
   }
-}
-function payloadLookup(topic) {
-  const cats = listPayloadCategories();
-  const key = topic.toLowerCase();
-  const ALIASES = {
-    sqli: "sql injection",
-    xss: "xss injection",
-    ssrf: "server side request forgery",
-    ssti: "server side template injection",
-    jwt: "json web token",
-    lfi: "file inclusion",
-    rfi: "file inclusion",
-    xxe: "xxe injection",
-    idor: "insecure direct object references",
-    csrf: "cross-site request forgery",
-    cmdi: "command injection",
-    rce: "command injection",
-    cors: "cors misconfiguration",
-    crlf: "crlf injection",
-    prototype: "prototype pollution",
-    nosql: "nosql injection",
-    upload: "upload insecure files"
+  report.tiers = { ...report.tiers, eagle_eye: { traced_chains: eagle } };
+  const rank = { critical: 0, high: 1, medium: 2, low: 3 };
+  const matchedSorted = [...blitz.matched_chains].sort((a, b) => (rank[a.severity] ?? 99) - (rank[b.severity] ?? 99));
+  const findings = matchedSorted.map((f) => {
+    const chain = chainById.get(f.chain_id);
+    const severity = f.severity ?? "medium";
+    const finding = makeFinding({
+      title: f.name,
+      target: { type: "source", path: target },
+      severity,
+      source: { type: "static_sink_signal", name: f.chain_id },
+      sink: { type: f.chain_id, symbol: f.name },
+      chainId: f.chain_id,
+      chainName: f.name,
+      status: "hypothesis"
+    });
+    const ev = makeEvidence({
+      type: "sink_location",
+      description: `Static sink signal matched escalation chain '${f.chain_id}' (${severity}). Hypothesis only — not yet validated.`,
+      sink: { chain_id: f.chain_id, name: f.name, severity },
+      artifacts: [{ name: "chain_match", kind: "json", content: JSON.stringify({ chain_id: f.chain_id, severity, steps: chain?.steps.length ?? 0 }) }]
+    });
+    finding.evidence.push(ev);
+    return finding;
+  });
+  report.findings = findings.map((f) => ({
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    evidence_count: f.evidence.length
+  }));
+  const reportTitle = `Blitz Strike — Engagement Report (${target})`;
+  const reportMarkdownText = reportMarkdown(findings, { title: reportTitle, scope: target, version: VERSION });
+  const reportJsonText = reportJson(findings, { title: reportTitle, scope: target, version: VERSION });
+  const sarifDoc = toSarif(findings.map((f) => ({
+    ruleId: f.chain.id || f.classification.severity,
+    level: sarifLevel(f.classification.severity),
+    message: f.title,
+    file: typeof f.target.path === "string" ? f.target.path : target,
+    line: 1
+  })));
+  report.report = {
+    summary: JSON.parse(reportJsonText).summary ?? null,
+    markdown: reportMarkdownText,
+    json: reportJsonText,
+    sarif: sarifDoc
+  };
+  report.status = "COMPLETE";
+  report.note = "All findings are HYPOTHESES until verified live with strike_verify. " + "Apply each chain's negative_control before reporting. Confidence reflects static evidence only.";
+  const executedState = "select_chain";
+  const scopeAllowed = report.scope?.allowed ?? false;
+  const plan = buildPlan(scopeAllowed, mode, executedState);
+  report.state = executedState;
+  report.state_description = stateDefinition(executedState).description;
+  report.plan = plan;
+  report.guidance = computeGuidance(executedState, scopeAllowed);
+  report.risk_policy = {
+    note: "High-risk actions (strike_verify, confirm_finding) require scope + are never run server-side automatically.",
+    gated: plan.filter((p) => !p.permitted).map((p) => p.tool)
   };
-  const normalized = ALIASES[key] ?? key;
-  const exact = cats.find((c) => c.toLowerCase() === normalized);
-  if (exact) {
-    return { found: true, category: exact, files: listFiles(join8(PAYLOADS, exact)) };
-  }
-  const keyTokens = normalized.split(/[^a-z0-9]+/).filter((t) => t.length >= 3);
-  const matches = cats.filter((c) => {
-    const cl = c.toLowerCase();
-    if (cl.includes(normalized) || normalized.includes(cl))
-      return true;
-    return keyTokens.some((tok) => new RegExp(`(^|[^a-z0-9])${tok}`).test(cl));
-  });
-  if (matches.length > 0) {
-    return { found: true, category: matches[0], files: listFiles(join8(PAYLOADS, matches[0])), alternatives: matches.slice(0, 10) };
-  }
-  return { found: false, topic, suggestions: cats.slice(0, 20) };
-}
-function readPayload(category, file) {
-  const cats = listPayloadCategories();
-  const exact = cats.find((c) => c.toLowerCase() === category.toLowerCase());
-  if (!exact)
-    return { found: false, category, suggestions: cats.slice(0, 20) };
-  const dir = join8(PAYLOADS, exact);
-  const files = listFiles(dir);
-  if (!file) {
-    const readme = files.find((f) => f.toLowerCase() === "readme.md");
-    if (readme) {
-      return { found: true, category: exact, file: readme, content: readFileSync8(join8(dir, readme), "utf8").slice(0, 20000) };
+  if (remember) {
+    let captured = 0;
+    for (const mc of blitz.matched_chains) {
+      const chain = chainById.get(mc.chain_id);
+      const content = `Chain '${mc.chain_id}' (${mc.severity}) matched on target '${target}'. ` + `Detected sink signals: ${blitz.sink_signals.join(", ")}. ` + `Prerequisites: ${(chain?.required_findings ?? []).join(", ")}.`;
+      if (rememberIfAbsent(mc.chain_id, content, "pattern", [mc.severity, "chain"], "engagement", false)) {
+        captured++;
+      }
     }
-    return { found: true, category: exact, files };
+    report.memory = { captured, deduped: blitz.matched_chains.length - captured };
   }
-  const f = files.find((x) => x.toLowerCase() === file.toLowerCase());
-  if (!f)
-    return { found: false, category: exact, file, suggestions: files };
-  return { found: true, category: exact, file: f, content: readFileSync8(join8(dir, f), "utf8").slice(0, 20000) };
+  return report;
 }
-function listFiles(dir) {
-  try {
-    return readdirSync3(dir).filter((f) => f.endsWith(".md") || f.endsWith(".txt") || f.endsWith(".yaml")).sort();
-  } catch {
-    return [];
-  }
+function listChains() {
+  const chains = loadChains();
+  return {
+    total: chains.length,
+    chains: chains.map((c) => ({
+      id: c.id,
+      name: c.name,
+      severity: c.severity,
+      steps: c.steps.length,
+      triggers: c.triggers
+    }))
+  };
 }
-function countTemplates() {
+var LIVE_SWEEP_PARAMS = ["q", "search", "query", "s", "id", "url", "redirect", "name", "page"];
+var SECURITY_HEADERS = [
+  ["strict-transport-security", "Strict-Transport-Security (HSTS)"],
+  ["content-security-policy", "Content-Security-Policy (CSP)"],
+  ["x-frame-options", "X-Frame-Options (clickjacking)"],
+  ["x-content-type-options", "X-Content-Type-Options"],
+  ["referrer-policy", "Referrer-Policy"]
+];
+var OPEN_REDIRECT_PARAMS = ["redirect", "url", "return", "next", "callback", "redirect_uri", "return_url", "goto", "dest", "target", "continue"];
+var PATH_PARAMS = ["file", "path", "page", "template", "lang", "include", "doc", "download", "load"];
+var EVIL_HOST = "evil-blitz.example.com";
+async function httpGet2(u, extraHeaders) {
   try {
-    let n = 0;
-    const walk = (dir) => {
-      for (const e of readdirSync3(dir, { withFileTypes: true })) {
-        if (e.isDirectory())
-          walk(join8(dir, e.name));
-        else if (e.name.endsWith(".yaml"))
-          n++;
-      }
-    };
-    walk(TEMPLATES);
-    return n;
+    const res = await fetch(u, { redirect: "manual", headers: extraHeaders, signal: AbortSignal.timeout(1e4) });
+    const body = await res.text();
+    const h = {};
+    res.headers.forEach((v, k) => {
+      h[k.toLowerCase()] = v;
+    });
+    return { status: res.status, headers: h, body };
   } catch {
-    return 0;
+    return null;
   }
 }
-function templateLookup(topic, limit = 10) {
-  const key = topic.toLowerCase();
-  const hits = [];
-  const walk = (dir, depth = 0) => {
-    if (depth > 6 || hits.length >= limit * 3)
-      return;
-    let entries;
-    try {
-      entries = readdirSync3(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      if (e.isDirectory())
-        walk(join8(dir, e.name), depth + 1);
-      else if (e.name.endsWith(".yaml")) {
-        const name = e.name.toLowerCase();
-        if (name.includes(key)) {
-          const full = join8(dir, e.name);
-          let id = "";
-          try {
-            const content = readFileSync8(full, "utf8");
-            const m = content.match(/^\s*id:\s*(.+)$/m);
-            if (m)
-              id = m[1].trim();
-          } catch {}
-          hits.push({ path: full.replace(ROOT3 + "/", ""), name: e.name, id });
-        }
-      }
+async function runDeterministicChecks(url) {
+  const findings = [];
+  const base = url.replace(/\/+$/, "");
+  const sep = base.includes("?") ? "&" : "?";
+  const home = await httpGet2(base);
+  if (home) {
+    const missing = SECURITY_HEADERS.filter(([h]) => !home.headers[h]).map(([, n]) => n);
+    if (missing.length) {
+      findings.push(makeFinding({
+        title: `Missing security headers: ${missing.join(", ")}`,
+        target: { type: "web", host: url, endpoint: "/" },
+        severity: "low",
+        cwe: "CWE-693",
+        cweName: "Protection Mechanism Failure",
+        source: { type: "http_response", name: "headers" },
+        sink: { type: "missing_header", symbol: missing[0] },
+        chainId: "missing_security_headers",
+        chainName: "Missing security headers",
+        status: "hypothesis"
+      }));
     }
-  };
-  walk(TEMPLATES);
-  return { found: hits.length > 0, topic, count: hits.length, templates: hits.slice(0, limit) };
-}
-var BYPASS_ALIASES = {
-  "403": "auth",
-  "401": "auth",
-  forbidden: "auth",
-  "auth bypass": "auth",
-  authorization: "auth",
-  acl: "auth",
-  access: "auth",
-  waf: "waf",
-  firewall: "waf",
-  modsecurity: "waf",
-  cloudflare: "waf",
-  filter: "filter",
-  sanitizer: "filter",
-  blacklist: "filter",
-  whitelist: "filter",
-  validation: "filter",
-  input: "filter",
-  "rate limit": "rate_limit",
-  ratelimit: "rate_limit",
-  captcha: "rate_limit",
-  bot: "rate_limit",
-  "bot protection": "rate_limit"
-};
-function bypassLookup(defense) {
-  const data = loadJson("bypass_techniques");
-  if (!data)
-    return { found: false, error: "bypass_techniques.json not found" };
-  const cats = data.categories;
-  if (!defense) {
-    return {
-      found: true,
-      categories: cats.map((c) => ({ id: c.id, defense: c.defense, techniques: c.techniques.length }))
-    };
-  }
-  const key = defense.toLowerCase();
-  const norm = BYPASS_ALIASES[key] ?? key;
-  const match = cats.find((c) => c.id === norm || c.defense.toLowerCase().includes(norm) || norm.includes(c.id));
-  if (!match)
-    return { found: false, defense, suggestions: cats.map((c) => c.id) };
-  return { found: true, defense: match.defense, techniques: match.techniques };
-}
-function chainLinks() {
-  const data = loadJson("chain_links");
-  if (!data)
-    return { found: false, error: "chain_links.json not found" };
-  return { found: true, total: data.links.length, links: data.links };
-}
-function retryGuidance(signal) {
-  const data = loadJson("retry_guidance");
-  if (!data)
-    return { found: false, error: "retry_guidance.json not found" };
-  if (!signal) {
-    return {
-      found: true,
-      modes: data.modes.map((m) => ({ id: m.id, signal: m.signal, actions: m.actions.length }))
-    };
-  }
-  const ALIASES = {
-    empty: "empty_output",
-    "no output": "empty_output",
-    stale: "empty_output",
-    blocked: "blocked",
-    waf: "blocked",
-    filter: "blocked",
-    firewall: "blocked",
-    sanitized: "sanitized",
-    sanitizer: "sanitized",
-    neutralized: "sanitized",
-    subagent: "subagent_failed",
-    "sub-agent": "subagent_failed",
-    delegate: "subagent_failed",
-    model: "model_failed",
-    "rate limit": "model_failed",
-    ratelimit: "model_failed",
-    quota: "model_failed",
-    context: "model_failed",
-    unconfirmed: "unconfirmed",
-    "not confirmed": "unconfirmed",
-    low: "low_severity",
-    "low severity": "low_severity"
-  };
-  const key = signal.toLowerCase().trim();
-  const norm = ALIASES[key] ?? key.replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "");
-  const match = data.modes.find((m) => m.id === norm || norm.includes(m.id) || m.id.includes(norm));
-  if (!match)
-    return { found: false, signal, suggestions: data.modes.map((m) => m.id) };
-  return { found: true, mode: match.id, signal: match.signal, actions: match.actions };
-}
-function orchestration(part) {
-  const data = loadJson("orchestration");
-  if (!data)
-    return { found: false, error: "orchestration.json not found" };
-  if (!part) {
-    return {
-      found: true,
-      phases: data.lifecycle.map((p) => ({ phase: p.phase, name: p.name })),
-      team: data.team.map((r) => ({ id: r.id, name: r.name }))
-    };
-  }
-  const q = part.toLowerCase();
-  if (q === "lifecycle" || q === "phases")
-    return { found: true, lifecycle: data.lifecycle };
-  if (q === "team" || q === "roles")
-    return { found: true, team: data.team };
-  if (q === "handoff")
-    return { found: true, handoff: data.handoff };
-  if (q === "termination" || q === "done")
-    return { found: true, termination: data.termination };
-  const phase = data.lifecycle.find((p) => String(p.phase) === q);
-  if (phase)
-    return { found: true, ...phase };
-  const role = data.team.find((r) => String(r.id) === q);
-  if (role)
-    return { found: true, ...role };
-  return {
-    found: false,
-    part,
-    suggestions: ["lifecycle", "team", "handoff", "termination", ...data.lifecycle.map((p) => String(p.phase)), ...data.team.map((r) => String(r.id))]
-  };
-}
-function modelFallback(signal) {
-  const data = loadJson("model_fallback");
-  if (!data)
-    return { found: false, error: "model_fallback.json not found" };
-  if (!signal) {
-    return {
-      found: true,
-      error_classes: data.error_classes.map((c) => ({ id: c.id, retryable: c.retryable, backoff: c.backoff })),
-      fallback_chain: data.fallback_chain,
-      backoff: data.backoff
-    };
   }
-  const q = signal.toLowerCase();
-  for (const c of data.error_classes) {
-    if (c.signals.some((s) => q.includes(s.toLowerCase()))) {
-      return {
-        found: true,
-        class: c.id,
-        retryable: c.retryable,
-        backoff: c.backoff,
-        action: c.action,
-        fallback_chain: data.fallback_chain,
-        backoff_schedule: c.backoff ? data.backoff : null
-      };
+  for (const p of OPEN_REDIRECT_PARAMS) {
+    const r = await httpGet2(`${base}${sep}${p}=${encodeURIComponent(`https://${EVIL_HOST}`)}`);
+    if (!r)
+      continue;
+    const loc = r.headers["location"] ?? "";
+    if (r.status >= 300 && r.status < 400 && loc.includes(EVIL_HOST)) {
+      findings.push(makeFinding({
+        title: `Open redirect via parameter '${p}'`,
+        target: { type: "web", host: url, endpoint: `?${p}=` },
+        severity: "medium",
+        cwe: "CWE-601",
+        cweName: "URL Redirection to Untrusted Site",
+        source: { type: "request_parameter", name: p },
+        sink: { type: "redirect", symbol: p },
+        chainId: "open_redirect",
+        chainName: "Open redirect",
+        status: "hypothesis"
+      }));
     }
   }
-  return { found: false, signal, suggestions: data.error_classes.map((c) => c.id) };
-}
-function doctrineMap(part) {
-  const data = loadJson("doctrine_map");
-  if (!data)
-    return { found: false, error: "doctrine_map.json not found" };
-  if (!part) {
-    return {
-      found: true,
-      phases: data.phases.map((p) => ({ phase: p.phase, skill: p.skill, wstg: p.wstg })),
-      cross_cutting: data.cross_cutting
-    };
+  for (const p of PATH_PARAMS) {
+    const r = await httpGet2(`${base}${sep}${p}=${encodeURIComponent("../../../../../../etc/passwd")}`);
+    if (r && r.body.includes("root:")) {
+      findings.push(makeFinding({
+        title: `Path traversal via parameter '${p}'`,
+        target: { type: "web", host: url, endpoint: `?${p}=` },
+        severity: "high",
+        cwe: "CWE-22",
+        cweName: "Path Traversal",
+        source: { type: "request_parameter", name: p },
+        sink: { type: "file_read", symbol: p },
+        chainId: "path_traversal",
+        chainName: "Path traversal / LFI",
+        status: "hypothesis"
+      }));
+    }
   }
-  const q = part.toLowerCase();
-  const phase = data.phases.find((p) => String(p.phase) === q);
-  if (phase)
-    return { found: true, ...phase };
-  if (q === "cross_cutting" || q === "cross" || q === "moments") {
-    return { found: true, cross_cutting: data.cross_cutting };
+  const cors = await httpGet2(base, { Origin: `https://${EVIL_HOST}` });
+  if (cors) {
+    const acao = cors.headers["access-control-allow-origin"] ?? "";
+    const acac = cors.headers["access-control-allow-credentials"] ?? "";
+    if ((acao.includes(EVIL_HOST) || acao === "*") && acac === "true") {
+      findings.push(makeFinding({
+        title: "CORS misconfiguration: reflected/wildcard origin with credentials",
+        target: { type: "web", host: url, endpoint: "/" },
+        severity: "medium",
+        cwe: "CWE-942",
+        cweName: "Permissive Cross-domain Policy",
+        source: { type: "http_response", name: "access-control-allow-origin" },
+        sink: { type: "cors", symbol: acao },
+        chainId: "cors_misconfiguration",
+        chainName: "CORS misconfiguration",
+        status: "hypothesis"
+      }));
+    }
   }
-  return {
-    found: false,
-    part,
-    suggestions: ["cross_cutting", ...data.phases.map((p) => String(p.phase))]
-  };
+  return findings;
 }
-function wstgMap(category) {
-  const data = loadJson("wstg_map");
-  if (!data)
-    return { found: false, error: "wstg_map.json not found" };
-  if (!category) {
-    return {
-      found: true,
-      categories: data.categories.map((c) => ({ wstg: c.wstg, name: c.name, phase: c.phase, skill: c.skill }))
-    };
+async function runLiveEngagement(url, scope = "", mode = "bug-bounty") {
+  const report = { banner: engagementBanner(url, mode), target: url, mode, findings: [], scope: null, status: "" };
+  const sc = scopeCheck(url, scope, mode);
+  report.scope = sc;
+  const recon = await liveRecon(url);
+  report.recon = {
+    fingerprint: recon.fingerprint,
+    waf: recon.waf,
+    tech: recon.tech,
+    versions: recon.versions,
+    crawl: recon.crawl,
+    params: recon.params,
+    subdomains: recon.subdomains,
+    dns_findings: recon.dns_findings,
+    wayback_urls: recon.wayback_urls,
+    api_endpoints: recon.api_endpoints,
+    open_ports: recon.open_ports,
+    intel: recon.intel,
+    next_steps: recon.next_steps
+  };
+  const findings = [];
+  for (const param of LIVE_SWEEP_PARAMS) {
+    const verdict = await strikeVerify({ url, param });
+    const finding = makeFinding({
+      title: `Reflected input in parameter '${param}'`,
+      target: { type: "web", host: url, endpoint: `?${param}=` },
+      severity: "medium",
+      cwe: "CWE-79",
+      cweName: "Cross-site Scripting",
+      source: { type: "request_parameter", name: param },
+      sink: { type: "reflected_input", symbol: param },
+      chainId: "reflected_input",
+      chainName: "Reflected input",
+      status: "hypothesis"
+    });
+    findings.push(resolveFinding(finding, verdict));
   }
-  const q = category.toUpperCase();
-  const c = data.categories.find((x) => String(x.wstg).toUpperCase() === q || String(x.name).toLowerCase().includes(category.toLowerCase()) || String(x.wstg).toUpperCase().includes(q));
-  if (c)
-    return { found: true, ...c };
-  return { found: false, category, suggestions: data.categories.map((x) => String(x.wstg)) };
+  findings.push(...await runDeterministicChecks(url));
+  report.findings = findings.map((f) => ({
+    id: f.id,
+    status: f.status,
+    title: f.title,
+    severity: f.classification.severity,
+    confidence: f.confidence,
+    confidence_level: f.confidence_level,
+    chain_id: f.chain.id,
+    validation: f.validation
+  }));
+  const title = `Blitz Strike — Live Engagement (${url})`;
+  const markdown = reportMarkdown(findings, { title, scope: url, version: VERSION });
+  const json = reportJson(findings, { title, scope: url, version: VERSION });
+  report.report = {
+    summary: JSON.parse(json).summary ?? null,
+    markdown,
+    json,
+    sarif: toSarif(findings.map((f) => ({
+      ruleId: f.chain.id || f.classification.cwe || f.classification.severity,
+      level: sarifLevel(f.classification.severity),
+      message: f.title,
+      file: url,
+      line: 1
+    })))
+  };
+  report.status = "COMPLETE";
+  report.note = "Autonomous live engagement — full recon + deterministic security checks (reflected " + "input, security headers, open redirect, path traversal, CORS) + inline report, all in " + "one call (no LLM babysitting). Reflected input was validated with a marker + negative " + "control; header/redirect/traversal/CORS checks are deterministic HTTP observations. " + "A hit is a hypothesis until strike_verify confirms it.";
+  return report;
 }
-function techniqueLookup(cls) {
-  const data = loadJson("techniques");
-  if (!data)
-    return { found: false, error: "techniques.json not found" };
-  if (!cls) {
-    return {
-      found: true,
-      classes: data.classes.map((c) => ({ id: c.id, name: c.name }))
-    };
+
+// src/catalog.ts
+import { readFileSync as readFileSync8, readdirSync as readdirSync3 } from "node:fs";
+import { join as join8 } from "node:path";
+import { fileURLToPath as fileURLToPath5 } from "node:url";
+import { spawnSync } from "node:child_process";
+var ROOT3 = join8(fileURLToPath5(new URL(".", import.meta.url)), "..");
+var _toolsCache = null;
+var _skillsCache = null;
+function loadTools() {
+  if (_toolsCache)
+    return _toolsCache;
+  try {
+    const raw = JSON.parse(readFileSync8(join8(ROOT3, "tools-catalog.json"), "utf8"));
+    _toolsCache = raw.tools ?? [];
+  } catch {
+    _toolsCache = [];
   }
-  const q = cls.toLowerCase();
-  const c = data.classes.find((x) => String(x.id).toLowerCase() === q || String(x.id).toLowerCase().includes(q) || String(x.name).toLowerCase().includes(q));
-  if (c)
-    return { found: true, ...c };
-  return { found: false, cls, suggestions: data.classes.map((x) => String(x.id)) };
+  return _toolsCache;
 }
-function frameworkTricks(framework) {
-  const data = loadJson("framework_tricks");
-  if (!data)
-    return { found: false, error: "framework_tricks.json not found" };
-  if (!framework) {
-    return { found: true, frameworks: data.frameworks.map((f) => ({ framework: f.framework })) };
-  }
-  const q = framework.toLowerCase();
-  const f = data.frameworks.find((x) => String(x.framework).toLowerCase().includes(q));
-  if (f)
-    return { found: true, ...f };
-  return { found: false, framework, suggestions: data.frameworks.map((x) => String(x.framework)) };
+function loadSkills() {
+  if (_skillsCache)
+    return _skillsCache;
+  const dir = join8(ROOT3, "skills");
+  const out = [];
+  try {
+    for (const f of readdirSync3(dir)) {
+      if (!f.endsWith(".md"))
+        continue;
+      const p = join8(dir, f);
+      const text = readFileSync8(p, "utf8");
+      const descMatch = text.match(/^description:\s*(.+)$/m);
+      out.push({
+        name: f.replace(/\.md$/, ""),
+        file: f,
+        description: (descMatch?.[1] ?? "").trim().slice(0, 200),
+        size: text.length
+      });
+    }
+  } catch {}
+  _skillsCache = out;
+  return out;
 }
-function resourceLookup(category) {
-  const data = loadJson("resources");
-  if (!data)
-    return { found: false, error: "resources.json not found" };
-  if (!category) {
+function toolLookup(name) {
+  const tools = loadTools();
+  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!t) {
     return {
-      found: true,
-      resources: data.resources.map((r) => ({ id: r.id, name: r.name, category: r.category, use_when: r.use_when }))
+      found: false,
+      query: name,
+      suggestions: tools.filter((x) => x.name.includes(name.toLowerCase()) || name.toLowerCase().includes(x.name)).slice(0, 5).map((x) => x.name)
     };
   }
-  const q = category.toLowerCase();
-  const matches = data.resources.filter((r) => String(r.category).toLowerCase() === q || String(r.id).toLowerCase().includes(q) || String(r.name).toLowerCase().includes(q) || String(r.use_when).toLowerCase().includes(q));
-  if (matches.length > 0)
-    return { found: true, matches };
-  return { found: false, category, suggestions: [...new Set(data.resources.map((r) => String(r.category)))] };
+  const manual = manualForTool(t.name);
+  const result = { found: true, tool: t };
+  if (manual && manual.content) {
+    result.manual = {
+      name: manual.name,
+      category: manual.category,
+      preview: manual.content.slice(0, 1500),
+      full_length: manual.content.length
+    };
+  } else {
+    result.manual = null;
+  }
+  return result;
 }
-function taxonomy(kind, query) {
-  if (kind === "api" || kind === "api_top10" || kind === "owasp-api") {
-    const data = loadJson("api_top10");
-    if (!data)
-      return { found: false, error: "api_top10.json not found" };
-    if (!query)
-      return { found: true, risks: data.risks };
-    const q = query.toLowerCase();
-    const r = data.risks.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
-    if (r)
-      return { found: true, ...r };
-    return { found: false, query, suggestions: data.risks.map((x) => String(x.id)) };
+function listTools() {
+  const tools = loadTools();
+  const byCat = {};
+  for (const t of tools) {
+    (byCat[t.category] ??= []).push(t.name);
   }
-  if (kind === "cwe" || kind === "weakness") {
-    const data = loadJson("cwe_map");
-    if (!data)
-      return { found: false, error: "cwe_map.json not found" };
-    if (!query)
-      return { found: true, mapping: data.mapping };
-    const q = query.toLowerCase();
-    const m = data.mapping.filter((x) => String(x.id).toLowerCase().includes(q) || String(x.cwe).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
-    if (m.length > 0)
-      return { found: true, matches: m };
-    return { found: false, query, suggestions: data.mapping.map((x) => String(x.id)) };
+  return { total: tools.length, categories: byCat, tools: tools.map((t) => ({ name: t.name, category: t.category, description: t.description })) };
+}
+function skillLookup(topic) {
+  const skills = loadSkills();
+  const q = topic.toLowerCase();
+  const scored = skills.map((s) => {
+    const hay = `${s.name} ${s.description}`.toLowerCase();
+    const nameHit = s.name.includes(q);
+    const descHit = s.description.includes(q);
+    const wordHit = q.split(/\s+/).filter((w) => w && hay.includes(w)).length;
+    return { s, score: (nameHit ? 10 : 0) + (descHit ? 5 : 0) + wordHit * 2 };
+  }).filter((x) => x.score > 0).sort((a, b) => b.score - a.score);
+  if (scored.length === 0) {
+    return { found: false, query: topic, suggestions: skills.map((s) => s.name).slice(0, 10) };
   }
-  if (kind === "web" || kind === "owasp" || kind === "top10" || kind === "web_top10") {
-    const data = loadJson("owasp_top10");
-    if (!data)
-      return { found: false, error: "owasp_top10.json not found" };
-    if (!query)
-      return { found: true, risks: data.risks };
-    const q = query.toLowerCase();
-    const r = data.risks.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
-    if (r)
-      return { found: true, ...r };
-    return { found: false, query, suggestions: data.risks.map((x) => String(x.id)) };
+  return {
+    found: true,
+    matches: scored.slice(0, 5).map((x) => ({ name: x.s.name, description: x.s.description, file: x.s.file }))
+  };
+}
+function listSkills() {
+  const skills = loadSkills();
+  return { total: skills.length, skills: skills.map((s) => ({ name: s.name, description: s.description })) };
+}
+function readSkill(name) {
+  const skills = loadSkills();
+  const s = skills.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!s)
+    return { found: false, query: name };
+  try {
+    const text = readFileSync8(join8(ROOT3, "skills", s.file), "utf8");
+    return { found: true, name: s.name, content: text.slice(0, 12000) };
+  } catch {
+    return { found: false, query: name, error: "unreadable" };
   }
-  if (kind === "asvs" || kind === "verification") {
-    const data = loadJson("asvs");
-    if (!data)
-      return { found: false, error: "asvs.json not found" };
-    if (!query)
-      return { found: true, chapters: data.chapters };
-    const q = query.toLowerCase();
-    const c = data.chapters.find((x) => String(x.id).toLowerCase() === q || String(x.name).toLowerCase().includes(q));
-    if (c)
-      return { found: true, ...c };
-    return { found: false, query, suggestions: data.chapters.map((x) => String(x.id)) };
+}
+function ensureTool(name) {
+  const tools = loadTools();
+  const t = tools.find((x) => x.name.toLowerCase() === name.toLowerCase());
+  if (!t) {
+    return { found: false, query: name, suggestions: tools.slice(0, 5).map((x) => x.name) };
+  }
+  const check = spawnSync(t.check_installed.command, { shell: true, timeout: 15000 });
+  if (check.status !== 127 && check.error === undefined) {
+    return { name: t.name, installed: true, action: "none", note: "already installed" };
+  }
+  const platform = process.platform;
+  const cmd = t.install[platform] ?? t.install.linux;
+  if (!cmd) {
+    return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
   }
+  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
+  const ok = r.status === 0;
   return {
-    found: false,
-    error: "unknown taxonomy kind",
-    usage: "taxonomy(kind='web'|'api'|'cwe'|'asvs', query?)"
+    name: t.name,
+    installed: ok,
+    action: "install",
+    command: cmd,
+    output: (r.stdout?.toString() ?? "").slice(-400) || (r.stderr?.toString() ?? "").slice(-400)
   };
 }
 
@@ -31886,7 +32428,7 @@ async function httpFetch(url, init) {
     clearTimeout(t);
   }
 }
-function normalizeTarget(target) {
+function normalizeTarget2(target) {
   let t = target.trim();
   if (!/^https?:\/\//i.test(t))
     t = `https://${t}`;
@@ -31954,7 +32496,7 @@ async function probeCommonPaths(base) {
   return out;
 }
 async function activeScan(target, scope = "", mode = "bug-bounty", allowed = undefined) {
-  const base = normalizeTarget(target);
+  const base = normalizeTarget2(target);
   const host = (() => {
     try {
       return new URL(base).hostname;
@@ -52706,767 +53248,345 @@ function detectDynamicDispatch(code, file, out) {
     });
   }
 }
-function detectDynamicMethod(code, file, out) {
-  const ls = lines(code);
-  DYNAMIC_METHOD_RE.lastIndex = 0;
-  let m;
-  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
-    const ln = lineNo(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    if (!userControlled(l) && !userControlled(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "dynamic_method_call",
-      category: "Route confusion (dynamic method dispatch)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
-    });
-  }
-}
-function detectDynamicInclude(code, file, out) {
-  const ls = lines(code);
-  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    if (!userControlled(l) && !userControlled(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "dynamic_include",
-      category: "Route confusion (dynamic file include)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
-    });
-  }
-}
-function detectBatchForwarding(code, file, out) {
-  BATCH_LOOP_RE.lastIndex = 0;
-  let m;
-  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
-    const ln = lineNo(code, m.index);
-    const body = lines(code).slice(ln, ln + 8).join(`
-`);
-    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
-    if (!forwards)
-      continue;
-    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
-    out.push({
-      file,
-      line: ln,
-      type: "batch_forwarding",
-      category: "Route confusion (batch/proxy forwarding)",
-      severity: rechecks ? "medium" : "high",
-      evidence: lines(code)[ln - 1]?.trim() ?? "",
-      detail: rechecks ? "Batch/proxy loop forwards to inner handlers — auth is re-checked in scope, but verify it applies per-route." : "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
-    });
-  }
-}
-function detectRouteNormalization(code, file, out) {
-  const ls = lines(code);
-  for (let i = 0;i < ls.length; i++) {
-    const l = ls[i];
-    if (!ROUTE_MATCH_RE.test(l))
-      continue;
-    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
-`);
-    if (!userControlled(scope))
-      continue;
-    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
-      continue;
-    out.push({
-      file,
-      line: i + 1,
-      type: "route_normalization_gap",
-      category: "Route confusion (missing path normalization)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
-    });
-  }
-}
-function detectRouteConfusion(code, file) {
-  const out = [];
-  detectDynamicDispatch(code, file, out);
-  detectDynamicMethod(code, file, out);
-  detectDynamicInclude(code, file, out);
-  detectBatchForwarding(code, file, out);
-  detectRouteNormalization(code, file, out);
-  return out;
-}
-
-// src/complex-bugs.ts
-var SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params)|getParameter\(|req\.(query|body|params|headers|cookies)/;
-function lines2(code) {
-  return code.split(`
-`);
-}
-function lineNo2(code, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++)
-    if (code.charCodeAt(i) === 10)
-      n++;
-  return n;
-}
-var MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
-function detectDeserialization(code, file, out) {
-  if (!MAGIC_METHODS.test(code))
-    return;
-  const ls = lines2(code);
-  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "deserialization",
-      category: "Deserialization → POP gadget chain",
-      severity: "high",
-      evidence: l.trim(),
-      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
-    });
-  }
-}
-function detectTypeJuggling(code, file, out) {
-  const ls = lines2(code);
-  const re = /(?<![=!<>])(==|!=)(?!=)/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    const hasSource = SOURCE_TOKENS2.test(l) || SOURCE_TOKENS2.test(scope);
-    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
-    if (!hasSource || !hasHash)
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "type_juggling",
-      category: "Type juggling (loose comparison)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
-    });
-  }
-}
-function detectMassAssignment(code, file, out) {
-  const ls = lines2(code);
-  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
-  let m;
-  while ((m = extractRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "mass_assignment",
-      category: "Mass assignment (variable injection)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
-    });
-  }
-  const parseRe = /\bparse_str\s*\(/g;
-  while ((m = parseRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
-`);
-    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "mass_assignment",
-      category: "Mass assignment (variable injection)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: "`parse_str()` of user input into the symbol table — variable injection."
-    });
-  }
-}
-function detectComplexBugs(code, file) {
-  const out = [];
-  detectDeserialization(code, file, out);
-  detectTypeJuggling(code, file, out);
-  detectMassAssignment(code, file, out);
-  detectPrototypePollution(code, file, out);
-  detectCrlfInjection(code, file, out);
-  detectPathConfusion(code, file, out);
-  const seen = new Set;
-  return out.filter((f) => {
-    const key = `${f.type}:${f.line}`;
-    if (seen.has(key))
-      return false;
-    seen.add(key);
-    return true;
-  });
-}
-function detectPrototypePollution(code, file, out) {
-  const ls = lines2(code);
-  const mergeRe = /\b(Object\.assign|_\.merge|_\.defaultsDeep|\.extend|\.merge|\.defaultsDeep|mergeDeep|deepMerge|_.set)\s*\(/g;
+function detectDynamicMethod(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_METHOD_RE.lastIndex = 0;
   let m;
-  while ((m = mergeRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
+  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
     const l = ls[ln - 1] ?? "";
     const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
 `);
-    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+    if (!userControlled(l) && !userControlled(scope))
       continue;
     out.push({
       file,
       line: ln,
-      type: "prototype_pollution",
-      category: "Prototype pollution (unsafe merge)",
+      type: "dynamic_method_call",
+      category: "Route confusion (dynamic method dispatch)",
       severity: "high",
       evidence: l.trim(),
-      detail: "Merge/extend of request data into an object without a `__proto__`/`constructor.prototype` guard — attacker-controlled keys can pollute `Object.prototype` and pivot to RCE or property injection."
+      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
     });
   }
 }
-function detectCrlfInjection(code, file, out) {
-  const ls = lines2(code);
-  const headerRe = /\b(header|setHeader|addHeader|writeHead|appendHeader)\s*\(/g;
+function detectDynamicInclude(code, file, out) {
+  const ls = lines(code);
+  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
   let m;
-  while ((m = headerRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
     const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
 `);
-    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+    if (!userControlled(l) && !userControlled(scope))
       continue;
     out.push({
       file,
       line: ln,
-      type: "crlf_injection",
-      category: "CRLF / header injection",
-      severity: "medium",
+      type: "dynamic_include",
+      category: "Route confusion (dynamic file include)",
+      severity: "high",
       evidence: l.trim(),
-      detail: "User input reaches an HTTP header — CRLF (`%0d%0a`) can split the response, inject headers, or poison cookies. Strip newlines from header values."
+      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
     });
   }
 }
-function detectPathConfusion(code, file, out) {
-  const ls = lines2(code);
-  const fileRe = /\b(file_get_contents|file_put_contents|fopen|readFileSync|readFile|open|include|require|new\s+File|Files\.read|FileInputStream|FileOutputStream)\s*\(/g;
+function detectBatchForwarding(code, file, out) {
+  BATCH_LOOP_RE.lastIndex = 0;
   let m;
-  while ((m = fileRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const body = lines(code).slice(ln, ln + 8).join(`
 `);
-    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
-      continue;
-    if (/\b(basename|realpath|canonicalPath|getCanonicalPath|normalize|resolve|toRealPath)\s*\(/i.test(scope + `
-` + l))
+    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
+    if (!forwards)
       continue;
+    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
     out.push({
       file,
       line: ln,
-      type: "path_confusion",
-      category: "Path confusion (unsanitized file path)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: "User input reaches a file path with no canonicalization (`basename`/`realpath`/`normalize`) — traversal, `..%2f`, backslash and null-byte variants can confuse a naive `../` filter."
+      type: "batch_forwarding",
+      category: "Route confusion (batch/proxy forwarding)",
+      severity: rechecks ? "medium" : "high",
+      evidence: lines(code)[ln - 1]?.trim() ?? "",
+      detail: rechecks ? "Batch/proxy loop forwards to inner handlers — auth is re-checked in scope, but verify it applies per-route." : "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
     });
   }
 }
-
-// src/guidance.ts
-var SINK_DIRECTIVES = {
-  sql_execution: "Validate the SQL injection live with strike_verify (use a unique MARKER and a NEGATIVE CONTROL that stays inert), or read_tool_manual for sqlmap. Only a reflected marker + inert control = confirmed.",
-  command_execution: "Validate command injection with strike_verify (e.g. `id`/`whoami` marker vs a control string). Read the relevant tool manual first (commix / os-command-injection).",
-  code_execution: "Code execution is a high-impact claim — confirm reachability end-to-end first, then validate with strike_verify. Never report eval/exec without a live marker.",
-  file_operations: "For upload sinks, confirm the file is writable and the uploaded content is reachable/executable. Read payload_lookup for upload payloads; validate with strike_verify.",
-  file_inclusion: "Validate LFI/RFI with strike_verify (marker file read vs control). Read payload_lookup for local-file-inclusion payloads and check for wrappers (php://, data://).",
-  deserialization: "Deserialization needs a crafted gadget chain — read_tool_manual (ysoserial / PHPGGC) and confirm the entry point is reachable before validating.",
-  http_request: "Validate SSRF with strike_verify (marker to a canary host vs control). Read payload_lookup for ssrf payloads and check for protocol/redirect filters.",
-  redirect: "Validate open redirect with strike_verify (marker URL vs control). Confirm the redirect reflects attacker-controlled input.",
-  html_render: "Validate the XSS with strike_verify (reflected marker script vs inert control). Check WAF first with detect_waf — many XSS are filtered at the edge.",
-  xml_processing: "Validate XXE with strike_verify (external entity marker vs control). Read payload_lookup for xxe payloads.",
-  archive_extraction: "Validate the archive/path issue (zip-slip / path traversal) with strike_verify. Confirm the extraction path is attacker-controlled.",
-  path_traversal: "Validate path traversal with strike_verify (marker file read vs control). Read payload_lookup for path-traversal payloads.",
-  template_injection: "SSTI needs a template-expression probe (e.g. {{7*7}} / ${7*7} / <%= 7*7 %>) — the marker is the evaluated arithmetic, the control is a benign literal. Confirm the template engine actually renders user input before reporting.",
-  xpath_injection: "Validate XPath injection with strike_verify (an XPath boolean/union probe vs a control that stays inert). Confirm the XPath expression is built from attacker-controlled input.",
-  ldap_injection: "Validate LDAP injection with strike_verify (an LDAP filter-wildcard/OR probe vs a control). Confirm the filter is concatenated from attacker-controlled input."
-};
-function nextSteps(ctx) {
-  const steps = [];
-  if (ctx.sanitizedCount && ctx.sanitizedCount > 0) {
-    steps.push(`${ctx.sanitizedCount} sink(s) were sanitized and are NOT findings — do not report them. Only tainted, unsanitized, unguarded sinks count.`);
-  }
-  if (ctx.taintedSinks && ctx.taintedSinks.length > 0) {
-    const seen = new Set;
-    for (const k of ctx.taintedSinks) {
-      if (seen.has(k))
-        continue;
-      seen.add(k);
-      const d = SINK_DIRECTIVES[k];
-      if (d)
-        steps.push(d);
-    }
-  }
-  if (steps.length === 0 && ctx.hasFindings) {
-    steps.push("Findings found. Trace each sink's reachability (taint_file / eagle_eye), then validate live with strike_verify before reporting.");
-  }
-  if (ctx.findingStatus) {
-    const transitions = {
-      detected: "detected -> triaged (classify severity + CWE + reachability)",
-      triaged: "triaged -> hypothesis (state the sink, source, and expected impact)",
-      hypothesis: "hypothesis -> validating (run strike_verify with marker + negative control)",
-      validating: "validating -> confirmed (only if marker reflected AND negative control inert) or false_positive",
-      confirmed: "confirmed — attach evidence (SHA-256), then report."
-    };
-    if (transitions[ctx.findingStatus]) {
-      steps.push(`Finding lifecycle next step: ${transitions[ctx.findingStatus]}.`);
-    }
-  }
-  if (ctx.hasFindings || ctx.findingStatus) {
-    steps.push("Record every confirmed finding with finding_create, attach confidence_score, and redact any secrets before persisting.");
-  }
-  return steps;
-}
-
-// src/live-recon.ts
-import { resolve4 } from "node:dns/promises";
-import { connect } from "node:net";
-var HTTP_TIMEOUT_MS = 20000;
-async function httpGet(url, opts = {}) {
-  const controller = new AbortController;
-  const t = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
-  try {
-    const res = await fetch(url, { signal: controller.signal, redirect: opts.redirect ?? "follow" });
-    const body = await res.text();
-    const headers = {};
-    res.headers.forEach((v, k) => {
-      headers[k] = v;
+function detectRouteNormalization(code, file, out) {
+  const ls = lines(code);
+  for (let i = 0;i < ls.length; i++) {
+    const l = ls[i];
+    if (!ROUTE_MATCH_RE.test(l))
+      continue;
+    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
+`);
+    if (!userControlled(scope))
+      continue;
+    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
+      continue;
+    out.push({
+      file,
+      line: i + 1,
+      type: "route_normalization_gap",
+      category: "Route confusion (missing path normalization)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
     });
-    return { status: res.status, headers, body: body.slice(0, 50000), ok: res.ok };
-  } catch (e) {
-    return { status: 0, headers: {}, body: String(e), ok: false };
-  } finally {
-    clearTimeout(t);
-  }
-}
-function normalizeTarget2(target) {
-  let t = target.trim();
-  if (!/^https?:\/\//i.test(t))
-    t = `https://${t}`;
-  return t.replace(/\/+$/, "");
-}
-function crawlLinks(base, body) {
-  const links = [];
-  const scripts = [];
-  const hrefRe = /<a[^>]+href=["']([^"'#]+)["']/gi;
-  const scriptRe = /<script[^>]+src=["']([^"'#]+)["']/gi;
-  let m;
-  while ((m = hrefRe.exec(body)) !== null) {
-    let u = m[1];
-    if (u.startsWith("/"))
-      u = base + u;
-    else if (!/^https?:\/\//i.test(u))
-      u = base + "/" + u;
-    links.push(u);
-  }
-  while ((m = scriptRe.exec(body)) !== null) {
-    let u = m[1];
-    if (u.startsWith("/"))
-      u = base + u;
-    else if (!/^https?:\/\//i.test(u))
-      u = base + "/" + u;
-    scripts.push(u);
   }
-  return { links, scripts };
-}
-async function fetchRobotsAndSitemap(base) {
-  const robots = [];
-  const sitemap = [];
-  const rob = await httpGet(`${base}/robots.txt`);
-  if (rob.status === 200) {
-    for (const line of rob.body.split(`
-`)) {
-      const sm = line.match(/^Sitemap:\s*(.+)$/i);
-      if (sm)
-        sitemap.push(sm[1].trim());
-      const allow = line.match(/^(?:Allow|Disallow):\s*(.+)$/i);
-      if (allow && !allow[1].includes("*"))
-        robots.push(base + allow[1].trim());
-    }
-  }
-  const sm = await httpGet(`${base}/sitemap.xml`);
-  if (sm.status === 200 && sm.body.includes("<loc>")) {
-    const locRe = /<loc>([^<]+)<\/loc>/gi;
-    let m;
-    while ((m = locRe.exec(sm.body)) !== null)
-      sitemap.push(m[1].trim());
-  }
-  return { robots, sitemap };
 }
-function extractParams(urls) {
-  const params = new Set;
-  for (const u of urls) {
-    try {
-      const q = new URL(u).searchParams;
-      for (const k of q.keys())
-        params.add(k);
-    } catch {}
-  }
-  return [...params];
+function detectRouteConfusion(code, file) {
+  const out = [];
+  detectDynamicDispatch(code, file, out);
+  detectDynamicMethod(code, file, out);
+  detectDynamicInclude(code, file, out);
+  detectBatchForwarding(code, file, out);
+  detectRouteNormalization(code, file, out);
+  return out;
 }
-async function subdomainEnum(domain) {
-  const out = new Set;
-  try {
-    const url = `https://crt.sh/?q=%25.${encodeURIComponent(domain)}&output=json`;
-    const r = await httpGet(url);
-    if (r.status === 200 && r.body.startsWith("[")) {
-      const data = JSON.parse(r.body);
-      for (const entry of data) {
-        for (const field of (entry.name_value ?? "").split(`
-`)) {
-          const name = field.trim().toLowerCase();
-          if (name && name.endsWith(domain.toLowerCase()) && !name.includes("*"))
-            out.add(name);
-        }
-      }
-    }
-  } catch {}
-  return { subdomains: [...out].sort(), source: "crt.sh (certificate transparency)" };
+
+// src/complex-bugs.ts
+var SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params)|getParameter\(|req\.(query|body|params|headers|cookies)/;
+function lines2(code) {
+  return code.split(`
+`);
 }
-async function waybackUrls(domain) {
-  const out = new Set;
-  const url = `https://web.archive.org/cdx/search/cdx?url=*.${encodeURIComponent(domain)}/*&output=json&fl=original&collapse=urlkey&limit=500`;
-  try {
-    const controller = new AbortController;
-    const t = setTimeout(() => controller.abort(), 60000);
-    const res = await fetch(url, { signal: controller.signal, redirect: "manual" });
-    const body = await res.text();
-    clearTimeout(t);
-    if (body.startsWith("[[")) {
-      const data = JSON.parse(body);
-      for (let i = 1;i < data.length; i++) {
-        const u = data[i]?.[0];
-        if (u && typeof u === "string" && u.includes(domain))
-          out.add(u);
-      }
-    }
-  } catch {}
-  return { urls: [...out].slice(0, 500), source: "web.archive.org (Wayback CDX)" };
+function lineNo2(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
 }
-var COMMON_SUBDOMAINS = [
-  "www",
-  "mail",
-  "ftp",
-  "api",
-  "dev",
-  "staging",
-  "test",
-  "admin",
-  "portal",
-  "app",
-  "blog",
-  "shop",
-  "store",
-  "cdn",
-  "static",
-  "assets",
-  "img",
-  "images",
-  "secure",
-  "vpn",
-  "remote",
-  "webmail",
-  "smtp",
-  "pop",
-  "imap",
-  "ns1",
-  "ns2",
-  "dns",
-  "db",
-  "database",
-  "mysql",
-  "git",
-  "gitlab",
-  "jenkins",
-  "ci",
-  "jira",
-  "wiki",
-  "docs",
-  "help",
-  "support",
-  "status",
-  "monitor",
-  "grafana",
-  "kibana",
-  "backup",
-  "old",
-  "beta",
-  "demo",
-  "sandbox",
-  "internal",
-  "intranet"
-];
-async function dnsBrute(domain) {
-  const found = [];
-  const base = domain.toLowerCase();
-  const seen = new Set([base, "www." + base]);
-  for (const prefix of COMMON_SUBDOMAINS) {
-    const host = `${prefix}.${base}`;
-    if (seen.has(host))
+var MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
+function detectDeserialization(code, file, out) {
+  if (!MAGIC_METHODS.test(code))
+    return;
+  const ls = lines2(code);
+  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
       continue;
-    seen.add(host);
-    try {
-      const ips = await resolve4(host);
-      if (ips.length > 0)
-        found.push({ host, ips });
-    } catch {}
+    out.push({
+      file,
+      line: ln,
+      type: "deserialization",
+      category: "Deserialization → POP gadget chain",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+    });
   }
-  return { found, source: "DNS resolution (common subdomain prefixes)" };
 }
-var COMMON_PORTS = [
-  [21, "ftp"],
-  [22, "ssh"],
-  [25, "smtp"],
-  [53, "dns"],
-  [80, "http"],
-  [110, "pop3"],
-  [135, "msrpc"],
-  [139, "netbios"],
-  [143, "imap"],
-  [443, "https"],
-  [445, "smb"],
-  [993, "imaps"],
-  [995, "pop3s"],
-  [1433, "mssql"],
-  [1521, "oracle"],
-  [3306, "mysql"],
-  [3389, "rdp"],
-  [5432, "postgres"],
-  [6379, "redis"],
-  [8080, "http-alt"],
-  [8443, "https-alt"],
-  [9000, "app"],
-  [9090, "app"],
-  [9200, "elasticsearch"],
-  [11211, "memcached"],
-  [27017, "mongodb"]
-];
-function tcpProbe(host, port, timeout = 2000) {
-  return new Promise((resolve) => {
-    const socket = connect({ host, port, timeout });
-    socket.once("connect", () => {
-      socket.destroy();
-      resolve(true);
+function detectTypeJuggling(code, file, out) {
+  const ls = lines2(code);
+  const re = /(?<![=!<>])(==|!=)(?!=)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    const hasSource = SOURCE_TOKENS2.test(l) || SOURCE_TOKENS2.test(scope);
+    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
+    if (!hasSource || !hasHash)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "type_juggling",
+      category: "Type juggling (loose comparison)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
     });
-    socket.once("timeout", () => {
-      socket.destroy();
-      resolve(false);
+  }
+}
+function detectMassAssignment(code, file, out) {
+  const ls = lines2(code);
+  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
+  let m;
+  while ((m = extractRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
     });
-    socket.once("error", () => {
-      socket.destroy();
-      resolve(false);
+  }
+  const parseRe = /\bparse_str\s*\(/g;
+  while ((m = parseRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "`parse_str()` of user input into the symbol table — variable injection."
     });
+  }
+}
+function detectComplexBugs(code, file) {
+  const out = [];
+  detectDeserialization(code, file, out);
+  detectTypeJuggling(code, file, out);
+  detectMassAssignment(code, file, out);
+  detectPrototypePollution(code, file, out);
+  detectCrlfInjection(code, file, out);
+  detectPathConfusion(code, file, out);
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
   });
 }
-async function scanPorts(host) {
-  const results = [];
-  for (const [port, service] of COMMON_PORTS) {
-    const open = await tcpProbe(host, port);
-    if (open) {
-      const corr = portCorrelation(port);
-      results.push({ port, service, open: true, correlation: corr });
-    }
+function detectPrototypePollution(code, file, out) {
+  const ls = lines2(code);
+  const mergeRe = /\b(Object\.assign|_\.merge|_\.defaultsDeep|\.extend|\.merge|\.defaultsDeep|mergeDeep|deepMerge|_.set)\s*\(/g;
+  let m;
+  while ((m = mergeRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "prototype_pollution",
+      category: "Prototype pollution (unsafe merge)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "Merge/extend of request data into an object without a `__proto__`/`constructor.prototype` guard — attacker-controlled keys can pollute `Object.prototype` and pivot to RCE or property injection."
+    });
   }
-  return results;
 }
-var API_PATHS = [
-  "/swagger.json",
-  "/swagger-ui.html",
-  "/openapi.json",
-  "/api-docs",
-  "/v2/api-docs",
-  "/v3/api-docs",
-  "/graphql",
-  "/graphiql",
-  "/actuator",
-  "/actuator/health",
-  "/actuator/env",
-  "/api/swagger.json",
-  "/docs",
-  "/redoc"
-];
-async function discoverApi(base) {
-  const out = [];
-  for (const p of API_PATHS) {
-    const r = await httpGet(`${base}${p}`);
-    if (r.status >= 200 && r.status < 400) {
-      out.push({ path: p, status: r.status, body_size: r.body.length });
-    }
+function detectCrlfInjection(code, file, out) {
+  const ls = lines2(code);
+  const headerRe = /\b(header|setHeader|addHeader|writeHead|appendHeader)\s*\(/g;
+  let m;
+  while ((m = headerRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "crlf_injection",
+      category: "CRLF / header injection",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "User input reaches an HTTP header — CRLF (`%0d%0a`) can split the response, inject headers, or poison cookies. Strip newlines from header values."
+    });
   }
-  return out;
 }
-function extractVersion(headers, body) {
-  const out = [];
-  const server = headers["server"] ?? headers["x-powered-by"] ?? "";
-  const serverVer = /^(nginx|apache|microsoft-iis|openresty|liteSpeed|caddy)\/?([0-9][0-9.\-]*)?/i.exec(server);
-  if (serverVer) {
-    out.push({ product: serverVer[1].toLowerCase(), version: serverVer[2] ?? "unknown", evidence: server });
-  }
-  const phpVer = /php\/([0-9][0-9.\-]*)/i.exec(server);
-  if (phpVer)
-    out.push({ product: "php", version: phpVer[1], evidence: server });
-  const wpVer = /content="WordPress\s+([0-9][0-9.]*)/i.exec(body);
-  if (wpVer)
-    out.push({ product: "wordpress", version: wpVer[1], evidence: `meta generator: WordPress ${wpVer[1]}` });
-  const joomlaVer = /Joomla!?\s*([0-9][0-9.]*)/i.exec(body);
-  if (joomlaVer)
-    out.push({ product: "joomla", version: joomlaVer[1], evidence: `body: Joomla ${joomlaVer[1]}` });
-  const drupalVer = /Drupal\s+([0-9][0-9.]*)/i.exec(body);
-  if (drupalVer)
-    out.push({ product: "drupal", version: drupalVer[1], evidence: `body: Drupal ${drupalVer[1]}` });
-  const powered = headers["x-powered-by"] ?? "";
-  if (powered && !out.some((o) => powered.includes(o.product))) {
-    out.push({ product: powered.split("/")[0].toLowerCase(), version: powered.split("/")[1] ?? "unknown", evidence: powered });
+function detectPathConfusion(code, file, out) {
+  const ls = lines2(code);
+  const fileRe = /\b(file_get_contents|file_put_contents|fopen|readFileSync|readFile|open|include|require|new\s+File|Files\.read|FileInputStream|FileOutputStream)\s*\(/g;
+  let m;
+  while ((m = fileRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
+      continue;
+    if (/\b(basename|realpath|canonicalPath|getCanonicalPath|normalize|resolve|toRealPath)\s*\(/i.test(scope + `
+` + l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "path_confusion",
+      category: "Path confusion (unsanitized file path)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "User input reaches a file path with no canonicalization (`basename`/`realpath`/`normalize`) — traversal, `..%2f`, backslash and null-byte variants can confuse a naive `../` filter."
+    });
   }
-  return out;
-}
-function correlateIntel(techs, versionList, portList) {
-  const tech = techs.map((t) => ({ tech: t, ...techCorrelation(t) }));
-  const versions = versionList.map((v) => ({
-    product: v.product,
-    version: v.version,
-    correlation: techCorrelation(v.product),
-    payload_lookup: payloadLookup(v.product),
-    template_lookup: templateLookup(v.product, 5)
-  }));
-  const ports = portList.map((p) => ({ port: p.port, service: p.service, ...portCorrelation(p.port) }));
-  return { tech, versions, ports };
 }
-async function liveRecon(target, includeActive = false) {
-  const base = normalizeTarget2(target);
-  const host = (() => {
-    try {
-      return new URL(base).hostname;
-    } catch {
-      return target;
+
+// src/guidance.ts
+var SINK_DIRECTIVES = {
+  sql_execution: "Validate the SQL injection live with strike_verify (use a unique MARKER and a NEGATIVE CONTROL that stays inert), or read_tool_manual for sqlmap. Only a reflected marker + inert control = confirmed.",
+  command_execution: "Validate command injection with strike_verify (e.g. `id`/`whoami` marker vs a control string). Read the relevant tool manual first (commix / os-command-injection).",
+  code_execution: "Code execution is a high-impact claim — confirm reachability end-to-end first, then validate with strike_verify. Never report eval/exec without a live marker.",
+  file_operations: "For upload sinks, confirm the file is writable and the uploaded content is reachable/executable. Read payload_lookup for upload payloads; validate with strike_verify.",
+  file_inclusion: "Validate LFI/RFI with strike_verify (marker file read vs control). Read payload_lookup for local-file-inclusion payloads and check for wrappers (php://, data://).",
+  deserialization: "Deserialization needs a crafted gadget chain — read_tool_manual (ysoserial / PHPGGC) and confirm the entry point is reachable before validating.",
+  http_request: "Validate SSRF with strike_verify (marker to a canary host vs control). Read payload_lookup for ssrf payloads and check for protocol/redirect filters.",
+  redirect: "Validate open redirect with strike_verify (marker URL vs control). Confirm the redirect reflects attacker-controlled input.",
+  html_render: "Validate the XSS with strike_verify (reflected marker script vs inert control). Check WAF first with detect_waf — many XSS are filtered at the edge.",
+  xml_processing: "Validate XXE with strike_verify (external entity marker vs control). Read payload_lookup for xxe payloads.",
+  archive_extraction: "Validate the archive/path issue (zip-slip / path traversal) with strike_verify. Confirm the extraction path is attacker-controlled.",
+  path_traversal: "Validate path traversal with strike_verify (marker file read vs control). Read payload_lookup for path-traversal payloads.",
+  template_injection: "SSTI needs a template-expression probe (e.g. {{7*7}} / ${7*7} / <%= 7*7 %>) — the marker is the evaluated arithmetic, the control is a benign literal. Confirm the template engine actually renders user input before reporting.",
+  xpath_injection: "Validate XPath injection with strike_verify (an XPath boolean/union probe vs a control that stays inert). Confirm the XPath expression is built from attacker-controlled input.",
+  ldap_injection: "Validate LDAP injection with strike_verify (an LDAP filter-wildcard/OR probe vs a control). Confirm the filter is concatenated from attacker-controlled input."
+};
+function nextSteps(ctx) {
+  const steps = [];
+  if (ctx.sanitizedCount && ctx.sanitizedCount > 0) {
+    steps.push(`${ctx.sanitizedCount} sink(s) were sanitized and are NOT findings — do not report them. Only tainted, unsanitized, unguarded sinks count.`);
+  }
+  if (ctx.taintedSinks && ctx.taintedSinks.length > 0) {
+    const seen = new Set;
+    for (const k of ctx.taintedSinks) {
+      if (seen.has(k))
+        continue;
+      seen.add(k);
+      const d = SINK_DIRECTIVES[k];
+      if (d)
+        steps.push(d);
     }
-  })();
-  const root = await httpGet(base);
-  const interestingHeaders = {};
-  for (const k of ["server", "x-powered-by", "x-aspnet-version", "x-drupal-cache", "x-generator", "via", "x-cache", "cf-ray"]) {
-    if (root.headers[k])
-      interestingHeaders[k] = root.headers[k];
   }
-  const fingerprint = {
-    status: root.status,
-    title: (root.body.match(/<title[^>]*>([^<]+)<\/title>/i) ?? [])[1]?.trim().slice(0, 200) ?? "",
-    server: root.headers["server"] ?? root.headers["x-powered-by"] ?? "",
-    headers: interestingHeaders,
-    body_size: root.body.length
-  };
-  const waf = detectWaf(root.headers, root.body);
-  const techSig = [
-    [/wp-content|wp-includes|wp-json/i, "wordpress"],
-    [/wp-login\.php|wp-admin/i, "wordpress"],
-    [/powered by joomla|com_content/i, "joomla"],
-    [/laravel|_token|csrf-token/i, "laravel"],
-    [/react|__NEXT_DATA__|next\/static/i, "nextjs"],
-    [/angular|ng-version/i, "angular"],
-    [/vue|__vue__|v-data/i, "vue"],
-    [/django|csrftoken|__debug__/i, "django"],
-    [/ruby on rails|rails/i, "rails"],
-    [/asp\.net|__VIEWSTATE|__EVENTVALIDATION/i, "aspnet"],
-    [/phpBB|phpbb/i, "phpbb"],
-    [/mybb|mybb/i, "mybb"],
-    [/drupal|Drupal\.settings/i, "drupal"],
-    [/magento|Mage\./i, "magento"],
-    [/shopify|cdn\.shopify/i, "shopify"],
-    [/grafana|kibana|elastic/i, "grafana-kibana"],
-    [/node\.js|express/i, "nodejs"],
-    [/flask|werkzeug/i, "flask"],
-    [/spring|actuator/i, "spring"]
-  ];
-  const techs = [...new Set(techSig.filter(([re]) => re.test(root.body)).map(([, t]) => t))];
-  const versions = extractVersion(root.headers, root.body);
-  const { links, scripts } = crawlLinks(base, root.body);
-  const { robots, sitemap } = await fetchRobotsAndSitemap(base);
-  const allUrls = [...links, ...scripts, ...robots, ...sitemap];
-  const crawl = { links, scripts, endpoints: [...new Set(allUrls)], robots, sitemap, count: allUrls.length };
-  const params = extractParams(allUrls);
-  const { subdomains } = await subdomainEnum(host);
-  const { found: dnsFindings } = await dnsBrute(host);
-  const { urls: wayback } = await waybackUrls(host);
-  const apiEndpoints = (await discoverApi(base)).map(({ path, status }) => ({ path, status }));
-  let openPorts = [];
-  if (includeActive && root.status > 0) {
-    const scan = await scanPorts(host);
-    openPorts = scan.map(({ port, service }) => ({ port, service }));
+  if (steps.length === 0 && ctx.hasFindings) {
+    steps.push("Findings found. Trace each sink's reachability (taint_file / eagle_eye), then validate live with strike_verify before reporting.");
   }
-  const intel = correlateIntel(techs, versions, openPorts);
-  const nextSteps = [];
-  if (waf.detected)
-    nextSteps.push(`WAF detected (${waf.wafs?.map((w) => w.waf).join(", ")}) — consult detect_waf + WAF bypass playbook before exploitation.`);
-  for (const t of techs) {
-    const c = techCorrelation(t);
-    if (c.found)
-      nextSteps.push(`Tech '${t}' maps to known vuln classes — read tech_correlation('${t}') and fetch nuclei templates with template_lookup('${t}').`);
+  if (ctx.findingStatus) {
+    const transitions = {
+      detected: "detected -> triaged (classify severity + CWE + reachability)",
+      triaged: "triaged -> hypothesis (state the sink, source, and expected impact)",
+      hypothesis: "hypothesis -> validating (run strike_verify with marker + negative control)",
+      validating: "validating -> confirmed (only if marker reflected AND negative control inert) or false_positive",
+      confirmed: "confirmed — attach evidence (SHA-256), then report."
+    };
+    if (transitions[ctx.findingStatus]) {
+      steps.push(`Finding lifecycle next step: ${transitions[ctx.findingStatus]}.`);
+    }
   }
-  for (const v of versions) {
-    nextSteps.push(`Version ${v.product}/${v.version} detected — check cve_correlation + nvd_lookup for known CVEs affecting ${v.product} ${v.version}.`);
+  if (ctx.hasFindings || ctx.findingStatus) {
+    steps.push("Record every confirmed finding with finding_create, attach confidence_score, and redact any secrets before persisting.");
   }
-  if (crawl.endpoints.length > 0)
-    nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
-  if (params.length > 0)
-    nextSteps.push(`Discovered input params: ${params.join(", ")} — these are attack-surface entry points; fuzz them with payload_lookup after scope confirms.`);
-  if (subdomains.length > 0)
-    nextSteps.push(`Found ${subdomains.length} subdomains — each is a separate scope surface; enumerate further with fofa_search.`);
-  if (dnsFindings.length > 0)
-    nextSteps.push(`DNS-resolved ${dnsFindings.length} hosts (${dnsFindings.map((d) => d.host).slice(0, 8).join(", ")}${dnsFindings.length > 8 ? "…" : ""}) — each is a live subdomain to recon.`);
-  if (wayback.length > 0)
-    nextSteps.push(`Wayback Machine surfaced ${wayback.length} historical URLs — mine them for hidden endpoints, old params, and forgotten pages; feed to taint_file/blitz_scan.`);
-  if (openPorts.length > 0)
-    nextSteps.push(`Open ports: ${openPorts.map((p) => `${p.port}/${p.service}`).join(", ")} — map services via port_correlation and probe each with the relevant tool manual.`);
-  if (apiEndpoints.length > 0)
-    nextSteps.push(`API endpoints exposed (${apiEndpoints.map((e) => e.path).join(", ")}) — audit them with api-security playbook; check for BOLA/IDOR/auth gaps.`);
-  if (nextSteps.length === 0)
-    nextSteps.push("Nothing exposed on the surface — try subdomain enumeration, port scan (active), or request source access for EAGLE-EYE analysis.");
-  nextSteps.push("Every confirmed finding: record with finding_create, attach confidence_score, redact secrets. A hit is a hypothesis until verified.");
-  return {
-    target: base,
-    host,
-    fingerprint,
-    waf,
-    tech: { detected: techs, server: fingerprint.server },
-    versions,
-    crawl,
-    params,
-    subdomains,
-    dns_findings: dnsFindings,
-    wayback_urls: wayback,
-    api_endpoints: apiEndpoints,
-    open_ports: openPorts,
-    intel,
-    next_steps: nextSteps
-  };
+  return steps;
 }
 
 // src/benchmark.ts
@@ -53812,7 +53932,7 @@ function createServer() {
     name: "blitzstrike",
     version: "1.0.0"
   }, {
-    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify automatically - no need to ask. A URL - with or " + "   without http/https - is LIVE (live_recon + the " + "   web-hunting doctrine + strike_verify). A filesystem path (exists on disk, " + "   or a code extension) is SOURCE audit (source-audit doctrine: blitz_scan + " + "   eagle_eye2 + complex_scan/route_scan). TWO DOCTRINES - never mix: live " + "   web/API -> web-hunting skill; source tree -> source-audit skill.\\n" + "1. RECORD SCOPE. scope_check classifies the target (intel for the report) - " + "   it does NOT gate the engagement. No authorization gate: the repo disclaimer " + "   places responsibility on the user. Hunt the target you are given.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter alternative. Both record scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment, prototype pollution, CRLF/header injection, path confusion) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 39 skills (7 bs-* agent doctrine: " + "  orchestrate, scope, source-audit, web-hunting, verify, review, report; + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, web-hunting for LIVE, source-audit for SOURCE, verify, " + "  review, report); load a technique skill for the specific technique.\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- CATALOG = external tools (130: sqlmap, nmap, nuclei, ffuf, ysoserial, ...). " + "  Blitz Strike's OWN tools find + verify; the catalog is for deeper EXTERNAL " + "  exploitation/enumeration. After your own analysis confirms a finding, run " + "  tool_lookup -> ensure_tool (auto-install) -> read_tool_manual to drive the " + "  external tool that demonstrates impact.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. technique_lookup(cls) returns the " + "  DETAILED methodology + tricks for a vulnerability class (ssrf, ssti, " + "  jwt, deserialization, ...) - load before testing a class. wstg_map maps " + "  an OWASP category to coverage; taxonomy maps findings to standard IDs " + "  (OWASP Top 10 / API Top 10 / CWE / ASVS); doctrine_map shows how everything links.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- NEVER ask 'should I continue?' / 'proceed?' / approval-style questions. " + "  Continue autonomously - the moment one step verifies, start the next. " + "  Pause ONLY when: a genuinely destructive/DoS action needs consent, an " + "  external dependency beyond your control blocks you (e.g. phone OTP), or " + "  the engagement is COMPLETE (deliver the final report). Otherwise keep hunting.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- There is NO retry cap. A failed probe/sub-agent is diagnosed and resumed " + "  until verified or definitively ruled out - never move on unverified.\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- On a model/sub-agent error (rate-limit, quota, timeout, 5xx, auth, " + "  unavailable), model_fallback(signal) classifies it and returns the exact " + "  recovery (retry+backoff / fall back / shrink scope / fix credentials / " + "  abort). Do not fall back blindly - the class decides.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
+    instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify automatically - no need to ask. A URL - with or " + "   without http/https - is LIVE (live_recon + the " + "   web-hunting doctrine + strike_verify). A filesystem path (exists on disk, " + "   or a code extension) is SOURCE audit (source-audit doctrine: blitz_scan + " + "   eagle_eye2 + complex_scan/route_scan). TWO DOCTRINES - never mix: live " + "   web/API -> web-hunting skill; source tree -> source-audit skill. For a WHOLE " + "   engagement prefer run_engagement (one call, no babysitting) FIRST; steps 1-5 " + "   below are the manual path for targeted follow-up on a specific finding.\\n" + "1. RECORD SCOPE. scope_check classifies the target (intel for the report) - " + "   it does NOT gate the engagement. No authorization gate: the repo disclaimer " + "   places responsibility on the user. Hunt the target you are given.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter alternative. Both record scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment, prototype pollution, CRLF/header injection, path confusion) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  full autonomous live pipeline (live_recon recon + deterministic checks: reflected " + "  input, security headers, open redirect, path traversal, CORS) + findings + report. " + "  PREFER THIS FIRST for a whole engagement; drive " + "  the steps above manually only for targeted follow-up on a specific finding.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 39 skills (7 bs-* agent doctrine: " + "  orchestrate, scope, source-audit, web-hunting, verify, review, report; + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE lookup + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, web-hunting for LIVE, source-audit for SOURCE, verify, " + "  review, report); load a technique skill for the specific technique.\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- CATALOG = external tools (130: sqlmap, nmap, nuclei, ffuf, ysoserial, ...). " + "  Blitz Strike's OWN tools find + verify; the catalog is for deeper EXTERNAL " + "  exploitation/enumeration. After your own analysis confirms a finding, run " + "  tool_lookup -> ensure_tool (auto-install) -> read_tool_manual to drive the " + "  external tool that demonstrates impact.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (57) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. technique_lookup(cls) returns the " + "  DETAILED methodology + tricks for a vulnerability class (ssrf, ssti, " + "  jwt, deserialization, ...) - load before testing a class. wstg_map maps " + "  an OWASP category to coverage; taxonomy maps findings to standard IDs " + "  (OWASP Top 10 / API Top 10 / CWE / ASVS); doctrine_map shows how everything links.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- NEVER ask 'should I continue?' / 'proceed?' / approval-style questions. " + "  Continue autonomously - the moment one step verifies, start the next. " + "  Pause ONLY when: a genuinely destructive/DoS action needs consent, an " + "  external dependency beyond your control blocks you (e.g. phone OTP), or " + "  the engagement is COMPLETE (deliver the final report). Otherwise keep hunting.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- There is NO retry cap. A failed probe/sub-agent is diagnosed and resumed " + "  until verified or definitively ruled out - never move on unverified.\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- On a model/sub-agent error (rate-limit, quota, timeout, 5xx, auth, " + "  unavailable), model_fallback(signal) classifies it and returns the exact " + "  recovery (retry+backoff / fall back / shrink scope / fix credentials / " + "  abort). Do not fall back blindly - the class decides.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
 ` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding may escalate — do not assume it is the " + "  end of the story. list_chains / chain_links show whether it composes into a " + "  multi-stage chain (e.g. SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell). " + "  Check before concluding, and do not overclaim an escalation that is not there.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "HYPOTHESIS EXPANSION (from each finding, enumerate + verify every follow-up):\\n" + "- A confirmed finding is the START, not the end. From each one, enumerate " + "  the follow-ups: ESCALATE (list_chains + chain_links), CHAIN (chain_links " + "  from->to), BYPASS (bypass_lookup), PIVOT (new endpoints/sinks now reachable).\\n" + "- Every follow-up (this might happen, this could chain, maybe bypassable) is " + "  a HYPOTHESIS, not a finding. Verify EACH via strike_verify (marker + negative " + "  control) before it enters the report.\\n" + "- Never report speculation: might / could / possibly live in the " + "  hypothesis list, never in the report. Every report line is a verified fact.\\n\\n" + "PROFESSIONAL JUDGMENT (act like a senior tester, not a checklist runner):\\n" + "- PRIORITIZE by severity, computed deterministically with cvss_score (impact x " + "  exploitability) and weighted by escalation potential (chain_links). Do NOT rank " + "  by bug class - a critical stored XSS that yields account takeover outranks an " + "  unreachable blind RCE. Weight by the engagement context (which asset/data is " + "  most sensitive for THIS target).\\n" + "- Recognize dead ends: if a branch yields nothing after a few varied probes, " + "  note it and move on. Do not tunnel-vision one sink at the expense of the rest.\\n" + "- Live-test with care: respect rate limits, do not lock accounts, do not " + "  trigger DoS. Test non-destructively and prove impact with the smallest payload.\\n" + "- Know when done: stop when the termination criteria are met, not when you feel " + "  tired. A thorough audit over a rushed one, every time.\\n\\n" + "IRON RULES:\\n" + "- No authorization gate - the repo disclaimer places responsibility on the " + "  user. Hunt the target you are given (like nmap/sqlmap/Burp, which do not " + "  ask). The one hard stop: malicious/third-party infra (cari pelaku) - hold/static.\\n" + "  need finer control."
   });
   server.registerTool("blitz_scan", {
@@ -54000,7 +54120,7 @@ function createServer() {
   });
   server.registerTool("run_engagement", {
     title: "STRIKE full engagement",
-    description: "STRIKE: run a full audit in ONE call (no babysitting). Source path -> triage -> chain enrichment -> findings -> inline report (markdown+JSON+SARIF). URL target -> autonomous live marker sweep (strike_verify per parameter) -> confirmed findings -> inline report.",
+    description: "STRIKE: run a full audit in ONE call (no babysitting). Source path -> triage -> chain enrichment -> findings -> inline report (markdown+JSON+SARIF). URL target -> full autonomous live pipeline: live_recon (fingerprint/WAF/tech/crawl/subdomains/API) + deterministic security checks (reflected input via marker/negative-control, missing security headers, open redirect, path traversal, CORS) -> findings -> inline report. Prefer this over driving tools one-by-one when you want the whole engagement in a single deterministic call.",
     inputSchema: {
       target: string2().describe("Source path or URL"),
       scope: string2().optional().describe("Scope (for URL targets)"),