blitzstrike 2.4.10 → 2.4.11

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.11] — 2026-09-14
+
+### Fixed — bulk-install no longer pollutes the caller's cwd
+
+- `install-tools` / `install_all_tools` now run every install command in a fixed
+  tools directory (`~/.blitzstrike/tools`, override `BLITZSTRIKE_TOOLS_DIR`), so
+  `git clone`-style tools (massdns, phpggc, radare2, testssl.sh, …) no longer
+  land in whatever directory you happened to run from.
+- Added those cloned tool dirs to `.gitignore`.
+- `blitzstrike install` now prints a hint pointing to `blitzstrike install-tools`
+  for the full 140-tool catalog.
+
 ## [2.4.10] — 2026-09-14
 
 ### Added — auto-install external MCP servers to every agent

package/dist/index.js

@@ -7398,9 +7398,10 @@ function h1Username() {
 }
 
 // src/catalog.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync6, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "node:fs";
 import { join as join6 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { homedir as homedir3 } from "node:os";
 import { spawnSync, spawn } from "node:child_process";
 function loadTools() {
   if (_toolsCache)
@@ -7517,7 +7518,8 @@ function ensureTool(name) {
   if (!cmd) {
     return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
   }
-  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
+  mkdirSync3(TOOLS_DIR, { recursive: true });
+  const r = spawnSync(cmd, { shell: true, timeout: 120000, cwd: TOOLS_DIR });
   const ok = r.status === 0;
   return {
     name: t.name,
@@ -7616,7 +7618,8 @@ function ensureToolAsync(name, timeoutMs = 120000) {
         resolve({ name: t.name, installed: false, action: "none", note: "no install command for this platform" });
         return;
       }
-      const inst = spawn(cmd, { shell: true, timeout: timeoutMs });
+      mkdirSync3(TOOLS_DIR, { recursive: true });
+      const inst = spawn(cmd, { shell: true, timeout: timeoutMs, cwd: TOOLS_DIR });
       let out = "";
       inst.stdout?.on("data", (d) => {
         out += d.toString();
@@ -7661,10 +7664,11 @@ async function installAllTools(opts = {}) {
     results
   };
 }
-var ROOT2, _toolsCache = null, _skillsCache = null;
+var ROOT2, TOOLS_DIR, _toolsCache = null, _skillsCache = null;
 var init_catalog = __esm(() => {
   init_manuals();
   ROOT2 = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
+  TOOLS_DIR = process.env.BLITZSTRIKE_TOOLS_DIR ?? join6(homedir3(), ".blitzstrike", "tools");
 });
 
 // src/burp-mcp.ts
@@ -15412,9 +15416,9 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
 import { join as join16 } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
@@ -15443,7 +15447,7 @@ function countFiles(dir) {
 }
 function syncData() {
   if (!dirExists(DATA_ROOT2))
-    mkdirSync4(DATA_ROOT2, { recursive: true });
+    mkdirSync5(DATA_ROOT2, { recursive: true });
   const payloadsPath = join16(DATA_ROOT2, "payloads");
   const templatesPath = join16(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
@@ -15501,7 +15505,7 @@ function copyDir(src, dst) {
   }
 }
 function manualCopy(src, dst) {
-  mkdirSync4(dst, { recursive: true });
+  mkdirSync5(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
     const s = join16(src, e.name);
     const d = join16(dst, e.name);
@@ -15514,7 +15518,7 @@ function manualCopy(src, dst) {
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
   ROOT7 = join16(fileURLToPath9(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join16(homedir5(), ".blitzstrike", "data");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join16(homedir6(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -15641,9 +15645,9 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
+import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6 } from "node:fs";
 import { join as join19, dirname as dirname2 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
@@ -15761,7 +15765,7 @@ function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
@@ -15774,7 +15778,7 @@ function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
@@ -15786,11 +15790,11 @@ function opencodeWrite(p) {
 }
 function copyOpenCodeAgents() {
   const srcDir = join19(ROOT10, "opencode-agents");
-  const dstDir = join19(homedir6(), ".config", "opencode", "agents");
+  const dstDir = join19(homedir7(), ".config", "opencode", "agents");
   if (!existsSync11(srcDir))
     return;
   if (!existsSync11(dstDir))
-    mkdirSync5(dstDir, { recursive: true });
+    mkdirSync6(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
     const src = join19(srcDir, f);
     const dst = join19(dstDir, f);
@@ -15803,7 +15807,7 @@ function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
@@ -15822,7 +15826,7 @@ function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
@@ -15848,7 +15852,7 @@ mcp_servers:
   };
 }
 function detectAgents() {
-  const home = homedir6();
+  const home = homedir7();
   const agents = [];
   const claudeJson = join19(home, ".claude.json");
   agents.push({
@@ -15963,6 +15967,8 @@ External MCP servers:`);
   const devtools = ensureTool("chrome-devtools-mcp");
   console.log(`  ${devtools.installed ? "OK  " : "FAIL"} chrome-devtools-mcp  ${devtools.installed ? "installed (browser MCP ready for all agents)" : devtools.command ?? "install failed"}`);
   console.log(`  SKIP burp-suite-mcp  GUI/daemon — build manually (PortSwigger/mcp-server) + load in Burp (connect, not install)`);
+  console.log(`
+To install ALL 140 catalog tools (139 CLI + chrome-devtools-mcp), run:  blitzstrike install-tools`);
 }
 async function runInstallTools(args) {
   const getArg = (flag) => {
@@ -31778,7 +31784,7 @@ async function browserValidate(check, target, payload) {
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
 import { join as join7 } from "node:path";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 function mcpClient(command, args) {
   const proc = spawn2(command, args, { stdio: ["pipe", "pipe", "pipe"] });
   let id = 0;
@@ -31854,7 +31860,7 @@ function findChromium() {
         return p;
     }
   }
-  const pw = join7(homedir3(), ".cache", "ms-playwright");
+  const pw = join7(homedir4(), ".cache", "ms-playwright");
   if (existsSync4(pw)) {
     for (const d of readdirSync3(pw)) {
       if (!d.startsWith("chromium"))
@@ -32184,7 +32190,7 @@ import { readFileSync as readFileSync7, existsSync as existsSync5 } from "node:f
 import { join as join8 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { readdirSync as readdirSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 var ROOT3 = join8(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var INTEL = join8(ROOT3, "intelligence");
 function loadJson(name) {
@@ -32415,7 +32421,7 @@ function attackPlan(target, tech = [], params = []) {
 }
 var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir4(), ".blitzstrike", "data");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir5(), ".blitzstrike", "data");
 function payloadsDir() {
   if (existsSync5(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
@@ -34735,7 +34741,7 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function tasksDir() {
@@ -34752,7 +34758,7 @@ function load(id) {
   }
 }
 function save(t) {
-  mkdirSync3(tasksDir(), { recursive: true });
+  mkdirSync4(tasksDir(), { recursive: true });
   writeFileSync2(taskPath(t.task_id), JSON.stringify(t, null, 2));
 }
 function taskStart(id, objective, plan) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.10",
+  "version": "2.4.11",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {