blitzstrike 2.4.107 → 2.4.108

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.108] — 2026-09-17
+
+### Added — surface-first map (attack surface → high-value tests)
+
+- New `surface_map(hint)` tool + `intelligence/surface-map.json`: maps 8 attack
+  surfaces to their highest-value test cases, derived from public target-recon
+  dossiers (image proxy → SSRF/URL-bypass/XSS; redirect proxy → open-redirect/
+  SSRF/bypass; edge cache → IDOR/cache-poisoning; payment portal →
+  price-manipulation/IDOR/subscription; AI agent → prompt-injection→SSRF-RCE/
+  deser/stored-XSS; file service → XSS-via-content/SSRF/upload-RCE; Electron →
+  HTML-injection→BrowserWindow-RCE/IPC; SSO → OAuth-redirect/JWT/2FA).
+- `matchSurfaces(techs, headers, body)` fingerprints the detected stack against
+  the map; `live_recon` now emits `suggested_surfaces` + a SURFACE-FIRST next
+  step. Added doctrine rule `surface_first` ("map surfaces before spraying
+  payloads").
+
 ## [2.4.107] — 2026-09-17
 
 ### Added — `review_harness` (per-file review, full-coverage deterministic rubric)

package/dist/index.js

@@ -17388,12 +17388,12 @@ document.getElementById('out').innerHTML = u;
 });
 
 // src/variants.ts
-import { readFileSync as readFileSync22 } from "node:fs";
-import { join as join21, dirname as dirname5 } from "node:path";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
+import { readFileSync as readFileSync23 } from "node:fs";
+import { join as join22, dirname as dirname5 } from "node:path";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
 function loadVariants() {
   try {
-    const doc = JSON.parse(readFileSync22(join21(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
+    const doc = JSON.parse(readFileSync23(join22(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
     return doc.variants ?? [];
   } catch {
     return [];
@@ -17447,15 +17447,15 @@ function variantCoverageText() {
 var __dirname5, CROSS_FILE_ONLY;
 var init_variants = __esm(() => {
   init_complex_bugs();
-  __dirname5 = dirname5(fileURLToPath12(import.meta.url));
+  __dirname5 = dirname5(fileURLToPath13(import.meta.url));
   CROSS_FILE_ONLY = new Set(["priv_esc"]);
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync28, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync5 } from "node:fs";
-import { join as join26 } from "node:path";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync29, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync5 } from "node:fs";
+import { join as join27 } from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { fileURLToPath as fileURLToPath15 } from "node:url";
+import { fileURLToPath as fileURLToPath16 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
   try {
@@ -17470,7 +17470,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join26(d, e.name));
+          walk(join27(d, e.name));
         else
           n++;
       }
@@ -17484,8 +17484,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync10(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join26(DATA_ROOT2, "payloads");
-  const templatesPath = join26(DATA_ROOT2, "templates");
+  const payloadsPath = join27(DATA_ROOT2, "payloads");
+  const templatesPath = join27(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -17495,8 +17495,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join26(ROOT8, "payloads");
-  const localTemplates = join26(ROOT8, "templates");
+  const localPayloads = join27(ROOT9, "payloads");
+  const localTemplates = join27(ROOT9, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -17509,7 +17509,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join26(DATA_ROOT2, ".tmp-clone");
+    const tmp = join27(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync5(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -17517,11 +17517,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join26(tmp, "payloads"), payloadsPath);
+          copyDir(join27(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join26(tmp, "templates"), templatesPath);
+          copyDir(join27(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -17543,18 +17543,18 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync10(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join26(src, e.name);
-    const d = join26(dst, e.name);
+    const s = join27(src, e.name);
+    const d = join27(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync9(d, readFileSync28(s));
+      writeFileSync9(d, readFileSync29(s));
   }
 }
-var ROOT8, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var ROOT9, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT8 = join26(fileURLToPath15(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join26(homedir10(), ".blitzstrike", "data");
+  ROOT9 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join27(homedir10(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -17599,15 +17599,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync30, existsSync as existsSync16 } from "node:fs";
-import { join as join27 } from "node:path";
-import { fileURLToPath as fileURLToPath16 } from "node:url";
+import { readFileSync as readFileSync31, existsSync as existsSync16 } from "node:fs";
+import { join as join28 } from "node:path";
+import { fileURLToPath as fileURLToPath17 } from "node:url";
 import { execSync as execSync4 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync30(join27(ROOT9, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync31(join28(ROOT10, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -17619,7 +17619,7 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT9, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT10, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
@@ -17639,22 +17639,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync16(join27(ROOT9, "package-lock.json")) || existsSync16(join27(ROOT9, "bun.lock")) || existsSync16(join27(ROOT9, "bun.lockb"));
+  return existsSync16(join28(ROOT10, "package-lock.json")) || existsSync16(join28(ROOT10, "bun.lock")) || existsSync16(join28(ROOT10, "bun.lockb"));
 }
-var ROOT9;
+var ROOT10;
 var init_release = __esm(() => {
   init_version();
-  ROOT9 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
+  ROOT10 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync31 } from "node:fs";
-import { join as join28 } from "node:path";
-import { fileURLToPath as fileURLToPath17 } from "node:url";
+import { readFileSync as readFileSync32 } from "node:fs";
+import { join as join29 } from "node:path";
+import { fileURLToPath as fileURLToPath18 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync31(join28(ROOT10, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync32(join29(ROOT11, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -17675,16 +17675,16 @@ function checkDependencies() {
     safe: installScripts.length === 0 && gitDependencies.length === 0
   };
 }
-var ROOT10;
+var ROOT11;
 var init_dependency = __esm(() => {
-  ROOT10 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
+  ROOT11 = join29(fileURLToPath18(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync32, existsSync as existsSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
-import { join as join29, dirname as dirname6 } from "node:path";
+import { readFileSync as readFileSync33, existsSync as existsSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
+import { join as join30, dirname as dirname6 } from "node:path";
 import { homedir as homedir11 } from "node:os";
-import { fileURLToPath as fileURLToPath18 } from "node:url";
+import { fileURLToPath as fileURLToPath19 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
   return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
@@ -17727,7 +17727,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync17(join29(ROOT11, "chains.json")) && existsSync17(join29(ROOT11, "tools-catalog.json"));
+  const dataOk = existsSync17(join30(ROOT12, "chains.json")) && existsSync17(join30(ROOT12, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17778,21 +17778,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join29(ROOT11, "src", "index.ts");
+  const src = join30(ROOT12, "src", "index.ts");
   if (which("bun") && existsSync17(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join29(ROOT11, "dist", "index.js");
+  const dist = join30(ROOT12, "dist", "index.js");
   if (existsSync17(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync32(p, "utf8"));
+    return JSON.parse(readFileSync33(p, "utf8"));
   } catch {
     return null;
   }
@@ -17825,17 +17825,17 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join29(ROOT11, "opencode-agents");
-  const dstDir = join29(homedir11(), ".config", "opencode", "agents");
+  const srcDir = join30(ROOT12, "opencode-agents");
+  const dstDir = join30(homedir11(), ".config", "opencode", "agents");
   if (!existsSync17(srcDir))
     return;
   if (!existsSync17(dstDir))
     mkdirSync11(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join29(srcDir, f);
-    const dst = join29(dstDir, f);
+    const src = join30(srcDir, f);
+    const dst = join30(dstDir, f);
     if (existsSync17(src)) {
-      writeFileSync10(dst, readFileSync32(src, "utf8"));
+      writeFileSync10(dst, readFileSync33(src, "utf8"));
     }
   }
 }
@@ -17844,7 +17844,7 @@ function codexWrite(p) {
     const dir = dirname6(p);
     if (!existsSync17(dir))
       mkdirSync11(dir, { recursive: true });
-    let existing = existsSync17(p) ? readFileSync32(p, "utf8") : "";
+    let existing = existsSync17(p) ? readFileSync33(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17863,7 +17863,7 @@ function hermesWrite(p) {
     const dir = dirname6(p);
     if (!existsSync17(dir))
       mkdirSync11(dir, { recursive: true });
-    let existing = existsSync17(p) ? readFileSync32(p, "utf8") : "";
+    let existing = existsSync17(p) ? readFileSync33(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17890,74 +17890,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir11();
   const agents = [];
-  const claudeJson = join29(home, ".claude.json");
+  const claudeJson = join30(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync17(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join29(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join30(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync17(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join29(home, ".cursor", "mcp.json");
+  const cursor = join30(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync17(join29(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync17(join30(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join29(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join30(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync17(join29(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync17(join30(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join29(home, ".codex", "config.toml");
+  const codex = join30(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync17(join29(home, ".codex")) || which("codex"),
+    installed: () => existsSync17(join30(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join29(home, ".hermes", "config.yaml");
+  const hermes = join30(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync17(join29(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync17(join30(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join29(home, ".gemini", "settings.json");
+  const gemini = join30(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync17(join29(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync17(join30(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join29(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join30(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync17(join29(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync17(join30(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join29(home, ".copilot", "mcp.json");
+  const copilot = join30(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync17(join29(home, ".copilot")),
+    installed: () => existsSync17(join30(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join29(home, ".cline", "mcp_settings.json");
+  const cline = join30(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync17(join29(home, ".cline")),
+    installed: () => existsSync17(join30(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -18069,13 +18069,13 @@ Failed (${failedList.length}) — reason per tool:`);
 Common causes: missing toolchain, pip/git network failures, or very heavy builds. ` + `Re-run after installing the missing toolchain — failed tools are skipped, not fatal.`);
   }
 }
-var ROOT11;
+var ROOT12;
 var init_cli = __esm(() => {
   init_catalog();
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT11 = join29(fileURLToPath18(new URL(".", import.meta.url)), "..");
+  ROOT12 = join30(fileURLToPath19(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -32713,7 +32713,7 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 
 // src/review-harness.ts
 init_scanner();
@@ -32879,9 +32879,9 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync12, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
-import { join as join13 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
+import { readFileSync as readFileSync13, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
+import { join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
 
 // src/memory.ts
 import { readFileSync as readFileSync3, appendFileSync, mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -36444,6 +36444,33 @@ function watchlistCveMatches(techs, headers = {}, body = "", versions = []) {
   });
 }
 
+// src/surface-map.ts
+import { readFileSync as readFileSync12 } from "node:fs";
+import { join as join13 } from "node:path";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
+var ROOT5 = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
+function load2() {
+  const raw = readFileSync12(join13(ROOT5, "intelligence", "surface-map.json"), "utf8");
+  return JSON.parse(raw);
+}
+function surfaceMap(hint = "") {
+  const data = load2();
+  if (!hint)
+    return data.surfaces;
+  const h = hint.toLowerCase();
+  return data.surfaces.filter((s) => s.id.includes(h) || s.name.toLowerCase().includes(h) || s.fingerprints.some((f) => f.toLowerCase().includes(h)));
+}
+function matchSurfaces(techs, headers = {}, body = "") {
+  const haystack = `${techs.join(" ")} ${Object.keys(headers).join(" ")} ${Object.values(headers).join(" ")} ${body}`.toLowerCase();
+  const out = [];
+  for (const s of load2().surfaces) {
+    const hits = s.fingerprints.filter((f) => haystack.includes(f.toLowerCase()));
+    if (hits.length > 0)
+      out.push({ ...s, hits });
+  }
+  return out.sort((a, b) => b.hits.length - a.hits.length);
+}
+
 // src/live-recon.ts
 import { resolve4 as resolve42 } from "node:dns/promises";
 import { connect } from "node:net";
@@ -36879,6 +36906,7 @@ async function liveRecon(target, includeActive = false) {
   const techs = detectTech(root.headers, root.body);
   const versions = extractVersion(root.headers, root.body);
   const suggestedCves = watchlistCveMatches(techs, root.headers, root.body, versions);
+  const surfaces = matchSurfaces(techs, root.headers, root.body);
   const { links, scripts } = crawlLinks(base, root.body);
   const { robots, sitemap } = await fetchRobotsAndSitemap(base);
   const allUrls = [...links, ...scripts, ...robots, ...sitemap];
@@ -36915,6 +36943,9 @@ async function liveRecon(target, includeActive = false) {
   if (suggestedCves.length > 0) {
     nextSteps.push(`FINGERPRINT MATCH: the stack matches a high-value watchlist product — test these specific CVEs first instead of generic scanning: ${suggestedCves.map((c) => `${c.cve} (${c.name}, EPSS ${((c.epss ?? 0) * 100).toFixed(0)}%)`).join("; ")}.`);
   }
+  if (surfaces.length > 0) {
+    nextSteps.push(`SURFACE-FIRST: detected ${surfaces.length} attack surface(s) — ${surfaces.map((s) => `${s.id} (${s.high_value_tests.length} high-value tests)`).join(", ")}. Map each surface to its tests via surface_map before spraying payloads.`);
+  }
   if (crawl.endpoints.length > 0)
     nextSteps.push(`Found ${crawl.endpoints.length} endpoints — feed them to taint_file/blitz_scan for source analysis, or strike_verify for live validation.`);
   if (params.length > 0)
@@ -36942,6 +36973,7 @@ async function liveRecon(target, includeActive = false) {
     tech: { detected: techs, server: fingerprint.server },
     versions,
     suggested_cves: suggestedCves.map((c) => ({ cve: c.cve, name: c.name, product: c.product, epss: c.epss, reports: c.reports })),
+    suggested_surfaces: surfaces.map((s) => ({ id: s.id, name: s.name, high_value_tests: s.high_value_tests, matched_fingerprints: s.hits })),
     crawl,
     params,
     subdomains,
@@ -37018,9 +37050,9 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
-    const path = join13(dir, "chains.json");
-    const raw = JSON.parse(readFileSync12(path, "utf8"));
+    const dir = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
+    const path = join14(dir, "chains.json");
+    const raw = JSON.parse(readFileSync13(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
   } catch {
@@ -37801,8 +37833,8 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
-    const data = JSON.parse(readFileSync12(join13(dir, "intelligence", "chain_links.json"), "utf8"));
+    const dir = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
+    const data = JSON.parse(readFileSync13(join14(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
     return [];
@@ -37958,18 +37990,18 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync13, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join14 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join15 } from "node:path";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
 function tasksDir() {
-  return join14(fileURLToPath8(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join15(fileURLToPath9(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
-  return join14(tasksDir(), `${id}.json`);
+  return join15(tasksDir(), `${id}.json`);
 }
-function load2(id) {
+function load3(id) {
   try {
-    return JSON.parse(readFileSync13(taskPath(id), "utf8"));
+    return JSON.parse(readFileSync14(taskPath(id), "utf8"));
   } catch {
     return null;
   }
@@ -37994,7 +38026,7 @@ function taskStart(id, objective, plan) {
   return { ...t, progress: `0/${plan.length}`, next: t.current_step };
 }
 function taskCheckpoint(id, step, status, note, outputHash) {
-  const t = load2(id);
+  const t = load3(id);
   if (!t)
     return { ok: false, error: `task '${id}' not found — call task_start first` };
   t.checkpoints.push({ step, status, output_hash: outputHash, note, ts: Date.now() });
@@ -38020,7 +38052,7 @@ function taskCheckpoint(id, step, status, note, outputHash) {
   };
 }
 function taskStatus(id) {
-  const t = load2(id);
+  const t = load3(id);
   if (!t)
     return { found: false, error: `task '${id}' not found` };
   const done = t.checkpoints.filter((c) => c.status === "done").length;
@@ -38036,7 +38068,7 @@ function taskStatus(id) {
   };
 }
 function taskResume(id) {
-  const t = load2(id);
+  const t = load3(id);
   if (!t)
     return { found: false, error: `task '${id}' not found` };
   const doneSteps = t.checkpoints.filter((c) => c.status === "done").map((c) => c.step);
@@ -38309,16 +38341,16 @@ function scaffoldEngagement(target, scope = [], out_of_scope = []) {
 // src/incremental.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { writeFileSync as writeFileSync4, mkdtempSync, rmSync } from "node:fs";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/eagle2.ts
 var import_php_parser2 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 
 // src/dataflow.ts
 init_scanner();
-import { readFileSync as readFileSync14 } from "node:fs";
+import { readFileSync as readFileSync15 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -38403,7 +38435,7 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    text = readFileSync14(path, "utf8");
+    text = readFileSync15(path, "utf8");
   } catch {
     return result;
   }
@@ -38484,7 +38516,7 @@ init_scanner();
 
 // src/callgraph.ts
 var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -38545,7 +38577,7 @@ function buildCallGraph(path) {
   const g = { nodes: new Map, edges: [] };
   let code;
   try {
-    code = readFileSync15(path, "utf8");
+    code = readFileSync16(path, "utf8");
   } catch {
     return g;
   }
@@ -39207,7 +39239,7 @@ function resolveFuncId(name, summaries) {
 function analyzeDataFlow2(path) {
   let cacheCode = "";
   try {
-    cacheCode = readFileSync16(path, "utf8");
+    cacheCode = readFileSync17(path, "utf8");
   } catch {}
   if (cacheCode) {
     const cached = getCache("eagle2", cacheCode);
@@ -39229,7 +39261,7 @@ function analyzeDataFlow2(path) {
   };
   let code;
   try {
-    code = cacheCode || readFileSync16(path, "utf8");
+    code = cacheCode || readFileSync17(path, "utf8");
   } catch {
     return result;
   }
@@ -57915,8 +57947,8 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
       continue;
     const lang = detectLanguage(file)?.language;
     if (lang === "php") {
-      const dir = mkdtempSync(join15(tmpdir(), "blitz-incr-"));
-      const tmp = join15(dir, "changed.php");
+      const dir = mkdtempSync(join16(tmpdir(), "blitz-incr-"));
+      const tmp = join16(dir, "changed.php");
       writeFileSync4(tmp, code);
       try {
         const r = analyzeDataFlow2(tmp);
@@ -57937,7 +57969,7 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
 // src/taint.ts
 init_scanner();
 var import_php_parser4 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 var parser4 = new import_php_parser4.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -58235,7 +58267,7 @@ function analyzeTaint(path) {
   const result = { file: path, findings: [], suppressed: 0 };
   let code;
   try {
-    code = readFileSync17(path, "utf8");
+    code = readFileSync18(path, "utf8");
   } catch {
     return result;
   }
@@ -58329,15 +58361,15 @@ function taintTree(root, maxFiles = 2000) {
 }
 
 // src/differential.ts
-import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync18 } from "node:fs";
-import { join as join16 } from "node:path";
+import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync19 } from "node:fs";
+import { join as join17 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 import { execFileSync as execFileSync4 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync2(join16(tmpdir2(), "blitz-diff-"));
-    const tmp = join16(dir, "old.php");
+    const dir = mkdtempSync2(join17(tmpdir2(), "blitz-diff-"));
+    const tmp = join17(dir, "old.php");
     writeFileSync5(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
@@ -58491,8 +58523,8 @@ function languageOf(file) {
   return adapter?.language ?? "php";
 }
 function analyzeDifferentialFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync18(oldPath, "utf8");
-  const newCode = readFileSync18(newPath, "utf8");
+  const oldCode = readFileSync19(oldPath, "utf8");
+  const newCode = readFileSync19(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzeDifferential(oldCode, newCode, lang, newPath);
 }
@@ -58619,46 +58651,46 @@ function analyzePatch(oldCode, newCode, language = "php") {
   };
 }
 function analyzePatchFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync18(oldPath, "utf8");
-  const newCode = readFileSync18(newPath, "utf8");
+  const oldCode = readFileSync19(oldPath, "utf8");
+  const newCode = readFileSync19(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzePatch(oldCode, newCode, lang);
 }
 
 // src/frameworks.ts
-import { readFileSync as readFileSync19, existsSync as existsSync9 } from "node:fs";
-import { join as join17 } from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
-var ROOT5 = join17(fileURLToPath9(new URL(".", import.meta.url)), "..");
-var INTEL2 = join17(ROOT5, "intelligence");
+import { readFileSync as readFileSync20, existsSync as existsSync9 } from "node:fs";
+import { join as join18 } from "node:path";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
+var ROOT6 = join18(fileURLToPath10(new URL(".", import.meta.url)), "..");
+var INTEL2 = join18(ROOT6, "intelligence");
 var cache = null;
-function load3() {
+function load4() {
   if (cache)
     return cache;
-  const p = join17(INTEL2, "frameworks.json");
+  const p = join18(INTEL2, "frameworks.json");
   if (!existsSync9(p))
     return null;
   try {
-    cache = JSON.parse(readFileSync19(p, "utf8"));
+    cache = JSON.parse(readFileSync20(p, "utf8"));
     return cache;
   } catch {
     return null;
   }
 }
 function listFrameworks2() {
-  const data = load3();
+  const data = load4();
   if (!data)
     return [];
   return data.frameworks.map((f) => ({ id: f.id, name: f.name, language: f.language }));
 }
 function frameworkProfile(id) {
-  const data = load3();
+  const data = load4();
   if (!data)
     return null;
   return data.frameworks.find((f) => f.id === id) ?? null;
 }
 function detectFramework(code, language) {
-  const data = load3();
+  const data = load4();
   const hay = code.toLowerCase();
   const candidates = [];
   if (data) {
@@ -59151,7 +59183,7 @@ function nextSteps(ctx) {
 init_complex_bugs();
 import { execFileSync as execFileSync5 } from "node:child_process";
 import { existsSync as existsSync11 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 function parseDeletions(output) {
   const out = [];
   let commit = "";
@@ -59180,7 +59212,7 @@ function blobBeforeDeletion(root, commit, path) {
 function scanGitHistory(root, opts) {
   const limit = opts?.limit ?? 30;
   const findings = [];
-  if (!existsSync11(join18(root, ".git"))) {
+  if (!existsSync11(join19(root, ".git"))) {
     return { root, is_git_repo: false, total: 0, findings: [], error: "not a git repository (no .git dir)" };
   }
   if (opts?.secretPattern) {
@@ -59327,13 +59359,13 @@ async function validateLeakedKey(input) {
 }
 
 // src/hackbot-arena.ts
-import { readFileSync as readFileSync20 } from "node:fs";
-import { join as join19, dirname as dirname3 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
-var __dirname3 = dirname3(fileURLToPath10(import.meta.url));
-function load4() {
+import { readFileSync as readFileSync21 } from "node:fs";
+import { join as join20, dirname as dirname3 } from "node:path";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
+var __dirname3 = dirname3(fileURLToPath11(import.meta.url));
+function load5() {
   try {
-    return JSON.parse(readFileSync20(join19(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
+    return JSON.parse(readFileSync21(join20(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
   } catch {
     return { total: 0, flag_format: "FLAG{nusasec-<32 hex>}", labs: [] };
   }
@@ -59370,10 +59402,10 @@ function mapLab(lab) {
 }
 function findByLab(labId) {
   const id = labId.toLowerCase().replace(/[^a-z0-9]/g, "");
-  return load4().labs.find((l) => l.id.toLowerCase() === id || l.id.toLowerCase() === `labs${id}`) ?? null;
+  return load5().labs.find((l) => l.id.toLowerCase() === id || l.id.toLowerCase() === `labs${id}`) ?? null;
 }
 function hackbotArenaList() {
-  const doc = load4();
+  const doc = load5();
   return {
     arena: "Hackbot-Arena (NusaSec)",
     total: doc.total,
@@ -59394,18 +59426,18 @@ function hackbotArenaBrief(labId) {
     target: `http://localhost:${lab.port}`,
     vuln_class: lab.vuln_class,
     stack: lab.stack,
-    flag_format: load4().flag_format,
+    flag_format: load5().flag_format,
     attack_plan: {
       vectors: plan.vectors,
       detectors: plan.detectors,
       chains: plan.chains,
       tools: plan.tools
     },
-    hint: `Start with live_recon(target) to fingerprint, then drive the ${plan.chains.join(" + ") || "detected"} chain. Verify every step live (strike_verify / browser_validate) and recover the flag. Flag format: ${load4().flag_format}.`
+    hint: `Start with live_recon(target) to fingerprint, then drive the ${plan.chains.join(" + ") || "detected"} chain. Verify every step live (strike_verify / browser_validate) and recover the flag. Flag format: ${load5().flag_format}.`
   };
 }
 function hackbotArenaCoverage() {
-  const doc = load4();
+  const doc = load5();
   const rows = doc.labs.map((l) => {
     const plan = mapLab(l);
     return { id: l.id, name: l.name, vuln_class: l.vuln_class, vectors: plan.vectors, detectors: plan.detectors, chains: plan.chains };
@@ -59497,13 +59529,13 @@ function listSeverityMap() {
 }
 
 // src/datarefresh.ts
-import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join20, dirname as dirname4 } from "node:path";
-import { fileURLToPath as fileURLToPath11 } from "node:url";
-var __dirname4 = dirname4(fileURLToPath11(import.meta.url));
+import { readFileSync as readFileSync22 } from "node:fs";
+import { join as join21, dirname as dirname4 } from "node:path";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
+var __dirname4 = dirname4(fileURLToPath12(import.meta.url));
 function loadJson2(rel) {
   try {
-    return JSON.parse(readFileSync21(join20(__dirname4, "..", rel), "utf8"));
+    return JSON.parse(readFileSync22(join21(__dirname4, "..", rel), "utf8"));
   } catch {
     return null;
   }
@@ -59695,18 +59727,18 @@ async function brokenLinkScan(url, maxHosts = 30) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync23, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join22 } from "node:path";
-import { fileURLToPath as fileURLToPath13 } from "node:url";
+import { readFileSync as readFileSync24, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join23 } from "node:path";
+import { fileURLToPath as fileURLToPath14 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
 init_complex_bugs();
-var ROOT6 = join22(fileURLToPath13(new URL(".", import.meta.url)), "..");
-var CORPUS = join22(ROOT6, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join22(homedir8(), ".blitzstrike", "corpus");
+var ROOT7 = join23(fileURLToPath14(new URL(".", import.meta.url)), "..");
+var CORPUS = join23(ROOT7, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join23(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync23(path, "utf8");
+    text = readFileSync24(path, "utf8");
   } catch {
     return null;
   }
@@ -59762,7 +59794,7 @@ function loadDir(dir) {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join22(dir, f));
+      const e = parseCorpusFile(join23(dir, f));
       if (e)
         entries.push(e);
     }
@@ -59789,7 +59821,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join22(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join23(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -59811,7 +59843,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join22(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join23(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -59880,12 +59912,12 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync24, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join23 } from "node:path";
+import { readFileSync as readFileSync25, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join24 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join23(homedir9(), ".blitzstrike");
-var OBLIGATION_PATH = join23(HOME_DIR4, "obligations.jsonl");
+var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join24(homedir9(), ".blitzstrike");
+var OBLIGATION_PATH = join24(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
   if (!existsSync12(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
@@ -59898,7 +59930,7 @@ function loadObligations() {
     return [];
   try {
     const out = [];
-    for (const line of readFileSync24(OBLIGATION_PATH, "utf8").split(`
+    for (const line of readFileSync25(OBLIGATION_PATH, "utf8").split(`
 `)) {
       const t = line.trim();
       if (!t)
@@ -60002,11 +60034,11 @@ init_framework_security();
 // src/variant-scan.ts
 init_scanner();
 init_complex_bugs();
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync27 } from "node:fs";
 
 // src/cross-file.ts
 init_scanner();
-import { readFileSync as readFileSync25 } from "node:fs";
+import { readFileSync as readFileSync26 } from "node:fs";
 var PUBLIC_HOOK_RE = /(?:wp_ajax_nopriv_\w+|admin_post_nopriv_\w+|init|template_redirect|wp_loaded|parse_request|user_register|um_user_register|register_new_user|authenticate)/;
 var PRIV_SINK_RE = /\b(set_role|add_role|remove_role|set_user_role|wp_set_current_user|wp_set_auth_cookie|wp_insert_user|wp_create_user|wp_update_user)\s*\(/;
 var ROLE_META_RE = /update_user_meta\s*\(\s*[^,]+,\s*['"](wp_capabilities|role|roles|capabilities|wp_user_level)['"]/;
@@ -60058,7 +60090,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync25(file, "utf8"));
+      code = stripComments(readFileSync26(file, "utf8"));
     } catch {
       continue;
     }
@@ -60099,7 +60131,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync25(file, "utf8"));
+      code = stripComments(readFileSync26(file, "utf8"));
     } catch {
       continue;
     }
@@ -60122,7 +60154,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync25(file, "utf8"));
+      code = stripComments(readFileSync26(file, "utf8"));
     } catch {
       continue;
     }
@@ -60237,7 +60269,7 @@ function variantScan(root, opts = {}) {
   for (const file of files) {
     let code;
     try {
-      code = readFileSync26(file, "utf8");
+      code = readFileSync27(file, "utf8");
     } catch {
       continue;
     }
@@ -61489,6 +61521,11 @@ var HUNTING_DOCTRINE = [
     id: "dedup_before_report",
     title: "Search for Duplicates Before Reporting",
     rule: "The #1 cause of 'Duplicate'/'N/A' rejections is not searching first. Before writing the report, search Hacktivity (and the program's prior public reports) for the same endpoint/tech/vuln class; an already-reported open S3 bucket, CORS misconfig, or XSS param is not worth a second report. Only submit what is genuinely new."
+  },
+  {
+    id: "surface_first",
+    title: "Map Attack Surfaces Before Spraying Payloads",
+    rule: "A large target is won by mapping its attack SURFACES (image proxy → SSRF/URL-bypass; redirect proxy → open-redirect/SSRF; edge cache → IDOR/cache-poisoning; payment portal → price-manipulation/IDOR; AI agent → prompt-injection→SSRF-RCE; file service → XSS-via-content/SSRF/upload-RCE; Electron app → HTML-injection→BrowserWindow-RCE; SSO → OAuth-redirect/JWT). Use surface_map(surface) to get each surface's high-value tests, then test those FIRST — not a payload spray across every endpoint."
   }
 ];
 function huntingDoctrine() {
@@ -61917,7 +61954,7 @@ function listPocTypes() {
 import { execSync as execSync3 } from "node:child_process";
 import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, rmSync as rmSync4, existsSync as existsSync14 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 function findForge() {
   try {
     const p = execSync3("which forge 2>/dev/null", { encoding: "utf8", timeout: 3000 }).trim();
@@ -61966,14 +62003,14 @@ async function foundryRun(input) {
     };
   }
   const poc = input.poc_code ?? foundryPoc(input.class_ ?? "missing_access_control", name);
-  const dir = mkdtempSync3(join24(tmpdir4(), "blitzstrike-foundry-"));
+  const dir = mkdtempSync3(join25(tmpdir4(), "blitzstrike-foundry-"));
   try {
     try {
       execSync3(`${forge} init --force --no-git ${dir}`, { stdio: "ignore", timeout: 60000 });
     } catch {
-      mkdirSync9(join24(dir, "src"), { recursive: true });
-      mkdirSync9(join24(dir, "test"), { recursive: true });
-      writeFileSync8(join24(dir, "foundry.toml"), `[profile.default]
+      mkdirSync9(join25(dir, "src"), { recursive: true });
+      mkdirSync9(join25(dir, "test"), { recursive: true });
+      writeFileSync8(join25(dir, "foundry.toml"), `[profile.default]
 src = "src"
 out = "out"
 libs = ["lib"]
@@ -61983,12 +62020,12 @@ solc = "0.8.20"
     for (const f of ["Counter.sol", "Counter.t.sol", "Counter.s.sol"]) {
       for (const sub of ["src", "test", "script"]) {
         try {
-          rmSync4(join24(dir, sub, f), { force: true });
+          rmSync4(join25(dir, sub, f), { force: true });
         } catch {}
       }
     }
-    writeFileSync8(join24(dir, "src", `${name}.sol`), input.contract_code);
-    writeFileSync8(join24(dir, "test", `${name}.t.sol`), poc);
+    writeFileSync8(join25(dir, "src", `${name}.sol`), input.contract_code);
+    writeFileSync8(join25(dir, "test", `${name}.t.sol`), poc);
     const { out } = runForge(forge, dir, input.timeout_ms ?? 60000);
     const tests = parseTestResults(out);
     const anyFail = tests.some((t) => t.status === "fail");
@@ -62006,18 +62043,18 @@ solc = "0.8.20"
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync15, readFileSync as readFileSync27, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join25, resolve } from "node:path";
-import { fileURLToPath as fileURLToPath14 } from "node:url";
+import { existsSync as existsSync15, readFileSync as readFileSync28, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { join as join26, resolve } from "node:path";
+import { fileURLToPath as fileURLToPath15 } from "node:url";
 init_complex_bugs();
-var ROOT7 = resolve(fileURLToPath14(new URL(".", import.meta.url)), "..", "bench", "enterprise");
+var ROOT8 = resolve(fileURLToPath15(new URL(".", import.meta.url)), "..", "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join25(ROOT7, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join25(ROOT7, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join25(ROOT7, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join25(ROOT7, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join25(ROOT7, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join25(ROOT7, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join26(ROOT8, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join26(ROOT8, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join26(ROOT8, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join26(ROOT8, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join26(ROOT8, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join26(ROOT8, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -62029,7 +62066,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join25(dir, e);
+      const p = join26(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -62050,7 +62087,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync27(f, "utf8");
+      code = readFileSync28(f, "utf8");
     } catch {
       continue;
     }
@@ -63154,7 +63191,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync29(path, "utf8");
+        src = readFileSync30(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -63235,7 +63272,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync29(path, "utf8");
+        src = readFileSync30(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -63308,6 +63345,15 @@ ${statusLine}` : statusLine },
   }, async ({ url }) => {
     return { content: [{ type: "text", text: JSON.stringify(await brokenLinkScan(url)) }] };
   });
+  server.registerTool("surface_map", {
+    title: "Attack-surface → high-value-test map (surface-first targeting)",
+    description: "Map an attack surface to its highest-value test cases (derived from public target-recon dossiers). Surfaces: image_proxy (SSRF/URL-bypass/XSS), redirect_proxy (open-redirect/SSRF/bypass), edge_cache (IDOR/cache-poisoning), payment_portal (price-manipulation/IDOR/subscription), ai_agent (prompt-injection→SSRF-RCE/deser/stored-XSS), file_service (XSS-via-content/SSRF/upload-RCE), electron_desktop (HTML-injection→BrowserWindow-RCE/IPC), auth_sso (OAuth-redirect/JWT/2FA). Pass a hint to filter, or no arg to list all. SURFACE-FIRST: a large target is won by mapping surfaces to tests, not by spraying payloads.",
+    inputSchema: {
+      hint: string2().optional().describe("Surface id/keyword to filter (e.g. 'image_proxy', 'payment', 'ai')")
+    }
+  }, async ({ hint }) => {
+    return { content: [{ type: "text", text: JSON.stringify(surfaceMap(hint ?? "")) }] };
+  });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",
     description: "Turn a finding into a concrete reproduction recipe (the 'reproducible' gate question made executable). Given a vuln class + target + endpoint + param, emit the exact request (with a MARKER), a NEGATIVE CONTROL, and the expected differential that PROVES the bug — plus a Patchstack-style title, derived severity, and the fix. Covers sql_injection, missing_authz/idor, ssrf, xss, ssti, command_injection, file_upload, mass_assignment, jwt_alg_confusion, crlf, open_redirect, xxe, prototype_pollution, deserialization, hardcoded_secret, cache_deception, cors_misconfiguration, subdomain_takeover. Pass type='list' to enumerate supported classes.",
@@ -63927,7 +63973,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync29(path, "utf8");
+    const code = readFileSync30(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -63941,7 +63987,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback), CORS misconfiguration (reflected/wildcard origin + credentials), XSS (user input into a DOM sink: innerHTML / dangerouslySetInnerHTML / document.write / .html / eval), and subdomain takeover (CNAME/AliasTarget to a claimable service).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync29(path, "utf8");
+    const code = readFileSync30(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -64027,7 +64073,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync29(path, "utf8");
+        src = readFileSync30(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -64276,15 +64322,15 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync33, existsSync as existsSync18 } from "node:fs";
-import { join as join30 } from "node:path";
-import { fileURLToPath as fileURLToPath19 } from "node:url";
-var ROOT12 = join30(fileURLToPath19(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync34, existsSync as existsSync18 } from "node:fs";
+import { join as join31 } from "node:path";
+import { fileURLToPath as fileURLToPath20 } from "node:url";
+var ROOT13 = join31(fileURLToPath20(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join30(ROOT12, "package.json");
+    const p = join31(ROOT13, "package.json");
     if (existsSync18(p))
-      return JSON.parse(readFileSync33(p, "utf8")).version ?? "1.0.0";
+      return JSON.parse(readFileSync34(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }

package/intelligence/surface-map.json

@@ -0,0 +1,159 @@
+{
+  "surfaces": [
+    {
+      "id": "image_proxy",
+      "name": "Image proxy / URL-rewrite service",
+      "fingerprints": [
+        "imgproxy",
+        "image proxy",
+        "url unfurling",
+        "image resize",
+        "?url=",
+        "slack-imgs",
+        "image-resize",
+        "proxy.php?url"
+      ],
+      "high_value_tests": [
+        "SSRF \u2014 the url= param reaches the proxy; point it at 169.254.169.254 or an internal range",
+        "URL validation bypass \u2014 encoded/internal-scheme (file://, gopher://, 127.0.0.1) variants",
+        "XSS via image content \u2014 SVG/HTML payloads rendered inline"
+      ]
+    },
+    {
+      "id": "redirect_proxy",
+      "name": "URL redirect / safety proxy",
+      "fingerprints": [
+        "redirect",
+        "safety proxy",
+        "redir",
+        "url shortener",
+        "outbound link",
+        "?to=",
+        "?redirect=",
+        "?url="
+      ],
+      "high_value_tests": [
+        "Open redirect \u2014 bypass the safety check to cloak phishing links",
+        "SSRF \u2014 the proxy fetches the target URL server-side",
+        "URL validation bypass \u2014 scheme/domain confusion (//, @, encoded chars)"
+      ]
+    },
+    {
+      "id": "edge_cache",
+      "name": "Edge cache / entity data service",
+      "fingerprints": [
+        "edge",
+        "cache",
+        "conditional fetch",
+        "timestamp",
+        "entity",
+        "flannel",
+        "graphql"
+      ],
+      "high_value_tests": [
+        "IDOR \u2014 read other entities (user/channel/tenant) by id without auth",
+        "Cache poisoning \u2014 inject a key that serves attacker content to other users",
+        "Unauthorized entity enumeration \u2014 bulk read via timestamp/resource pattern"
+      ]
+    },
+    {
+      "id": "payment_portal",
+      "name": "Payment / billing portal",
+      "fingerprints": [
+        "payment",
+        "billing",
+        "checkout",
+        "invoice",
+        "subscription",
+        "stripe",
+        "paypal",
+        "braintree",
+        "plan",
+        "pricing"
+      ],
+      "high_value_tests": [
+        "Price/amount manipulation \u2014 alter the client-side total before checkout",
+        "IDOR on invoices/payment records \u2014 read or modify other users' billing",
+        "Subscription tampering \u2014 upgrade/entitlement without payment",
+        "Auth bypass on checkout/order endpoints"
+      ]
+    },
+    {
+      "id": "ai_agent",
+      "name": "AI agent / no-code app builder",
+      "fingerprints": [
+        "agent",
+        "ai",
+        "llm",
+        "no-code",
+        "builder",
+        "prompt",
+        "gpt",
+        "assistant",
+        "horizons"
+      ],
+      "high_value_tests": [
+        "Prompt injection \u2192 SSRF / RCE / data exfiltration via tool-call abuse",
+        "Insecure deserialization of tool-call arguments",
+        "Stored XSS in agent-generated output rendered in the dashboard"
+      ]
+    },
+    {
+      "id": "file_service",
+      "name": "File upload / download service",
+      "fingerprints": [
+        "file",
+        "upload",
+        "download",
+        "supra",
+        "miata",
+        "attachment",
+        "?file=",
+        "?download="
+      ],
+      "high_value_tests": [
+        "XSS via file content \u2014 SVG/HTML served inline",
+        "SSRF via file URL / remote file fetch",
+        "Upload \u2192 RCE \u2014 executable file landing web-reachable"
+      ]
+    },
+    {
+      "id": "electron_desktop",
+      "name": "Electron / desktop app",
+      "fingerprints": [
+        "electron",
+        "browserwindow",
+        "desktop",
+        "chromium",
+        "node.js desktop",
+        "app.asar"
+      ],
+      "high_value_tests": [
+        "HTML injection \u2192 BrowserWindow RCE (nodeIntegration + remote content)",
+        "Insecure IPC / preload bridge \u2014 expose privileged APIs to renderer",
+        "Remote content loading \u2014 hot-update/CDN resources replaced"
+      ]
+    },
+    {
+      "id": "auth_sso",
+      "name": "Authentication / SSO portal",
+      "fingerprints": [
+        "auth",
+        "sso",
+        "oauth",
+        "saml",
+        "login",
+        "passport",
+        "jwt",
+        "token",
+        "signin"
+      ],
+      "high_value_tests": [
+        "OAuth open redirect via redirect_uri manipulation",
+        "JWT alg:none / weak secret / missing expiry",
+        "Token leakage / account enumeration / 2FA bypass"
+      ]
+    }
+  ],
+  "note": "Generalized attack-surface \u2192 high-value-test map, derived from public target-recon dossiers. Each surface is matched by fingerprint keywords against the detected tech stack/headers/body; when a surface is present, test its high-value cases FIRST (surface-first, not payload-spraying)."
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.107",
+  "version": "2.4.108",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {