blitzstrike 2.4.11 → 2.4.12

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.12] — 2026-09-14
+
+### Improved — install-tools failure diagnostics
+
+- `install-tools` now reports the REASON for every failed tool (last stderr/stdout
+  lines) instead of a bare `Failed: …` list.
+- Preflight reports missing toolchains (go/java/python/cargo/meson/ninja/make/gcc)
+  + the `apt install` line to fix them before the mass install.
+- Per-tool install budget raised 120s → 300s so cold-cache `go install` /
+  `pip install` of large tools (nuclei, amass, httpx, metasploit, …) no longer
+  time out.
+
 ## [2.4.11] — 2026-09-14
 
 ### Fixed — bulk-install no longer pollutes the caller's cwd

package/dist/index.js

@@ -7519,7 +7519,7 @@ function ensureTool(name) {
     return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
   }
   mkdirSync3(TOOLS_DIR, { recursive: true });
-  const r = spawnSync(cmd, { shell: true, timeout: 120000, cwd: TOOLS_DIR });
+  const r = spawnSync(cmd, { shell: true, timeout: 300000, cwd: TOOLS_DIR });
   const ok = r.status === 0;
   return {
     name: t.name,
@@ -7599,7 +7599,7 @@ function runCatalogTool(hint, target, extraFlags = []) {
     output: out.slice(0, 6000)
   };
 }
-function ensureToolAsync(name, timeoutMs = 120000) {
+function ensureToolAsync(name, timeoutMs = 300000) {
   return new Promise((resolve) => {
     const t = loadTools().find((x) => x.name.toLowerCase() === name.toLowerCase());
     if (!t) {
@@ -15995,15 +15995,32 @@ async function runInstallTools(args) {
   }
   console.log(`Installing catalog tools${category ? ` (category: ${category})` : ""} — concurrency ${concurrency}
 `);
+  const chainMap = { go: "golang", java: "default-jdk", python3: "python3", pip3: "python3-pip", cargo: "cargo", make: "build-essential", meson: "meson", ninja: "ninja-build", gcc: "build-essential", git: "git" };
+  const missingChains = Object.keys(chainMap).filter((c) => spawnSync5(`command -v ${c}`, { shell: true }).status !== 0);
+  if (missingChains.length) {
+    console.log(`⚠ Missing toolchains: ${missingChains.join(", ")} (${missingChains.map((c) => chainMap[c]).join(", ")})`);
+    console.log(`  Tools that need them will FAIL below. Install first, e.g.:
+  apt install -y ${missingChains.map((c) => chainMap[c]).join(" ")}
+`);
+  }
   const r = await installAllTools({ category, concurrency, onProgress: (name, ok) => console.log(`  ${ok ? "OK  " : "FAIL"} ${name}`) });
   console.log(`
 Summary: ${r.target_count} targets · ${r.installed} newly installed · ${r.already_installed} already present · ${r.failed} failed`);
   const mcp = r.skipped_mcp_servers;
   if (mcp.length)
     console.log(`Skipped MCP servers (connect them): ${mcp.join(", ")}`);
-  const failedList = r.results.filter((x) => x.installed !== true).map((x) => x.name);
-  if (failedList.length)
-    console.log(`Failed: ${failedList.join(", ")}`);
+  const failedList = r.results.filter((x) => x.installed !== true);
+  if (failedList.length) {
+    console.log(`
+Failed (${failedList.length}) — reason per tool:`);
+    for (const f of failedList) {
+      const reason = String(f.output ?? f.note ?? "unknown error").split(`
+`).map((s) => s.trim()).filter(Boolean).slice(-2).join(" | ").slice(-160);
+      console.log(`  - ${f.name}: ${reason}`);
+    }
+    console.log(`
+Common causes: missing Go/Java/Rust toolchain, build tools (meson/ninja/make), pip/git network failures, or heavy builds that exceed the 120s per-tool budget. Re-run after installing the missing toolchain; failed tools are skipped, not fatal.`);
+  }
 }
 var ROOT10;
 var init_cli = __esm(() => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.11",
+  "version": "2.4.12",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {