blitzstrike 2.4.111 → 2.4.113

package/dist/index.js

@@ -17110,11 +17110,11 @@ var require_src = __commonJS(function(exports, module) {
 });
 
 // src/mcp-status.ts
-import { existsSync as existsSync10 } from "node:fs";
+import { existsSync as existsSync11 } from "node:fs";
 import { spawnSync as spawnSync3 } from "node:child_process";
 async function checkMcpServers() {
   const out = [];
-  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync10(p));
+  const bin = ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"].find((p) => existsSync11(p));
   const npxOk = spawnSync3("npx", ["--version"], { timeout: 8000 }).error === undefined;
   const devtoolsOk = Boolean(bin) || npxOk;
   out.push({
@@ -17388,12 +17388,12 @@ document.getElementById('out').innerHTML = u;
 });
 
 // src/variants.ts
-import { readFileSync as readFileSync23 } from "node:fs";
-import { join as join22, dirname as dirname5 } from "node:path";
-import { fileURLToPath as fileURLToPath13 } from "node:url";
+import { readFileSync as readFileSync24 } from "node:fs";
+import { join as join23, dirname as dirname5 } from "node:path";
+import { fileURLToPath as fileURLToPath14 } from "node:url";
 function loadVariants() {
   try {
-    const doc = JSON.parse(readFileSync23(join22(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
+    const doc = JSON.parse(readFileSync24(join23(__dirname5, "..", "intelligence", "variants.json"), "utf8"));
     return doc.variants ?? [];
   } catch {
     return [];
@@ -17447,19 +17447,19 @@ function variantCoverageText() {
 var __dirname5, CROSS_FILE_ONLY;
 var init_variants = __esm(() => {
   init_complex_bugs();
-  __dirname5 = dirname5(fileURLToPath13(import.meta.url));
+  __dirname5 = dirname5(fileURLToPath14(import.meta.url));
   CROSS_FILE_ONLY = new Set(["priv_esc"]);
 });
 
 // src/sync.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync29, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync5 } from "node:fs";
-import { join as join27 } from "node:path";
-import { homedir as homedir10 } from "node:os";
-import { fileURLToPath as fileURLToPath16 } from "node:url";
+import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync9, readFileSync as readFileSync30, readdirSync as readdirSync8, statSync as statSync5, rmSync as rmSync5 } from "node:fs";
+import { join as join28 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { fileURLToPath as fileURLToPath17 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
   try {
-    return statSync4(p).isDirectory();
+    return statSync5(p).isDirectory();
   } catch {
     return false;
   }
@@ -17468,9 +17468,9 @@ function countFiles(dir) {
   try {
     let n = 0;
     const walk = (d) => {
-      for (const e of readdirSync7(d, { withFileTypes: true })) {
+      for (const e of readdirSync8(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join27(d, e.name));
+          walk(join28(d, e.name));
         else
           n++;
       }
@@ -17484,8 +17484,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync10(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join27(DATA_ROOT2, "payloads");
-  const templatesPath = join27(DATA_ROOT2, "templates");
+  const payloadsPath = join28(DATA_ROOT2, "payloads");
+  const templatesPath = join28(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -17495,8 +17495,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join27(ROOT9, "payloads");
-  const localTemplates = join27(ROOT9, "templates");
+  const localPayloads = join28(ROOT10, "payloads");
+  const localTemplates = join28(ROOT10, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -17509,7 +17509,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join27(DATA_ROOT2, ".tmp-clone");
+    const tmp = join28(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync5(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -17517,11 +17517,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join27(tmp, "payloads"), payloadsPath);
+          copyDir(join28(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join27(tmp, "templates"), templatesPath);
+          copyDir(join28(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -17542,19 +17542,19 @@ function copyDir(src, dst) {
 }
 function manualCopy(src, dst) {
   mkdirSync10(dst, { recursive: true });
-  for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join27(src, e.name);
-    const d = join27(dst, e.name);
+  for (const e of readdirSync8(src, { withFileTypes: true })) {
+    const s = join28(src, e.name);
+    const d = join28(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync9(d, readFileSync29(s));
+      writeFileSync9(d, readFileSync30(s));
   }
 }
-var ROOT9, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var ROOT10, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT9 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join27(homedir10(), ".blitzstrike", "data");
+  ROOT10 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join28(homedir11(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -17599,15 +17599,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync31, existsSync as existsSync16 } from "node:fs";
-import { join as join28 } from "node:path";
-import { fileURLToPath as fileURLToPath17 } from "node:url";
+import { readFileSync as readFileSync32, existsSync as existsSync17 } from "node:fs";
+import { join as join29 } from "node:path";
+import { fileURLToPath as fileURLToPath18 } from "node:url";
 import { execSync as execSync4 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync31(join28(ROOT10, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync32(join29(ROOT11, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -17619,7 +17619,7 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT10, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT11, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
     checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
@@ -17639,22 +17639,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync16(join28(ROOT10, "package-lock.json")) || existsSync16(join28(ROOT10, "bun.lock")) || existsSync16(join28(ROOT10, "bun.lockb"));
+  return existsSync17(join29(ROOT11, "package-lock.json")) || existsSync17(join29(ROOT11, "bun.lock")) || existsSync17(join29(ROOT11, "bun.lockb"));
 }
-var ROOT10;
+var ROOT11;
 var init_release = __esm(() => {
   init_version();
-  ROOT10 = join28(fileURLToPath17(new URL(".", import.meta.url)), "..");
+  ROOT11 = join29(fileURLToPath18(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
-import { readFileSync as readFileSync32 } from "node:fs";
-import { join as join29 } from "node:path";
-import { fileURLToPath as fileURLToPath18 } from "node:url";
+import { readFileSync as readFileSync33 } from "node:fs";
+import { join as join30 } from "node:path";
+import { fileURLToPath as fileURLToPath19 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync32(join29(ROOT11, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync33(join30(ROOT12, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -17675,16 +17675,16 @@ function checkDependencies() {
     safe: installScripts.length === 0 && gitDependencies.length === 0
   };
 }
-var ROOT11;
+var ROOT12;
 var init_dependency = __esm(() => {
-  ROOT11 = join29(fileURLToPath18(new URL(".", import.meta.url)), "..");
+  ROOT12 = join30(fileURLToPath19(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync33, existsSync as existsSync17, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
-import { join as join30, dirname as dirname6 } from "node:path";
-import { homedir as homedir11 } from "node:os";
-import { fileURLToPath as fileURLToPath19 } from "node:url";
+import { readFileSync as readFileSync34, existsSync as existsSync18, writeFileSync as writeFileSync10, mkdirSync as mkdirSync11 } from "node:fs";
+import { join as join31, dirname as dirname6 } from "node:path";
+import { homedir as homedir12 } from "node:os";
+import { fileURLToPath as fileURLToPath20 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
   return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
@@ -17727,7 +17727,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync17(join30(ROOT12, "chains.json")) && existsSync17(join30(ROOT12, "tools-catalog.json"));
+  const dataOk = existsSync18(join31(ROOT13, "chains.json")) && existsSync18(join31(ROOT13, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17778,21 +17778,21 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join30(ROOT12, "src", "index.ts");
-  if (which("bun") && existsSync17(src))
+  const src = join31(ROOT13, "src", "index.ts");
+  if (which("bun") && existsSync18(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join30(ROOT12, "dist", "index.js");
-  if (existsSync17(dist))
+  const dist = join31(ROOT13, "dist", "index.js");
+  if (existsSync18(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
 function readJson(p) {
   try {
-    return JSON.parse(readFileSync33(p, "utf8"));
+    return JSON.parse(readFileSync34(p, "utf8"));
   } catch {
     return null;
   }
@@ -17800,7 +17800,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync17(dir))
+    if (!existsSync18(dir))
       mkdirSync11(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -17813,7 +17813,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync17(dir))
+    if (!existsSync18(dir))
       mkdirSync11(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -17825,26 +17825,26 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join30(ROOT12, "opencode-agents");
-  const dstDir = join30(homedir11(), ".config", "opencode", "agents");
-  if (!existsSync17(srcDir))
+  const srcDir = join31(ROOT13, "opencode-agents");
+  const dstDir = join31(homedir12(), ".config", "opencode", "agents");
+  if (!existsSync18(srcDir))
     return;
-  if (!existsSync17(dstDir))
+  if (!existsSync18(dstDir))
     mkdirSync11(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join30(srcDir, f);
-    const dst = join30(dstDir, f);
-    if (existsSync17(src)) {
-      writeFileSync10(dst, readFileSync33(src, "utf8"));
+    const src = join31(srcDir, f);
+    const dst = join31(dstDir, f);
+    if (existsSync18(src)) {
+      writeFileSync10(dst, readFileSync34(src, "utf8"));
     }
   }
 }
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync17(dir))
+    if (!existsSync18(dir))
       mkdirSync11(dir, { recursive: true });
-    let existing = existsSync17(p) ? readFileSync33(p, "utf8") : "";
+    let existing = existsSync18(p) ? readFileSync34(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17861,9 +17861,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname6(p);
-    if (!existsSync17(dir))
+    if (!existsSync18(dir))
       mkdirSync11(dir, { recursive: true });
-    let existing = existsSync17(p) ? readFileSync33(p, "utf8") : "";
+    let existing = existsSync18(p) ? readFileSync34(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17888,76 +17888,76 @@ mcp_servers:
   };
 }
 function detectAgents() {
-  const home = homedir11();
+  const home = homedir12();
   const agents = [];
-  const claudeJson = join30(home, ".claude.json");
+  const claudeJson = join31(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync17(claudeJson) || which("claude"),
+    installed: () => existsSync18(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join30(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join31(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync17(claudeDesktop),
+    installed: () => existsSync18(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join30(home, ".cursor", "mcp.json");
+  const cursor = join31(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync17(join30(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync18(join31(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join30(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join31(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync17(join30(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync18(join31(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join30(home, ".codex", "config.toml");
+  const codex = join31(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync17(join30(home, ".codex")) || which("codex"),
+    installed: () => existsSync18(join31(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join30(home, ".hermes", "config.yaml");
+  const hermes = join31(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync17(join30(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync18(join31(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join30(home, ".gemini", "settings.json");
+  const gemini = join31(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync17(join30(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync18(join31(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join30(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join31(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync17(join30(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync18(join31(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join30(home, ".copilot", "mcp.json");
+  const copilot = join31(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync17(join30(home, ".copilot")),
+    installed: () => existsSync18(join31(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join30(home, ".cline", "mcp_settings.json");
+  const cline = join31(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync17(join30(home, ".cline")),
+    installed: () => existsSync18(join31(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -18069,13 +18069,13 @@ Failed (${failedList.length}) — reason per tool:`);
 Common causes: missing toolchain, pip/git network failures, or very heavy builds. ` + `Re-run after installing the missing toolchain — failed tools are skipped, not fatal.`);
   }
 }
-var ROOT12;
+var ROOT13;
 var init_cli = __esm(() => {
   init_catalog();
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT12 = join30(fileURLToPath19(new URL(".", import.meta.url)), "..");
+  ROOT13 = join31(fileURLToPath20(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -32713,7 +32713,8 @@ class StdioServerTransport {
 
 // src/server.ts
 init_scanner();
-import { readFileSync as readFileSync30 } from "node:fs";
+import { readFileSync as readFileSync31 } from "node:fs";
+import { execFileSync as execFileSync6 } from "node:child_process";
 
 // src/review-harness.ts
 init_scanner();
@@ -32879,9 +32880,9 @@ async function nvdLookup(cveId) {
 
 // src/orchestrator.ts
 init_scanner();
-import { readFileSync as readFileSync13, existsSync as existsSync8, statSync as statSync2 } from "node:fs";
-import { join as join14 } from "node:path";
-import { fileURLToPath as fileURLToPath8 } from "node:url";
+import { readFileSync as readFileSync14, existsSync as existsSync9, statSync as statSync3 } from "node:fs";
+import { join as join15 } from "node:path";
+import { fileURLToPath as fileURLToPath9 } from "node:url";
 
 // src/memory.ts
 import { readFileSync as readFileSync3, appendFileSync, mkdirSync, existsSync, writeFileSync } from "node:fs";
@@ -36295,10 +36296,323 @@ init_version();
 // src/hunting-intel.ts
 import { execFileSync } from "node:child_process";
 import { resolve4, Resolver } from "node:dns/promises";
-import { readFileSync as readFileSync11 } from "node:fs";
+import { readFileSync as readFileSync12 } from "node:fs";
+import { join as join13 } from "node:path";
+import { fileURLToPath as fileURLToPath7 } from "node:url";
+
+// src/nuclei-corpus.ts
+import { existsSync as existsSync8, readFileSync as readFileSync11, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
 import { join as join12 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 var ROOT4 = join12(fileURLToPath6(new URL(".", import.meta.url)), "..");
+var GENERIC = new Set([
+  "php",
+  "python",
+  "java",
+  "javascript",
+  "node",
+  "nodejs",
+  "ruby",
+  "perl",
+  "go",
+  "golang",
+  "rust",
+  "html",
+  "css",
+  "xml",
+  "json",
+  "shell",
+  "bash",
+  "sql",
+  "apache",
+  "nginx",
+  "iis",
+  "tomcat",
+  "jboss",
+  "weblogic",
+  "websphere",
+  "litespeed",
+  "lighttpd",
+  "caddy",
+  "mysql",
+  "mariadb",
+  "postgres",
+  "postgresql",
+  "sqlite",
+  "mongodb",
+  "redis",
+  "memcached",
+  "elasticsearch",
+  "elastic",
+  "cassandra",
+  "content",
+  "console",
+  "directory",
+  "manager",
+  "panel",
+  "admin",
+  "login",
+  "logout",
+  "config",
+  "configuration",
+  "upload",
+  "download",
+  "view",
+  "list",
+  "index",
+  "search",
+  "read",
+  "write",
+  "text",
+  "data",
+  "utils",
+  "utility",
+  "api",
+  "web",
+  "app",
+  "application",
+  "site",
+  "page",
+  "portal",
+  "dashboard",
+  "interface",
+  "module",
+  "plugin",
+  "component",
+  "service",
+  "client",
+  "user",
+  "account",
+  "session",
+  "token",
+  "password",
+  "credential",
+  "key",
+  "secret",
+  "auth",
+  "request",
+  "response",
+  "header",
+  "body",
+  "function",
+  "script",
+  "code",
+  "execute",
+  "command",
+  "injection",
+  "remote",
+  "local",
+  "arbitrary",
+  "attacker",
+  "unauth",
+  "authenticated",
+  "unauthenticated",
+  "version",
+  "versions",
+  "prior",
+  "before",
+  "after",
+  "multiple",
+  "vulnerable",
+  "vulnerability",
+  "vulnerabilities",
+  "security",
+  "issue",
+  "issues",
+  "exploit",
+  "exploits",
+  "denial",
+  "escalation",
+  "disclosure",
+  "exposure",
+  "bypass",
+  "override",
+  "flaw",
+  "bug",
+  "error",
+  "warning",
+  "info",
+  "information",
+  "access",
+  "control",
+  "privilege",
+  "leading",
+  "lead",
+  "allows",
+  "affects",
+  "affected",
+  "powered",
+  "power",
+  "by",
+  "software",
+  "systems",
+  "technologies",
+  "solutions",
+  "enterprise",
+  "professional",
+  "studio",
+  "labs",
+  "network",
+  "networks",
+  "cloud",
+  "hosting",
+  "platform",
+  "framework",
+  "library",
+  "inc",
+  "ltd",
+  "llc",
+  "corp",
+  "co",
+  "company",
+  "free",
+  "open",
+  "source",
+  "project",
+  "wordpress",
+  "joomla",
+  "drupal",
+  "magento",
+  "shopify",
+  "prestashop",
+  "zencart",
+  "opencart",
+  "red",
+  "hat",
+  "magic",
+  "hue",
+  "get",
+  "set",
+  "use",
+  "run",
+  "top",
+  "new"
+]);
+function tokens(text) {
+  const out = [];
+  for (const t of text.toLowerCase().split(/[^a-z0-9]+/)) {
+    if (!t || t.length < 3)
+      continue;
+    if (/^\d+(\.\d+)*$/.test(t))
+      continue;
+    if (GENERIC.has(t))
+      continue;
+    out.push(t);
+  }
+  return out;
+}
+function firstMatch(txt, re) {
+  const m = re.exec(txt);
+  return m ? m[1].trim() : null;
+}
+function parseTemplate(text) {
+  const cve = firstMatch(text, /^id:\s*(\S+)/m);
+  if (!cve || !cve.toUpperCase().startsWith("CVE-"))
+    return null;
+  const name = firstMatch(text, /^\s*name:\s*(.+)$/m) ?? cve;
+  const severity = firstMatch(text, /^\s*severity:\s*(\w+)/m) ?? undefined;
+  const epssStr = firstMatch(text, /^\s*epss-score:\s*([\d.]+)/m);
+  const cwe = firstMatch(text, /^\s*cwe-id:\s*(CWE-\d+)/m) ?? undefined;
+  let prod = name.split(/\s+-\s+|:\s+/, 1)[0].trim();
+  prod = prod.replace(/[\s<>=~]+[vV]?[\d][\w.\-]*.*$/, "").trim();
+  const kw = new Set(tokens(prod));
+  for (const q of text.matchAll(/^\s*(?:fofa|shodan)-query:\s*(.+)$/gm)) {
+    for (const m of q[1].matchAll(/(?:body|title|header|http\.html|html)\s*=\s*"([^"]+)"/g)) {
+      for (const t of tokens(m[1]))
+        kw.add(t);
+    }
+  }
+  if (kw.size === 0)
+    for (const t of tokens(name).slice(0, 3))
+      kw.add(t);
+  const kwSorted = [...kw].sort().slice(0, 8);
+  const match = kwSorted.length ? `\\b(?:${kwSorted.map((k) => k.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|")})\\b` : undefined;
+  return {
+    cve,
+    name,
+    product: prod,
+    severity,
+    epss: parseFloat(epssStr ?? "0") || 0,
+    cwe,
+    match
+  };
+}
+function findTemplatesDir() {
+  const candidates = [join12(homedir8(), "nuclei-templates"), join12(homedir8(), ".nuclei-templates"), "/root/nuclei-templates"];
+  for (const c of candidates)
+    if (existsSync8(join12(c, "http", "cves")))
+      return c;
+  return null;
+}
+function loadLiveCorpus() {
+  const dir = findTemplatesDir();
+  if (!dir)
+    return [];
+  const out = [];
+  const walk = (d) => {
+    let entries;
+    try {
+      entries = readdirSync5(d);
+    } catch {
+      return;
+    }
+    for (const name of entries) {
+      const full = join12(d, name);
+      let st;
+      try {
+        st = statSync2(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory())
+        walk(full);
+      else if (name.endsWith(".yaml")) {
+        try {
+          const e = parseTemplate(readFileSync11(full, "utf8"));
+          if (e)
+            out.push(e);
+        } catch {}
+      }
+    }
+  };
+  walk(join12(dir, "http", "cves"));
+  return out;
+}
+var cache = null;
+function invalidateCorpusCache() {
+  cache = null;
+}
+function loadCorpusEntries() {
+  if (cache)
+    return cache;
+  const live = loadLiveCorpus();
+  if (live.length > 0) {
+    cache = live;
+    return live;
+  }
+  try {
+    const data = JSON.parse(readFileSync11(join12(ROOT4, "intelligence", "cve-corpus.json"), "utf8"));
+    cache = (data.cves ?? []).map((c) => ({
+      cve: String(c.cve ?? ""),
+      name: String(c.name ?? ""),
+      product: String(c.product ?? ""),
+      severity: typeof c.severity === "string" ? c.severity : undefined,
+      epss: typeof c.epss === "number" ? c.epss : parseFloat(String(c.epss ?? "0")) || 0,
+      cwe: typeof c.cwe === "string" ? c.cwe : undefined,
+      match: typeof c.match === "string" ? c.match : undefined
+    }));
+    return cache;
+  } catch {
+    return [];
+  }
+}
+function corpusSourceIsLive() {
+  return findTemplatesDir() !== null;
+}
+
+// src/hunting-intel.ts
+var ROOT5 = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
 var BLOCKING_KEYWORDS = /internet positif|kominfo|\.go\.id\b|pemblokiran|ditutup|dilarang|akses dibatasi|blocked|restricted|illegal|advertencia|coljuegos|regulat|forbidden|this (site|website) has been (blocked|banned)/i;
 var HOSTNAME_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
 function isValidHostname(host) {
@@ -36372,10 +36686,25 @@ async function resolveCheck(host) {
   };
 }
 function loadWatchlist() {
-  const raw = readFileSync11(join12(ROOT4, "intelligence", "watchlist.json"), "utf8");
+  const raw = readFileSync12(join13(ROOT5, "intelligence", "watchlist.json"), "utf8");
   const data = JSON.parse(raw);
   return { cwe_frequency: data.cwe_frequency ?? [], cve_watchlist: data.cve_watchlist ?? [] };
 }
+function loadCorpus() {
+  return loadCorpusEntries().map((c) => ({
+    cve: c.cve,
+    name: c.name,
+    product: c.product,
+    class: "",
+    epss: c.epss,
+    reports: 0,
+    fingerprint: c.product,
+    match: c.match,
+    fixed_in: null,
+    version_key: null,
+    severity: c.severity
+  }));
+}
 function fmtPayout(min, max) {
   if (min == null || max == null)
     return "n/a";
@@ -36417,40 +36746,51 @@ function semverLt(a, b) {
   }
   return false;
 }
-function watchlistCveMatches(techs, headers = {}, body = "", versions = []) {
+function watchlistCveMatches(techs, headers = {}, body = "", versions = [], max = 20) {
   const { cve_watchlist } = loadWatchlist();
+  const corpus = loadCorpus();
   const haystack = `${techs.join(" ")} ${Object.keys(headers).join(" ")} ${Object.values(headers).join(" ")} ${body}`.toLowerCase();
-  return cve_watchlist.filter((c) => {
+  const curated = new Map(cve_watchlist.map((c) => [c.cve, c]));
+  const merged = [...corpus.filter((c) => !curated.has(c.cve)), ...cve_watchlist];
+  const matched = merged.filter((c) => {
     const m = c.match;
     if (!m)
       return false;
-    let matched = false;
+    let ok = false;
     try {
-      matched = new RegExp(m, "i").test(haystack);
+      ok = new RegExp(m, "i").test(haystack);
     } catch {
-      matched = false;
+      ok = false;
     }
-    if (!matched)
+    if (!ok)
       return false;
     const fixedIn = c.fixed_in;
     const vkey = c.version_key;
     if (fixedIn && vkey) {
       const v = versions.find((x) => x.product.toLowerCase().includes(vkey.toLowerCase()));
-      if (v?.version && !semverLt(v.version, fixedIn)) {
+      if (v?.version && !semverLt(v.version, fixedIn))
         return false;
-      }
     }
     return true;
   });
+  const sevRank = { critical: 0, high: 1, medium: 2, low: 3 };
+  matched.sort((a, b) => {
+    const ea = a.epss ?? 0;
+    const eb = b.epss ?? 0;
+    if (ea !== eb)
+      return eb - ea;
+    return (sevRank[a.severity ?? ""] ?? 9) - (sevRank[b.severity ?? ""] ?? 9);
+  });
+  return matched.slice(0, max);
 }
 
 // src/surface-map.ts
-import { readFileSync as readFileSync12 } from "node:fs";
-import { join as join13 } from "node:path";
-import { fileURLToPath as fileURLToPath7 } from "node:url";
-var ROOT5 = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync13 } from "node:fs";
+import { join as join14 } from "node:path";
+import { fileURLToPath as fileURLToPath8 } from "node:url";
+var ROOT6 = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
 function load2() {
-  const raw = readFileSync12(join13(ROOT5, "intelligence", "surface-map.json"), "utf8");
+  const raw = readFileSync13(join14(ROOT6, "intelligence", "surface-map.json"), "utf8");
   return JSON.parse(raw);
 }
 function surfaceMap(hint = "") {
@@ -37034,7 +37374,7 @@ function classifyTarget(target) {
   if (/^https?:\/\//i.test(target))
     return { kind: "live", target };
   try {
-    if (existsSync8(target) && (statSync2(target).isDirectory() || statSync2(target).isFile())) {
+    if (existsSync9(target) && (statSync3(target).isDirectory() || statSync3(target).isFile())) {
       return { kind: "source", target };
     }
   } catch {}
@@ -37050,9 +37390,9 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
-    const path = join14(dir, "chains.json");
-    const raw = JSON.parse(readFileSync13(path, "utf8"));
+    const dir = join15(fileURLToPath9(new URL(".", import.meta.url)), "..");
+    const path = join15(dir, "chains.json");
+    const raw = JSON.parse(readFileSync14(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
   } catch {
@@ -37175,7 +37515,7 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
   };
   const isPath = (() => {
     try {
-      return existsSync8(target) && (statSync2(target).isDirectory() || statSync2(target).isFile());
+      return existsSync9(target) && (statSync3(target).isDirectory() || statSync3(target).isFile());
     } catch {
       return false;
     }
@@ -37833,8 +38173,8 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
-    const data = JSON.parse(readFileSync13(join14(dir, "intelligence", "chain_links.json"), "utf8"));
+    const dir = join15(fileURLToPath9(new URL(".", import.meta.url)), "..");
+    const data = JSON.parse(readFileSync14(join15(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
     return [];
@@ -37990,18 +38330,18 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync6, readFileSync as readFileSync14, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join15 } from "node:path";
-import { fileURLToPath as fileURLToPath9 } from "node:url";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync15, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join16 } from "node:path";
+import { fileURLToPath as fileURLToPath10 } from "node:url";
 function tasksDir() {
-  return join15(fileURLToPath9(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join16(fileURLToPath10(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
-  return join15(tasksDir(), `${id}.json`);
+  return join16(tasksDir(), `${id}.json`);
 }
 function load3(id) {
   try {
-    return JSON.parse(readFileSync14(taskPath(id), "utf8"));
+    return JSON.parse(readFileSync15(taskPath(id), "utf8"));
   } catch {
     return null;
   }
@@ -38341,16 +38681,16 @@ function scaffoldEngagement(target, scope = [], out_of_scope = []) {
 // src/incremental.ts
 import { execFileSync as execFileSync3 } from "node:child_process";
 import { writeFileSync as writeFileSync4, mkdtempSync, rmSync } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/eagle2.ts
 var import_php_parser2 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync17 } from "node:fs";
+import { readFileSync as readFileSync18 } from "node:fs";
 
 // src/dataflow.ts
 init_scanner();
-import { readFileSync as readFileSync15 } from "node:fs";
+import { readFileSync as readFileSync16 } from "node:fs";
 var SOURCES = {
   $_GET: { id: "http_get", label: "HTTP GET parameter", attacker_controlled: true },
   $_POST: { id: "http_post", label: "HTTP POST body", attacker_controlled: true },
@@ -38435,7 +38775,7 @@ function traceDataFlow(path) {
     return result;
   let text;
   try {
-    text = readFileSync15(path, "utf8");
+    text = readFileSync16(path, "utf8");
   } catch {
     return result;
   }
@@ -38516,7 +38856,7 @@ init_scanner();
 
 // src/callgraph.ts
 var import_php_parser = __toESM(require_src(), 1);
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 var parser = new import_php_parser.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -38577,7 +38917,7 @@ function buildCallGraph(path) {
   const g = { nodes: new Map, edges: [] };
   let code;
   try {
-    code = readFileSync16(path, "utf8");
+    code = readFileSync17(path, "utf8");
   } catch {
     return g;
   }
@@ -39239,7 +39579,7 @@ function resolveFuncId(name, summaries) {
 function analyzeDataFlow2(path) {
   let cacheCode = "";
   try {
-    cacheCode = readFileSync17(path, "utf8");
+    cacheCode = readFileSync18(path, "utf8");
   } catch {}
   if (cacheCode) {
     const cached = getCache("eagle2", cacheCode);
@@ -39261,7 +39601,7 @@ function analyzeDataFlow2(path) {
   };
   let code;
   try {
-    code = cacheCode || readFileSync17(path, "utf8");
+    code = cacheCode || readFileSync18(path, "utf8");
   } catch {
     return result;
   }
@@ -57947,8 +58287,8 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
       continue;
     const lang = detectLanguage(file)?.language;
     if (lang === "php") {
-      const dir = mkdtempSync(join16(tmpdir(), "blitz-incr-"));
-      const tmp = join16(dir, "changed.php");
+      const dir = mkdtempSync(join17(tmpdir(), "blitz-incr-"));
+      const tmp = join17(dir, "changed.php");
       writeFileSync4(tmp, code);
       try {
         const r = analyzeDataFlow2(tmp);
@@ -57969,7 +58309,7 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
 // src/taint.ts
 init_scanner();
 var import_php_parser4 = __toESM(require_src(), 1);
-import { readFileSync as readFileSync18 } from "node:fs";
+import { readFileSync as readFileSync19 } from "node:fs";
 var parser4 = new import_php_parser4.Engine({
   parser: { extractDoc: false, php7: true },
   ast: { withPositions: true, withSource: false }
@@ -58267,7 +58607,7 @@ function analyzeTaint(path) {
   const result = { file: path, findings: [], suppressed: 0 };
   let code;
   try {
-    code = readFileSync18(path, "utf8");
+    code = readFileSync19(path, "utf8");
   } catch {
     return result;
   }
@@ -58361,15 +58701,15 @@ function taintTree(root, maxFiles = 2000) {
 }
 
 // src/differential.ts
-import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync19 } from "node:fs";
-import { join as join17 } from "node:path";
+import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync20 } from "node:fs";
+import { join as join18 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 import { execFileSync as execFileSync4 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync2(join17(tmpdir2(), "blitz-diff-"));
-    const tmp = join17(dir, "old.php");
+    const dir = mkdtempSync2(join18(tmpdir2(), "blitz-diff-"));
+    const tmp = join18(dir, "old.php");
     writeFileSync5(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
@@ -58523,8 +58863,8 @@ function languageOf(file) {
   return adapter?.language ?? "php";
 }
 function analyzeDifferentialFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync19(oldPath, "utf8");
-  const newCode = readFileSync19(newPath, "utf8");
+  const oldCode = readFileSync20(oldPath, "utf8");
+  const newCode = readFileSync20(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzeDifferential(oldCode, newCode, lang, newPath);
 }
@@ -58651,28 +58991,28 @@ function analyzePatch(oldCode, newCode, language = "php") {
   };
 }
 function analyzePatchFiles(oldPath, newPath, language) {
-  const oldCode = readFileSync19(oldPath, "utf8");
-  const newCode = readFileSync19(newPath, "utf8");
+  const oldCode = readFileSync20(oldPath, "utf8");
+  const newCode = readFileSync20(newPath, "utf8");
   const lang = language ?? languageOf(newPath);
   return analyzePatch(oldCode, newCode, lang);
 }
 
 // src/frameworks.ts
-import { readFileSync as readFileSync20, existsSync as existsSync9 } from "node:fs";
-import { join as join18 } from "node:path";
-import { fileURLToPath as fileURLToPath10 } from "node:url";
-var ROOT6 = join18(fileURLToPath10(new URL(".", import.meta.url)), "..");
-var INTEL2 = join18(ROOT6, "intelligence");
-var cache = null;
+import { readFileSync as readFileSync21, existsSync as existsSync10 } from "node:fs";
+import { join as join19 } from "node:path";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
+var ROOT7 = join19(fileURLToPath11(new URL(".", import.meta.url)), "..");
+var INTEL2 = join19(ROOT7, "intelligence");
+var cache2 = null;
 function load4() {
-  if (cache)
-    return cache;
-  const p = join18(INTEL2, "frameworks.json");
-  if (!existsSync9(p))
+  if (cache2)
+    return cache2;
+  const p = join19(INTEL2, "frameworks.json");
+  if (!existsSync10(p))
     return null;
   try {
-    cache = JSON.parse(readFileSync20(p, "utf8"));
-    return cache;
+    cache2 = JSON.parse(readFileSync21(p, "utf8"));
+    return cache2;
   } catch {
     return null;
   }
@@ -59182,8 +59522,8 @@ function nextSteps(ctx) {
 // src/git-history.ts
 init_complex_bugs();
 import { execFileSync as execFileSync5 } from "node:child_process";
-import { existsSync as existsSync11 } from "node:fs";
-import { join as join19 } from "node:path";
+import { existsSync as existsSync12 } from "node:fs";
+import { join as join20 } from "node:path";
 function parseDeletions(output) {
   const out = [];
   let commit = "";
@@ -59212,7 +59552,7 @@ function blobBeforeDeletion(root, commit, path) {
 function scanGitHistory(root, opts) {
   const limit = opts?.limit ?? 30;
   const findings = [];
-  if (!existsSync11(join19(root, ".git"))) {
+  if (!existsSync12(join20(root, ".git"))) {
     return { root, is_git_repo: false, total: 0, findings: [], error: "not a git repository (no .git dir)" };
   }
   if (opts?.secretPattern) {
@@ -59359,13 +59699,13 @@ async function validateLeakedKey(input) {
 }
 
 // src/hackbot-arena.ts
-import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join20, dirname as dirname3 } from "node:path";
-import { fileURLToPath as fileURLToPath11 } from "node:url";
-var __dirname3 = dirname3(fileURLToPath11(import.meta.url));
+import { readFileSync as readFileSync22 } from "node:fs";
+import { join as join21, dirname as dirname3 } from "node:path";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
+var __dirname3 = dirname3(fileURLToPath12(import.meta.url));
 function load5() {
   try {
-    return JSON.parse(readFileSync21(join20(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
+    return JSON.parse(readFileSync22(join21(__dirname3, "..", "intelligence", "hackbot-arena.json"), "utf8"));
   } catch {
     return { total: 0, flag_format: "FLAG{nusasec-<32 hex>}", labs: [] };
   }
@@ -59529,13 +59869,13 @@ function listSeverityMap() {
 }
 
 // src/datarefresh.ts
-import { readFileSync as readFileSync22 } from "node:fs";
-import { join as join21, dirname as dirname4 } from "node:path";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
-var __dirname4 = dirname4(fileURLToPath12(import.meta.url));
+import { readFileSync as readFileSync23 } from "node:fs";
+import { join as join22, dirname as dirname4 } from "node:path";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
+var __dirname4 = dirname4(fileURLToPath13(import.meta.url));
 function loadJson2(rel) {
   try {
-    return JSON.parse(readFileSync22(join21(__dirname4, "..", rel), "utf8"));
+    return JSON.parse(readFileSync23(join22(__dirname4, "..", rel), "utf8"));
   } catch {
     return null;
   }
@@ -59727,18 +60067,18 @@ async function brokenLinkScan(url, maxHosts = 30) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync24, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join23 } from "node:path";
-import { fileURLToPath as fileURLToPath14 } from "node:url";
-import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
+import { readFileSync as readFileSync25, readdirSync as readdirSync6, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join24 } from "node:path";
+import { fileURLToPath as fileURLToPath15 } from "node:url";
+import { tmpdir as tmpdir3, homedir as homedir9 } from "node:os";
 init_complex_bugs();
-var ROOT7 = join23(fileURLToPath14(new URL(".", import.meta.url)), "..");
-var CORPUS = join23(ROOT7, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join23(homedir8(), ".blitzstrike", "corpus");
+var ROOT8 = join24(fileURLToPath15(new URL(".", import.meta.url)), "..");
+var CORPUS = join24(ROOT8, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join24(homedir9(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
-    text = readFileSync24(path, "utf8");
+    text = readFileSync25(path, "utf8");
   } catch {
     return null;
   }
@@ -59791,17 +60131,17 @@ function parseCorpusFile(path) {
 function loadDir(dir) {
   const entries = [];
   try {
-    for (const f of readdirSync5(dir)) {
+    for (const f of readdirSync6(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join23(dir, f));
+      const e = parseCorpusFile(join24(dir, f));
       if (e)
         entries.push(e);
     }
   } catch {}
   return entries;
 }
-function loadCorpus() {
+function loadCorpus2() {
   return [...loadDir(CORPUS), ...loadDir(CAPTURED_CORPUS_DIR)];
 }
 function captureFalsePositive(input) {
@@ -59821,7 +60161,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join23(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join24(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -59843,7 +60183,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join23(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join24(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -59858,7 +60198,7 @@ function detect(entry) {
   return { detected: false };
 }
 function runBenchmark() {
-  const entries = loadCorpus();
+  const entries = loadCorpus2();
   const results = entries.map((entry) => {
     const { detected, sinkKind } = detect(entry);
     const outcome = entry.vulnerable ? detected ? "tp" : "fn" : detected ? "fp" : "tn";
@@ -59912,25 +60252,25 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync25, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync12, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join24 } from "node:path";
+import { readFileSync as readFileSync26, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync13, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join25 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
-import { homedir as homedir9 } from "node:os";
-var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join24(homedir9(), ".blitzstrike");
-var OBLIGATION_PATH = join24(HOME_DIR4, "obligations.jsonl");
+import { homedir as homedir10 } from "node:os";
+var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join25(homedir10(), ".blitzstrike");
+var OBLIGATION_PATH = join25(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
-  if (!existsSync12(HOME_DIR4))
+  if (!existsSync13(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
 }
 function shortId2(claim) {
   return `obl-${createHash6("sha256").update(`${claim}\x00${Date.now()}`).digest("hex").slice(0, 12)}`;
 }
 function loadObligations() {
-  if (!existsSync12(OBLIGATION_PATH))
+  if (!existsSync13(OBLIGATION_PATH))
     return [];
   try {
     const out = [];
-    for (const line of readFileSync25(OBLIGATION_PATH, "utf8").split(`
+    for (const line of readFileSync26(OBLIGATION_PATH, "utf8").split(`
 `)) {
       const t = line.trim();
       if (!t)
@@ -60034,11 +60374,11 @@ init_framework_security();
 // src/variant-scan.ts
 init_scanner();
 init_complex_bugs();
-import { readFileSync as readFileSync27 } from "node:fs";
+import { readFileSync as readFileSync28 } from "node:fs";
 
 // src/cross-file.ts
 init_scanner();
-import { readFileSync as readFileSync26 } from "node:fs";
+import { readFileSync as readFileSync27 } from "node:fs";
 var PUBLIC_HOOK_RE = /(?:wp_ajax_nopriv_\w+|admin_post_nopriv_\w+|init|template_redirect|wp_loaded|parse_request|user_register|um_user_register|register_new_user|authenticate)/;
 var PRIV_SINK_RE = /\b(set_role|add_role|remove_role|set_user_role|wp_set_current_user|wp_set_auth_cookie|wp_insert_user|wp_create_user|wp_update_user)\s*\(/;
 var ROLE_META_RE = /update_user_meta\s*\(\s*[^,]+,\s*['"](wp_capabilities|role|roles|capabilities|wp_user_level)['"]/;
@@ -60090,7 +60430,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync26(file, "utf8"));
+      code = stripComments(readFileSync27(file, "utf8"));
     } catch {
       continue;
     }
@@ -60131,7 +60471,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync26(file, "utf8"));
+      code = stripComments(readFileSync27(file, "utf8"));
     } catch {
       continue;
     }
@@ -60154,7 +60494,7 @@ function detectCrossFilePrivesc(root) {
   for (const file of files) {
     let code;
     try {
-      code = stripComments(readFileSync26(file, "utf8"));
+      code = stripComments(readFileSync27(file, "utf8"));
     } catch {
       continue;
     }
@@ -60269,7 +60609,7 @@ function variantScan(root, opts = {}) {
   for (const file of files) {
     let code;
     try {
-      code = readFileSync27(file, "utf8");
+      code = readFileSync28(file, "utf8");
     } catch {
       continue;
     }
@@ -60933,7 +61273,7 @@ import { spawn as spawn3, execSync as execSync2 } from "node:child_process";
 import { createServer } from "node:http";
 import { randomUUID } from "node:crypto";
 import { networkInterfaces } from "node:os";
-import { existsSync as existsSync13 } from "node:fs";
+import { existsSync as existsSync14 } from "node:fs";
 var sessions = new Map;
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
@@ -60947,7 +61287,7 @@ function findInteractsh() {
   const home = process.env.HOME ?? "/root";
   const candidates = [`${home}/go/bin/interactsh-client`, "/usr/local/bin/interactsh-client", "/usr/bin/interactsh-client"];
   for (const c of candidates)
-    if (existsSync13(c))
+    if (existsSync14(c))
       return c;
   return null;
 }
@@ -61952,9 +62292,9 @@ function listPocTypes() {
 
 // src/foundry-run.ts
 import { execSync as execSync3 } from "node:child_process";
-import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, rmSync as rmSync4, existsSync as existsSync14 } from "node:fs";
+import { mkdtempSync as mkdtempSync3, mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, rmSync as rmSync4, existsSync as existsSync15 } from "node:fs";
 import { tmpdir as tmpdir4 } from "node:os";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 function findForge() {
   try {
     const p = execSync3("which forge 2>/dev/null", { encoding: "utf8", timeout: 3000 }).trim();
@@ -61964,7 +62304,7 @@ function findForge() {
   const home = process.env.HOME ?? "/root";
   const candidates = [`${home}/.foundry/bin/forge`, "/usr/local/bin/forge", "/usr/bin/forge"];
   for (const c of candidates)
-    if (existsSync14(c))
+    if (existsSync15(c))
       return c;
   return null;
 }
@@ -62003,14 +62343,14 @@ async function foundryRun(input) {
     };
   }
   const poc = input.poc_code ?? foundryPoc(input.class_ ?? "missing_access_control", name);
-  const dir = mkdtempSync3(join25(tmpdir4(), "blitzstrike-foundry-"));
+  const dir = mkdtempSync3(join26(tmpdir4(), "blitzstrike-foundry-"));
   try {
     try {
       execSync3(`${forge} init --force --no-git ${dir}`, { stdio: "ignore", timeout: 60000 });
     } catch {
-      mkdirSync9(join25(dir, "src"), { recursive: true });
-      mkdirSync9(join25(dir, "test"), { recursive: true });
-      writeFileSync8(join25(dir, "foundry.toml"), `[profile.default]
+      mkdirSync9(join26(dir, "src"), { recursive: true });
+      mkdirSync9(join26(dir, "test"), { recursive: true });
+      writeFileSync8(join26(dir, "foundry.toml"), `[profile.default]
 src = "src"
 out = "out"
 libs = ["lib"]
@@ -62020,12 +62360,12 @@ solc = "0.8.20"
     for (const f of ["Counter.sol", "Counter.t.sol", "Counter.s.sol"]) {
       for (const sub of ["src", "test", "script"]) {
         try {
-          rmSync4(join25(dir, sub, f), { force: true });
+          rmSync4(join26(dir, sub, f), { force: true });
         } catch {}
       }
     }
-    writeFileSync8(join25(dir, "src", `${name}.sol`), input.contract_code);
-    writeFileSync8(join25(dir, "test", `${name}.t.sol`), poc);
+    writeFileSync8(join26(dir, "src", `${name}.sol`), input.contract_code);
+    writeFileSync8(join26(dir, "test", `${name}.t.sol`), poc);
     const { out } = runForge(forge, dir, input.timeout_ms ?? 60000);
     const tests = parseTestResults(out);
     const anyFail = tests.some((t) => t.status === "fail");
@@ -62043,33 +62383,33 @@ solc = "0.8.20"
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync15, readFileSync as readFileSync28, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join26, resolve } from "node:path";
-import { fileURLToPath as fileURLToPath15 } from "node:url";
+import { existsSync as existsSync16, readFileSync as readFileSync29, readdirSync as readdirSync7, statSync as statSync4 } from "node:fs";
+import { join as join27, resolve } from "node:path";
+import { fileURLToPath as fileURLToPath16 } from "node:url";
 init_complex_bugs();
-var ROOT8 = resolve(fileURLToPath15(new URL(".", import.meta.url)), "..", "bench", "enterprise");
+var ROOT9 = resolve(fileURLToPath16(new URL(".", import.meta.url)), "..", "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join26(ROOT8, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join26(ROOT8, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join26(ROOT8, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join26(ROOT8, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join26(ROOT8, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join26(ROOT8, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join27(ROOT9, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join27(ROOT9, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join27(ROOT9, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join27(ROOT9, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join27(ROOT9, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join27(ROOT9, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
   const walk = (dir) => {
     let entries;
     try {
-      entries = readdirSync6(dir);
+      entries = readdirSync7(dir);
     } catch {
       return;
     }
     for (const e of entries) {
-      const p = join26(dir, e);
+      const p = join27(dir, e);
       let st;
       try {
-        st = statSync3(p);
+        st = statSync4(p);
       } catch {
         continue;
       }
@@ -62087,7 +62427,7 @@ function detectFixture(dir) {
   for (const f of sourceFiles(dir)) {
     let code;
     try {
-      code = readFileSync28(f, "utf8");
+      code = readFileSync29(f, "utf8");
     } catch {
       continue;
     }
@@ -62105,7 +62445,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync15(fx.dir)) {
+    if (!existsSync16(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -63191,7 +63531,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync30(path, "utf8");
+        src = readFileSync31(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -63272,7 +63612,7 @@ ${statusLine}` : statusLine },
     let src = code;
     if (!src && path) {
       try {
-        src = readFileSync30(path, "utf8");
+        src = readFileSync31(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "unreadable path" }) }] };
       }
@@ -63354,6 +63694,27 @@ ${statusLine}` : statusLine },
   }, async ({ hint }) => {
     return { content: [{ type: "text", text: JSON.stringify(surfaceMap(hint ?? "")) }] };
   });
+  server.registerTool("sync_cve_corpus", {
+    title: "Refresh the CVE fingerprint corpus from nuclei-templates",
+    description: "Auto-refresh the CVE watchlist corpus: run `nuclei -update-templates` (best-effort, if nuclei is installed), then reload the corpus directly from the live nuclei-templates `http/cves/**` tree. The CVE corpus is read LIVE from nuclei-templates whenever it is present on disk, so it auto-stays current after a template update; this tool forces a refresh and reports the fresh count + whether the source is live or the bundled snapshot. Call it before a large recon pass to pick up newly-disclosed CVEs.",
+    inputSchema: {}
+  }, async () => {
+    let update = "skipped (nuclei not found)";
+    try {
+      execFileSync6("nuclei", ["-update-templates"], { timeout: 120000, stdio: "pipe" });
+      update = "ok";
+    } catch {}
+    invalidateCorpusCache();
+    const corpus = loadCorpusEntries();
+    return {
+      content: [
+        {
+          type: "text",
+          text: JSON.stringify({ nuclei_update: update, source: corpusSourceIsLive() ? "live nuclei-templates" : "bundled snapshot", cve_count: corpus.length })
+        }
+      ]
+    };
+  });
   server.registerTool("auto_poc", {
     title: "Auto-PoC — generate a copy-paste-ready reproduction recipe",
     description: "Turn a finding into a concrete reproduction recipe (the 'reproducible' gate question made executable). Given a vuln class + target + endpoint + param, emit the exact request (with a MARKER), a NEGATIVE CONTROL, and the expected differential that PROVES the bug — plus a Patchstack-style title, derived severity, and the fix. Covers sql_injection, missing_authz/idor, ssrf, xss, ssti, command_injection, file_upload, mass_assignment, jwt_alg_confusion, crlf, open_redirect, xxe, prototype_pollution, deserialization, hardcoded_secret, cache_deception, cors_misconfiguration, subdomain_takeover. Pass type='list' to enumerate supported classes.",
@@ -63973,7 +64334,7 @@ ${statusLine}` : statusLine },
     description: "Route confusion (separate class from source→sink taint): detect attacker-controlled dispatch (call_user_func/forward/dispatch), dynamic method calls ($obj->$m()), dynamic include (LFI), batch/proxy forwarding without per-route auth re-check, and route matching without path normalization.",
     inputSchema: { path: string2().describe("Source file path (PHP)") }
   }, async ({ path }) => {
-    const code = readFileSync30(path, "utf8");
+    const code = readFileSync31(path, "utf8");
     const findings = detectRouteConfusion(code, path);
     return {
       content: [{
@@ -63987,7 +64348,7 @@ ${statusLine}` : statusLine },
     description: "Complex-bug detection beyond taint: deserialization→POP gadget chain (unserialize + magic method), type juggling (loose ==/!= vs hash/secret), mass assignment (extract/parse_str without a safe flag), prototype pollution (unsafe merge of request data), CRLF/header injection (user input into a header), path confusion (user input into a file path without canonicalization), SSRF (user-controlled URL with no host allowlist), XXE (user XML parsed without disabling entities), SSTI (user input into a template render with no sandbox), wrong-context sanitization (sanitize_text_field() into a SQL query), missing authorization/nonce on WordPress entry points (wp_ajax_* / admin_post_* / register_rest_route without current_user_can, nonce verification, or permission_callback), CORS misconfiguration (reflected/wildcard origin + credentials), XSS (user input into a DOM sink: innerHTML / dangerouslySetInnerHTML / document.write / .html / eval), and subdomain takeover (CNAME/AliasTarget to a claimable service).",
     inputSchema: { path: string2().describe("Source file path") }
   }, async ({ path }) => {
-    const code = readFileSync30(path, "utf8");
+    const code = readFileSync31(path, "utf8");
     const findings = detectComplexBugs(code, path);
     return {
       content: [{
@@ -64073,7 +64434,7 @@ ${statusLine}` : statusLine },
     let lang = language;
     if (path && !code) {
       try {
-        src = readFileSync30(path, "utf8");
+        src = readFileSync31(path, "utf8");
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: `cannot read ${path}` }) }] };
       }
@@ -64322,15 +64683,15 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync34, existsSync as existsSync18 } from "node:fs";
-import { join as join31 } from "node:path";
-import { fileURLToPath as fileURLToPath20 } from "node:url";
-var ROOT13 = join31(fileURLToPath20(new URL(".", import.meta.url)), "..");
+import { readFileSync as readFileSync35, existsSync as existsSync19 } from "node:fs";
+import { join as join32 } from "node:path";
+import { fileURLToPath as fileURLToPath21 } from "node:url";
+var ROOT14 = join32(fileURLToPath21(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join31(ROOT13, "package.json");
-    if (existsSync18(p))
-      return JSON.parse(readFileSync34(p, "utf8")).version ?? "1.0.0";
+    const p = join32(ROOT14, "package.json");
+    if (existsSync19(p))
+      return JSON.parse(readFileSync35(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";
 }