blitzstrike 2.4.12 → 2.4.14

package/CHANGELOG.md

@@ -5,6 +5,23 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.14] — 2026-09-14
+
+### Added — mandatory devtools-MCP precision directive
+
+- System prompt now mandates: when a lead needs DOM/JS precision (DOM-XSS sink
+  execution, AJAX interception, JS runtime errors, redirect chains, SSO/token
+  flow), the LLM MUST call `drive_devtools` (spawns chrome-devtools-mcp + drives
+  a real headless browser) instead of eyeballing static HTML — the precision +
+  consistency layer. Includes a `check_mcp` preflight step.
+
+## [2.4.13] — 2026-09-14
+
+### Improved — live install progress
+
+- `install-tools` streams a real-time `[done/total]` counter per tool completion,
+  so a long bulk install is visibly progressing instead of appearing stuck.
+
 ## [2.4.12] — 2026-09-14
 
 ### Improved — install-tools failure diagnostics

package/dist/index.js

@@ -16003,7 +16003,19 @@ async function runInstallTools(args) {
   apt install -y ${missingChains.map((c) => chainMap[c]).join(" ")}
 `);
   }
-  const r = await installAllTools({ category, concurrency, onProgress: (name, ok) => console.log(`  ${ok ? "OK  " : "FAIL"} ${name}`) });
+  const tools = loadTools();
+  const totalTargets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!category || t.category === category.toLowerCase())).length;
+  let done = 0;
+  const r = await installAllTools({
+    category,
+    concurrency,
+    onProgress: (name, ok) => {
+      done += 1;
+      const bar = `[${String(done).padStart(3)}/${String(totalTargets).padStart(3)}]`;
+      process.stdout.write(`  ${bar} ${ok ? "OK  " : "FAIL"} ${name}
+`);
+    }
+  });
   console.log(`
 Summary: ${r.target_count} targets · ${r.installed} newly installed · ${r.already_installed} already present · ${r.failed} failed`);
   const mcp = r.skipped_mcp_servers;
@@ -16019,7 +16031,7 @@ Failed (${failedList.length}) — reason per tool:`);
       console.log(`  - ${f.name}: ${reason}`);
     }
     console.log(`
-Common causes: missing Go/Java/Rust toolchain, build tools (meson/ninja/make), pip/git network failures, or heavy builds that exceed the 120s per-tool budget. Re-run after installing the missing toolchain; failed tools are skipped, not fatal.`);
+Common causes: missing toolchain, pip/git network failures, or very heavy builds. ` + `Re-run after installing the missing toolchain — failed tools are skipped, not fatal.`);
   }
 }
 var ROOT10;
@@ -56313,6 +56325,9 @@ function createServer() {
 
 ` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + `DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.
 ` + `KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these.
+` + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
+` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
   });
   server.registerTool("blitz_scan", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.12",
+  "version": "2.4.14",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {