blitzstrike 2.4.15 → 2.4.17

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.17] — 2026-09-14
+
+### Added — auto-provision toolchains + non-interactive installs
+
+- Preflight now AUTO-PROVISIONS missing build toolchains (go, cargo, meson, ninja)
+  instead of only warning — `install-tools` installs them via apt before the
+  mass install, so `go install` / `meson build` / `ninja` no longer fail.
+- All install commands now run with stdin closed (non-interactive) — prompts like
+  metasploit's "Overwrite? (y/N)" can no longer hang the run; `yes |` is piped
+  where an interactive confirm is required.
+
+## [2.4.16] — 2026-09-14
+
+### Added — auto-fallback install (toolchain provision + pip fallback)
+
+- `go install` / `cargo install` tools now auto-provision the missing toolchain
+  (`apt-get install golang-go` / `cargo`) before installing — no more
+  "go: not found" / "cargo: not found" failures (provisioned once per run).
+- `pip install --break-system-packages` now falls back to `pip install --user`
+  when the flag is unsupported (pip < 23.0 on older distros) — no more
+  "no such option: --break-system-packages".
+
 ## [2.4.15] — 2026-09-14
 
 ### Fixed — detection → verification loop now unmissable

package/dist/index.js

@@ -7403,6 +7403,50 @@ import { join as join6 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 import { homedir as homedir3 } from "node:os";
 import { spawnSync, spawn } from "node:child_process";
+function provisionMissingToolchains() {
+  const missing = [];
+  for (const [tc, inst] of Object.entries(TOOLCHAIN_INSTALL)) {
+    if (hasCommand(tc))
+      continue;
+    missing.push(tc);
+    spawnSync(inst, { shell: true, timeout: 300000, stdio: ["ignore", "pipe", "pipe"] });
+  }
+  return missing;
+}
+function hasCommand(cmd) {
+  return spawnSync(`command -v ${cmd}`, { shell: true, timeout: 8000 }).status === 0;
+}
+function requiredToolchain(cmd) {
+  if (/^\s*go\s+install\b/.test(cmd))
+    return "go";
+  if (/^\s*cargo\s+(install|build)\b/.test(cmd))
+    return "cargo";
+  return null;
+}
+function provisionToolchain(cmd) {
+  const tc = requiredToolchain(cmd);
+  if (!tc || hasCommand(tc) || _provisioned.has(tc))
+    return;
+  _provisioned.add(tc);
+  const inst = TOOLCHAIN_INSTALL[tc];
+  if (!inst)
+    return;
+  spawnSync(inst, { shell: true, timeout: 300000 });
+}
+function runInstallCommand(cmd, timeoutMs) {
+  provisionToolchain(cmd);
+  let r = spawnSync(cmd, { shell: true, timeout: timeoutMs, cwd: TOOLS_DIR, stdio: ["ignore", "pipe", "pipe"] });
+  let output = `${r.stdout?.toString() ?? ""}${r.stderr?.toString() ?? ""}`;
+  if (r.status !== 0 && /--break-system-packages/.test(cmd)) {
+    const alt = cmd.replace(/--break-system-packages/g, "--user");
+    const r2 = spawnSync(alt, { shell: true, timeout: timeoutMs, cwd: TOOLS_DIR, stdio: ["ignore", "pipe", "pipe"] });
+    if (r2.status === 0)
+      r = r2;
+    output = `${output}
+${r2.stdout?.toString() ?? ""}${r2.stderr?.toString() ?? ""}`;
+  }
+  return { status: r.status, output };
+}
 function loadTools() {
   if (_toolsCache)
     return _toolsCache;
@@ -7519,14 +7563,14 @@ function ensureTool(name) {
     return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
   }
   mkdirSync3(TOOLS_DIR, { recursive: true });
-  const r = spawnSync(cmd, { shell: true, timeout: 300000, cwd: TOOLS_DIR });
-  const ok = r.status === 0;
+  const { status, output } = runInstallCommand(cmd, 300000);
+  const ok = status === 0;
   return {
     name: t.name,
     installed: ok,
     action: "install",
     command: cmd,
-    output: (r.stdout?.toString() ?? "").slice(-400) || (r.stderr?.toString() ?? "").slice(-400)
+    output: output.slice(-400)
   };
 }
 function toolForHint(hint) {
@@ -7619,7 +7663,8 @@ function ensureToolAsync(name, timeoutMs = 300000) {
         return;
       }
       mkdirSync3(TOOLS_DIR, { recursive: true });
-      const inst = spawn(cmd, { shell: true, timeout: timeoutMs, cwd: TOOLS_DIR });
+      provisionToolchain(cmd);
+      const inst = spawn(cmd, { shell: true, timeout: timeoutMs, cwd: TOOLS_DIR, stdio: ["ignore", "pipe", "pipe"] });
       let out = "";
       inst.stdout?.on("data", (d) => {
         out += d.toString();
@@ -7629,7 +7674,25 @@ function ensureToolAsync(name, timeoutMs = 300000) {
       });
       inst.on("error", (e) => resolve({ name: t.name, installed: false, action: "install", error: String(e) }));
       inst.on("close", (icode) => {
-        resolve({ name: t.name, installed: icode === 0, action: "install", command: cmd, output: out.slice(-400) });
+        if (icode === 0) {
+          resolve({ name: t.name, installed: true, action: "install", command: cmd, output: out.slice(-400) });
+          return;
+        }
+        if (/--break-system-packages/.test(cmd)) {
+          const alt = cmd.replace(/--break-system-packages/g, "--user");
+          const r2 = spawn(alt, { shell: true, timeout: timeoutMs, cwd: TOOLS_DIR, stdio: ["ignore", "pipe", "pipe"] });
+          let out2 = "";
+          r2.stdout?.on("data", (d) => {
+            out2 += d.toString();
+          });
+          r2.stderr?.on("data", (d) => {
+            out2 += d.toString();
+          });
+          r2.on("error", (e) => resolve({ name: t.name, installed: false, action: "install", error: String(e) }));
+          r2.on("close", (i2) => resolve({ name: t.name, installed: i2 === 0, action: "install", command: alt, output: out2.slice(-400) }));
+          return;
+        }
+        resolve({ name: t.name, installed: false, action: "install", command: cmd, output: out.slice(-400) });
       });
     });
   });
@@ -7664,11 +7727,18 @@ async function installAllTools(opts = {}) {
     results
   };
 }
-var ROOT2, TOOLS_DIR, _toolsCache = null, _skillsCache = null;
+var ROOT2, TOOLS_DIR, TOOLCHAIN_INSTALL, _provisioned, _toolsCache = null, _skillsCache = null;
 var init_catalog = __esm(() => {
   init_manuals();
   ROOT2 = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
   TOOLS_DIR = process.env.BLITZSTRIKE_TOOLS_DIR ?? join6(homedir3(), ".blitzstrike", "tools");
+  TOOLCHAIN_INSTALL = {
+    go: "apt-get install -y golang-go",
+    cargo: "apt-get install -y cargo",
+    meson: "apt-get install -y meson",
+    ninja: "apt-get install -y ninja-build"
+  };
+  _provisioned = new Set;
 });
 
 // src/burp-mcp.ts
@@ -15995,12 +16065,9 @@ async function runInstallTools(args) {
   }
   console.log(`Installing catalog tools${category ? ` (category: ${category})` : ""} — concurrency ${concurrency}
 `);
-  const chainMap = { go: "golang", java: "default-jdk", python3: "python3", pip3: "python3-pip", cargo: "cargo", make: "build-essential", meson: "meson", ninja: "ninja-build", gcc: "build-essential", git: "git" };
-  const missingChains = Object.keys(chainMap).filter((c) => spawnSync5(`command -v ${c}`, { shell: true }).status !== 0);
-  if (missingChains.length) {
-    console.log(`⚠ Missing toolchains: ${missingChains.join(", ")} (${missingChains.map((c) => chainMap[c]).join(", ")})`);
-    console.log(`  Tools that need them will FAIL below. Install first, e.g.:
-  apt install -y ${missingChains.map((c) => chainMap[c]).join(" ")}
+  const provisioned = provisionMissingToolchains();
+  if (provisioned.length) {
+    console.log(`Provisioned missing toolchains: ${provisioned.join(", ")}
 `);
   }
   const tools = loadTools();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.15",
+  "version": "2.4.17",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/tools-catalog.json

@@ -2846,7 +2846,7 @@
         }
       ],
       "install": {
-        "linux": "curl https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb | bash",
+        "linux": "curl -sL https://raw.githubusercontent.com/rapid7/metasploit-omnibus/master/config/templates/metasploit-framework-wrappers/msfupdate.erb -o /tmp/msfinstall && chmod +x /tmp/msfinstall && yes | /tmp/msfinstall",
         "darwin": "brew install metasploit",
         "win32": "manual"
       },