blitzstrike 2.4.2 → 2.4.5

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.5] — 2026-09-14
+
+### Added — responsible-disclosure header (X-HackerOne-Research)
+
+- New `H1_USERNAME` env var: when set, every outbound security-testing request
+  (STRIKE verification, live recon, active scan, advanced checks, leak-source
+  fetch) carries `X-HackerOne-Research: <username>` so targets/triagers can
+  identify the researcher.
+- `src/http.ts` central helper (`researchHeaders` / `withResearchHeaders` /
+  `h1Username`); injected across strike, live-recon, active, orchestrator, server.
+- `blitzstrike doctor` now reports the HackerOne research-header status.
+
+## [2.4.4] — 2026-09-14
+
+### Added — automated publishing via npm trusted publishing (OIDC)
+
+- New `.github/workflows/release.yml`: publishes to npm on push to `main`
+  (version-gated) using trusted publishing (OIDC) — no npm token, no 2FA.
+- Adds `--provenance` (SLSA attestation) so every release is verifiably built
+  from this repo. npm's bypass-2FA token deprecation no longer blocks releases.
+
 ## [2.4.0] — 2026-09-14
 
 ### Added — bulk tool installation (install the whole catalog at once)

package/README.md

@@ -347,6 +347,9 @@ Edit `chains.json` to add knowledge — never hardcode in source.
 |---|---|---|
 | `FOFA_EMAIL` | For `fofa_search` | FOFA account email |
 | `FOFA_KEY` | For `fofa_search` | FOFA API key |
+| `H1_USERNAME` | Optional | Your HackerOne username. When set, every outbound security-testing request carries `X-HackerOne-Research: <username>` so targets/triagers can identify you (responsible-disclosure convention). |
+| `BLITZSTRIKE_HOME` | Optional | Override the home directory (default `~/.blitzstrike`). |
+| `BLITZSTRIKE_DATA` | Optional | Override the data-cache directory (default `~/.blitzstrike/data`). |
 
 All other tools need no credentials.
 

package/ROADMAP.md

@@ -46,3 +46,10 @@ Blitz Strike is version 1.0. This is where it's headed.
 - Everything wired, nothing decorative. A feature that isn't exercised in the
   flow is removed.
 - License-safe. MIT/Apache-2.0 only for vendored data.
+
+## Release pipeline
+
+Publishing is automated via npm **trusted publishing (OIDC)** — see
+`.github/workflows/release.yml`. No npm token or 2FA is required; push to `main`
+with a bumped `package.json` version and the workflow publishes directly with
+SLSA provenance.

package/dist/index.js

@@ -7388,6 +7388,15 @@ var init_version = __esm(() => {
   })();
 });
 
+// src/http.ts
+function researchHeaders() {
+  const u = process.env.H1_USERNAME?.trim();
+  return u ? { "X-HackerOne-Research": u } : {};
+}
+function h1Username() {
+  return process.env.H1_USERNAME?.trim() ?? "";
+}
+
 // src/catalog.ts
 import { readFileSync as readFileSync6, readdirSync as readdirSync2 } from "node:fs";
 import { join as join6 } from "node:path";
@@ -15555,6 +15564,13 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
+  const h1 = h1Username();
+  issues.push({
+    name: "HackerOne research header",
+    status: h1 ? "ok" : "warn",
+    detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
+    fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
+  });
   const dataOk = existsSync10(join19(ROOT10, "chains.json")) && existsSync10(join19(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
@@ -31115,7 +31131,7 @@ async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEO
     const res = await fetch(url, {
       method,
       body: method === "POST" ? data : undefined,
-      headers: { "User-Agent": "blitzstrike/1.0", ...headers ?? {} },
+      headers: { "User-Agent": "blitzstrike/1.0", ...researchHeaders(), ...headers ?? {} },
       signal: controller.signal,
       redirect: "follow"
     });
@@ -31940,7 +31956,6 @@ async function executeChainSteps(f, steps) {
   }
   return results;
 }
-
 // src/orchestration.ts
 var STATE_MACHINE = [
   { state: "scope_check", description: "Validate target against scope + risk policy.", recommended_tools: ["scope_check"], required_evidence: ["scope_decision"], next: ["plan"], confidence: "high" },
@@ -33161,7 +33176,7 @@ async function httpGet(url, opts = {}) {
   const controller = new AbortController;
   const t = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
   try {
-    const res = await fetch(url, { signal: controller.signal, redirect: opts.redirect ?? "follow" });
+    const res = await fetch(url, { signal: controller.signal, redirect: opts.redirect ?? "follow", headers: researchHeaders() });
     const body = await res.text();
     const headers = {};
     res.headers.forEach((v, k) => {
@@ -33937,7 +33952,7 @@ var PATH_PARAMS = ["file", "path", "page", "template", "lang", "include", "doc",
 var EVIL_HOST = "evil-blitz.example.com";
 async function httpGet2(u, extraHeaders) {
   try {
-    const res = await fetch(u, { redirect: "manual", headers: extraHeaders, signal: AbortSignal.timeout(1e4) });
+    const res = await fetch(u, { redirect: "manual", headers: { ...researchHeaders(), ...extraHeaders ?? {} }, signal: AbortSignal.timeout(1e4) });
     const body = await res.text();
     const h = {};
     res.headers.forEach((v, k) => {
@@ -34068,7 +34083,7 @@ async function checkCrlf(base, p) {
 async function checkHostHeader(url) {
   try {
     const u = new URL(url);
-    const res = await fetch(u, { redirect: "manual", headers: { Host: HOST_HEADER_MARKER } });
+    const res = await fetch(u, { redirect: "manual", headers: { ...researchHeaders(), Host: HOST_HEADER_MARKER } });
     const body = await res.text();
     const loc = res.headers.get("location") ?? "";
     const setCookie = res.headers.get("set-cookie") ?? "";
@@ -34081,7 +34096,7 @@ async function checkHostHeader(url) {
 async function checkJwt(url) {
   const out = [];
   try {
-    const res = await fetch(url, { redirect: "follow" });
+    const res = await fetch(url, { redirect: "follow", headers: researchHeaders() });
     const body = await res.text();
     const setCookie = res.headers.get("set-cookie") ?? "";
     const jwtRe = /eyJ[a-zA-Z0-9_-]{5,}\.eyJ[a-zA-Z0-9_-]{5,}\.[a-zA-Z0-9_-]{5,}/g;
@@ -34092,7 +34107,7 @@ async function checkJwt(url) {
       const [h, p] = token.split(".");
       const header = JSON.parse(Buffer.from(h, "base64url").toString());
       const noneToken = `${h}.${p}.`;
-      const noneRes = await fetch(url, { headers: { Authorization: `Bearer ${noneToken}` } });
+      const noneRes = await fetch(url, { headers: { ...researchHeaders(), Authorization: `Bearer ${noneToken}` } });
       if (noneRes.status !== 401 && noneRes.status !== 403) {
         out.push({ type: `alg:none accepted (${header.alg})`, token: noneToken.slice(0, 40), accepted: true });
       } else if (header.alg?.toUpperCase().startsWith("RS") || header.alg?.toUpperCase().startsWith("ES")) {
@@ -34699,7 +34714,7 @@ async function httpFetch(url, init) {
   const controller = new AbortController;
   const t = setTimeout(() => controller.abort(), TIMEOUT_MS2);
   try {
-    const res = await fetch(url, { ...init, signal: controller.signal, redirect: "follow" });
+    const res = await fetch(url, { ...init, signal: controller.signal, redirect: "follow", headers: { ...researchHeaders(), ...init?.headers ?? {} } });
     const body = await res.text();
     const headers = {};
     res.headers.forEach((v, k) => {
@@ -56300,7 +56315,7 @@ function createServer() {
     let body = text ?? "";
     if (url && !body) {
       try {
-        const r = await fetch(url, { redirect: "follow" });
+        const r = await fetch(url, { redirect: "follow", headers: researchHeaders() });
         body = await r.text();
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "fetch failed", url }) }] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.2",
+  "version": "2.4.5",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {