blitzstrike 2.4.21 → 2.4.22

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.22] — 2026-09-14
+
+### Added — on-disk report persistence (reports/ folder)
+
+- `generate_report` now WRITES the HackerOne-grade markdown/JSON report to
+  `~/.blitzstrike/reports/<scope-slug>-<timestamp>.md` (override via
+  `BLITZSTRIKE_REPORT_DIR`) and returns the saved path — an engagement now
+  produces an on-disk deliverable, not just an in-memory string.
+- `run_engagement` / `run_autonomous` also persist their inline report to the
+  same folder (report.report.saved).
+
 ## [2.4.21] — 2026-09-14
 
 ### Security — eliminate the last shell-interpolation sites

package/dist/index.js

@@ -15493,9 +15493,9 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join16 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { join as join17 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
@@ -15511,7 +15511,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join16(d, e.name));
+          walk(join17(d, e.name));
         else
           n++;
       }
@@ -15524,9 +15524,9 @@ function countFiles(dir) {
 }
 function syncData() {
   if (!dirExists(DATA_ROOT2))
-    mkdirSync5(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join16(DATA_ROOT2, "payloads");
-  const templatesPath = join16(DATA_ROOT2, "templates");
+    mkdirSync6(DATA_ROOT2, { recursive: true });
+  const payloadsPath = join17(DATA_ROOT2, "payloads");
+  const templatesPath = join17(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -15536,8 +15536,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join16(ROOT7, "payloads");
-  const localTemplates = join16(ROOT7, "templates");
+  const localPayloads = join17(ROOT7, "payloads");
+  const localTemplates = join17(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -15550,7 +15550,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join16(DATA_ROOT2, ".tmp-clone");
+    const tmp = join17(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -15558,11 +15558,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join16(tmp, "payloads"), payloadsPath);
+          copyDir(join17(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join16(tmp, "templates"), templatesPath);
+          copyDir(join17(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -15582,20 +15582,20 @@ function copyDir(src, dst) {
   }
 }
 function manualCopy(src, dst) {
-  mkdirSync5(dst, { recursive: true });
+  mkdirSync6(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join16(src, e.name);
-    const d = join16(dst, e.name);
+    const s = join17(src, e.name);
+    const d = join17(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync6(d, readFileSync18(s));
+      writeFileSync7(d, readFileSync18(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join16(fileURLToPath9(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join16(homedir6(), ".blitzstrike", "data");
+  ROOT7 = join17(fileURLToPath9(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join17(homedir7(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -15641,14 +15641,14 @@ var init_update = __esm(() => {
 
 // src/release.ts
 import { readFileSync as readFileSync20, existsSync as existsSync10 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync20(join17(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync20(join18(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -15680,22 +15680,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync10(join17(ROOT8, "package-lock.json")) || existsSync10(join17(ROOT8, "bun.lock")) || existsSync10(join17(ROOT8, "bun.lockb"));
+  return existsSync10(join18(ROOT8, "package-lock.json")) || existsSync10(join18(ROOT8, "bun.lock")) || existsSync10(join18(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join17(fileURLToPath10(new URL(".", import.meta.url)), "..");
+  ROOT8 = join18(fileURLToPath10(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
 import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync21(join18(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync21(join19(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -15718,13 +15718,13 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join18(fileURLToPath11(new URL(".", import.meta.url)), "..");
+  ROOT9 = join19(fileURLToPath11(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join19, dirname as dirname2 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join20, dirname as dirname2 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
@@ -15768,7 +15768,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync11(join19(ROOT10, "chains.json")) && existsSync11(join19(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync11(join20(ROOT10, "chains.json")) && existsSync11(join20(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -15819,14 +15819,14 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join19(ROOT10, "src", "index.ts");
+  const src = join20(ROOT10, "src", "index.ts");
   if (which("bun") && existsSync11(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join19(ROOT10, "dist", "index.js");
+  const dist = join20(ROOT10, "dist", "index.js");
   if (existsSync11(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
@@ -15842,41 +15842,41 @@ function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
       blitzstrike: { command, args }
     };
-    writeFileSync7(p, JSON.stringify(existing, null, 2));
+    writeFileSync8(p, JSON.stringify(existing, null, 2));
   };
 }
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
       blitzstrike: { type: "local", command: [command, ...args], enabled: true }
     };
-    writeFileSync7(p, JSON.stringify(existing, null, 2));
+    writeFileSync8(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join19(ROOT10, "opencode-agents");
-  const dstDir = join19(homedir7(), ".config", "opencode", "agents");
+  const srcDir = join20(ROOT10, "opencode-agents");
+  const dstDir = join20(homedir8(), ".config", "opencode", "agents");
   if (!existsSync11(srcDir))
     return;
   if (!existsSync11(dstDir))
-    mkdirSync6(dstDir, { recursive: true });
+    mkdirSync7(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join19(srcDir, f);
-    const dst = join19(dstDir, f);
+    const src = join20(srcDir, f);
+    const dst = join20(dstDir, f);
     if (existsSync11(src)) {
-      writeFileSync7(dst, readFileSync22(src, "utf8"));
+      writeFileSync8(dst, readFileSync22(src, "utf8"));
     }
   }
 }
@@ -15884,7 +15884,7 @@ function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
@@ -15896,14 +15896,14 @@ function codexWrite(p) {
 command = "${command}"
 args = ${JSON.stringify(args)}
 `;
-    writeFileSync7(p, existing);
+    writeFileSync8(p, existing);
   };
 }
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
@@ -15925,80 +15925,80 @@ mcp_servers:
     args: ${JSON.stringify(args)}
 `;
     }
-    writeFileSync7(p, existing);
+    writeFileSync8(p, existing);
   };
 }
 function detectAgents() {
-  const home = homedir7();
+  const home = homedir8();
   const agents = [];
-  const claudeJson = join19(home, ".claude.json");
+  const claudeJson = join20(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync11(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join19(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join20(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync11(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join19(home, ".cursor", "mcp.json");
+  const cursor = join20(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync11(join19(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync11(join20(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join19(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join20(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync11(join19(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync11(join20(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join19(home, ".codex", "config.toml");
+  const codex = join20(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync11(join19(home, ".codex")) || which("codex"),
+    installed: () => existsSync11(join20(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join19(home, ".hermes", "config.yaml");
+  const hermes = join20(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync11(join19(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync11(join20(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join19(home, ".gemini", "settings.json");
+  const gemini = join20(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync11(join19(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync11(join20(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join19(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join20(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync11(join19(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync11(join20(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join19(home, ".copilot", "mcp.json");
+  const copilot = join20(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync11(join19(home, ".copilot")),
+    installed: () => existsSync11(join20(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join19(home, ".cline", "mcp_settings.json");
+  const cline = join20(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync11(join19(home, ".cline")),
+    installed: () => existsSync11(join20(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -16116,7 +16116,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join19(fileURLToPath12(new URL(".", import.meta.url)), "..");
+  ROOT10 = join20(fileURLToPath12(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -30838,7 +30838,7 @@ async function nvdLookup(cveId) {
 // src/orchestrator.ts
 init_scanner();
 import { readFileSync as readFileSync8, existsSync as existsSync6, statSync as statSync2 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/memory.ts
@@ -33115,6 +33115,9 @@ function cvssAssess(input) {
 }
 
 // src/report.ts
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join9 } from "node:path";
+import { homedir as homedir6 } from "node:os";
 var SEVERITY_METRICS = {
   critical: { AV: "N", AC: "L", PR: "N", UI: "N", S: "U", C: "H", I: "H", A: "H" },
   high: { AV: "N", AC: "L", PR: "L", UI: "N", S: "U", C: "H", I: "H", A: "N" },
@@ -33317,6 +33320,21 @@ function reportJson(findings, opts = {}) {
   };
   return JSON.stringify(payload, null, 2);
 }
+var REPORT_DIR = process.env.BLITZSTRIKE_REPORT_DIR ?? join9(homedir6(), ".blitzstrike", "reports");
+function slugify2(s) {
+  const slug = s.toLowerCase().replace(/^https?:\/\//, "").replace(/[^a-z0-9.-]+/g, "-").replace(/^-+|-+$/g, "").replace(/\./g, "_").slice(0, 60);
+  return slug || "engagement";
+}
+function saveReport(content, opts = {}) {
+  mkdirSync4(REPORT_DIR, { recursive: true });
+  const slug = slugify2(opts.scope ?? opts.title ?? "engagement");
+  const ts = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  const ext = opts.format === "json" ? "json" : "md";
+  const filename = `${slug}-${ts}.${ext}`;
+  const path = join9(REPORT_DIR, filename);
+  writeFileSync2(path, content, "utf8");
+  return { path, dir: REPORT_DIR, filename };
+}
 
 // src/sarif.ts
 init_version();
@@ -33910,8 +33928,8 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join9(fileURLToPath5(new URL(".", import.meta.url)), "..");
-    const path = join9(dir, "chains.json");
+    const dir = join10(fileURLToPath5(new URL(".", import.meta.url)), "..");
+    const path = join10(dir, "chains.json");
     const raw = JSON.parse(readFileSync8(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
@@ -34136,7 +34154,8 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
     summary: JSON.parse(reportJsonText).summary ?? null,
     markdown: reportMarkdownText,
     json: reportJsonText,
-    sarif: sarifDoc
+    sarif: sarifDoc,
+    saved: saveReport(reportMarkdownText, { title: reportTitle, scope: target, version: VERSION, format: "markdown" }).path
   };
   report.status = "DETECTED";
   report.note = "Detection complete — verification is the NEXT mandatory step (do not stop here). " + "Every finding is a HYPOTHESIS until verified: strike_verify (HTTP reflection, marker + negative control), " + "verify_file_read (CWE-22 / path traversal), or drive_devtools (DOM/JS precision). " + "Verify each finding NOW, then generate_report. Never deliver a report with unverified findings.";
@@ -34689,8 +34708,8 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join9(fileURLToPath5(new URL(".", import.meta.url)), "..");
-    const data = JSON.parse(readFileSync8(join9(dir, "intelligence", "chain_links.json"), "utf8"));
+    const dir = join10(fileURLToPath5(new URL(".", import.meta.url)), "..");
+    const data = JSON.parse(readFileSync8(join10(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
     return [];
@@ -34846,14 +34865,14 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function tasksDir() {
-  return join10(fileURLToPath6(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join11(fileURLToPath6(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
-  return join10(tasksDir(), `${id}.json`);
+  return join11(tasksDir(), `${id}.json`);
 }
 function load(id) {
   try {
@@ -34863,8 +34882,8 @@ function load(id) {
   }
 }
 function save(t) {
-  mkdirSync4(tasksDir(), { recursive: true });
-  writeFileSync2(taskPath(t.task_id), JSON.stringify(t, null, 2));
+  mkdirSync5(tasksDir(), { recursive: true });
+  writeFileSync3(taskPath(t.task_id), JSON.stringify(t, null, 2));
 }
 function taskStart(id, objective, plan) {
   const now = Date.now();
@@ -35161,8 +35180,8 @@ function engagementStatus() {
 
 // src/incremental.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { writeFileSync as writeFileSync3, mkdtempSync, rmSync } from "node:fs";
-import { join as join11 } from "node:path";
+import { writeFileSync as writeFileSync4, mkdtempSync, rmSync } from "node:fs";
+import { join as join12 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/eagle2.ts
@@ -54677,9 +54696,9 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
       continue;
     const lang = detectLanguage(file)?.language;
     if (lang === "php") {
-      const dir = mkdtempSync(join11(tmpdir(), "blitz-incr-"));
-      const tmp = join11(dir, "changed.php");
-      writeFileSync3(tmp, code);
+      const dir = mkdtempSync(join12(tmpdir(), "blitz-incr-"));
+      const tmp = join12(dir, "changed.php");
+      writeFileSync4(tmp, code);
       try {
         const r = analyzeDataFlow2(tmp);
         for (const f of r.findings)
@@ -55091,16 +55110,16 @@ function taintTree(root, maxFiles = 2000) {
 }
 
 // src/differential.ts
-import { writeFileSync as writeFileSync4, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14 } from "node:fs";
-import { join as join12 } from "node:path";
+import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14 } from "node:fs";
+import { join as join13 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 import { execFileSync as execFileSync3 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync2(join12(tmpdir2(), "blitz-diff-"));
-    const tmp = join12(dir, "old.php");
-    writeFileSync4(tmp, code);
+    const dir = mkdtempSync2(join13(tmpdir2(), "blitz-diff-"));
+    const tmp = join13(dir, "old.php");
+    writeFileSync5(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
       return r.findings.map((f) => ({ sink: f.sink, sink_line: f.sink_line, category: f.category, source: f.source, cwe: f.cwe }));
@@ -55285,15 +55304,15 @@ function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
 
 // src/frameworks.ts
 import { readFileSync as readFileSync15, existsSync as existsSync7 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
-var ROOT4 = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
-var INTEL2 = join13(ROOT4, "intelligence");
+var ROOT4 = join14(fileURLToPath7(new URL(".", import.meta.url)), "..");
+var INTEL2 = join14(ROOT4, "intelligence");
 var cache = null;
 function load2() {
   if (cache)
     return cache;
-  const p = join13(INTEL2, "frameworks.json");
+  const p = join14(INTEL2, "frameworks.json");
   if (!existsSync7(p))
     return null;
   try {
@@ -56050,12 +56069,12 @@ function nextSteps(ctx) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync16, readdirSync as readdirSync5, writeFileSync as writeFileSync5, rmSync as rmSync3 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readFileSync as readFileSync16, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3 } from "node:fs";
+import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { tmpdir as tmpdir3 } from "node:os";
-var ROOT5 = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
-var CORPUS = join14(ROOT5, "bench", "corpus");
+var ROOT5 = join15(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var CORPUS = join15(ROOT5, "bench", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
@@ -56109,7 +56128,7 @@ function loadCorpus() {
     for (const f of readdirSync5(CORPUS)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join14(CORPUS, f));
+      const e = parseCorpusFile(join15(CORPUS, f));
       if (e)
         entries.push(e);
     }
@@ -56121,8 +56140,8 @@ function loadCorpus() {
 function detect(entry) {
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join14(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
-    writeFileSync5(tmp, entry.code);
+    const tmp = join15(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
     if (r.findings.length > 0)
@@ -56165,15 +56184,15 @@ function runBenchmark() {
 
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync9, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join15, resolve } from "node:path";
+import { join as join16, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join15(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join15(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join15(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join15(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join15(ROOT6, "wp-batch-route"), expected_vulns: 1 },
-  { id: "php-complex", dir: join15(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join16(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join16(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join16(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join16(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join16(ROOT6, "wp-batch-route"), expected_vulns: 1 },
+  { id: "php-complex", dir: join16(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -56185,7 +56204,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join15(dir, e);
+      const p = join16(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -57788,9 +57807,13 @@ ${statusLine}` : statusLine },
     } catch {
       return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
     }
+    const fmt = format ?? "markdown";
     const opts = { title, scope, version: VERSION };
-    const out = (format ?? "markdown") === "json" ? reportJson(list, opts) : reportMarkdown(list, opts);
-    return { content: [{ type: "text", text: out }] };
+    const out = fmt === "json" ? reportJson(list, opts) : reportMarkdown(list, opts);
+    const saved = saveReport(out, { title, scope, version: VERSION, format: fmt });
+    return { content: [{ type: "text", text: `Report saved to: ${saved.path}
+
+${out}` }] };
   });
   server.registerTool("run_benchmark", {
     title: "Run the benchmark suite",
@@ -57832,12 +57855,12 @@ async function serve() {
 // src/index.ts
 init_cli();
 import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
-var ROOT11 = join20(fileURLToPath13(new URL(".", import.meta.url)), "..");
+var ROOT11 = join21(fileURLToPath13(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join20(ROOT11, "package.json");
+    const p = join21(ROOT11, "package.json");
     if (existsSync12(p))
       return JSON.parse(readFileSync23(p, "utf8")).version ?? "1.0.0";
   } catch {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.21",
+  "version": "2.4.22",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {