blitzstrike 2.4.21 → 2.4.23

package/CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.23] — 2026-09-14
+
+### Precision — false-positive reduction + per-detector benchmark
+
+- Fixed 6 false-positive patterns in the heuristic detectors (complex-bugs +
+  route-confusion): canonicalized include (`basename`/`realpath`), whitelist
+  lookup (`$allowed[$p]`), batch-forwarding WITH an auth re-check, anchored
+  validation regex (`preg_match('/^[a-z]+$/')`), constrained SSRF (fixed
+  `scheme://` host literal), and URL literals in the path-confusion detector.
+- Extended the benchmark to measure per-detector precision/recall/F1 (taint +
+  complex_bugs + route_confusion) with 28 new labelled fixtures.
+- Corpus now at 137 cases: **precision 1.0 / recall 1.0 / F1 1.0, 0 FP, 0 FN**
+  across all three detectors.
+
+## [2.4.22] — 2026-09-14
+
+### Added — on-disk report persistence (reports/ folder)
+
+- `generate_report` now WRITES the HackerOne-grade markdown/JSON report to
+  `~/.blitzstrike/reports/<scope-slug>-<timestamp>.md` (override via
+  `BLITZSTRIKE_REPORT_DIR`) and returns the saved path — an engagement now
+  produces an on-disk deliverable, not just an in-memory string.
+- `run_engagement` / `run_autonomous` also persist their inline report to the
+  same folder (report.report.saved).
+
 ## [2.4.21] — 2026-09-14
 
 ### Security — eliminate the last shell-interpolation sites

package/bench/corpus/cb-crlf-safe.md

@@ -0,0 +1,9 @@
+- id: cb-crlf-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+header("Location: /home");
+```

package/bench/corpus/cb-crlf-vuln.md

@@ -0,0 +1,9 @@
+- id: cb-crlf-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+header("Location: " . $_GET['url']);
+```

package/bench/corpus/cb-deser-safe.md

@@ -0,0 +1,9 @@
+- id: cb-deser-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+$data = json_decode($_GET['data']);
+```

package/bench/corpus/cb-deser-vuln.md

@@ -0,0 +1,11 @@
+- id: cb-deser-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+$data = $_GET['data'];
+$obj = unserialize($data);
+class X { function __destruct() { system('id'); } }
+```

package/bench/corpus/cb-massassign-safe.md

@@ -0,0 +1,9 @@
+- id: cb-massassign-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+extract($_POST, EXTR_SKIP);
+```

package/bench/corpus/cb-massassign-vuln.md

@@ -0,0 +1,9 @@
+- id: cb-massassign-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+extract($_REQUEST);
+```

package/bench/corpus/cb-pathconf-safe.md

@@ -0,0 +1,10 @@
+- id: cb-pathconf-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+$f = basename($_GET['file']);
+echo file_get_contents($f);
+```

package/bench/corpus/cb-pathconf-vuln.md

@@ -0,0 +1,10 @@
+- id: cb-pathconf-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+$f = $_GET['file'];
+echo file_get_contents($f);
+```

package/bench/corpus/cb-proto-safe.md

@@ -0,0 +1,8 @@
+- id: cb-proto-safe
+- language: javascript
+- vulnerable: false
+- detector: complex_bugs
+
+```js
+const x = Object.assign({}, { a: 1 });
+```

package/bench/corpus/cb-proto-vuln.md

@@ -0,0 +1,8 @@
+- id: cb-proto-vuln
+- language: javascript
+- vulnerable: true
+- detector: complex_bugs
+
+```js
+const x = Object.assign({}, req.body);
+```

package/bench/corpus/cb-ssrf-safe.md

@@ -0,0 +1,9 @@
+- id: cb-ssrf-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+echo file_get_contents("https://api.example.com/" . $_GET['path']);
+```

package/bench/corpus/cb-ssrf-vuln.md

@@ -0,0 +1,10 @@
+- id: cb-ssrf-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+$url = $_GET['url'];
+echo file_get_contents($url);
+```

package/bench/corpus/cb-ssti-safe.md

@@ -0,0 +1,8 @@
+- id: cb-ssti-safe
+- language: javascript
+- vulnerable: false
+- detector: complex_bugs
+
+```js
+const html = _.template("<h1>static</h1>");
+```

package/bench/corpus/cb-ssti-vuln.md

@@ -0,0 +1,8 @@
+- id: cb-ssti-vuln
+- language: javascript
+- vulnerable: true
+- detector: complex_bugs
+
+```js
+const html = ejs.render(req.query.template);
+```

package/bench/corpus/cb-typejuggle-safe.md

@@ -0,0 +1,9 @@
+- id: cb-typejuggle-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+if ($_GET['password'] === $secret) { echo 'ok'; }
+```

package/bench/corpus/cb-typejuggle-vuln.md

@@ -0,0 +1,9 @@
+- id: cb-typejuggle-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+if ($_GET['password'] == $secret) { echo 'ok'; }
+```

package/bench/corpus/cb-xxe-safe.md

@@ -0,0 +1,11 @@
+- id: cb-xxe-safe
+- language: php
+- vulnerable: false
+- detector: complex_bugs
+
+```php
+<?php
+$xml = $_GET['xml'];
+libxml_disable_entity_loader(true);
+$doc = simplexml_load_string($xml);
+```

package/bench/corpus/cb-xxe-vuln.md

@@ -0,0 +1,10 @@
+- id: cb-xxe-vuln
+- language: php
+- vulnerable: true
+- detector: complex_bugs
+
+```php
+<?php
+$xml = $_GET['xml'];
+$doc = simplexml_load_string($xml);
+```

package/bench/corpus/rc-batch-safe.md

@@ -0,0 +1,9 @@
+- id: rc-batch-safe
+- language: php
+- vulnerable: false
+- detector: route_confusion
+
+```php
+<?php
+foreach ($requests as $r) { if (!authorize($r)) continue; handle($r); }
+```

package/bench/corpus/rc-batch-vuln.md

@@ -0,0 +1,9 @@
+- id: rc-batch-vuln
+- language: php
+- vulnerable: true
+- detector: route_confusion
+
+```php
+<?php
+foreach ($requests as $r) { forward($r); }
+```

package/bench/corpus/rc-dispatch-safe.md

@@ -0,0 +1,10 @@
+- id: rc-dispatch-safe
+- language: php
+- vulnerable: false
+- detector: route_confusion
+
+```php
+<?php
+$cb = $_GET['cb'];
+call_user_func($map[$cb]);
+```

package/bench/corpus/rc-dispatch-vuln.md

@@ -0,0 +1,9 @@
+- id: rc-dispatch-vuln
+- language: php
+- vulnerable: true
+- detector: route_confusion
+
+```php
+<?php
+call_user_func($_GET['callback']);
+```

package/bench/corpus/rc-include-safe.md

@@ -0,0 +1,10 @@
+- id: rc-include-safe
+- language: php
+- vulnerable: false
+- detector: route_confusion
+
+```php
+<?php
+$f = basename($_GET['f']);
+include($f);
+```

package/bench/corpus/rc-include-vuln.md

@@ -0,0 +1,9 @@
+- id: rc-include-vuln
+- language: php
+- vulnerable: true
+- detector: route_confusion
+
+```php
+<?php
+include($_GET['page']);
+```

package/bench/corpus/rc-method-safe.md

@@ -0,0 +1,10 @@
+- id: rc-method-safe
+- language: php
+- vulnerable: false
+- detector: route_confusion
+
+```php
+<?php
+$m = $_GET['m'];
+$obj->{$allowed[$m]}();
+```

package/bench/corpus/rc-method-vuln.md

@@ -0,0 +1,10 @@
+- id: rc-method-vuln
+- language: php
+- vulnerable: true
+- detector: route_confusion
+
+```php
+<?php
+$m = $_GET['m'];
+$obj->$m();
+```

package/bench/corpus/rc-normalize-safe.md

@@ -0,0 +1,10 @@
+- id: rc-normalize-safe
+- language: php
+- vulnerable: false
+- detector: route_confusion
+
+```php
+<?php
+$path = $_GET['p'];
+if (preg_match("/^[a-z]+$/", $path)) route($path);
+```

package/bench/corpus/rc-normalize-vuln.md

@@ -0,0 +1,10 @@
+- id: rc-normalize-vuln
+- language: php
+- vulnerable: true
+- detector: route_confusion
+
+```php
+<?php
+$path = $_GET['p'];
+if (preg_match("/^\/admin/", $path)) route($path);
+```

package/dist/index.js

@@ -15493,9 +15493,9 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join16 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { join as join17 } from "node:path";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
@@ -15511,7 +15511,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join16(d, e.name));
+          walk(join17(d, e.name));
         else
           n++;
       }
@@ -15524,9 +15524,9 @@ function countFiles(dir) {
 }
 function syncData() {
   if (!dirExists(DATA_ROOT2))
-    mkdirSync5(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join16(DATA_ROOT2, "payloads");
-  const templatesPath = join16(DATA_ROOT2, "templates");
+    mkdirSync6(DATA_ROOT2, { recursive: true });
+  const payloadsPath = join17(DATA_ROOT2, "payloads");
+  const templatesPath = join17(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -15536,8 +15536,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join16(ROOT7, "payloads");
-  const localTemplates = join16(ROOT7, "templates");
+  const localPayloads = join17(ROOT7, "payloads");
+  const localTemplates = join17(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -15550,7 +15550,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join16(DATA_ROOT2, ".tmp-clone");
+    const tmp = join17(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -15558,11 +15558,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join16(tmp, "payloads"), payloadsPath);
+          copyDir(join17(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join16(tmp, "templates"), templatesPath);
+          copyDir(join17(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -15582,20 +15582,20 @@ function copyDir(src, dst) {
   }
 }
 function manualCopy(src, dst) {
-  mkdirSync5(dst, { recursive: true });
+  mkdirSync6(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join16(src, e.name);
-    const d = join16(dst, e.name);
+    const s = join17(src, e.name);
+    const d = join17(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
-      writeFileSync6(d, readFileSync18(s));
+      writeFileSync7(d, readFileSync18(s));
   }
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join16(fileURLToPath9(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join16(homedir6(), ".blitzstrike", "data");
+  ROOT7 = join17(fileURLToPath9(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join17(homedir7(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -15641,14 +15641,14 @@ var init_update = __esm(() => {
 
 // src/release.ts
 import { readFileSync as readFileSync20, existsSync as existsSync10 } from "node:fs";
-import { join as join17 } from "node:path";
+import { join as join18 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync20(join17(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync20(join18(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -15680,22 +15680,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync10(join17(ROOT8, "package-lock.json")) || existsSync10(join17(ROOT8, "bun.lock")) || existsSync10(join17(ROOT8, "bun.lockb"));
+  return existsSync10(join18(ROOT8, "package-lock.json")) || existsSync10(join18(ROOT8, "bun.lock")) || existsSync10(join18(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join17(fileURLToPath10(new URL(".", import.meta.url)), "..");
+  ROOT8 = join18(fileURLToPath10(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
 import { readFileSync as readFileSync21 } from "node:fs";
-import { join as join18 } from "node:path";
+import { join as join19 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync21(join18(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync21(join19(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -15718,13 +15718,13 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join18(fileURLToPath11(new URL(".", import.meta.url)), "..");
+  ROOT9 = join19(fileURLToPath11(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6 } from "node:fs";
-import { join as join19, dirname as dirname2 } from "node:path";
-import { homedir as homedir7 } from "node:os";
+import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7 } from "node:fs";
+import { join as join20, dirname as dirname2 } from "node:path";
+import { homedir as homedir8 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
@@ -15768,7 +15768,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync11(join19(ROOT10, "chains.json")) && existsSync11(join19(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync11(join20(ROOT10, "chains.json")) && existsSync11(join20(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -15819,14 +15819,14 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join19(ROOT10, "src", "index.ts");
+  const src = join20(ROOT10, "src", "index.ts");
   if (which("bun") && existsSync11(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join19(ROOT10, "dist", "index.js");
+  const dist = join20(ROOT10, "dist", "index.js");
   if (existsSync11(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
@@ -15842,41 +15842,41 @@ function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
       blitzstrike: { command, args }
     };
-    writeFileSync7(p, JSON.stringify(existing, null, 2));
+    writeFileSync8(p, JSON.stringify(existing, null, 2));
   };
 }
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
       blitzstrike: { type: "local", command: [command, ...args], enabled: true }
     };
-    writeFileSync7(p, JSON.stringify(existing, null, 2));
+    writeFileSync8(p, JSON.stringify(existing, null, 2));
     copyOpenCodeAgents();
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join19(ROOT10, "opencode-agents");
-  const dstDir = join19(homedir7(), ".config", "opencode", "agents");
+  const srcDir = join20(ROOT10, "opencode-agents");
+  const dstDir = join20(homedir8(), ".config", "opencode", "agents");
   if (!existsSync11(srcDir))
     return;
   if (!existsSync11(dstDir))
-    mkdirSync6(dstDir, { recursive: true });
+    mkdirSync7(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join19(srcDir, f);
-    const dst = join19(dstDir, f);
+    const src = join20(srcDir, f);
+    const dst = join20(dstDir, f);
     if (existsSync11(src)) {
-      writeFileSync7(dst, readFileSync22(src, "utf8"));
+      writeFileSync8(dst, readFileSync22(src, "utf8"));
     }
   }
 }
@@ -15884,7 +15884,7 @@ function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
@@ -15896,14 +15896,14 @@ function codexWrite(p) {
 command = "${command}"
 args = ${JSON.stringify(args)}
 `;
-    writeFileSync7(p, existing);
+    writeFileSync8(p, existing);
   };
 }
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync6(dir, { recursive: true });
+      mkdirSync7(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
@@ -15925,80 +15925,80 @@ mcp_servers:
     args: ${JSON.stringify(args)}
 `;
     }
-    writeFileSync7(p, existing);
+    writeFileSync8(p, existing);
   };
 }
 function detectAgents() {
-  const home = homedir7();
+  const home = homedir8();
   const agents = [];
-  const claudeJson = join19(home, ".claude.json");
+  const claudeJson = join20(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
     installed: () => existsSync11(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join19(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join20(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
     installed: () => existsSync11(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join19(home, ".cursor", "mcp.json");
+  const cursor = join20(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync11(join19(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync11(join20(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join19(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join20(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync11(join19(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync11(join20(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join19(home, ".codex", "config.toml");
+  const codex = join20(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync11(join19(home, ".codex")) || which("codex"),
+    installed: () => existsSync11(join20(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join19(home, ".hermes", "config.yaml");
+  const hermes = join20(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync11(join19(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync11(join20(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join19(home, ".gemini", "settings.json");
+  const gemini = join20(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync11(join19(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync11(join20(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join19(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join20(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync11(join19(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync11(join20(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join19(home, ".copilot", "mcp.json");
+  const copilot = join20(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync11(join19(home, ".copilot")),
+    installed: () => existsSync11(join20(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join19(home, ".cline", "mcp_settings.json");
+  const cline = join20(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync11(join19(home, ".cline")),
+    installed: () => existsSync11(join20(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -16116,7 +16116,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join19(fileURLToPath12(new URL(".", import.meta.url)), "..");
+  ROOT10 = join20(fileURLToPath12(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -30838,7 +30838,7 @@ async function nvdLookup(cveId) {
 // src/orchestrator.ts
 init_scanner();
 import { readFileSync as readFileSync8, existsSync as existsSync6, statSync as statSync2 } from "node:fs";
-import { join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/memory.ts
@@ -33115,6 +33115,9 @@ function cvssAssess(input) {
 }
 
 // src/report.ts
+import { writeFileSync as writeFileSync2, mkdirSync as mkdirSync4 } from "node:fs";
+import { join as join9 } from "node:path";
+import { homedir as homedir6 } from "node:os";
 var SEVERITY_METRICS = {
   critical: { AV: "N", AC: "L", PR: "N", UI: "N", S: "U", C: "H", I: "H", A: "H" },
   high: { AV: "N", AC: "L", PR: "L", UI: "N", S: "U", C: "H", I: "H", A: "N" },
@@ -33317,6 +33320,21 @@ function reportJson(findings, opts = {}) {
   };
   return JSON.stringify(payload, null, 2);
 }
+var REPORT_DIR = process.env.BLITZSTRIKE_REPORT_DIR ?? join9(homedir6(), ".blitzstrike", "reports");
+function slugify2(s) {
+  const slug = s.toLowerCase().replace(/^https?:\/\//, "").replace(/[^a-z0-9.-]+/g, "-").replace(/^-+|-+$/g, "").replace(/\./g, "_").slice(0, 60);
+  return slug || "engagement";
+}
+function saveReport(content, opts = {}) {
+  mkdirSync4(REPORT_DIR, { recursive: true });
+  const slug = slugify2(opts.scope ?? opts.title ?? "engagement");
+  const ts = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
+  const ext = opts.format === "json" ? "json" : "md";
+  const filename = `${slug}-${ts}.${ext}`;
+  const path = join9(REPORT_DIR, filename);
+  writeFileSync2(path, content, "utf8");
+  return { path, dir: REPORT_DIR, filename };
+}
 
 // src/sarif.ts
 init_version();
@@ -33910,8 +33928,8 @@ function loadChains() {
   if (_chainsCache)
     return _chainsCache;
   try {
-    const dir = join9(fileURLToPath5(new URL(".", import.meta.url)), "..");
-    const path = join9(dir, "chains.json");
+    const dir = join10(fileURLToPath5(new URL(".", import.meta.url)), "..");
+    const path = join10(dir, "chains.json");
     const raw = JSON.parse(readFileSync8(path, "utf8"));
     _chainsCache = raw.chains ?? [];
     return _chainsCache;
@@ -34136,7 +34154,8 @@ function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000,
     summary: JSON.parse(reportJsonText).summary ?? null,
     markdown: reportMarkdownText,
     json: reportJsonText,
-    sarif: sarifDoc
+    sarif: sarifDoc,
+    saved: saveReport(reportMarkdownText, { title: reportTitle, scope: target, version: VERSION, format: "markdown" }).path
   };
   report.status = "DETECTED";
   report.note = "Detection complete — verification is the NEXT mandatory step (do not stop here). " + "Every finding is a HYPOTHESIS until verified: strike_verify (HTTP reflection, marker + negative control), " + "verify_file_read (CWE-22 / path traversal), or drive_devtools (DOM/JS precision). " + "Verify each finding NOW, then generate_report. Never deliver a report with unverified findings.";
@@ -34689,8 +34708,8 @@ var CHAIN_ID_TO_ESCALATION = {
 };
 function loadChainLinks() {
   try {
-    const dir = join9(fileURLToPath5(new URL(".", import.meta.url)), "..");
-    const data = JSON.parse(readFileSync8(join9(dir, "intelligence", "chain_links.json"), "utf8"));
+    const dir = join10(fileURLToPath5(new URL(".", import.meta.url)), "..");
+    const data = JSON.parse(readFileSync8(join10(dir, "intelligence", "chain_links.json"), "utf8"));
     return data.links ?? [];
   } catch {
     return [];
@@ -34846,14 +34865,14 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
-import { join as join10 } from "node:path";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync9, writeFileSync as writeFileSync3 } from "node:fs";
+import { join as join11 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function tasksDir() {
-  return join10(fileURLToPath6(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
+  return join11(fileURLToPath6(new URL(".", import.meta.url)), "..", ".blitzstrike", "tasks");
 }
 function taskPath(id) {
-  return join10(tasksDir(), `${id}.json`);
+  return join11(tasksDir(), `${id}.json`);
 }
 function load(id) {
   try {
@@ -34863,8 +34882,8 @@ function load(id) {
   }
 }
 function save(t) {
-  mkdirSync4(tasksDir(), { recursive: true });
-  writeFileSync2(taskPath(t.task_id), JSON.stringify(t, null, 2));
+  mkdirSync5(tasksDir(), { recursive: true });
+  writeFileSync3(taskPath(t.task_id), JSON.stringify(t, null, 2));
 }
 function taskStart(id, objective, plan) {
   const now = Date.now();
@@ -35161,8 +35180,8 @@ function engagementStatus() {
 
 // src/incremental.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { writeFileSync as writeFileSync3, mkdtempSync, rmSync } from "node:fs";
-import { join as join11 } from "node:path";
+import { writeFileSync as writeFileSync4, mkdtempSync, rmSync } from "node:fs";
+import { join as join12 } from "node:path";
 import { tmpdir } from "node:os";
 
 // src/eagle2.ts
@@ -54677,9 +54696,9 @@ function analyzeChangedFiles(repo, base = "HEAD~1", head = "HEAD") {
       continue;
     const lang = detectLanguage(file)?.language;
     if (lang === "php") {
-      const dir = mkdtempSync(join11(tmpdir(), "blitz-incr-"));
-      const tmp = join11(dir, "changed.php");
-      writeFileSync3(tmp, code);
+      const dir = mkdtempSync(join12(tmpdir(), "blitz-incr-"));
+      const tmp = join12(dir, "changed.php");
+      writeFileSync4(tmp, code);
       try {
         const r = analyzeDataFlow2(tmp);
         for (const f of r.findings)
@@ -55091,16 +55110,16 @@ function taintTree(root, maxFiles = 2000) {
 }
 
 // src/differential.ts
-import { writeFileSync as writeFileSync4, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14 } from "node:fs";
-import { join as join12 } from "node:path";
+import { writeFileSync as writeFileSync5, rmSync as rmSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync14 } from "node:fs";
+import { join as join13 } from "node:path";
 import { tmpdir as tmpdir2 } from "node:os";
 import { execFileSync as execFileSync3 } from "node:child_process";
 init_scanner();
 function runEngine(code, language, file) {
   if (language === "php") {
-    const dir = mkdtempSync2(join12(tmpdir2(), "blitz-diff-"));
-    const tmp = join12(dir, "old.php");
-    writeFileSync4(tmp, code);
+    const dir = mkdtempSync2(join13(tmpdir2(), "blitz-diff-"));
+    const tmp = join13(dir, "old.php");
+    writeFileSync5(tmp, code);
     try {
       const r = analyzeDataFlow2(tmp);
       return r.findings.map((f) => ({ sink: f.sink, sink_line: f.sink_line, category: f.category, source: f.source, cwe: f.cwe }));
@@ -55285,15 +55304,15 @@ function analyzeGitDiff(repo, base = "HEAD~1", head = "HEAD") {
 
 // src/frameworks.ts
 import { readFileSync as readFileSync15, existsSync as existsSync7 } from "node:fs";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 import { fileURLToPath as fileURLToPath7 } from "node:url";
-var ROOT4 = join13(fileURLToPath7(new URL(".", import.meta.url)), "..");
-var INTEL2 = join13(ROOT4, "intelligence");
+var ROOT4 = join14(fileURLToPath7(new URL(".", import.meta.url)), "..");
+var INTEL2 = join14(ROOT4, "intelligence");
 var cache = null;
 function load2() {
   if (cache)
     return cache;
-  const p = join13(INTEL2, "frameworks.json");
+  const p = join14(INTEL2, "frameworks.json");
   if (!existsSync7(p))
     return null;
   try {
@@ -55611,6 +55630,8 @@ var DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
 var BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
 var ROUTE_MATCH_RE = /\b(preg_match|preg_match_all|strpos|stripos|str_contains)\s*\(/i;
 var NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
+var WHITELIST_LOOKUP = /\$[A-Za-z_]\w*\s*\[\s*\$[A-Za-z_]\w*\s*\]/;
+var CANONICALIZE = /\b(basename|realpath|normalize|canonical|resolve|toRealPath)\s*\(/i;
 function detectDynamicDispatch(code, file, out) {
   const ls = lines(code);
   DYNAMIC_DISPATCH_RE.lastIndex = 0;
@@ -55622,6 +55643,8 @@ function detectDynamicDispatch(code, file, out) {
 `);
     if (!userControlled(l) && !userControlled(scope))
       continue;
+    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
+      continue;
     out.push({
       file,
       line: ln,
@@ -55644,6 +55667,8 @@ function detectDynamicMethod(code, file, out) {
 `);
     if (!userControlled(l) && !userControlled(scope))
       continue;
+    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
+      continue;
     out.push({
       file,
       line: ln,
@@ -55666,6 +55691,11 @@ function detectDynamicInclude(code, file, out) {
 `);
     if (!userControlled(l) && !userControlled(scope))
       continue;
+    if (CANONICALIZE.test(scope + `
+` + l))
+      continue;
+    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
+      continue;
     out.push({
       file,
       line: ln,
@@ -55688,14 +55718,16 @@ function detectBatchForwarding(code, file, out) {
     if (!forwards)
       continue;
     const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
+    if (rechecks)
+      continue;
     out.push({
       file,
       line: ln,
       type: "batch_forwarding",
       category: "Route confusion (batch/proxy forwarding)",
-      severity: rechecks ? "medium" : "high",
+      severity: "high",
       evidence: lines(code)[ln - 1]?.trim() ?? "",
-      detail: rechecks ? "Batch/proxy loop forwards to inner handlers — auth is re-checked in scope, but verify it applies per-route." : "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
+      detail: "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
     });
   }
 }
@@ -55711,6 +55743,8 @@ function detectRouteNormalization(code, file, out) {
       continue;
     if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
       continue;
+    if (/preg_match\s*\(\s*["'][^"']*\^[^"']*\$[^"']*["']/.test(l))
+      continue;
     out.push({
       file,
       line: i + 1,
@@ -55908,6 +55942,12 @@ function detectPathConfusion(code, file, out) {
     if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
       continue;
     if (/\b(basename|realpath|canonicalPath|getCanonicalPath|normalize|resolve|toRealPath)\s*\(/i.test(scope + `
+` + l))
+      continue;
+    if (/\$[A-Za-z_]\w*\s*\[\s*\$[A-Za-z_]\w*\s*\]/.test(scope + `
+` + l))
+      continue;
+    if (/["'][^"']*:\/\/[^"']*["']/.test(scope + `
 ` + l))
       continue;
     out.push({
@@ -55933,6 +55973,9 @@ function detectSsrF(code, file, out) {
     if (!SOURCE_TOKENS2.test(l) && !SOURCE_TOKENS2.test(scope))
       continue;
     if (/(allowlist|whitelist|in_array|preg_match|parse_url|startsWith\(["']https?|endsWith\(["']|basename|realpath|normalize)/i.test(scope + `
+` + l))
+      continue;
+    if (/["'][^"']*:\/\/[^"']*["']/.test(scope + `
 ` + l))
       continue;
     out.push({
@@ -56050,12 +56093,12 @@ function nextSteps(ctx) {
 }
 
 // src/benchmark.ts
-import { readFileSync as readFileSync16, readdirSync as readdirSync5, writeFileSync as writeFileSync5, rmSync as rmSync3 } from "node:fs";
-import { join as join14 } from "node:path";
+import { readFileSync as readFileSync16, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3 } from "node:fs";
+import { join as join15 } from "node:path";
 import { fileURLToPath as fileURLToPath8 } from "node:url";
 import { tmpdir as tmpdir3 } from "node:os";
-var ROOT5 = join14(fileURLToPath8(new URL(".", import.meta.url)), "..");
-var CORPUS = join14(ROOT5, "bench", "corpus");
+var ROOT5 = join15(fileURLToPath8(new URL(".", import.meta.url)), "..");
+var CORPUS = join15(ROOT5, "bench", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
@@ -56069,11 +56112,12 @@ function parseCorpusFile(path) {
   let language = "php";
   let vulnerable = true;
   let sinkType;
+  let detector;
   let code = "";
   let inCode = false;
   let codeLang = "";
   for (const line of lines) {
-    const m = line.match(/^\s*-\s*(id|language|vulnerable|sink_type)\s*:\s*(.+)$/i);
+    const m = line.match(/^\s*-\s*(id|language|vulnerable|sink_type|detector)\s*:\s*(.+)$/i);
     if (!inCode && m) {
       const key = m[1].toLowerCase();
       const val = m[2].trim();
@@ -56085,6 +56129,8 @@ function parseCorpusFile(path) {
         vulnerable = val === "true";
       else if (key === "sink_type")
         sinkType = val;
+      else if (key === "detector")
+        detector = val;
       continue;
     }
     const start = line.match(/^```(\w*)/);
@@ -56101,7 +56147,7 @@ function parseCorpusFile(path) {
   }
   if (!id)
     id = path.split("/").pop().replace(/\.md$/, "");
-  return { id, language: language || codeLang || "php", vulnerable, sink_type: sinkType, code: code.trim() };
+  return { id, language: language || codeLang || "php", vulnerable, sink_type: sinkType, detector, code: code.trim() };
 }
 function loadCorpus() {
   let entries = [];
@@ -56109,7 +56155,7 @@ function loadCorpus() {
     for (const f of readdirSync5(CORPUS)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join14(CORPUS, f));
+      const e = parseCorpusFile(join15(CORPUS, f));
       if (e)
         entries.push(e);
     }
@@ -56119,10 +56165,22 @@ function loadCorpus() {
   return entries;
 }
 function detect(entry) {
+  if (entry.detector === "route_confusion") {
+    const f = detectRouteConfusion(entry.code, "bench." + entry.language);
+    if (f.length > 0)
+      return { detected: true, sinkKind: f[0].type };
+    return { detected: false };
+  }
+  if (entry.detector === "complex_bugs") {
+    const f = detectComplexBugs(entry.code, "bench." + entry.language);
+    if (f.length > 0)
+      return { detected: true, sinkKind: f[0].type };
+    return { detected: false };
+  }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join14(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
-    writeFileSync5(tmp, entry.code);
+    const tmp = join15(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
     if (r.findings.length > 0)
@@ -56150,6 +56208,19 @@ function runBenchmark() {
   const detectionRate = tp + fn > 0 ? tp / (tp + fn) : 0;
   const falsePositiveRate = fp + tn > 0 ? fp / (fp + tn) : 0;
   const precision = tp + fp > 0 ? tp / (tp + fp) : 0;
+  const byDetector = {};
+  for (const r of results) {
+    const d = r.entry.detector ?? "taint";
+    byDetector[d] = byDetector[d] ?? { tp: 0, tn: 0, fp: 0, fn: 0, total: 0 };
+    byDetector[d][r.outcome] += 1;
+    byDetector[d].total += 1;
+  }
+  const detectorMetrics = Object.fromEntries(Object.entries(byDetector).map(([d, m]) => {
+    const p = m.tp + m.fp > 0 ? m.tp / (m.tp + m.fp) : 0;
+    const rec = m.tp + m.fn > 0 ? m.tp / (m.tp + m.fn) : 0;
+    const f1 = p + rec > 0 ? 2 * p * rec / (p + rec) : 0;
+    return [d, { ...m, precision: Number(p.toFixed(3)), recall: Number(rec.toFixed(3)), f1: Number(f1.toFixed(3)) }];
+  }));
   return {
     total_cases: total,
     tp,
@@ -56159,21 +56230,22 @@ function runBenchmark() {
     detection_rate: Number(detectionRate.toFixed(3)),
     false_positive_rate: Number(falsePositiveRate.toFixed(3)),
     precision: Number(precision.toFixed(3)),
-    results: results.map((r) => ({ id: r.entry.id, language: r.entry.language, outcome: r.outcome, sink: r.sink_kind }))
+    by_detector: detectorMetrics,
+    results: results.map((r) => ({ id: r.entry.id, language: r.entry.language, detector: r.entry.detector ?? "taint", outcome: r.outcome, sink: r.sink_kind }))
   };
 }
 
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync9, readFileSync as readFileSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join15, resolve } from "node:path";
+import { join as join16, resolve } from "node:path";
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join15(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join15(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join15(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join15(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join15(ROOT6, "wp-batch-route"), expected_vulns: 1 },
-  { id: "php-complex", dir: join15(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join16(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join16(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join16(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join16(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join16(ROOT6, "wp-batch-route"), expected_vulns: 1 },
+  { id: "php-complex", dir: join16(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -56185,7 +56257,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join15(dir, e);
+      const p = join16(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -57788,9 +57860,13 @@ ${statusLine}` : statusLine },
     } catch {
       return { content: [{ type: "text", text: JSON.stringify({ error: "invalid JSON" }) }] };
     }
+    const fmt = format ?? "markdown";
     const opts = { title, scope, version: VERSION };
-    const out = (format ?? "markdown") === "json" ? reportJson(list, opts) : reportMarkdown(list, opts);
-    return { content: [{ type: "text", text: out }] };
+    const out = fmt === "json" ? reportJson(list, opts) : reportMarkdown(list, opts);
+    const saved = saveReport(out, { title, scope, version: VERSION, format: fmt });
+    return { content: [{ type: "text", text: `Report saved to: ${saved.path}
+
+${out}` }] };
   });
   server.registerTool("run_benchmark", {
     title: "Run the benchmark suite",
@@ -57832,12 +57908,12 @@ async function serve() {
 // src/index.ts
 init_cli();
 import { readFileSync as readFileSync23, existsSync as existsSync12 } from "node:fs";
-import { join as join20 } from "node:path";
+import { join as join21 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
-var ROOT11 = join20(fileURLToPath13(new URL(".", import.meta.url)), "..");
+var ROOT11 = join21(fileURLToPath13(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join20(ROOT11, "package.json");
+    const p = join21(ROOT11, "package.json");
     if (existsSync12(p))
       return JSON.parse(readFileSync23(p, "utf8")).version ?? "1.0.0";
   } catch {}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.21",
+  "version": "2.4.23",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {