blitzstrike 2.4.4 → 2.4.6

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.6] — 2026-09-14
+
+### Added — chrome-devtools-mcp auto-install (npx zero-install fallback)
+
+- `drive_devtools` / `browser_devtools` now auto-fetch chrome-devtools-mcp via
+  `npx -y chrome-devtools-mcp@latest` when no global binary is present — no
+  manual `npm i -g` required. (burp-suite-mcp still can't be auto-installed:
+  it's a Java/GUI app that must be built + run manually.)
+
+## [2.4.5] — 2026-09-14
+
+### Added — responsible-disclosure header (X-HackerOne-Research)
+
+- New `H1_USERNAME` env var: when set, every outbound security-testing request
+  (STRIKE verification, live recon, active scan, advanced checks, leak-source
+  fetch) carries `X-HackerOne-Research: <username>` so targets/triagers can
+  identify the researcher.
+- `src/http.ts` central helper (`researchHeaders` / `withResearchHeaders` /
+  `h1Username`); injected across strike, live-recon, active, orchestrator, server.
+- `blitzstrike doctor` now reports the HackerOne research-header status.
+
 ## [2.4.4] — 2026-09-14
 
 ### Added — automated publishing via npm trusted publishing (OIDC)

package/README.md

@@ -347,6 +347,9 @@ Edit `chains.json` to add knowledge — never hardcode in source.
 |---|---|---|
 | `FOFA_EMAIL` | For `fofa_search` | FOFA account email |
 | `FOFA_KEY` | For `fofa_search` | FOFA API key |
+| `H1_USERNAME` | Optional | Your HackerOne username. When set, every outbound security-testing request carries `X-HackerOne-Research: <username>` so targets/triagers can identify you (responsible-disclosure convention). |
+| `BLITZSTRIKE_HOME` | Optional | Override the home directory (default `~/.blitzstrike`). |
+| `BLITZSTRIKE_DATA` | Optional | Override the data-cache directory (default `~/.blitzstrike/data`). |
 
 All other tools need no credentials.
 

package/dist/index.js

@@ -7388,6 +7388,15 @@ var init_version = __esm(() => {
   })();
 });
 
+// src/http.ts
+function researchHeaders() {
+  const u = process.env.H1_USERNAME?.trim();
+  return u ? { "X-HackerOne-Research": u } : {};
+}
+function h1Username() {
+  return process.env.H1_USERNAME?.trim() ?? "";
+}
+
 // src/catalog.ts
 import { readFileSync as readFileSync6, readdirSync as readdirSync2 } from "node:fs";
 import { join as join6 } from "node:path";
@@ -15291,7 +15300,7 @@ import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, readFileSync
 import { join as join16 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 function dirExists(p) {
   try {
     return statSync4(p).isDirectory();
@@ -15342,14 +15351,14 @@ function syncData() {
     copyDir(localTemplates, templatesPath);
     templatesSynced = true;
   }
-  const gitOk = spawnSync2("git", ["--version"]).status === 0;
+  const gitOk = spawnSync3("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
     const tmp = join16(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
-    const r = spawnSync2("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
+    const r = spawnSync3("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
-      const sparse = spawnSync2("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
+      const sparse = spawnSync3("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
           copyDir(join16(tmp, "payloads"), payloadsPath);
@@ -15370,7 +15379,7 @@ function syncData() {
   };
 }
 function copyDir(src, dst) {
-  const r = spawnSync2("cp", ["-r", src, dst], { timeout: 120000 });
+  const r = spawnSync3("cp", ["-r", src, dst], { timeout: 120000 });
   if (r.status !== 0) {
     manualCopy(src, dst);
   }
@@ -15520,9 +15529,9 @@ import { readFileSync as readFileSync22, existsSync as existsSync10, writeFileSy
 import { join as join19, dirname as dirname2 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function which(cmd) {
-  return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
+  return spawnSync4(`command -v ${cmd}`, { shell: true }).status === 0;
 }
 function installedCount() {
   const tools = loadTools();
@@ -15555,6 +15564,13 @@ function runDoctor() {
     detail: fofa ? "set" : "FOFA_EMAIL/FOFA_KEY not set",
     fix: fofa ? undefined : "export FOFA_EMAIL=... && export FOFA_KEY=... (enables fofa_search)"
   });
+  const h1 = h1Username();
+  issues.push({
+    name: "HackerOne research header",
+    status: h1 ? "ok" : "warn",
+    detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
+    fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
+  });
   const dataOk = existsSync10(join19(ROOT10, "chains.json")) && existsSync10(join19(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
@@ -31115,7 +31131,7 @@ async function httpRequest(url, method, data, headers, timeoutMs = DEFAULT_TIMEO
     const res = await fetch(url, {
       method,
       body: method === "POST" ? data : undefined,
-      headers: { "User-Agent": "blitzstrike/1.0", ...headers ?? {} },
+      headers: { "User-Agent": "blitzstrike/1.0", ...researchHeaders(), ...headers ?? {} },
       signal: controller.signal,
       redirect: "follow"
     });
@@ -31571,7 +31587,7 @@ async function browserValidate(check, target, payload) {
 }
 
 // src/devtools.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 import { homedir as homedir3 } from "node:os";
@@ -31662,11 +31678,14 @@ function findChromium() {
   }
   return null;
 }
-function chromeDevtoolsBin() {
+function chromeDevtoolsCommand() {
   for (const c of ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"]) {
     if (existsSync4(c))
       return { command: c, args: [] };
   }
+  const npx = spawnSync2("npx", ["--version"], { timeout: 8000 });
+  if (npx.error === undefined)
+    return { command: "npx", args: ["-y", "chrome-devtools-mcp@latest"] };
   return null;
 }
 function parsePageId(text) {
@@ -31674,17 +31693,12 @@ function parsePageId(text) {
   return m ? parseInt(m[1], 10) : 1;
 }
 async function driveChromeDevtools(target, timeoutMs = 25000) {
-  const bin = chromeDevtoolsBin();
+  const bin = chromeDevtoolsCommand();
   if (!bin) {
-    return { ok: false, error: "chrome-devtools-mcp not installed — run: npm install -g chrome-devtools-mcp (or npx chrome-devtools-mcp@latest)" };
+    return { ok: false, error: "chrome-devtools-mcp not available (no global binary and no npx) — install Node/npm first" };
   }
   const chrome = findChromium();
-  const args = [
-    "--headless",
-    "--isolated",
-    "--chromeArg=--no-sandbox",
-    "--chromeArg=--disable-gpu"
-  ];
+  const args = [...bin.args, "--headless", "--isolated", "--chromeArg=--no-sandbox", "--chromeArg=--disable-gpu"];
   if (chrome)
     args.push(`--executablePath=${chrome}`);
   const client = mcpClient(bin.command, args);
@@ -31940,7 +31954,6 @@ async function executeChainSteps(f, steps) {
   }
   return results;
 }
-
 // src/orchestration.ts
 var STATE_MACHINE = [
   { state: "scope_check", description: "Validate target against scope + risk policy.", recommended_tools: ["scope_check"], required_evidence: ["scope_decision"], next: ["plan"], confidence: "high" },
@@ -33161,7 +33174,7 @@ async function httpGet(url, opts = {}) {
   const controller = new AbortController;
   const t = setTimeout(() => controller.abort(), HTTP_TIMEOUT_MS);
   try {
-    const res = await fetch(url, { signal: controller.signal, redirect: opts.redirect ?? "follow" });
+    const res = await fetch(url, { signal: controller.signal, redirect: opts.redirect ?? "follow", headers: researchHeaders() });
     const body = await res.text();
     const headers = {};
     res.headers.forEach((v, k) => {
@@ -33937,7 +33950,7 @@ var PATH_PARAMS = ["file", "path", "page", "template", "lang", "include", "doc",
 var EVIL_HOST = "evil-blitz.example.com";
 async function httpGet2(u, extraHeaders) {
   try {
-    const res = await fetch(u, { redirect: "manual", headers: extraHeaders, signal: AbortSignal.timeout(1e4) });
+    const res = await fetch(u, { redirect: "manual", headers: { ...researchHeaders(), ...extraHeaders ?? {} }, signal: AbortSignal.timeout(1e4) });
     const body = await res.text();
     const h = {};
     res.headers.forEach((v, k) => {
@@ -34068,7 +34081,7 @@ async function checkCrlf(base, p) {
 async function checkHostHeader(url) {
   try {
     const u = new URL(url);
-    const res = await fetch(u, { redirect: "manual", headers: { Host: HOST_HEADER_MARKER } });
+    const res = await fetch(u, { redirect: "manual", headers: { ...researchHeaders(), Host: HOST_HEADER_MARKER } });
     const body = await res.text();
     const loc = res.headers.get("location") ?? "";
     const setCookie = res.headers.get("set-cookie") ?? "";
@@ -34081,7 +34094,7 @@ async function checkHostHeader(url) {
 async function checkJwt(url) {
   const out = [];
   try {
-    const res = await fetch(url, { redirect: "follow" });
+    const res = await fetch(url, { redirect: "follow", headers: researchHeaders() });
     const body = await res.text();
     const setCookie = res.headers.get("set-cookie") ?? "";
     const jwtRe = /eyJ[a-zA-Z0-9_-]{5,}\.eyJ[a-zA-Z0-9_-]{5,}\.[a-zA-Z0-9_-]{5,}/g;
@@ -34092,7 +34105,7 @@ async function checkJwt(url) {
       const [h, p] = token.split(".");
       const header = JSON.parse(Buffer.from(h, "base64url").toString());
       const noneToken = `${h}.${p}.`;
-      const noneRes = await fetch(url, { headers: { Authorization: `Bearer ${noneToken}` } });
+      const noneRes = await fetch(url, { headers: { ...researchHeaders(), Authorization: `Bearer ${noneToken}` } });
       if (noneRes.status !== 401 && noneRes.status !== 403) {
         out.push({ type: `alg:none accepted (${header.alg})`, token: noneToken.slice(0, 40), accepted: true });
       } else if (header.alg?.toUpperCase().startsWith("RS") || header.alg?.toUpperCase().startsWith("ES")) {
@@ -34699,7 +34712,7 @@ async function httpFetch(url, init) {
   const controller = new AbortController;
   const t = setTimeout(() => controller.abort(), TIMEOUT_MS2);
   try {
-    const res = await fetch(url, { ...init, signal: controller.signal, redirect: "follow" });
+    const res = await fetch(url, { ...init, signal: controller.signal, redirect: "follow", headers: { ...researchHeaders(), ...init?.headers ?? {} } });
     const body = await res.text();
     const headers = {};
     res.headers.forEach((v, k) => {
@@ -56300,7 +56313,7 @@ function createServer() {
     let body = text ?? "";
     if (url && !body) {
       try {
-        const r = await fetch(url, { redirect: "follow" });
+        const r = await fetch(url, { redirect: "follow", headers: researchHeaders() });
         body = await r.text();
       } catch {
         return { content: [{ type: "text", text: JSON.stringify({ error: "fetch failed", url }) }] };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.4",
+  "version": "2.4.6",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {