blitzstrike 2.4.5 → 2.4.6

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.6] — 2026-09-14
+
+### Added — chrome-devtools-mcp auto-install (npx zero-install fallback)
+
+- `drive_devtools` / `browser_devtools` now auto-fetch chrome-devtools-mcp via
+  `npx -y chrome-devtools-mcp@latest` when no global binary is present — no
+  manual `npm i -g` required. (burp-suite-mcp still can't be auto-installed:
+  it's a Java/GUI app that must be built + run manually.)
+
 ## [2.4.5] — 2026-09-14
 
 ### Added — responsible-disclosure header (X-HackerOne-Research)

package/dist/index.js

@@ -15300,7 +15300,7 @@ import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, readFileSync
 import { join as join16 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
-import { spawnSync as spawnSync2 } from "node:child_process";
+import { spawnSync as spawnSync3 } from "node:child_process";
 function dirExists(p) {
   try {
     return statSync4(p).isDirectory();
@@ -15351,14 +15351,14 @@ function syncData() {
     copyDir(localTemplates, templatesPath);
     templatesSynced = true;
   }
-  const gitOk = spawnSync2("git", ["--version"]).status === 0;
+  const gitOk = spawnSync3("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
     const tmp = join16(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
-    const r = spawnSync2("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
+    const r = spawnSync3("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
     if (r.status === 0) {
-      const sparse = spawnSync2("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
+      const sparse = spawnSync3("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
           copyDir(join16(tmp, "payloads"), payloadsPath);
@@ -15379,7 +15379,7 @@ function syncData() {
   };
 }
 function copyDir(src, dst) {
-  const r = spawnSync2("cp", ["-r", src, dst], { timeout: 120000 });
+  const r = spawnSync3("cp", ["-r", src, dst], { timeout: 120000 });
   if (r.status !== 0) {
     manualCopy(src, dst);
   }
@@ -15529,9 +15529,9 @@ import { readFileSync as readFileSync22, existsSync as existsSync10, writeFileSy
 import { join as join19, dirname as dirname2 } from "node:path";
 import { homedir as homedir6 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 function which(cmd) {
-  return spawnSync3(`command -v ${cmd}`, { shell: true }).status === 0;
+  return spawnSync4(`command -v ${cmd}`, { shell: true }).status === 0;
 }
 function installedCount() {
   const tools = loadTools();
@@ -31587,7 +31587,7 @@ async function browserValidate(check, target, payload) {
 }
 
 // src/devtools.ts
-import { spawn as spawn2 } from "node:child_process";
+import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
 import { join as join7 } from "node:path";
 import { homedir as homedir3 } from "node:os";
@@ -31678,11 +31678,14 @@ function findChromium() {
   }
   return null;
 }
-function chromeDevtoolsBin() {
+function chromeDevtoolsCommand() {
   for (const c of ["/usr/bin/chrome-devtools-mcp", "/usr/local/bin/chrome-devtools-mcp"]) {
     if (existsSync4(c))
       return { command: c, args: [] };
   }
+  const npx = spawnSync2("npx", ["--version"], { timeout: 8000 });
+  if (npx.error === undefined)
+    return { command: "npx", args: ["-y", "chrome-devtools-mcp@latest"] };
   return null;
 }
 function parsePageId(text) {
@@ -31690,17 +31693,12 @@ function parsePageId(text) {
   return m ? parseInt(m[1], 10) : 1;
 }
 async function driveChromeDevtools(target, timeoutMs = 25000) {
-  const bin = chromeDevtoolsBin();
+  const bin = chromeDevtoolsCommand();
   if (!bin) {
-    return { ok: false, error: "chrome-devtools-mcp not installed — run: npm install -g chrome-devtools-mcp (or npx chrome-devtools-mcp@latest)" };
+    return { ok: false, error: "chrome-devtools-mcp not available (no global binary and no npx) — install Node/npm first" };
   }
   const chrome = findChromium();
-  const args = [
-    "--headless",
-    "--isolated",
-    "--chromeArg=--no-sandbox",
-    "--chromeArg=--disable-gpu"
-  ];
+  const args = [...bin.args, "--headless", "--isolated", "--chromeArg=--no-sandbox", "--chromeArg=--disable-gpu"];
   if (chrome)
     args.push(`--executablePath=${chrome}`);
   const client = mcpClient(bin.command, args);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.5",
+  "version": "2.4.6",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {