blitzstrike 2.4.59 → 2.4.61

package/dist/index.js

@@ -7385,6 +7385,69 @@ var init_version = __esm(() => {
   })();
 });
 
+// src/secrets.ts
+function shannonEntropy(s) {
+  if (!s)
+    return 0;
+  const freq = new Map;
+  for (const c of s)
+    freq.set(c, (freq.get(c) ?? 0) + 1);
+  let e = 0;
+  for (const n of freq.values()) {
+    const p = n / s.length;
+    e -= p * Math.log2(p);
+  }
+  return e;
+}
+function redactSecrets(text) {
+  let out = text;
+  for (const [re, repl] of REDACTION_PATTERNS) {
+    out = out.replace(re, repl);
+  }
+  return out;
+}
+var SECRET_FIELDS = "api[_-]?key|apikey|api[_-]?secret|access[_-]?key|access[_-]?token|secret[_-]?key|secret[_-]?access[_-]?key|auth[_-]?token|client[_-]?secret|consumer[_-]?secret|consumer[_-]?key|private[_-]?key|db[_-]?password|database[_-]?password|db[_-]?pass|passwd|password|jwt[_-]?secret|encryption[_-]?key|encryption[_-]?password|github[_-]?token|gitlab[_-]?token|stripe[_-]?key|sendgrid[_-]?api[_-]?key|datadog[_-]?api[_-]?key|cloudflare[_-]?api[_-]?key|slack[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|bot[_-]?token", SECRET_FORMATS, REDACTION_PATTERNS;
+var init_secrets = __esm(() => {
+  SECRET_FORMATS = [
+    { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
+    { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/g },
+    { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g },
+    { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
+    { name: "OpenAI/Stripe key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
+    { name: "Stripe live/test key", re: /\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g },
+    { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
+    { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+    { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g },
+    { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g },
+    { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g },
+    { name: "PEM private key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g }
+  ];
+  REDACTION_PATTERNS = [
+    [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
+    [/(api[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
+    [/(access[_-]?token\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
+    [/(secret\s*[:=]\s*)["']?[A-Za-z0-9._/-]{16,}["']?/gi, "$1[REDACTED]"],
+    [/(password\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
+    [/(passwd\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
+    [/(private[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9+/=_-]{16,}["']?/gi, "$1[REDACTED]"],
+    [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
+    [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
+    [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
+    [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
+    [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
+    [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
+    [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
+    [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
+    [/\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g, "[REDACTED]"],
+    [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED]"],
+    [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED]"],
+    [/\bAC[0-9a-f]{32}\b/g, "[REDACTED]"],
+    [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]"],
+    [/\bkey-[0-9a-zA-Z]{32}\b/g, "[REDACTED]"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
+  ];
+});
+
 // src/http.ts
 function researchHeaders() {
   const u = process.env.H1_USERNAME?.trim();
@@ -15489,256 +15552,1451 @@ async function checkMcpServers() {
 }
 var init_mcp_status = () => {};
 
-// src/sync.ts
-import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync24, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join21 } from "node:path";
-import { homedir as homedir10 } from "node:os";
-import { fileURLToPath as fileURLToPath11 } from "node:url";
-import { spawnSync as spawnSync4 } from "node:child_process";
-function dirExists(p) {
-  try {
-    return statSync4(p).isDirectory();
-  } catch {
-    return false;
-  }
-}
-function countFiles(dir) {
-  try {
-    let n = 0;
-    const walk = (d) => {
-      for (const e of readdirSync7(d, { withFileTypes: true })) {
-        if (e.isDirectory())
-          walk(join21(d, e.name));
-        else
-          n++;
+// src/security-state.ts
+function analyzeSecurityState(input) {
+  let state = "tainted";
+  let context = null;
+  for (const fn of input.sanitizers) {
+    const s = SANITIZERS2[fn];
+    if (!s)
+      continue;
+    if (s.level === "validated") {
+      if (state === "tainted" || state === "sanitized") {
+        state = "validated";
+        context = s.context;
       }
-    };
-    walk(dir);
-    return n;
-  } catch {
-    return 0;
+    } else if (state === "tainted") {
+      state = "sanitized";
+      context = s.context;
+    }
   }
-}
-function syncData() {
-  if (!dirExists(DATA_ROOT2))
-    mkdirSync9(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join21(DATA_ROOT2, "payloads");
-  const templatesPath = join21(DATA_ROOT2, "templates");
-  const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
-  const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
-  if (hasPayloads && hasTemplates) {
-    return {
-      payloads: { path: payloadsPath, files: countFiles(payloadsPath), synced: false },
-      templates: { path: templatesPath, files: countFiles(templatesPath), synced: false },
-      data_root: DATA_ROOT2
-    };
+  const required = SINK_REQUIREMENTS[input.sinkType] ?? [];
+  if (required.length === 0) {
+    return { verdict: "unknown", state, context, required, reason: `sink type '${input.sinkType}' not in the requirements table` };
   }
-  const localPayloads = join21(ROOT7, "payloads");
-  const localTemplates = join21(ROOT7, "templates");
-  let payloadsSynced = false;
-  let templatesSynced = false;
-  if (!hasPayloads && dirExists(localPayloads)) {
-    copyDir(localPayloads, payloadsPath);
-    payloadsSynced = true;
+  if (state === "tainted") {
+    return { verdict: "vulnerable", state, context, required, reason: `raw tainted input reaches a ${input.sinkType} sink with no sanitization` };
   }
-  if (!hasTemplates && dirExists(localTemplates)) {
-    copyDir(localTemplates, templatesPath);
-    templatesSynced = true;
+  if (state === "validated") {
+    return { verdict: "safe", state, context, required, reason: `input validated (${context}) — safe for any sink` };
   }
-  const gitOk = spawnSync4("git", ["--version"]).status === 0;
-  if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join21(DATA_ROOT2, ".tmp-clone");
-    if (dirExists(tmp))
-      rmSync4(tmp, { recursive: true, force: true });
-    const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
-    if (r.status === 0) {
-      const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
-      if (sparse.status === 0) {
-        if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join21(tmp, "payloads"), payloadsPath);
-          payloadsSynced = true;
-        }
-        if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join21(tmp, "templates"), templatesPath);
-          templatesSynced = true;
-        }
-      }
-      rmSync4(tmp, { recursive: true, force: true });
+  if (state === "sanitized") {
+    if (context && required.includes(context)) {
+      return { verdict: "safe", state, context, required, reason: `sanitized for '${context}' — matches sink requirement ${required.join("/")}` };
     }
+    return { verdict: "vulnerable", state, context, required, reason: `sanitized for '${context}' but this sink requires ${required.join("/")} — WRONG sanitizer (context mismatch)` };
   }
-  return {
-    payloads: { path: payloadsPath, files: countFiles(payloadsPath), synced: payloadsSynced },
-    templates: { path: templatesPath, files: countFiles(templatesPath), synced: templatesSynced },
-    data_root: DATA_ROOT2
-  };
+  return { verdict: "unknown", state, context, required, reason: "unhandled state" };
 }
-function copyDir(src, dst) {
-  const r = spawnSync4("cp", ["-r", src, dst], { timeout: 120000 });
-  if (r.status !== 0) {
-    manualCopy(src, dst);
-  }
+function sinkTypeOf(line) {
+  if (/\$wpdb->(query|get_var|get_row|get_results|get_col)|mysqli_query\s*\(|mysql_query\s*\(|pg_query\s*\(|->query\s*\(/.test(line) && !/->prepare\s*\(/.test(line))
+    return "sql_execution";
+  if (/\b(eval|assert)\s*\(/.test(line))
+    return "code_execution";
+  if (/\b(system|exec|shell_exec|passthru|proc_open|popen)\s*\(/.test(line))
+    return "command_execution";
+  if (/\b(unserialize|maybe_unserialize)\s*\(/.test(line))
+    return "deserialization";
+  if (/\b(file_get_contents|file_put_contents|fopen|readfile|include|require|include_once|require_once)\s*\(/.test(line))
+    return "file_operations";
+  if (/header\s*\(\s*['"]Location/i.test(line))
+    return "redirect";
+  return null;
 }
-function manualCopy(src, dst) {
-  mkdirSync9(dst, { recursive: true });
-  for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join21(src, e.name);
-    const d = join21(dst, e.name);
-    if (e.isDirectory())
-      manualCopy(s, d);
-    else
-      writeFileSync8(d, readFileSync24(s));
+function detectWrongSanitizer(code, file) {
+  const out = [];
+  const ls = code.split(`
+`);
+  const varSanitizer = new Map;
+  for (const line of ls) {
+    const m = line.match(/\$(\w+)\s*=\s*([a-zA-Z0-9_]+)\s*\(\s*([^)]*)\s*\)\s*;?/);
+    if (!m)
+      continue;
+    const [, varName, fn, arg] = m;
+    if (!SOURCE_TOKENS2.test(arg))
+      continue;
+    if (SANITIZERS2[fn])
+      varSanitizer.set(varName, fn);
+    else if (PSEUDO_SANITIZERS.has(fn))
+      varSanitizer.set(varName, fn);
+  }
+  for (let i = 0;i < ls.length; i++) {
+    const line = ls[i];
+    const sinkType = sinkTypeOf(line);
+    if (!sinkType)
+      continue;
+    const required = SINK_REQUIREMENTS[sinkType] ?? [];
+    for (const [varName, fn] of varSanitizer) {
+      if (!new RegExp(`\\$${varName}\\b`).test(line))
+        continue;
+      const sanitizer = SANITIZERS2[fn];
+      const context = sanitizer?.context ?? null;
+      if (sanitizer && (sanitizer.level === "validated" || context && required.includes(context)))
+        continue;
+      const detail = sanitizer ? `$${varName} was sanitized for '${context}' (${fn}()) but this ${sinkType} sink requires ${required.join("/")} — WRONG sanitizer (context mismatch).` : `$${varName} passed through ${fn}() — a NON-sanitizing transformation — and still reaches this ${sinkType} sink as raw tainted input. ${fn}() does not neutralize ${required.join("/")} context.`;
+      out.push({
+        file,
+        line: i + 1,
+        type: "wrong_sanitizer",
+        category: "Wrong-context sanitization / pseudo-sanitizer",
+        severity: "high",
+        evidence: line.trim(),
+        detail
+      });
+    }
   }
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
 }
-var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
-var init_sync = __esm(() => {
-  ROOT7 = join21(fileURLToPath11(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join21(homedir10(), ".blitzstrike", "data");
+var SANITIZERS2, PSEUDO_SANITIZERS, SINK_REQUIREMENTS, SOURCE_TOKENS2;
+var init_security_state = __esm(() => {
+  SANITIZERS2 = {
+    esc_sql: { context: "sql", level: "sanitized" },
+    addslashes: { context: "sql", level: "sanitized" },
+    mysqli_real_escape_string: { context: "sql", level: "sanitized" },
+    mysql_real_escape_string: { context: "sql", level: "sanitized" },
+    pg_escape_string: { context: "sql", level: "sanitized" },
+    sanitize_text_field: { context: "html", level: "sanitized" },
+    sanitize_textarea_field: { context: "html", level: "sanitized" },
+    esc_html: { context: "html", level: "sanitized" },
+    esc_html__: { context: "html", level: "sanitized" },
+    htmlspecialchars: { context: "html", level: "sanitized" },
+    htmlentities: { context: "html", level: "sanitized" },
+    wp_kses: { context: "html", level: "sanitized" },
+    wp_kses_post: { context: "html", level: "sanitized" },
+    wp_kses_data: { context: "html", level: "sanitized" },
+    strip_tags: { context: "html", level: "sanitized" },
+    esc_attr: { context: "html_attr", level: "sanitized" },
+    esc_url: { context: "url", level: "sanitized" },
+    esc_url_raw: { context: "url", level: "sanitized" },
+    esc_textarea: { context: "html", level: "sanitized" },
+    esc_js: { context: "js", level: "sanitized" },
+    urlencode: { context: "url", level: "sanitized" },
+    rawurlencode: { context: "url", level: "sanitized" },
+    wp_json_encode: { context: "json", level: "sanitized" },
+    json_encode: { context: "json", level: "sanitized" },
+    absint: { context: "int", level: "validated" },
+    intval: { context: "int", level: "validated" },
+    sanitize_key: { context: "key", level: "sanitized" },
+    sanitize_email: { context: "email", level: "validated" },
+    sanitize_file_name: { context: "filename", level: "validated" },
+    sanitize_url: { context: "url", level: "validated" },
+    sanitize_title: { context: "slug", level: "validated" },
+    sanitize_title_with_dashes: { context: "slug", level: "validated" },
+    sanitize_user: { context: "username", level: "validated" },
+    filter_var: { context: "validated", level: "validated" },
+    wp_validate_boolean: { context: "validated", level: "validated" }
+  };
+  PSEUDO_SANITIZERS = new Set([
+    "trim",
+    "ltrim",
+    "rtrim",
+    "strtolower",
+    "strtoupper",
+    "ucfirst",
+    "ucwords",
+    "base64_encode",
+    "base64_decode",
+    "urldecode",
+    "rawurldecode",
+    "stripslashes",
+    "html_entity_decode",
+    "htmlspecialchars_decode",
+    "json_decode",
+    "unserialize",
+    "serialize",
+    "substr",
+    "mb_substr",
+    "explode",
+    "implode",
+    "str_replace",
+    "preg_replace",
+    "nl2br",
+    "strval",
+    "number_format",
+    "sprintf",
+    "md5",
+    "sha1",
+    "hash",
+    "crypt",
+    "chr",
+    "ord",
+    "strrev",
+    "str_repeat",
+    "str_pad"
+  ]);
+  SINK_REQUIREMENTS = {
+    sql_execution: ["sql", "sql_param", "int"],
+    code_execution: ["code"],
+    command_execution: ["code"],
+    deserialization: ["code"],
+    file_operations: ["filename"],
+    redirect: ["url"],
+    html_render: ["html"]
+  };
+  SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|->(input|query|request)\(|\breq\.(query|body|params|headers|cookies)|\bgetParameter\(/;
 });
 
-// src/update.ts
-async function checkLatestVersion(timeoutMs = 1e4) {
-  try {
-    const controller = new AbortController;
-    const t = setTimeout(() => controller.abort(), timeoutMs);
-    const res = await fetch("https://registry.npmjs.org/blitzstrike/latest", { signal: controller.signal });
-    clearTimeout(t);
-    if (!res.ok)
-      return null;
-    const data = await res.json();
-    return data.version ?? null;
-  } catch {
-    return null;
-  }
+// src/framework-security.ts
+function frameworkKnowledge(framework = "wordpress") {
+  return FRAMEWORKS[framework.toLowerCase()] ?? null;
 }
-function semverCompare(a, b) {
-  const pa = a.replace(/^v/, "").split(".").map((n) => parseInt(n, 10) || 0);
-  const pb = b.replace(/^v/, "").split(".").map((n) => parseInt(n, 10) || 0);
-  for (let i = 0;i < 3; i++) {
-    const x = pa[i] ?? 0;
-    const y = pb[i] ?? 0;
-    if (x !== y)
-      return x < y ? -1 : 1;
+function listFrameworks2() {
+  const s = new Set;
+  for (const k of Object.keys(FRAMEWORKS))
+    s.add(FRAMEWORKS[k].framework);
+  return [...s];
+}
+function lineNoOf(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
+}
+function functionBody(code, name) {
+  const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
+  if (idx === -1)
+    return null;
+  const open = code.indexOf("{", idx);
+  if (open === -1)
+    return null;
+  let depth = 0;
+  for (let i = open;i < code.length; i++) {
+    if (code[i] === "{")
+      depth++;
+    else if (code[i] === "}") {
+      depth--;
+      if (depth === 0)
+        return code.slice(open, i + 1);
+    }
   }
-  return 0;
+  return code.slice(open);
 }
-async function runUpdate(currentVersion) {
-  const latest = await checkLatestVersion();
-  const outdated = latest !== null && semverCompare(currentVersion, latest) < 0;
-  return {
-    current: currentVersion,
-    latest,
-    outdated,
-    update_command: "npm install -g blitzstrike@latest   # or: bun add -g blitzstrike@latest",
-    data_sync: syncData()
-  };
+function handlerName(expr) {
+  const quoted = expr.match(/['"]([A-Za-z_][A-Za-z0-9_]*)['"]/g);
+  if (quoted && quoted.length > 0)
+    return quoted[quoted.length - 1].replace(/['"]/g, "");
+  return null;
 }
-var init_update = __esm(() => {
-  init_sync();
-});
-
-// src/release.ts
-import { readFileSync as readFileSync26, existsSync as existsSync12 } from "node:fs";
-import { join as join22 } from "node:path";
-import { fileURLToPath as fileURLToPath12 } from "node:url";
-import { execSync as execSync2 } from "node:child_process";
-function validateRelease() {
-  const checks = [];
-  checks.push({ name: "package.json version", ok: true, detail: VERSION });
-  try {
-    const changelog = readFileSync26(join22(ROOT8, "CHANGELOG.md"), "utf8");
-    const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
-    const changelogVersion = m?.[1] ?? null;
-    checks.push({
-      name: "CHANGELOG version",
-      ok: changelogVersion === VERSION,
-      detail: changelogVersion ?? "no version header found"
-    });
-  } catch {
-    checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
+function detectWpAuthz(code, file, out) {
+  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
+  let m;
+  while ((m = ajaxRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = handlerName(m[2]);
+    if (!handler)
+      continue;
+    const nopriv = hook.startsWith("wp_ajax_nopriv_");
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = NONCE_RE.test(body);
+    const dangerous = DANGEROUS_OP_RE.test(body);
+    const line = lineNoOf(code, m.index);
+    if (nopriv && !hasCap && dangerous) {
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated AJAX handler '${handler}()' performs a privileged/state-changing operation with no current_user_can()/authorization check — auth bypass / privilege escalation.` });
+    }
+    if (!hasNonce && dangerous) {
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `AJAX handler '${handler}()' performs a state-changing operation without nonce verification (wp_verify_nonce / check_ajax_referer) — CSRF.` });
+    }
   }
-  try {
-    const tag = execSync2("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-    checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
-  } catch {
-    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
+  const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
+  while ((m = adminRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = handlerName(m[2]);
+    if (!handler)
+      continue;
+    const nopriv = hook.startsWith("admin_post_nopriv_");
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = NONCE_RE.test(body);
+    const dangerous = DANGEROUS_OP_RE.test(body);
+    const line = lineNoOf(code, m.index);
+    if (nopriv && !hasCap && dangerous) {
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated admin-post handler '${handler}()' performs a privileged/state-changing operation with no authorization check — auth bypass / privilege escalation.` });
+    }
+    if (!hasNonce && dangerous) {
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `admin-post handler '${handler}()' performs a state-changing operation without nonce verification — CSRF.` });
+    }
   }
-  try {
-    const published = execSync2("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
-    checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
-  } catch {
-    checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
+  const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
+  while ((m = restRe.exec(code)) !== null) {
+    const line = lineNoOf(code, m.index);
+    const window2 = code.slice(m.index, m.index + 800);
+    const pc = window2.match(/permission_callback['"]?\s*=>\s*(.+?)(?:,|\s*\n|\])/);
+    if (pc) {
+      const expr = pc[1].trim();
+      if (/__return_true/.test(expr)) {
+        out.push({ file, line, type: "missing_authz", category: "REST route explicitly public (__return_true)", severity: "medium", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' sets permission_callback to __return_true (always allow) — verify the endpoint does not expose sensitive data or perform privileged actions.` });
+      }
+      continue;
+    }
+    out.push({ file, line, type: "missing_authz", category: "REST route missing permission_callback", severity: "high", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass).` });
+  }
+  const formRe = /add_action\s*\(\s*['"](init|admin_init|wp_loaded|template_redirect|parse_request|wp)['"]\s*,\s*(.+?)\s*\)/g;
+  while ((m = formRe.exec(code)) !== null) {
+    const hook = m[1];
+    const handler = handlerName(m[2]);
+    if (!handler)
+      continue;
+    const body = functionBody(code, handler);
+    if (!body)
+      continue;
+    if (!/\$_(GET|POST|REQUEST|COOKIE|SERVER)\b|php:\/\/input|filter_input|file_get_contents\(['"]php:\/\/input/.test(body))
+      continue;
+    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
+    const hasNonce = NONCE_RE.test(body);
+    const dangerous = DANGEROUS_OP_RE.test(body);
+    const line = lineNoOf(code, m.index);
+    if (!hasNonce && dangerous) {
+      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification (direct request handler)", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') performs a state-changing operation without nonce verification — CSRF.` });
+    }
+    if (!hasCap && dangerous) {
+      out.push({ file, line, type: "missing_authz", category: "Missing capability check (direct request handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') performs a privileged/state-changing operation with no capability check — auth bypass / privilege escalation.` });
+    }
   }
-  checks.push({
-    name: "Lockfile",
-    ok: lockfilePresent(),
-    detail: lockfilePresent() ? "present (bun.lock / package-lock.json)" : "missing",
-    soft: true
-  });
-  return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
-}
-function lockfilePresent() {
-  return existsSync12(join22(ROOT8, "package-lock.json")) || existsSync12(join22(ROOT8, "bun.lock")) || existsSync12(join22(ROOT8, "bun.lockb"));
 }
-var ROOT8;
-var init_release = __esm(() => {
-  init_version();
-  ROOT8 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
-});
-
-// src/dependency.ts
-import { readFileSync as readFileSync27 } from "node:fs";
-import { join as join23 } from "node:path";
-import { fileURLToPath as fileURLToPath13 } from "node:url";
-function checkDependencies() {
-  let pkg = {};
-  try {
-    pkg = JSON.parse(readFileSync27(join23(ROOT9, "package.json"), "utf8"));
-  } catch {
-    return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
+function detectRouteAuthz(code, file, out) {
+  const ls = code.split(`
+`);
+  for (const d of ROUTE_DETECTORS) {
+    d.entry.lastIndex = 0;
+    let m;
+    while ((m = d.entry.exec(code)) !== null) {
+      const ln = lineNoOf(code, m.index);
+      const window2 = ls.slice(Math.max(0, ln - d.window), Math.min(ls.length, ln + d.window + 1)).join(`
+`);
+      if (d.auth.test(window2))
+        continue;
+      out.push({
+        file,
+        line: ln,
+        type: "missing_authz",
+        category: `${d.framework}: endpoint without authorization`,
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `${d.framework} endpoint has no authorization enforcement in the surrounding ${d.window}-line window — auth bypass / privilege escalation.`
+      });
+    }
   }
-  const installScriptNames = ["preinstall", "install", "postinstall", "prepare"];
-  const installScripts = installScriptNames.filter((n) => pkg.scripts?.[n]).map((n) => ({ name: n, command: pkg.scripts[n] }));
-  const allDeps = {
-    ...pkg.dependencies ?? {},
-    ...pkg.devDependencies ?? {},
-    ...pkg.peerDependencies ?? {},
-    ...pkg.optionalDependencies ?? {}
-  };
-  const gitDependencies = Object.entries(allDeps).filter(([, v]) => /^(git\+|git:|github:|gitlab:|bitbucket:|\w+:\/\/)/.test(v)).map(([name, v]) => `${name}@${v}`);
-  const total = Object.keys(allDeps).length;
-  return {
-    install_scripts: installScripts,
-    git_dependencies: gitDependencies,
-    total_dependencies: total,
-    safe: installScripts.length === 0 && gitDependencies.length === 0
-  };
 }
-var ROOT9;
-var init_dependency = __esm(() => {
-  ROOT9 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
+function detectMissingAuthz(code, file) {
+  const out = [];
+  detectWpAuthz(code, file, out);
+  detectRouteAuthz(code, file, out);
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+var FRAMEWORKS, INDIRECT_AUTH, AUTH_RE, NONCE_RE, DANGEROUS_OP_RE, ROUTE_DETECTORS;
+var init_framework_security = __esm(() => {
+  FRAMEWORKS = {
+    wordpress: {
+      framework: "wordpress",
+      auth_primitives: ["current_user_can", "current_user_can_edit_post", "is_user_logged_in", "authorize"],
+      nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer", "verify_nonce"],
+      entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "admin_post_", "admin_post_nopriv_", "register_rest_route", "add_shortcode", "init", "rest_api_init"],
+      sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "esc_attr", "esc_url", "wp_kses", "wp_kses_post", "absint", "sanitize_email", "sanitize_file_name"]
+    },
+    wp: {
+      framework: "wordpress",
+      auth_primitives: ["current_user_can", "is_user_logged_in", "authorize"],
+      nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer"],
+      entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "register_rest_route"],
+      sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "absint"]
+    },
+    laravel: {
+      framework: "laravel",
+      auth_primitives: ["auth", "authorize", "Gate::", "can:", "->middleware('auth'", "->can(", "$this->authorize", "@can", "@cannot", "policy"],
+      nonce_primitives: ["@csrf", "csrf_field", "VerifyCsrfToken"],
+      entry_point_hooks: ["Route::get", "Route::post", "Route::put", "Route::delete", "Route::resource", "Route::match"],
+      sanitizers: ["e(", "htmlspecialchars", "clean(", "strip_tags"]
+    },
+    django: {
+      framework: "django",
+      auth_primitives: ["login_required", "permission_required", "user_passes_test", "LoginRequiredMixin", "PermissionRequiredMixin", "permission_classes", "IsAuthenticated", "has_permission"],
+      nonce_primitives: ["csrf_protect", "CsrfViewMiddleware", "@csrf"],
+      entry_point_hooks: ["def ", "@api_view", "path(", "url(", "re_path("],
+      sanitizers: ["escape(", "mark_safe", "html.escape"]
+    },
+    flask: {
+      framework: "flask",
+      auth_primitives: ["login_required", "@login_required", "current_user.is_authenticated", "permission_required"],
+      nonce_primitives: ["CSRFProtect", "csrf_token"],
+      entry_point_hooks: ["@app.route", "@blueprint.route", "@bp.route"],
+      sanitizers: ["escape(", "Markup", "html.escape"]
+    },
+    express: {
+      framework: "express",
+      auth_primitives: ["requireAuth", "authenticate", "passport.authenticate", "req.user", "isAuthenticated", "ensureAuthenticated", "requireLogin", "authorize", "authMiddleware"],
+      nonce_primitives: ["csurf", "csrfProtection", "helmet"],
+      entry_point_hooks: ["app.get", "app.post", "router.get", "router.post"],
+      sanitizers: ["escapeHtml", "encodeURIComponent", "sanitize", "xss"]
+    },
+    spring: {
+      framework: "spring",
+      auth_primitives: ["@PreAuthorize", "@Secured", "@RolesAllowed", "hasRole", "hasAuthority", "isAuthenticated", "SecurityContextHolder"],
+      nonce_primitives: ["csrf", "CsrfToken"],
+      entry_point_hooks: ["@GetMapping", "@PostMapping", "@RequestMapping", "@Controller"],
+      sanitizers: ["HtmlUtils.htmlEscape", "escapeHtml", "StringEscapeUtils"]
+    },
+    symfony: {
+      framework: "symfony",
+      auth_primitives: ["is_granted", "denyAccessUnlessGranted", "->isGranted(", "IsGranted", "Voter"],
+      nonce_primitives: ["isCsrfTokenValid", "csrf_token"],
+      entry_point_hooks: ["#[Route", "@Route", "#[Get", "#[Post"],
+      sanitizers: ["e(", "htmlspecialchars", "escape("]
+    },
+    aspnet: {
+      framework: "aspnet",
+      auth_primitives: ["[Authorize", "[AllowAnonymous", "User.Identity", "IsInRole", "AuthorizeAsync", "IAuthorizationService"],
+      nonce_primitives: ["ValidateAntiForgeryToken", "Antiforgery"],
+      entry_point_hooks: ["[HttpGet", "[HttpPost", "[Route("],
+      sanitizers: ["HtmlEncoder", "Html.Raw", "UrlEncoder"]
+    },
+    rails: {
+      framework: "rails",
+      auth_primitives: ["authenticate_user!", "authorize", "before_action :authenticate", "before_action :authorize", "current_user"],
+      nonce_primitives: ["protect_from_forgery", "form_authenticity_token"],
+      entry_point_hooks: ["def ", "before_action"],
+      sanitizers: ["h(", "html_escape", "sanitize"]
+    }
+  };
+  INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
+  AUTH_RE = /current_user_can|is_user_logged_in|is_super_admin|current_user_can_edit_post|authorize/;
+  NONCE_RE = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/;
+  DANGEROUS_OP_RE = /\b(update_option|add_option|delete_option|update_site_option|delete_site_option|update_post_meta|add_post_meta|delete_post_meta|update_user_meta|add_user_meta|delete_user_meta|update_metadata|add_metadata|delete_metadata|set_transient|delete_transient|wp_insert_post|wp_update_post|wp_delete_post|wp_trash_post|wp_untrash_post|wp_insert_comment|wp_update_comment|wp_delete_comment|wp_insert_user|wp_update_user|wp_delete_user|wp_create_user|wp_set_current_user|wp_set_auth_cookie|set_user_role|set_role|add_role|remove_role|add_cap|remove_cap|wp_mail|wp_new_user_notification|wp_handle_upload|move_uploaded_file|wp_upload_bits|wp_set_object_terms|wp_set_post_terms|wp_schedule_event|wp_clear_scheduled_hook|wp_redirect|file_put_contents|unlink|rename|wpdb->query|wpdb->insert|wpdb->update|wpdb->delete|wpdb->replace)\s*\(/;
+  ROUTE_DETECTORS = [
+    { framework: "laravel", entry: /Route::(?:get|post|put|patch|delete|any|match|resource)\s*\(\s*['"][^'"]+['"]/g, auth: /->middleware\s*\(\s*['"]auth|middleware\s*\(\s*\[[^\]]*['"]auth|->can\s*\(|\$this->authorize|Gate::|authorize\s*\(|@can\b/, window: 2 },
+    { framework: "django", entry: /@api_view\s*\(|def\s+\w+\s*\(\s*request\s*[,)]/g, auth: /login_required|permission_required|user_passes_test|LoginRequiredMixin|PermissionRequiredMixin|permission_classes|IsAuthenticated|has_permission/, window: 3 },
+    { framework: "flask", entry: /@(?:app|bp|blueprint)\.route\s*\(/g, auth: /login_required|current_user\.is_authenticated|permission_required/, window: 3 },
+    { framework: "express", entry: /(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware/, window: 2 },
+    { framework: "spring", entry: /@(?:Get|Post|Put|Delete|Patch|Request)Mapping\s*\(/g, auth: /@PreAuthorize|@Secured|@RolesAllowed|hasRole|hasAuthority|isAuthenticated|SecurityContextHolder/, window: 2 },
+    { framework: "symfony", entry: /#\[(?:Route|Get|Post|Put|Delete|Patch)\b|@Route\s*\(/g, auth: /is_granted|denyAccessUnlessGranted|->isGranted\s*\(|IsGranted|Voter/, window: 2 },
+    { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
+    { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
+  ];
 });
 
-// src/cli.ts
-import { readFileSync as readFileSync28, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join24, dirname as dirname4 } from "node:path";
-import { homedir as homedir11 } from "node:os";
-import { fileURLToPath as fileURLToPath14 } from "node:url";
-import { spawnSync as spawnSync5 } from "node:child_process";
-function which(cmd) {
-  return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
+// src/complex-bugs.ts
+function lines2(code) {
+  return code.split(`
+`);
 }
-function installedCount() {
-  const tools = loadTools();
-  const installed = tools.filter((t) => which(t.name)).map((t) => t.name);
-  return { total: tools.length, installed, missing: tools.map((t) => t.name).filter((n) => !installed.includes(n)) };
+function lineNo2(code, pos) {
+  let n = 1;
+  for (let i = 0;i < pos; i++)
+    if (code.charCodeAt(i) === 10)
+      n++;
+  return n;
 }
-async function runDoctor() {
-  console.log(`BlitzStrike doctor — environment health check
-`);
-  const issues = [];
-  const bunOk = which("bun") || which("node");
-  issues.push({
-    name: "Runtime (bun/node)",
+function stripCommentsOnly(code) {
+  const out = code.split("");
+  const n = code.length;
+  let i = 0;
+  while (i < n) {
+    const c = code[i];
+    const nc = code[i + 1];
+    if (c === "'" || c === '"') {
+      const q = c;
+      i++;
+      while (i < n && code[i] !== q) {
+        if (code[i] === "\\")
+          i++;
+        i++;
+      }
+      i++;
+      continue;
+    }
+    if (c === "/" && nc === "/" || c === "#") {
+      while (i < n && code[i] !== `
+`) {
+        out[i] = " ";
+        i++;
+      }
+      continue;
+    }
+    if (c === "/" && nc === "*") {
+      out[i] = " ";
+      out[i + 1] = " ";
+      i += 2;
+      while (i < n && !(code[i] === "*" && code[i + 1] === "/")) {
+        if (code[i] !== `
+`)
+          out[i] = " ";
+        i++;
+      }
+      if (i < n) {
+        out[i] = " ";
+        if (i + 1 < n)
+          out[i + 1] = " ";
+        i += 2;
+      }
+      continue;
+    }
+    i++;
+  }
+  return out.join("");
+}
+function detectDeserialization(code, file, out) {
+  if (!MAGIC_METHODS.test(code))
+    return;
+  const ls = lines2(code);
+  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "deserialization",
+      category: "Deserialization → POP gadget chain",
+      severity: "high",
+      evidence: l.trim(),
+      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
+    });
+  }
+}
+function detectTypeJuggling(code, file, out) {
+  const ls = lines2(code);
+  const re = /(?<![=!<>])(==|!=)(?!=)/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    const hasSource = SOURCE_TOKENS3.test(l) || SOURCE_TOKENS3.test(scope);
+    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
+    if (!hasSource || !hasHash)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "type_juggling",
+      category: "Type juggling (loose comparison)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
+    });
+  }
+}
+function detectMassAssignment(code, file, out) {
+  const ls = lines2(code);
+  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
+  let m;
+  while ((m = extractRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
+    });
+  }
+  const parseRe = /\bparse_str\s*\(/g;
+  while ((m = parseRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "mass_assignment",
+      category: "Mass assignment (variable injection)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "`parse_str()` of user input into the symbol table — variable injection."
+    });
+  }
+}
+function detectComplexBugs(code, file) {
+  const out = [];
+  detectDeserialization(code, file, out);
+  detectTypeJuggling(code, file, out);
+  detectMassAssignment(code, file, out);
+  detectPrototypePollution(code, file, out);
+  detectCrlfInjection(code, file, out);
+  detectPathConfusion(code, file, out);
+  detectSsrF(code, file, out);
+  detectXxe(code, file, out);
+  detectSsti(code, file, out);
+  detectFileUploadRce(code, file, out);
+  detectUnrestrictedUpload(code, file, out);
+  detectSqlInjection(code, file, out);
+  detectHardcodedSecret(code, file, out);
+  detectLlmInjection(code, file, out);
+  detectGraphqlExposure(code, file, out);
+  detectOauthMisconfig(code, file, out);
+  detectGrpcReflection(code, file, out);
+  out.push(...detectWrongSanitizer(code, file));
+  out.push(...detectMissingAuthz(code, file));
+  const seen = new Set;
+  return out.filter((f) => {
+    const key = `${f.type}:${f.line}`;
+    if (seen.has(key))
+      return false;
+    seen.add(key);
+    return true;
+  });
+}
+function detectPrototypePollution(code, file, out) {
+  const ls = lines2(code);
+  const mergeRe = /\b(Object\.assign|_\.merge|_\.defaultsDeep|\.extend|\.merge|\.defaultsDeep|mergeDeep|deepMerge|_.set)\s*\(/g;
+  let m;
+  while ((m = mergeRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "prototype_pollution",
+      category: "Prototype pollution (unsafe merge)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "Merge/extend of request data into an object without a `__proto__`/`constructor.prototype` guard — attacker-controlled keys can pollute `Object.prototype` and pivot to RCE or property injection."
+    });
+  }
+}
+function detectCrlfInjection(code, file, out) {
+  const ls = lines2(code);
+  const headerRe = /\b(header|setHeader|addHeader|writeHead|appendHeader)\s*\(/g;
+  let m;
+  while ((m = headerRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "crlf_injection",
+      category: "CRLF / header injection",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "User input reaches an HTTP header — CRLF (`%0d%0a`) can split the response, inject headers, or poison cookies. Strip newlines from header values."
+    });
+  }
+}
+function detectPathConfusion(code, file, out) {
+  const ls = lines2(code);
+  const fileRe = /\b(file_get_contents|file_put_contents|fopen|readFileSync|readFile|open|include|require|new\s+File|Files\.read|FileInputStream|FileOutputStream)\s*\(/g;
+  let m;
+  while ((m = fileRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    if (/\b(basename|realpath|canonicalPath|getCanonicalPath|normalize|resolve|toRealPath)\s*\(/i.test(scope + `
+` + l))
+      continue;
+    if (/\$[A-Za-z_]\w*\s*\[\s*\$[A-Za-z_]\w*\s*\]/.test(scope + `
+` + l))
+      continue;
+    if (/["'][^"']*:\/\/[^"']*["']/.test(scope + `
+` + l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "path_confusion",
+      category: "Path confusion (unsanitized file path)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "User input reaches a file path with no canonicalization (`basename`/`realpath`/`normalize`) — traversal, `..%2f`, backslash and null-byte variants can confuse a naive `../` filter."
+    });
+  }
+}
+function detectSsrF(code, file, out) {
+  const ls = lines2(code);
+  const re = /\b(file_get_contents|fopen|file|readfile|curl_setopt|curl_init|fetch|axios|requests\.(get|post|put)|urllib\.request|http_get|wp_remote_(get|post)|new\s+URL\s*\(|got\(|http\.(get|request))\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    if (/(allowlist|whitelist|in_array|preg_match|parse_url|startsWith\(["']https?|endsWith\(["']|basename|realpath|normalize)/i.test(scope + `
+` + l))
+      continue;
+    if (/["'][^"']*:\/\/[^"']*["']/.test(scope + `
+` + l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "ssrf",
+      category: "SSRF (user-controlled URL)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "User input reaches a URL-accepting sink with no host allowlist — SSRF (cloud metadata, internal port scan, IAM credential theft)."
+    });
+  }
+}
+function detectXxe(code, file, out) {
+  const ls = lines2(code);
+  const re = /\b(simplexml_load_string|simplexml_load_file|new\s+SimpleXMLElement|->loadXML\s*\(|->load\s*\(|XMLReader\s*->\s*XML\s*\(|libxml_parse)\s*\(?/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    if (/libxml_disable_entity_loader\s*\(\s*true|LIBXML_NONET/.test(scope + `
+` + l))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "xxe",
+      category: "XXE (unprotected XML parse)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "User-controlled XML parsed without disabling external entities — XXE (file read, SSRF, billion-laughs DoS)."
+    });
+  }
+}
+function detectSsti(code, file, out) {
+  const ls = lines2(code);
+  const re = /\b(render_template_string|Template\s*\(|res\.render\s*\(|ejs\.(render|compile)\s*\(|_\.template\s*\(|render_string|twig\.render|Jinja2\(|jinja2\.Template)\s*\(?/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
+`);
+    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "ssti",
+      category: "SSTI (template render of user input)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "User input reaches a template render with no sandbox — SSTI (`{{7*7}}`, `${7*7}`, `#{7*7}`) → RCE."
+    });
+  }
+}
+function detectFileUploadRce(code, file, out) {
+  code = stripCommentsOnly(code);
+  const ls = lines2(code);
+  const re = /\b(move_uploaded_file|wp_upload_bits|->move\s*\(|storeAs\s*\(|->storeAs\s*\(|putFile\s*\()\s*\(/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 30), ln + 3).join(`
+`);
+    if (!/\$_FILES\b|tmp_name|getUploadedFile|uploadedFile|\['name'\]/i.test(scope))
+      continue;
+    if (/(wp_check_filetype|PATHINFO_EXTENSION|wp_get_mime_types|allowed_?(types|extensions|exts)|mime_?(types|extensions)|in_array\s*\([^)]*\$(?:allowed|whitelist|ext)|wp_handle_upload\s*\(\s*[^)]*test_form\s*=>\s*true)/i.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "file_upload",
+      category: "File upload → RCE (unvalidated extension)",
+      severity: "high",
+      evidence: l.trim(),
+      detail: "An uploaded file is written with an attacker-controlled name and no visible extension/filetype validation — upload a .php/.phtml shell → RCE."
+    });
+  }
+}
+function detectUnrestrictedUpload(code, file, out) {
+  const ls = lines2(code);
+  const re = /['"]uploadAllow['"]\s*=>\s*(?:array\s*\(\s*)?['"]all['"]/g;
+  let m;
+  while ((m = re.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 4), ln + 4).join(`
+`);
+    const denyFirst = /['"]uploadOrder['"]\s*=>\s*array\s*\(\s*['"]deny['"]/.test(scope);
+    out.push({
+      file,
+      line: ln,
+      type: "file_upload",
+      category: "Unrestricted upload config (uploadAllow=all)",
+      severity: denyFirst ? "high" : "medium",
+      evidence: l.trim(),
+      detail: denyFirst ? "File-manager/connector config sets uploadAllow='all' with uploadOrder deny→allow — every mimetype (including .php) is uploadable → RCE." : "File-manager/connector config sets uploadAllow='all' — any file type can be uploaded; verify the upload path is not web-reachable or that a server-side extension whitelist exists."
+    });
+  }
+}
+function detectSqlInjection(code, file, out) {
+  const ls = lines2(code);
+  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|->query\s*\(|DB::unprepared\s*\(|->whereRaw\s*\(|->selectRaw\s*\(/g;
+  let m;
+  while ((m = sinkRe.exec(code)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const l = ls[ln - 1] ?? "";
+    const scope = ls.slice(Math.max(0, ln - 6), ln + 1).join(`
+`);
+    if (/->prepare\s*\(/.test(scope))
+      continue;
+    if (SOURCE_TOKENS3.test(scope))
+      continue;
+    const inlineConcat = /\.\s*\$[A-Za-z_]\w*/.test(l);
+    const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope);
+    if (!inlineConcat && !assignConcat)
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "sql_injection",
+      category: "SQL injection (raw string-interpolated query)",
+      severity: "medium",
+      evidence: l.trim(),
+      detail: "A SQL sink receives a query built by string concatenation (not prepared), with no visible source in this file — trace the concatenated variable back to a request source; if user-controlled, this is SQL injection (CWE-89)."
+    });
+  }
+}
+function detectHardcodedSecret(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const flaggedLines = new Set;
+  SECRET_FIELD_RE.lastIndex = 0;
+  let m;
+  while ((m = SECRET_FIELD_RE.exec(clean)) !== null) {
+    const field = m[1];
+    const rest = clean.slice(m.index + m[0].length);
+    const lineEnd = rest.search(/\r?\n/);
+    const valueRaw = (lineEnd === -1 ? rest : rest.slice(0, lineEnd)).trim();
+    let value = "";
+    const qm = valueRaw.match(/^["']([^"']{4,})["']/);
+    if (qm)
+      value = qm[1];
+    else
+      value = (valueRaw.match(/^([A-Za-z0-9._/+=@-]{8,})/) ?? [])[1] ?? "";
+    if (!value)
+      continue;
+    if (SECRET_PLACEHOLDER_RE.test(value))
+      continue;
+    if (/\$[A-Za-z_]|[{}\[\]]|process\.env|getenv|os\.environ|config\s*\(|env\s*\(/.test(valueRaw))
+      continue;
+    const ln = lineNo2(code, m.index);
+    flaggedLines.add(ln);
+    out.push({
+      file,
+      line: ln,
+      type: "hardcoded_secret",
+      category: "Hardcoded secret (credential in source)",
+      severity: "high",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `Secret field '${field}' is assigned a hardcoded value in source — the credential is exposed to anyone with code access (CWE-798 Hard-coded Credentials). Rotate it and load from the environment instead.`
+    });
+  }
+  for (const fmt of SECRET_FORMATS) {
+    fmt.re.lastIndex = 0;
+    let fm;
+    while ((fm = fmt.re.exec(clean)) !== null) {
+      const ln = lineNo2(code, fm.index);
+      if (flaggedLines.has(ln))
+        continue;
+      flaggedLines.add(ln);
+      out.push({
+        file,
+        line: ln,
+        type: "hardcoded_secret",
+        category: "Hardcoded secret (known format)",
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `A ${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798). Rotate it and load from the environment instead.`
+      });
+    }
+  }
+  const isMinified = /\.min\.(js|css)$/i.test(file) || /[\\/](bundle|vendor|dist|build)[\\/]/i.test(file);
+  if (!isMinified) {
+    const entropyRe = /(\b[A-Za-z_]\w*)\s*(?:::|=>|=|:)\s*["']([A-Za-z0-9_-]{32,})["']/g;
+    entropyRe.lastIndex = 0;
+    let em;
+    while ((em = entropyRe.exec(clean)) !== null) {
+      const varName = em[1];
+      const value = em[2];
+      const ln = lineNo2(code, em.index);
+      if (flaggedLines.has(ln))
+        continue;
+      if (ENTROPY_EXCLUDE_VAR.test(varName))
+        continue;
+      if (!/[A-Z]/.test(value) || !/[a-z]/.test(value) || !/[0-9]/.test(value))
+        continue;
+      if (shannonEntropy(value) < 4.5)
+        continue;
+      flaggedLines.add(ln);
+      out.push({
+        file,
+        line: ln,
+        type: "hardcoded_secret",
+        category: "Suspected secret (high-entropy token)",
+        severity: "medium",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `'${varName}' is assigned a high-entropy token (Shannon ${shannonEntropy(value).toFixed(2)} bits/char) that looks like a generated credential — verify it is not a secret key/token (CWE-798).`
+      });
+    }
+  }
+}
+function detectLlmInjection(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const llmCallRe = /\b(?:openai|anthropic|langchain|llama_index)\.[A-Za-z_.]+\s*\(|\b(?:ChatCompletion|completion|messages)\.create\s*\(|\bllm\.invoke\s*\(|\.chat\.completions\.create\s*\(/g;
+  let m;
+  while ((m = llmCallRe.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const scope = ls.slice(Math.max(0, ln - 6), ln + 3).join(`
+`);
+    if (!SOURCE_TOKENS3.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "llm_injection",
+      category: "LLM prompt injection surface",
+      severity: "medium",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: "Request input reaches an LLM call (chat/completion/invoke) with no visible prompt-injection boundary — untrusted text may override instructions or exfiltrate context (OWASP LLM01 Prompt Injection). Verify the prompt is sandboxed and output is not used for privileged actions."
+    });
+  }
+}
+function detectGraphqlExposure(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /\b(introspection|playground|graphiql)\s*[:=]\s*(true|1)\b/gi;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    out.push({
+      file,
+      line: ln,
+      type: "graphql_exposure",
+      category: "GraphQL introspection/playground exposed",
+      severity: "medium",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: `GraphQL ${m[1].toLowerCase()} is enabled (${m[2]}) in a configuration that appears production-reachable — introspection exposes the full schema/fields, and a playground enables interactive querying (CWE-200 Information Exposure). Disable in production.`
+    });
+  }
+}
+function detectOauthMisconfig(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /\b(redirect_uri|redirectUrl|return_url|returnUrl|callback_url)\s*[:=]\s*/gi;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    const rest = clean.slice(m.index + m[0].length);
+    const lineEnd = rest.search(/\r?\n/);
+    const line = lineEnd === -1 ? rest : rest.slice(0, lineEnd);
+    if (!/(request|params|query|\$_(?:GET|POST|REQUEST)|req\.)/i.test(line))
+      continue;
+    const scope = ls.slice(Math.max(0, ln - 6), ln + 3).join(`
+`);
+    if (/(allowlist|whitelist|allowed_|in_array|startsWith|===\s*['"])/.test(scope))
+      continue;
+    out.push({
+      file,
+      line: ln,
+      type: "oauth_misconfig",
+      category: "OAuth redirect_uri misconfiguration",
+      severity: "high",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: "An OAuth redirect_uri/callback is fed by request input with no allowlist validation — an attacker can redirect the authorization code/token to an attacker-controlled endpoint (CWE-601 Open Redirect → token theft). Validate the redirect target against a static allowlist."
+    });
+  }
+}
+function detectGrpcReflection(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const re = /\b(enable_server_reflection|RegisterReflectionService|reflection\.enable|grpc_reflection|reflection\.Register)\b/gi;
+  let m;
+  while ((m = re.exec(clean)) !== null) {
+    const ln = lineNo2(code, m.index);
+    out.push({
+      file,
+      line: ln,
+      type: "grpc_reflection",
+      category: "gRPC reflection exposed",
+      severity: "low",
+      evidence: (ls[ln - 1] ?? "").trim(),
+      detail: "gRPC server reflection is enabled — it enumerates every service/method to any caller, expanding the attack surface and leaking the API contract (CWE-200 Information Exposure). Disable reflection in production."
+    });
+  }
+}
+var SOURCE_TOKENS3, MAGIC_METHODS, SECRET_FIELD_RE, SECRET_PLACEHOLDER_RE, ENTROPY_EXCLUDE_VAR;
+var init_complex_bugs = __esm(() => {
+  init_security_state();
+  init_framework_security();
+  init_secrets();
+  SOURCE_TOKENS3 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params)|getParameter\(|req\.(query|body|params|headers|cookies)/;
+  MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
+  SECRET_FIELD_RE = new RegExp(`\\b(${SECRET_FIELDS})\\s*(?:::|=>|=|:)\\s*`, "gi");
+  SECRET_PLACEHOLDER_RE = /^(null|true|false|undefined|your_|xxx+|changeme|example|placeholder|test|secret|password|token|key|api|smtp|localhost|root|admin|pass|change|me|none|na|foo|bar|dummy)$/i;
+  ENTROPY_EXCLUDE_VAR = /\b(data|payload|content|body|base64|encoded|encode|image|binary|blob|hash|digest|checksum|nonce|uuid|etag|signature|sig|cipher|iv|ciphertext|plaintext|thumb|thumbnail)\b/i;
+});
+
+// src/verify-harness.ts
+function runVerificationHarness() {
+  const cases = CASES.map((c) => {
+    const pos = detectComplexBugs(c.positive, "positive.php").filter((f) => f.type === c.detector);
+    const neg = detectComplexBugs(c.negative, "negative.php").filter((f) => f.type === c.detector);
+    const positive_fired = pos.length > 0;
+    const negative_fired = neg.length > 0;
+    const tp = positive_fired;
+    const tn = !negative_fired;
+    const status = tp && tn ? "pass" : !tp ? "fn" : "fp";
+    return { id: c.id, detector: c.detector, positive_fired, negative_fired, tp, tn, status };
+  });
+  const passed = cases.filter((c) => c.status === "pass").length;
+  return {
+    total: cases.length,
+    passed,
+    failed: cases.length - passed,
+    tp_count: cases.filter((c) => c.tp).length,
+    fp_count: cases.filter((c) => c.status === "fp").length,
+    fn_count: cases.filter((c) => c.status === "fn").length,
+    cases
+  };
+}
+function verificationReportText() {
+  const r = runVerificationHarness();
+  const lines = [];
+  lines.push(`Blitz Strike verification harness`);
+  lines.push(`  ${r.passed}/${r.total} detectors pass (TP + TN) · TP ${r.tp_count} · FP ${r.fp_count} · FN ${r.fn_count}`);
+  lines.push(``);
+  for (const c of r.cases) {
+    const mark = c.status === "pass" ? "OK " : c.status === "fn" ? "FN " : "FP ";
+    lines.push(`  [${mark}] ${c.id.padEnd(20)} pos=${c.positive_fired ? "hit" : "miss"} neg=${c.negative_fired ? "HIT" : "clean"}`);
+  }
+  if (r.failed > 0) {
+    lines.push(``);
+    lines.push(`  ${r.failed} detector(s) failed — see the cases above (FN = missed a positive, FP = fired on clean code).`);
+  }
+  return lines.join(`
+`);
+}
+var PHP = (body) => `<?php
+${body}
+`, CASES;
+var init_verify_harness = __esm(() => {
+  init_complex_bugs();
+  CASES = [
+    {
+      id: "deserialization",
+      detector: "deserialization",
+      positive: PHP(`$o = unserialize($_GET['data']);
+class A { function __destruct() { system($this->c); } }`),
+      negative: PHP(`$o = json_decode($_GET['data'], true);`)
+    },
+    {
+      id: "type-juggling",
+      detector: "type_juggling",
+      positive: PHP(`$hash = "0e1234567890";
+if ($_GET['pwd'] == $hash) { login(); }`),
+      negative: PHP(`if (hash_equals($_GET['pwd'], $hash)) { login(); }`)
+    },
+    {
+      id: "mass-assignment",
+      detector: "mass_assignment",
+      positive: PHP(`extract($_POST);`),
+      negative: PHP(`extract($data, EXTR_SKIP);`)
+    },
+    {
+      id: "prototype-pollution",
+      detector: "prototype_pollution",
+      positive: PHP(`const merged = deepMerge({}, JSON.parse(req.body));`),
+      negative: PHP(`const merged = Object.assign({}, { a: 1 });`)
+    },
+    {
+      id: "crlf-injection",
+      detector: "crlf_injection",
+      positive: PHP(`header("Location: " . $_GET['url']);`),
+      negative: PHP(`header("Location: /fixed");`)
+    },
+    {
+      id: "path-traversal",
+      detector: "path_confusion",
+      positive: PHP(`include($_GET['page'] . ".php");`),
+      negative: PHP(`include('views/' . basename($_GET['page']) . '.php');`)
+    },
+    {
+      id: "ssrf",
+      detector: "ssrf",
+      positive: PHP(`$r = file_get_contents($_GET['url']);`),
+      negative: PHP(`$r = file_get_contents('https://api.fixed.example/x');`)
+    },
+    {
+      id: "xxe",
+      detector: "xxe",
+      positive: PHP(`$x = simplexml_load_string($_POST['xml']);`),
+      negative: PHP(`$x = json_decode($_POST['data']);`)
+    },
+    {
+      id: "ssti",
+      detector: "ssti",
+      positive: PHP(`return render_template_string($_GET['tpl']);`),
+      negative: PHP(`return render_template('fixed.html');`)
+    },
+    {
+      id: "wrong-sanitizer",
+      detector: "wrong_sanitizer",
+      positive: PHP(`$x = htmlspecialchars($_GET['q']);
+$wpdb->query("SELECT * FROM t WHERE c='" . $x . "'");`),
+      negative: PHP(`$x = $wpdb->prepare("SELECT * FROM t WHERE c=%s", $_GET['q']);`)
+    },
+    {
+      id: "missing-authz",
+      detector: "missing_authz",
+      positive: PHP(`add_action('wp_ajax_nopriv_set_opt', 'h');
+function h() { update_option('x', $_POST['x']); }`),
+      negative: PHP(`add_action('wp_ajax_set_opt', 'h');
+function h() { if (!current_user_can('manage_options')) wp_die(); update_option('x', $_POST['x']); }`)
+    },
+    {
+      id: "missing-nonce",
+      detector: "missing_nonce",
+      positive: PHP(`add_action('wp_ajax_del', 'h');
+function h() { wp_delete_post((int)$_POST['id']); }`),
+      negative: PHP(`add_action('wp_ajax_del', 'h');
+function h() { check_ajax_referer('n'); wp_delete_post((int)$_POST['id']); }`)
+    },
+    {
+      id: "file-upload",
+      detector: "file_upload",
+      positive: PHP(`$f = $_FILES['up'];
+move_uploaded_file($f['tmp_name'], '/uploads/' . $f['name']);`),
+      negative: PHP(`$f = $_FILES['up'];
+if (in_array(pathinfo($f['name'], PATHINFO_EXTENSION), ['jpg','png'])) move_uploaded_file($f['tmp_name'], '/uploads/' . $f['name']);`)
+    },
+    {
+      id: "sql-injection",
+      detector: "sql_injection",
+      positive: PHP(`$wpdb->get_results("SELECT * FROM t WHERE id=" . $id);`),
+      negative: PHP(`$wpdb->get_results($wpdb->prepare("SELECT * FROM t WHERE id=%d", $id));`)
+    },
+    {
+      id: "hardcoded-secret",
+      detector: "hardcoded_secret",
+      positive: PHP(`$api_key = "EXAMPLE_API_KEY_123456789";`),
+      negative: PHP(`$api_key = getenv("API_KEY");`)
+    },
+    {
+      id: "llm-injection",
+      detector: "llm_injection",
+      positive: PHP(`$u = $_POST['msg'];
+$r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content' => $u]]]);`),
+      negative: PHP(`$r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content' => 'hello']]]);`)
+    },
+    {
+      id: "graphql-exposure",
+      detector: "graphql_exposure",
+      positive: PHP(`$srv = new ApolloServer({ introspection: true, playground: true });`),
+      negative: PHP(`$srv = new ApolloServer({ introspection: false });`)
+    },
+    {
+      id: "oauth-misconfig",
+      detector: "oauth_misconfig",
+      positive: PHP(`$redirect_uri = $_GET['redirect_uri'];`),
+      negative: PHP(`$redirect_uri = 'https://app.example.com/callback';`)
+    },
+    {
+      id: "grpc-reflection",
+      detector: "grpc_reflection",
+      positive: PHP(`$server->addService(enable_server_reflection());`),
+      negative: PHP(`$server->addService($my_service);`)
+    }
+  ];
+});
+
+// src/sync.ts
+import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync24, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { join as join21 } from "node:path";
+import { homedir as homedir10 } from "node:os";
+import { fileURLToPath as fileURLToPath11 } from "node:url";
+import { spawnSync as spawnSync4 } from "node:child_process";
+function dirExists(p) {
+  try {
+    return statSync4(p).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function countFiles(dir) {
+  try {
+    let n = 0;
+    const walk = (d) => {
+      for (const e of readdirSync7(d, { withFileTypes: true })) {
+        if (e.isDirectory())
+          walk(join21(d, e.name));
+        else
+          n++;
+      }
+    };
+    walk(dir);
+    return n;
+  } catch {
+    return 0;
+  }
+}
+function syncData() {
+  if (!dirExists(DATA_ROOT2))
+    mkdirSync9(DATA_ROOT2, { recursive: true });
+  const payloadsPath = join21(DATA_ROOT2, "payloads");
+  const templatesPath = join21(DATA_ROOT2, "templates");
+  const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
+  const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
+  if (hasPayloads && hasTemplates) {
+    return {
+      payloads: { path: payloadsPath, files: countFiles(payloadsPath), synced: false },
+      templates: { path: templatesPath, files: countFiles(templatesPath), synced: false },
+      data_root: DATA_ROOT2
+    };
+  }
+  const localPayloads = join21(ROOT7, "payloads");
+  const localTemplates = join21(ROOT7, "templates");
+  let payloadsSynced = false;
+  let templatesSynced = false;
+  if (!hasPayloads && dirExists(localPayloads)) {
+    copyDir(localPayloads, payloadsPath);
+    payloadsSynced = true;
+  }
+  if (!hasTemplates && dirExists(localTemplates)) {
+    copyDir(localTemplates, templatesPath);
+    templatesSynced = true;
+  }
+  const gitOk = spawnSync4("git", ["--version"]).status === 0;
+  if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
+    const tmp = join21(DATA_ROOT2, ".tmp-clone");
+    if (dirExists(tmp))
+      rmSync4(tmp, { recursive: true, force: true });
+    const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
+    if (r.status === 0) {
+      const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
+      if (sparse.status === 0) {
+        if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
+          copyDir(join21(tmp, "payloads"), payloadsPath);
+          payloadsSynced = true;
+        }
+        if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
+          copyDir(join21(tmp, "templates"), templatesPath);
+          templatesSynced = true;
+        }
+      }
+      rmSync4(tmp, { recursive: true, force: true });
+    }
+  }
+  return {
+    payloads: { path: payloadsPath, files: countFiles(payloadsPath), synced: payloadsSynced },
+    templates: { path: templatesPath, files: countFiles(templatesPath), synced: templatesSynced },
+    data_root: DATA_ROOT2
+  };
+}
+function copyDir(src, dst) {
+  const r = spawnSync4("cp", ["-r", src, dst], { timeout: 120000 });
+  if (r.status !== 0) {
+    manualCopy(src, dst);
+  }
+}
+function manualCopy(src, dst) {
+  mkdirSync9(dst, { recursive: true });
+  for (const e of readdirSync7(src, { withFileTypes: true })) {
+    const s = join21(src, e.name);
+    const d = join21(dst, e.name);
+    if (e.isDirectory())
+      manualCopy(s, d);
+    else
+      writeFileSync8(d, readFileSync24(s));
+  }
+}
+var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
+var init_sync = __esm(() => {
+  ROOT7 = join21(fileURLToPath11(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join21(homedir10(), ".blitzstrike", "data");
+});
+
+// src/update.ts
+async function checkLatestVersion(timeoutMs = 1e4) {
+  try {
+    const controller = new AbortController;
+    const t = setTimeout(() => controller.abort(), timeoutMs);
+    const res = await fetch("https://registry.npmjs.org/blitzstrike/latest", { signal: controller.signal });
+    clearTimeout(t);
+    if (!res.ok)
+      return null;
+    const data = await res.json();
+    return data.version ?? null;
+  } catch {
+    return null;
+  }
+}
+function semverCompare(a, b) {
+  const pa = a.replace(/^v/, "").split(".").map((n) => parseInt(n, 10) || 0);
+  const pb = b.replace(/^v/, "").split(".").map((n) => parseInt(n, 10) || 0);
+  for (let i = 0;i < 3; i++) {
+    const x = pa[i] ?? 0;
+    const y = pb[i] ?? 0;
+    if (x !== y)
+      return x < y ? -1 : 1;
+  }
+  return 0;
+}
+async function runUpdate(currentVersion) {
+  const latest = await checkLatestVersion();
+  const outdated = latest !== null && semverCompare(currentVersion, latest) < 0;
+  return {
+    current: currentVersion,
+    latest,
+    outdated,
+    update_command: "npm install -g blitzstrike@latest   # or: bun add -g blitzstrike@latest",
+    data_sync: syncData()
+  };
+}
+var init_update = __esm(() => {
+  init_sync();
+});
+
+// src/release.ts
+import { readFileSync as readFileSync26, existsSync as existsSync12 } from "node:fs";
+import { join as join22 } from "node:path";
+import { fileURLToPath as fileURLToPath12 } from "node:url";
+import { execSync as execSync2 } from "node:child_process";
+function validateRelease() {
+  const checks = [];
+  checks.push({ name: "package.json version", ok: true, detail: VERSION });
+  try {
+    const changelog = readFileSync26(join22(ROOT8, "CHANGELOG.md"), "utf8");
+    const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
+    const changelogVersion = m?.[1] ?? null;
+    checks.push({
+      name: "CHANGELOG version",
+      ok: changelogVersion === VERSION,
+      detail: changelogVersion ?? "no version header found"
+    });
+  } catch {
+    checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
+  }
+  try {
+    const tag = execSync2("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
+  } catch {
+    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
+  }
+  try {
+    const published = execSync2("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
+    checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
+  } catch {
+    checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
+  }
+  checks.push({
+    name: "Lockfile",
+    ok: lockfilePresent(),
+    detail: lockfilePresent() ? "present (bun.lock / package-lock.json)" : "missing",
+    soft: true
+  });
+  return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
+}
+function lockfilePresent() {
+  return existsSync12(join22(ROOT8, "package-lock.json")) || existsSync12(join22(ROOT8, "bun.lock")) || existsSync12(join22(ROOT8, "bun.lockb"));
+}
+var ROOT8;
+var init_release = __esm(() => {
+  init_version();
+  ROOT8 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
+});
+
+// src/dependency.ts
+import { readFileSync as readFileSync27 } from "node:fs";
+import { join as join23 } from "node:path";
+import { fileURLToPath as fileURLToPath13 } from "node:url";
+function checkDependencies() {
+  let pkg = {};
+  try {
+    pkg = JSON.parse(readFileSync27(join23(ROOT9, "package.json"), "utf8"));
+  } catch {
+    return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
+  }
+  const installScriptNames = ["preinstall", "install", "postinstall", "prepare"];
+  const installScripts = installScriptNames.filter((n) => pkg.scripts?.[n]).map((n) => ({ name: n, command: pkg.scripts[n] }));
+  const allDeps = {
+    ...pkg.dependencies ?? {},
+    ...pkg.devDependencies ?? {},
+    ...pkg.peerDependencies ?? {},
+    ...pkg.optionalDependencies ?? {}
+  };
+  const gitDependencies = Object.entries(allDeps).filter(([, v]) => /^(git\+|git:|github:|gitlab:|bitbucket:|\w+:\/\/)/.test(v)).map(([name, v]) => `${name}@${v}`);
+  const total = Object.keys(allDeps).length;
+  return {
+    install_scripts: installScripts,
+    git_dependencies: gitDependencies,
+    total_dependencies: total,
+    safe: installScripts.length === 0 && gitDependencies.length === 0
+  };
+}
+var ROOT9;
+var init_dependency = __esm(() => {
+  ROOT9 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
+});
+
+// src/cli.ts
+import { readFileSync as readFileSync28, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join24, dirname as dirname4 } from "node:path";
+import { homedir as homedir11 } from "node:os";
+import { fileURLToPath as fileURLToPath14 } from "node:url";
+import { spawnSync as spawnSync5 } from "node:child_process";
+function which(cmd) {
+  return spawnSync5("sh", ["-c", 'command -v "$1" >/dev/null 2>&1', "sh", cmd]).status === 0;
+}
+function installedCount() {
+  const tools = loadTools();
+  const installed = tools.filter((t) => which(t.name)).map((t) => t.name);
+  return { total: tools.length, installed, missing: tools.map((t) => t.name).filter((n) => !installed.includes(n)) };
+}
+async function runDoctor() {
+  console.log(`BlitzStrike doctor — environment health check
+`);
+  const issues = [];
+  const bunOk = which("bun") || which("node");
+  issues.push({
+    name: "Runtime (bun/node)",
     status: bunOk ? "ok" : "fail",
     detail: bunOk ? `node ${process.version}` : "neither bun nor node found",
     fix: bunOk ? undefined : "install bun: curl -fsSL https://bun.sh/install | bash"
@@ -30999,70 +32257,9 @@ function recordAudit(event, opts = {}) {
 
 // src/evidence.ts
 init_version();
+init_secrets();
+init_secrets();
 import { createHash as createHash2 } from "node:crypto";
-
-// src/secrets.ts
-var SECRET_FIELDS = "api[_-]?key|apikey|api[_-]?secret|access[_-]?key|access[_-]?token|secret[_-]?key|secret[_-]?access[_-]?key|auth[_-]?token|client[_-]?secret|consumer[_-]?secret|consumer[_-]?key|private[_-]?key|db[_-]?password|database[_-]?password|db[_-]?pass|passwd|password|jwt[_-]?secret|encryption[_-]?key|encryption[_-]?password|github[_-]?token|gitlab[_-]?token|stripe[_-]?key|sendgrid[_-]?api[_-]?key|datadog[_-]?api[_-]?key|cloudflare[_-]?api[_-]?key|slack[_-]?token|aws[_-]?access[_-]?key[_-]?id|aws[_-]?secret[_-]?access[_-]?key|aws[_-]?session[_-]?token|bot[_-]?token";
-var SECRET_FORMATS = [
-  { name: "JWT", re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g },
-  { name: "AWS access key", re: /\bAKIA[0-9A-Z]{16}\b/g },
-  { name: "GitHub PAT (classic)", re: /\bghp_[A-Za-z0-9]{20,}\b/g },
-  { name: "GitHub PAT (fine-grained)", re: /\bgithub_pat_[A-Za-z0-9_]{20,}\b/g },
-  { name: "OpenAI/Stripe key", re: /\bsk-[A-Za-z0-9]{20,}\b/g },
-  { name: "Stripe live/test key", re: /\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g },
-  { name: "Slack token", re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
-  { name: "Google API key", re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
-  { name: "Twilio account SID", re: /\bAC[0-9a-f]{32}\b/g },
-  { name: "SendGrid API key", re: /\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g },
-  { name: "Mailgun API key", re: /\bkey-[0-9a-zA-Z]{32}\b/g },
-  { name: "PEM private key", re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/g }
-];
-function shannonEntropy(s) {
-  if (!s)
-    return 0;
-  const freq = new Map;
-  for (const c of s)
-    freq.set(c, (freq.get(c) ?? 0) + 1);
-  let e = 0;
-  for (const n of freq.values()) {
-    const p = n / s.length;
-    e -= p * Math.log2(p);
-  }
-  return e;
-}
-var REDACTION_PATTERNS = [
-  [/(authorization\s*[:=]\s*)(bearer\s+)?[A-Za-z0-9._~+/=-]{8,}/gi, "$1$2[REDACTED]"],
-  [/(api[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
-  [/(access[_-]?token\s*[:=]\s*)["']?[A-Za-z0-9._-]{16,}["']?/gi, "$1[REDACTED]"],
-  [/(secret\s*[:=]\s*)["']?[A-Za-z0-9._/-]{16,}["']?/gi, "$1[REDACTED]"],
-  [/(password\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
-  [/(passwd\s*[:=]\s*)["']?[^"'\s,}&]{4,}["']?/gi, "$1[REDACTED]"],
-  [/(private[_-]?key\s*[:=]\s*)["']?[A-Za-z0-9+/=_-]{16,}["']?/gi, "$1[REDACTED]"],
-  [/(session\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
-  [/(cookie\s*[:=]\s*)["']?[A-Za-z0-9._-]{12,}["']?/gi, "$1[REDACTED]"],
-  [/(set-cookie\s*:\s*)[^\r\n]+/gi, "$1[REDACTED]"],
-  [/\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{4,}/g, "[REDACTED]"],
-  [/AKIA[0-9A-Z]{16}/g, "[REDACTED]"],
-  [/ghp_[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-  [/github_pat_[A-Za-z0-9_]{20,}/g, "[REDACTED]"],
-  [/sk-[A-Za-z0-9]{20,}/g, "[REDACTED]"],
-  [/\b(?:sk|pk|rk)_(?:live|test)_[0-9a-zA-Z]{10,}\b/g, "[REDACTED]"],
-  [/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g, "[REDACTED]"],
-  [/\bAIza[0-9A-Za-z_-]{35}\b/g, "[REDACTED]"],
-  [/\bAC[0-9a-f]{32}\b/g, "[REDACTED]"],
-  [/\bSG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}\b/g, "[REDACTED]"],
-  [/\bkey-[0-9a-zA-Z]{32}\b/g, "[REDACTED]"],
-  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED]"]
-];
-function redactSecrets(text) {
-  let out = text;
-  for (const [re, repl] of REDACTION_PATTERNS) {
-    out = out.replace(re, repl);
-  }
-  return out;
-}
-
-// src/evidence.ts
 function hasSecrets(text) {
   return redactSecrets(text) !== text;
 }
@@ -31327,6 +32524,7 @@ function rejectFinding(finding, status, reason, evidence) {
 }
 
 // src/sinks.ts
+init_secrets();
 var NEXT = {
   rce: "test the sink with a marker payload (eval -> '1+1' -> 2, then sleep vs no-sleep / write a marker file) — this is direct RCE",
   ssti: "probe {{7*7}} / {{7*'7'}} for evaluation; if it evaluates, it is SSTI -> RCE",
@@ -56084,1097 +57282,179 @@ async function browserAgent(op, args = []) {
       return browserBack();
     case "forward":
       return browserForward();
-    case "get_cookie":
-      return browserGetCookie(args[0] ?? "");
-    case "set_cookie":
-      return browserSetCookie(args[0] ?? "", args[1] ?? "");
-  }
-}
-function browserDiagnostics() {
-  return { console_errors: [...consoleErrors], page_errors: [...pageErrors] };
-}
-
-// src/server.ts
-init_mcp_status();
-
-// src/route-confusion.ts
-var SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
-function lines(code) {
-  return code.split(`
-`);
-}
-function lineNo(code, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++)
-    if (code.charCodeAt(i) === 10)
-      n++;
-  return n;
-}
-function userControlled(scope) {
-  return SOURCE_TOKENS.test(scope);
-}
-var DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
-var DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
-var BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
-var ROUTE_MATCH_RE = /\b(preg_match|preg_match_all|strpos|stripos|str_contains)\s*\(/i;
-var NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
-var WHITELIST_LOOKUP = /\$[A-Za-z_]\w*\s*\[\s*\$[A-Za-z_]\w*\s*\]/;
-var CANONICALIZE = /\b(basename|realpath|normalize|canonical|resolve|toRealPath)\s*\(/i;
-function detectDynamicDispatch(code, file, out) {
-  const ls = lines(code);
-  DYNAMIC_DISPATCH_RE.lastIndex = 0;
-  let m;
-  while ((m = DYNAMIC_DISPATCH_RE.exec(code)) !== null) {
-    const ln = lineNo(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    if (!userControlled(l) && !userControlled(scope))
-      continue;
-    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "dynamic_dispatch",
-      category: "Route confusion (user-controlled dispatch)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: `\`${m[1]}()\` invoked with an attacker-controlled callback/route — the request selects the handler.`
-    });
-  }
-}
-function detectDynamicMethod(code, file, out) {
-  const ls = lines(code);
-  DYNAMIC_METHOD_RE.lastIndex = 0;
-  let m;
-  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
-    const ln = lineNo(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    if (!userControlled(l) && !userControlled(scope))
-      continue;
-    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "dynamic_method_call",
-      category: "Route confusion (dynamic method dispatch)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
-    });
-  }
-}
-function detectDynamicInclude(code, file, out) {
-  const ls = lines(code);
-  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    if (!userControlled(l) && !userControlled(scope))
-      continue;
-    if (CANONICALIZE.test(scope + `
-` + l))
-      continue;
-    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "dynamic_include",
-      category: "Route confusion (dynamic file include)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
-    });
-  }
-}
-function detectBatchForwarding(code, file, out) {
-  BATCH_LOOP_RE.lastIndex = 0;
-  let m;
-  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
-    const ln = lineNo(code, m.index);
-    const body = lines(code).slice(ln - 1, ln + 8).join(`
-`);
-    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
-    if (!forwards)
-      continue;
-    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
-    if (rechecks)
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "batch_forwarding",
-      category: "Route confusion (batch/proxy forwarding)",
-      severity: "high",
-      evidence: lines(code)[ln - 1]?.trim() ?? "",
-      detail: "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
-    });
-  }
-}
-function detectRouteNormalization(code, file, out) {
-  const ls = lines(code);
-  for (let i = 0;i < ls.length; i++) {
-    const l = ls[i];
-    if (!ROUTE_MATCH_RE.test(l))
-      continue;
-    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
-`);
-    if (!userControlled(scope))
-      continue;
-    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
-      continue;
-    if (/preg_match\s*\(\s*["'][^"']*\^[^"']*\$[^"']*["']/.test(l))
-      continue;
-    out.push({
-      file,
-      line: i + 1,
-      type: "route_normalization_gap",
-      category: "Route confusion (missing path normalization)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
-    });
-  }
-}
-function detectRouteConfusion(code, file) {
-  const out = [];
-  detectDynamicDispatch(code, file, out);
-  detectDynamicMethod(code, file, out);
-  detectDynamicInclude(code, file, out);
-  detectBatchForwarding(code, file, out);
-  detectRouteNormalization(code, file, out);
-  return out;
-}
-
-// src/security-state.ts
-var SANITIZERS2 = {
-  esc_sql: { context: "sql", level: "sanitized" },
-  addslashes: { context: "sql", level: "sanitized" },
-  mysqli_real_escape_string: { context: "sql", level: "sanitized" },
-  mysql_real_escape_string: { context: "sql", level: "sanitized" },
-  pg_escape_string: { context: "sql", level: "sanitized" },
-  sanitize_text_field: { context: "html", level: "sanitized" },
-  sanitize_textarea_field: { context: "html", level: "sanitized" },
-  esc_html: { context: "html", level: "sanitized" },
-  esc_html__: { context: "html", level: "sanitized" },
-  htmlspecialchars: { context: "html", level: "sanitized" },
-  htmlentities: { context: "html", level: "sanitized" },
-  wp_kses: { context: "html", level: "sanitized" },
-  wp_kses_post: { context: "html", level: "sanitized" },
-  wp_kses_data: { context: "html", level: "sanitized" },
-  strip_tags: { context: "html", level: "sanitized" },
-  esc_attr: { context: "html_attr", level: "sanitized" },
-  esc_url: { context: "url", level: "sanitized" },
-  esc_url_raw: { context: "url", level: "sanitized" },
-  esc_textarea: { context: "html", level: "sanitized" },
-  esc_js: { context: "js", level: "sanitized" },
-  urlencode: { context: "url", level: "sanitized" },
-  rawurlencode: { context: "url", level: "sanitized" },
-  wp_json_encode: { context: "json", level: "sanitized" },
-  json_encode: { context: "json", level: "sanitized" },
-  absint: { context: "int", level: "validated" },
-  intval: { context: "int", level: "validated" },
-  sanitize_key: { context: "key", level: "sanitized" },
-  sanitize_email: { context: "email", level: "validated" },
-  sanitize_file_name: { context: "filename", level: "validated" },
-  sanitize_url: { context: "url", level: "validated" },
-  sanitize_title: { context: "slug", level: "validated" },
-  sanitize_title_with_dashes: { context: "slug", level: "validated" },
-  sanitize_user: { context: "username", level: "validated" },
-  filter_var: { context: "validated", level: "validated" },
-  wp_validate_boolean: { context: "validated", level: "validated" }
-};
-var PSEUDO_SANITIZERS = new Set([
-  "trim",
-  "ltrim",
-  "rtrim",
-  "strtolower",
-  "strtoupper",
-  "ucfirst",
-  "ucwords",
-  "base64_encode",
-  "base64_decode",
-  "urldecode",
-  "rawurldecode",
-  "stripslashes",
-  "html_entity_decode",
-  "htmlspecialchars_decode",
-  "json_decode",
-  "unserialize",
-  "serialize",
-  "substr",
-  "mb_substr",
-  "explode",
-  "implode",
-  "str_replace",
-  "preg_replace",
-  "nl2br",
-  "strval",
-  "number_format",
-  "sprintf",
-  "md5",
-  "sha1",
-  "hash",
-  "crypt",
-  "chr",
-  "ord",
-  "strrev",
-  "str_repeat",
-  "str_pad"
-]);
-var SINK_REQUIREMENTS = {
-  sql_execution: ["sql", "sql_param", "int"],
-  code_execution: ["code"],
-  command_execution: ["code"],
-  deserialization: ["code"],
-  file_operations: ["filename"],
-  redirect: ["url"],
-  html_render: ["html"]
-};
-var SOURCE_TOKENS2 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|->(input|query|request)\(|\breq\.(query|body|params|headers|cookies)|\bgetParameter\(/;
-function analyzeSecurityState(input) {
-  let state = "tainted";
-  let context = null;
-  for (const fn of input.sanitizers) {
-    const s = SANITIZERS2[fn];
-    if (!s)
-      continue;
-    if (s.level === "validated") {
-      if (state === "tainted" || state === "sanitized") {
-        state = "validated";
-        context = s.context;
-      }
-    } else if (state === "tainted") {
-      state = "sanitized";
-      context = s.context;
-    }
-  }
-  const required = SINK_REQUIREMENTS[input.sinkType] ?? [];
-  if (required.length === 0) {
-    return { verdict: "unknown", state, context, required, reason: `sink type '${input.sinkType}' not in the requirements table` };
-  }
-  if (state === "tainted") {
-    return { verdict: "vulnerable", state, context, required, reason: `raw tainted input reaches a ${input.sinkType} sink with no sanitization` };
-  }
-  if (state === "validated") {
-    return { verdict: "safe", state, context, required, reason: `input validated (${context}) — safe for any sink` };
-  }
-  if (state === "sanitized") {
-    if (context && required.includes(context)) {
-      return { verdict: "safe", state, context, required, reason: `sanitized for '${context}' — matches sink requirement ${required.join("/")}` };
-    }
-    return { verdict: "vulnerable", state, context, required, reason: `sanitized for '${context}' but this sink requires ${required.join("/")} — WRONG sanitizer (context mismatch)` };
-  }
-  return { verdict: "unknown", state, context, required, reason: "unhandled state" };
-}
-function sinkTypeOf(line) {
-  if (/\$wpdb->(query|get_var|get_row|get_results|get_col)|mysqli_query\s*\(|mysql_query\s*\(|pg_query\s*\(|->query\s*\(/.test(line) && !/->prepare\s*\(/.test(line))
-    return "sql_execution";
-  if (/\b(eval|assert)\s*\(/.test(line))
-    return "code_execution";
-  if (/\b(system|exec|shell_exec|passthru|proc_open|popen)\s*\(/.test(line))
-    return "command_execution";
-  if (/\b(unserialize|maybe_unserialize)\s*\(/.test(line))
-    return "deserialization";
-  if (/\b(file_get_contents|file_put_contents|fopen|readfile|include|require|include_once|require_once)\s*\(/.test(line))
-    return "file_operations";
-  if (/header\s*\(\s*['"]Location/i.test(line))
-    return "redirect";
-  return null;
-}
-function detectWrongSanitizer(code, file) {
-  const out = [];
-  const ls = code.split(`
-`);
-  const varSanitizer = new Map;
-  for (const line of ls) {
-    const m = line.match(/\$(\w+)\s*=\s*([a-zA-Z0-9_]+)\s*\(\s*([^)]*)\s*\)\s*;?/);
-    if (!m)
-      continue;
-    const [, varName, fn, arg] = m;
-    if (!SOURCE_TOKENS2.test(arg))
-      continue;
-    if (SANITIZERS2[fn])
-      varSanitizer.set(varName, fn);
-    else if (PSEUDO_SANITIZERS.has(fn))
-      varSanitizer.set(varName, fn);
-  }
-  for (let i = 0;i < ls.length; i++) {
-    const line = ls[i];
-    const sinkType = sinkTypeOf(line);
-    if (!sinkType)
-      continue;
-    const required = SINK_REQUIREMENTS[sinkType] ?? [];
-    for (const [varName, fn] of varSanitizer) {
-      if (!new RegExp(`\\$${varName}\\b`).test(line))
-        continue;
-      const sanitizer = SANITIZERS2[fn];
-      const context = sanitizer?.context ?? null;
-      if (sanitizer && (sanitizer.level === "validated" || context && required.includes(context)))
-        continue;
-      const detail = sanitizer ? `$${varName} was sanitized for '${context}' (${fn}()) but this ${sinkType} sink requires ${required.join("/")} — WRONG sanitizer (context mismatch).` : `$${varName} passed through ${fn}() — a NON-sanitizing transformation — and still reaches this ${sinkType} sink as raw tainted input. ${fn}() does not neutralize ${required.join("/")} context.`;
-      out.push({
-        file,
-        line: i + 1,
-        type: "wrong_sanitizer",
-        category: "Wrong-context sanitization / pseudo-sanitizer",
-        severity: "high",
-        evidence: line.trim(),
-        detail
-      });
-    }
-  }
-  const seen = new Set;
-  return out.filter((f) => {
-    const key = `${f.type}:${f.line}`;
-    if (seen.has(key))
-      return false;
-    seen.add(key);
-    return true;
-  });
-}
-
-// src/framework-security.ts
-var FRAMEWORKS = {
-  wordpress: {
-    framework: "wordpress",
-    auth_primitives: ["current_user_can", "current_user_can_edit_post", "is_user_logged_in", "authorize"],
-    nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer", "verify_nonce"],
-    entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "admin_post_", "admin_post_nopriv_", "register_rest_route", "add_shortcode", "init", "rest_api_init"],
-    sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "esc_attr", "esc_url", "wp_kses", "wp_kses_post", "absint", "sanitize_email", "sanitize_file_name"]
-  },
-  wp: {
-    framework: "wordpress",
-    auth_primitives: ["current_user_can", "is_user_logged_in", "authorize"],
-    nonce_primitives: ["wp_verify_nonce", "check_ajax_referer", "check_admin_referer"],
-    entry_point_hooks: ["wp_ajax_", "wp_ajax_nopriv_", "register_rest_route"],
-    sanitizers: ["sanitize_text_field", "esc_sql", "esc_html", "absint"]
-  },
-  laravel: {
-    framework: "laravel",
-    auth_primitives: ["auth", "authorize", "Gate::", "can:", "->middleware('auth'", "->can(", "$this->authorize", "@can", "@cannot", "policy"],
-    nonce_primitives: ["@csrf", "csrf_field", "VerifyCsrfToken"],
-    entry_point_hooks: ["Route::get", "Route::post", "Route::put", "Route::delete", "Route::resource", "Route::match"],
-    sanitizers: ["e(", "htmlspecialchars", "clean(", "strip_tags"]
-  },
-  django: {
-    framework: "django",
-    auth_primitives: ["login_required", "permission_required", "user_passes_test", "LoginRequiredMixin", "PermissionRequiredMixin", "permission_classes", "IsAuthenticated", "has_permission"],
-    nonce_primitives: ["csrf_protect", "CsrfViewMiddleware", "@csrf"],
-    entry_point_hooks: ["def ", "@api_view", "path(", "url(", "re_path("],
-    sanitizers: ["escape(", "mark_safe", "html.escape"]
-  },
-  flask: {
-    framework: "flask",
-    auth_primitives: ["login_required", "@login_required", "current_user.is_authenticated", "permission_required"],
-    nonce_primitives: ["CSRFProtect", "csrf_token"],
-    entry_point_hooks: ["@app.route", "@blueprint.route", "@bp.route"],
-    sanitizers: ["escape(", "Markup", "html.escape"]
-  },
-  express: {
-    framework: "express",
-    auth_primitives: ["requireAuth", "authenticate", "passport.authenticate", "req.user", "isAuthenticated", "ensureAuthenticated", "requireLogin", "authorize", "authMiddleware"],
-    nonce_primitives: ["csurf", "csrfProtection", "helmet"],
-    entry_point_hooks: ["app.get", "app.post", "router.get", "router.post"],
-    sanitizers: ["escapeHtml", "encodeURIComponent", "sanitize", "xss"]
-  },
-  spring: {
-    framework: "spring",
-    auth_primitives: ["@PreAuthorize", "@Secured", "@RolesAllowed", "hasRole", "hasAuthority", "isAuthenticated", "SecurityContextHolder"],
-    nonce_primitives: ["csrf", "CsrfToken"],
-    entry_point_hooks: ["@GetMapping", "@PostMapping", "@RequestMapping", "@Controller"],
-    sanitizers: ["HtmlUtils.htmlEscape", "escapeHtml", "StringEscapeUtils"]
-  },
-  symfony: {
-    framework: "symfony",
-    auth_primitives: ["is_granted", "denyAccessUnlessGranted", "->isGranted(", "IsGranted", "Voter"],
-    nonce_primitives: ["isCsrfTokenValid", "csrf_token"],
-    entry_point_hooks: ["#[Route", "@Route", "#[Get", "#[Post"],
-    sanitizers: ["e(", "htmlspecialchars", "escape("]
-  },
-  aspnet: {
-    framework: "aspnet",
-    auth_primitives: ["[Authorize", "[AllowAnonymous", "User.Identity", "IsInRole", "AuthorizeAsync", "IAuthorizationService"],
-    nonce_primitives: ["ValidateAntiForgeryToken", "Antiforgery"],
-    entry_point_hooks: ["[HttpGet", "[HttpPost", "[Route("],
-    sanitizers: ["HtmlEncoder", "Html.Raw", "UrlEncoder"]
-  },
-  rails: {
-    framework: "rails",
-    auth_primitives: ["authenticate_user!", "authorize", "before_action :authenticate", "before_action :authorize", "current_user"],
-    nonce_primitives: ["protect_from_forgery", "form_authenticity_token"],
-    entry_point_hooks: ["def ", "before_action"],
-    sanitizers: ["h(", "html_escape", "sanitize"]
-  }
-};
-function frameworkKnowledge(framework = "wordpress") {
-  return FRAMEWORKS[framework.toLowerCase()] ?? null;
-}
-function listFrameworks2() {
-  const s = new Set;
-  for (const k of Object.keys(FRAMEWORKS))
-    s.add(FRAMEWORKS[k].framework);
-  return [...s];
-}
-function lineNoOf(code, pos) {
-  let n = 1;
-  for (let i = 0;i < pos; i++)
-    if (code.charCodeAt(i) === 10)
-      n++;
-  return n;
-}
-function functionBody(code, name) {
-  const idx = code.search(new RegExp(`function\\s+${name}\\s*\\(`));
-  if (idx === -1)
-    return null;
-  const open = code.indexOf("{", idx);
-  if (open === -1)
-    return null;
-  let depth = 0;
-  for (let i = open;i < code.length; i++) {
-    if (code[i] === "{")
-      depth++;
-    else if (code[i] === "}") {
-      depth--;
-      if (depth === 0)
-        return code.slice(open, i + 1);
-    }
-  }
-  return code.slice(open);
-}
-function handlerName(expr) {
-  const quoted = expr.match(/['"]([A-Za-z_][A-Za-z0-9_]*)['"]/g);
-  if (quoted && quoted.length > 0)
-    return quoted[quoted.length - 1].replace(/['"]/g, "");
-  return null;
-}
-var INDIRECT_AUTH = /\b[a-zA-Z0-9_]*(auth|permission|cap|nonce|can_|check|verify|allow)[a-zA-Z0-9_]*\s*\(/;
-var AUTH_RE = /current_user_can|is_user_logged_in|is_super_admin|current_user_can_edit_post|authorize/;
-var NONCE_RE = /wp_verify_nonce|check_ajax_referer|check_admin_referer|verify_nonce/;
-var DANGEROUS_OP_RE = /\b(update_option|add_option|delete_option|update_site_option|delete_site_option|update_post_meta|add_post_meta|delete_post_meta|update_user_meta|add_user_meta|delete_user_meta|update_metadata|add_metadata|delete_metadata|set_transient|delete_transient|wp_insert_post|wp_update_post|wp_delete_post|wp_trash_post|wp_untrash_post|wp_insert_comment|wp_update_comment|wp_delete_comment|wp_insert_user|wp_update_user|wp_delete_user|wp_create_user|wp_set_current_user|wp_set_auth_cookie|set_user_role|set_role|add_role|remove_role|add_cap|remove_cap|wp_mail|wp_new_user_notification|wp_handle_upload|move_uploaded_file|wp_upload_bits|wp_set_object_terms|wp_set_post_terms|wp_schedule_event|wp_clear_scheduled_hook|wp_redirect|file_put_contents|unlink|rename|wpdb->query|wpdb->insert|wpdb->update|wpdb->delete|wpdb->replace)\s*\(/;
-function detectWpAuthz(code, file, out) {
-  const ajaxRe = /add_action\s*\(\s*['"](wp_ajax(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
-  let m;
-  while ((m = ajaxRe.exec(code)) !== null) {
-    const hook = m[1];
-    const handler = handlerName(m[2]);
-    if (!handler)
-      continue;
-    const nopriv = hook.startsWith("wp_ajax_nopriv_");
-    const body = functionBody(code, handler);
-    if (!body)
-      continue;
-    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
-    const hasNonce = NONCE_RE.test(body);
-    const dangerous = DANGEROUS_OP_RE.test(body);
-    const line = lineNoOf(code, m.index);
-    if (nopriv && !hasCap && dangerous) {
-      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated AJAX handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated AJAX handler '${handler}()' performs a privileged/state-changing operation with no current_user_can()/authorization check — auth bypass / privilege escalation.` });
-    }
-    if (!hasNonce && dangerous) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `AJAX handler '${handler}()' performs a state-changing operation without nonce verification (wp_verify_nonce / check_ajax_referer) — CSRF.` });
-    }
-  }
-  const adminRe = /add_action\s*\(\s*['"](admin_post(?:_nopriv)?_\w+)['"]\s*,\s*(.+?)\s*\)/g;
-  while ((m = adminRe.exec(code)) !== null) {
-    const hook = m[1];
-    const handler = handlerName(m[2]);
-    if (!handler)
-      continue;
-    const nopriv = hook.startsWith("admin_post_nopriv_");
-    const body = functionBody(code, handler);
-    if (!body)
-      continue;
-    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
-    const hasNonce = NONCE_RE.test(body);
-    const dangerous = DANGEROUS_OP_RE.test(body);
-    const line = lineNoOf(code, m.index);
-    if (nopriv && !hasCap && dangerous) {
-      out.push({ file, line, type: "missing_authz", category: "Missing capability check (unauthenticated admin-post handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Unauthenticated admin-post handler '${handler}()' performs a privileged/state-changing operation with no authorization check — auth bypass / privilege escalation.` });
-    }
-    if (!hasNonce && dangerous) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `admin-post handler '${handler}()' performs a state-changing operation without nonce verification — CSRF.` });
-    }
-  }
-  const restRe = /register_rest_route\s*\(\s*['"]([^'"]+)['"]\s*,\s*['"]([^'"]+)['"]/g;
-  while ((m = restRe.exec(code)) !== null) {
-    const line = lineNoOf(code, m.index);
-    const window2 = code.slice(m.index, m.index + 800);
-    const pc = window2.match(/permission_callback['"]?\s*=>\s*(.+?)(?:,|\s*\n|\])/);
-    if (pc) {
-      const expr = pc[1].trim();
-      if (/__return_true/.test(expr)) {
-        out.push({ file, line, type: "missing_authz", category: "REST route explicitly public (__return_true)", severity: "medium", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' sets permission_callback to __return_true (always allow) — verify the endpoint does not expose sensitive data or perform privileged actions.` });
-      }
-      continue;
-    }
-    out.push({ file, line, type: "missing_authz", category: "REST route missing permission_callback", severity: "high", evidence: `register_rest_route('${m[1]}', '${m[2]}')`, detail: `REST route '${m[1]}${m[2]}' has no permission_callback — the endpoint defaults to public (auth bypass).` });
-  }
-  const formRe = /add_action\s*\(\s*['"](init|admin_init|wp_loaded|template_redirect|parse_request|wp)['"]\s*,\s*(.+?)\s*\)/g;
-  while ((m = formRe.exec(code)) !== null) {
-    const hook = m[1];
-    const handler = handlerName(m[2]);
-    if (!handler)
-      continue;
-    const body = functionBody(code, handler);
-    if (!body)
-      continue;
-    if (!/\$_(GET|POST|REQUEST|COOKIE|SERVER)\b|php:\/\/input|filter_input|file_get_contents\(['"]php:\/\/input/.test(body))
-      continue;
-    const hasCap = AUTH_RE.test(body) || INDIRECT_AUTH.test(body);
-    const hasNonce = NONCE_RE.test(body);
-    const dangerous = DANGEROUS_OP_RE.test(body);
-    const line = lineNoOf(code, m.index);
-    if (!hasNonce && dangerous) {
-      out.push({ file, line, type: "missing_nonce", category: "Missing nonce verification (direct request handler)", severity: "medium", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') performs a state-changing operation without nonce verification — CSRF.` });
-    }
-    if (!hasCap && dangerous) {
-      out.push({ file, line, type: "missing_authz", category: "Missing capability check (direct request handler)", severity: "high", evidence: `add_action('${hook}', ...)`, detail: `Request handler '${handler}()' (on '${hook}') performs a privileged/state-changing operation with no capability check — auth bypass / privilege escalation.` });
-    }
-  }
-}
-var ROUTE_DETECTORS = [
-  { framework: "laravel", entry: /Route::(?:get|post|put|patch|delete|any|match|resource)\s*\(\s*['"][^'"]+['"]/g, auth: /->middleware\s*\(\s*['"]auth|middleware\s*\(\s*\[[^\]]*['"]auth|->can\s*\(|\$this->authorize|Gate::|authorize\s*\(|@can\b/, window: 2 },
-  { framework: "django", entry: /@api_view\s*\(|def\s+\w+\s*\(\s*request\s*[,)]/g, auth: /login_required|permission_required|user_passes_test|LoginRequiredMixin|PermissionRequiredMixin|permission_classes|IsAuthenticated|has_permission/, window: 3 },
-  { framework: "flask", entry: /@(?:app|bp|blueprint)\.route\s*\(/g, auth: /login_required|current_user\.is_authenticated|permission_required/, window: 3 },
-  { framework: "express", entry: /(?:app|router)\.(?:get|post|put|delete|patch|use)\s*\(\s*['"][^'"]+['"]/g, auth: /requireAuth|authenticate|passport\.authenticate|req\.user|isAuthenticated|ensureAuthenticated|requireLogin|\.authorize|authMiddleware/, window: 2 },
-  { framework: "spring", entry: /@(?:Get|Post|Put|Delete|Patch|Request)Mapping\s*\(/g, auth: /@PreAuthorize|@Secured|@RolesAllowed|hasRole|hasAuthority|isAuthenticated|SecurityContextHolder/, window: 2 },
-  { framework: "symfony", entry: /#\[(?:Route|Get|Post|Put|Delete|Patch)\b|@Route\s*\(/g, auth: /is_granted|denyAccessUnlessGranted|->isGranted\s*\(|IsGranted|Voter/, window: 2 },
-  { framework: "aspnet", entry: /\[Http(?:Get|Post|Put|Delete|Patch)\b/g, auth: /\[Authorize|User\.Identity|IsInRole|AuthorizeAsync|\[AllowAnonymous|IAuthorizationService/, window: 2 },
-  { framework: "rails", entry: /class\s+\w+\s*<\s*ApplicationController/g, auth: /before_action\s+:authenticate|before_action\s+:authorize|authenticate_user!|authorize\s+|current_user|authenticate/, window: 6 }
-];
-function detectRouteAuthz(code, file, out) {
-  const ls = code.split(`
-`);
-  for (const d of ROUTE_DETECTORS) {
-    d.entry.lastIndex = 0;
-    let m;
-    while ((m = d.entry.exec(code)) !== null) {
-      const ln = lineNoOf(code, m.index);
-      const window2 = ls.slice(Math.max(0, ln - d.window), Math.min(ls.length, ln + d.window + 1)).join(`
-`);
-      if (d.auth.test(window2))
-        continue;
-      out.push({
-        file,
-        line: ln,
-        type: "missing_authz",
-        category: `${d.framework}: endpoint without authorization`,
-        severity: "high",
-        evidence: (ls[ln - 1] ?? "").trim(),
-        detail: `${d.framework} endpoint has no authorization enforcement in the surrounding ${d.window}-line window — auth bypass / privilege escalation.`
-      });
-    }
+    case "get_cookie":
+      return browserGetCookie(args[0] ?? "");
+    case "set_cookie":
+      return browserSetCookie(args[0] ?? "", args[1] ?? "");
   }
 }
-function detectMissingAuthz(code, file) {
-  const out = [];
-  detectWpAuthz(code, file, out);
-  detectRouteAuthz(code, file, out);
-  const seen = new Set;
-  return out.filter((f) => {
-    const key = `${f.type}:${f.line}`;
-    if (seen.has(key))
-      return false;
-    seen.add(key);
-    return true;
-  });
+function browserDiagnostics() {
+  return { console_errors: [...consoleErrors], page_errors: [...pageErrors] };
 }
 
-// src/complex-bugs.ts
-var SOURCE_TOKENS3 = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post|data|body|headers|cookies|params)|getParameter\(|req\.(query|body|params|headers|cookies)/;
-function lines2(code) {
+// src/server.ts
+init_mcp_status();
+
+// src/route-confusion.ts
+var SOURCE_TOKENS = /\$_(GET|POST|REQUEST|COOKIE|FILES|SERVER)\b|\$request->|\$req->|request\.(get|input|query|post)|getParameter\(|req\.(query|body|params)/;
+function lines(code) {
   return code.split(`
 `);
 }
-function lineNo2(code, pos) {
+function lineNo(code, pos) {
   let n = 1;
   for (let i = 0;i < pos; i++)
     if (code.charCodeAt(i) === 10)
       n++;
   return n;
 }
-function stripCommentsOnly(code) {
-  const out = code.split("");
-  const n = code.length;
-  let i = 0;
-  while (i < n) {
-    const c = code[i];
-    const nc = code[i + 1];
-    if (c === "'" || c === '"') {
-      const q = c;
-      i++;
-      while (i < n && code[i] !== q) {
-        if (code[i] === "\\")
-          i++;
-        i++;
-      }
-      i++;
-      continue;
-    }
-    if (c === "/" && nc === "/" || c === "#") {
-      while (i < n && code[i] !== `
-`) {
-        out[i] = " ";
-        i++;
-      }
-      continue;
-    }
-    if (c === "/" && nc === "*") {
-      out[i] = " ";
-      out[i + 1] = " ";
-      i += 2;
-      while (i < n && !(code[i] === "*" && code[i + 1] === "/")) {
-        if (code[i] !== `
-`)
-          out[i] = " ";
-        i++;
-      }
-      if (i < n) {
-        out[i] = " ";
-        if (i + 1 < n)
-          out[i + 1] = " ";
-        i += 2;
-      }
-      continue;
-    }
-    i++;
-  }
-  return out.join("");
-}
-var MAGIC_METHODS = /\b(__destruct|__wakeup|__toString|__invoke|__call|__get|__set|__isset|__unset|__sleep)\s*\(/;
-function detectDeserialization(code, file, out) {
-  if (!MAGIC_METHODS.test(code))
-    return;
-  const ls = lines2(code);
-  const re = /\b(unserialize|maybe_unserialize)\s*\(/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
-`);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "deserialization",
-      category: "Deserialization → POP gadget chain",
-      severity: "high",
-      evidence: l.trim(),
-      detail: `\`${m[1]}()\` of attacker-controlled data AND a magic method is present — object injection can pivot to RCE via the gadget chain.`
-    });
-  }
+function userControlled(scope) {
+  return SOURCE_TOKENS.test(scope);
 }
-function detectTypeJuggling(code, file, out) {
-  const ls = lines2(code);
-  const re = /(?<![=!<>])(==|!=)(?!=)/g;
+var DYNAMIC_DISPATCH_RE = /\b(call_user_func|call_user_func_array|forward|dispatch|resolve_route|invoke)\s*\(\s*(\$|\[)/gi;
+var DYNAMIC_METHOD_RE = /(->|::)\s*\$[A-Za-z_]/g;
+var BATCH_LOOP_RE = /\bforeach\s*\([^)]*(requests|batch|sub_requests|operations)\b/gi;
+var ROUTE_MATCH_RE = /\b(preg_match|preg_match_all|strpos|stripos|str_contains)\s*\(/i;
+var NORMALIZERS = /\b(strtolower|strtoupper|rtrim|urldecode|rawurldecode|parse_url|normalize|canonical)\b/i;
+var WHITELIST_LOOKUP = /\$[A-Za-z_]\w*\s*\[\s*\$[A-Za-z_]\w*\s*\]/;
+var CANONICALIZE = /\b(basename|realpath|normalize|canonical|resolve|toRealPath)\s*\(/i;
+function detectDynamicDispatch(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_DISPATCH_RE.lastIndex = 0;
   let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
+  while ((m = DYNAMIC_DISPATCH_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
     const l = ls[ln - 1] ?? "";
     const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
 `);
-    const hasSource = SOURCE_TOKENS3.test(l) || SOURCE_TOKENS3.test(scope);
-    const hasHash = /\b(md5|sha1|sha256|hash|crc32|crypt|password_verify|strcmp|hash_equals|secret|token|nonce)\s*\(?/i.test(l) || /\b(secret|token|nonce|hash)\b/i.test(l);
-    if (!hasSource || !hasHash)
+    if (!userControlled(l) && !userControlled(scope))
       continue;
-    out.push({
-      file,
-      line: ln,
-      type: "type_juggling",
-      category: "Type juggling (loose comparison)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: 'Loose comparison of user input against a hash/secret — PHP type juggling (`0e…`, `"str" == 0`) may bypass the check. Use strict `===`.'
-    });
-  }
-}
-function detectMassAssignment(code, file, out) {
-  const ls = lines2(code);
-  const extractRe = /\bextract\s*\(\s*[^)]*(REQUEST|POST|GET|COOKIE|FILES|\$_(REQUEST|POST|GET|COOKIE|FILES))/g;
-  let m;
-  while ((m = extractRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    if (/EXTR_SKIP|EXTR_PREFIX_ALL/.test(l))
+    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
       continue;
     out.push({
       file,
       line: ln,
-      type: "mass_assignment",
-      category: "Mass assignment (variable injection)",
+      type: "dynamic_dispatch",
+      category: "Route confusion (user-controlled dispatch)",
       severity: "high",
       evidence: l.trim(),
-      detail: "`extract()` of request data without EXTR_SKIP — attacker can overwrite arbitrary variables."
-    });
-  }
-  const parseRe = /\bparse_str\s*\(/g;
-  while ((m = parseRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
-`);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "mass_assignment",
-      category: "Mass assignment (variable injection)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: "`parse_str()` of user input into the symbol table — variable injection."
+      detail: `\`${m[1]}()\` invoked with an attacker-controlled callback/route — the request selects the handler.`
     });
   }
 }
-function detectComplexBugs(code, file) {
-  const out = [];
-  detectDeserialization(code, file, out);
-  detectTypeJuggling(code, file, out);
-  detectMassAssignment(code, file, out);
-  detectPrototypePollution(code, file, out);
-  detectCrlfInjection(code, file, out);
-  detectPathConfusion(code, file, out);
-  detectSsrF(code, file, out);
-  detectXxe(code, file, out);
-  detectSsti(code, file, out);
-  detectFileUploadRce(code, file, out);
-  detectUnrestrictedUpload(code, file, out);
-  detectSqlInjection(code, file, out);
-  detectHardcodedSecret(code, file, out);
-  out.push(...detectWrongSanitizer(code, file));
-  out.push(...detectMissingAuthz(code, file));
-  const seen = new Set;
-  return out.filter((f) => {
-    const key = `${f.type}:${f.line}`;
-    if (seen.has(key))
-      return false;
-    seen.add(key);
-    return true;
-  });
-}
-function detectPrototypePollution(code, file, out) {
-  const ls = lines2(code);
-  const mergeRe = /\b(Object\.assign|_\.merge|_\.defaultsDeep|\.extend|\.merge|\.defaultsDeep|mergeDeep|deepMerge|_.set)\s*\(/g;
+function detectDynamicMethod(code, file, out) {
+  const ls = lines(code);
+  DYNAMIC_METHOD_RE.lastIndex = 0;
   let m;
-  while ((m = mergeRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
+  while ((m = DYNAMIC_METHOD_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
     const l = ls[ln - 1] ?? "";
     const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
 `);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "prototype_pollution",
-      category: "Prototype pollution (unsafe merge)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: "Merge/extend of request data into an object without a `__proto__`/`constructor.prototype` guard — attacker-controlled keys can pollute `Object.prototype` and pivot to RCE or property injection."
-    });
-  }
-}
-function detectCrlfInjection(code, file, out) {
-  const ls = lines2(code);
-  const headerRe = /\b(header|setHeader|addHeader|writeHead|appendHeader)\s*\(/g;
-  let m;
-  while ((m = headerRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
-`);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "crlf_injection",
-      category: "CRLF / header injection",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: "User input reaches an HTTP header — CRLF (`%0d%0a`) can split the response, inject headers, or poison cookies. Strip newlines from header values."
-    });
-  }
-}
-function detectPathConfusion(code, file, out) {
-  const ls = lines2(code);
-  const fileRe = /\b(file_get_contents|file_put_contents|fopen|readFileSync|readFile|open|include|require|new\s+File|Files\.read|FileInputStream|FileOutputStream)\s*\(/g;
-  let m;
-  while ((m = fileRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
-`);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
-      continue;
-    if (/\b(basename|realpath|canonicalPath|getCanonicalPath|normalize|resolve|toRealPath)\s*\(/i.test(scope + `
-` + l))
-      continue;
-    if (/\$[A-Za-z_]\w*\s*\[\s*\$[A-Za-z_]\w*\s*\]/.test(scope + `
-` + l))
-      continue;
-    if (/["'][^"']*:\/\/[^"']*["']/.test(scope + `
-` + l))
-      continue;
-    out.push({
-      file,
-      line: ln,
-      type: "path_confusion",
-      category: "Path confusion (unsanitized file path)",
-      severity: "medium",
-      evidence: l.trim(),
-      detail: "User input reaches a file path with no canonicalization (`basename`/`realpath`/`normalize`) — traversal, `..%2f`, backslash and null-byte variants can confuse a naive `../` filter."
-    });
-  }
-}
-function detectSsrF(code, file, out) {
-  const ls = lines2(code);
-  const re = /\b(file_get_contents|fopen|file|readfile|curl_setopt|curl_init|fetch|axios|requests\.(get|post|put)|urllib\.request|http_get|wp_remote_(get|post)|new\s+URL\s*\(|got\(|http\.(get|request))\s*\(/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
-`);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
-      continue;
-    if (/(allowlist|whitelist|in_array|preg_match|parse_url|startsWith\(["']https?|endsWith\(["']|basename|realpath|normalize)/i.test(scope + `
-` + l))
+    if (!userControlled(l) && !userControlled(scope))
       continue;
-    if (/["'][^"']*:\/\/[^"']*["']/.test(scope + `
-` + l))
+    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
       continue;
     out.push({
       file,
       line: ln,
-      type: "ssrf",
-      category: "SSRF (user-controlled URL)",
+      type: "dynamic_method_call",
+      category: "Route confusion (dynamic method dispatch)",
       severity: "high",
       evidence: l.trim(),
-      detail: "User input reaches a URL-accepting sink with no host allowlist — SSRF (cloud metadata, internal port scan, IAM credential theft)."
+      detail: "Dynamic method/static call `" + m[1] + "$var()` — the invoked symbol is attacker-influenced."
     });
   }
 }
-function detectXxe(code, file, out) {
-  const ls = lines2(code);
-  const re = /\b(simplexml_load_string|simplexml_load_file|new\s+SimpleXMLElement|->loadXML\s*\(|->load\s*\(|XMLReader\s*->\s*XML\s*\(|libxml_parse)\s*\(?/g;
+function detectDynamicInclude(code, file, out) {
+  const ls = lines(code);
+  const re = /\b(include|require)(_once)?\s*\(\s*(\$[A-Za-z_]\w*)/g;
   let m;
   while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
+    const ln = lineNo(code, m.index);
     const l = ls[ln - 1] ?? "";
     const scope = ls.slice(Math.max(0, ln - 4), ln).join(`
 `);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+    if (!userControlled(l) && !userControlled(scope))
       continue;
-    if (/libxml_disable_entity_loader\s*\(\s*true|LIBXML_NONET/.test(scope + `
+    if (CANONICALIZE.test(scope + `
 ` + l))
       continue;
-    out.push({
-      file,
-      line: ln,
-      type: "xxe",
-      category: "XXE (unprotected XML parse)",
-      severity: "high",
-      evidence: l.trim(),
-      detail: "User-controlled XML parsed without disabling external entities — XXE (file read, SSRF, billion-laughs DoS)."
-    });
-  }
-}
-function detectSsti(code, file, out) {
-  const ls = lines2(code);
-  const re = /\b(render_template_string|Template\s*\(|res\.render\s*\(|ejs\.(render|compile)\s*\(|_\.template\s*\(|render_string|twig\.render|Jinja2\(|jinja2\.Template)\s*\(?/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 3), ln).join(`
-`);
-    if (!SOURCE_TOKENS3.test(l) && !SOURCE_TOKENS3.test(scope))
+    if (WHITELIST_LOOKUP.test(l) || WHITELIST_LOOKUP.test(scope))
       continue;
     out.push({
       file,
       line: ln,
-      type: "ssti",
-      category: "SSTI (template render of user input)",
+      type: "dynamic_include",
+      category: "Route confusion (dynamic file include)",
       severity: "high",
       evidence: l.trim(),
-      detail: "User input reaches a template render with no sandbox — SSTI (`{{7*7}}`, `${7*7}`, `#{7*7}`) → RCE."
+      detail: `\`${m[1]}(…)\` of a variable — potential LFI/RCE when the path is attacker-controlled.`
     });
   }
 }
-function detectFileUploadRce(code, file, out) {
-  code = stripCommentsOnly(code);
-  const ls = lines2(code);
-  const re = /\b(move_uploaded_file|wp_upload_bits|->move\s*\(|storeAs\s*\(|->storeAs\s*\(|putFile\s*\()\s*\(/g;
+function detectBatchForwarding(code, file, out) {
+  BATCH_LOOP_RE.lastIndex = 0;
   let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 30), ln + 3).join(`
+  while ((m = BATCH_LOOP_RE.exec(code)) !== null) {
+    const ln = lineNo(code, m.index);
+    const body = lines(code).slice(ln - 1, ln + 8).join(`
 `);
-    if (!/\$_FILES\b|tmp_name|getUploadedFile|uploadedFile|\['name'\]/i.test(scope))
+    const forwards = /\b(call_user_func|forward|dispatch|resolve_route|invoke|handle|route)\s*\(/i.test(body);
+    if (!forwards)
       continue;
-    if (/(wp_check_filetype|PATHINFO_EXTENSION|wp_get_mime_types|allowed_?(types|extensions|exts)|mime_?(types|extensions)|in_array\s*\([^)]*\$(?:allowed|whitelist|ext)|wp_handle_upload\s*\(\s*[^)]*test_form\s*=>\s*true)/i.test(scope))
+    const rechecks = /\b(current_user_can|permission_callback|check_ajax_referer|authorize|authorise|is_user_logged_in)\b/i.test(body);
+    if (rechecks)
       continue;
     out.push({
       file,
       line: ln,
-      type: "file_upload",
-      category: "File upload → RCE (unvalidated extension)",
+      type: "batch_forwarding",
+      category: "Route confusion (batch/proxy forwarding)",
       severity: "high",
-      evidence: l.trim(),
-      detail: "An uploaded file is written with an attacker-controlled name and no visible extension/filetype validation — upload a .php/.phtml shell → RCE."
-    });
-  }
-}
-function detectUnrestrictedUpload(code, file, out) {
-  const ls = lines2(code);
-  const re = /['"]uploadAllow['"]\s*=>\s*(?:array\s*\(\s*)?['"]all['"]/g;
-  let m;
-  while ((m = re.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 4), ln + 4).join(`
-`);
-    const denyFirst = /['"]uploadOrder['"]\s*=>\s*array\s*\(\s*['"]deny['"]/.test(scope);
-    out.push({
-      file,
-      line: ln,
-      type: "file_upload",
-      category: "Unrestricted upload config (uploadAllow=all)",
-      severity: denyFirst ? "high" : "medium",
-      evidence: l.trim(),
-      detail: denyFirst ? "File-manager/connector config sets uploadAllow='all' with uploadOrder deny→allow — every mimetype (including .php) is uploadable → RCE." : "File-manager/connector config sets uploadAllow='all' — any file type can be uploaded; verify the upload path is not web-reachable or that a server-side extension whitelist exists."
+      evidence: lines(code)[ln - 1]?.trim() ?? "",
+      detail: "Batch/proxy loop forwards to inner handlers with no per-route authorization re-check — an attacker may reach a protected handler."
     });
   }
 }
-function detectSqlInjection(code, file, out) {
-  const ls = lines2(code);
-  const sinkRe = /\$wpdb->(get_results|get_col|get_var|get_row|query)\s*\(|->query\s*\(|DB::unprepared\s*\(|->whereRaw\s*\(|->selectRaw\s*\(/g;
-  let m;
-  while ((m = sinkRe.exec(code)) !== null) {
-    const ln = lineNo2(code, m.index);
-    const l = ls[ln - 1] ?? "";
-    const scope = ls.slice(Math.max(0, ln - 6), ln + 1).join(`
+function detectRouteNormalization(code, file, out) {
+  const ls = lines(code);
+  for (let i = 0;i < ls.length; i++) {
+    const l = ls[i];
+    if (!ROUTE_MATCH_RE.test(l))
+      continue;
+    const scope = ls.slice(Math.max(0, i - 3), i + 1).join(`
 `);
-    if (/->prepare\s*\(/.test(scope))
+    if (!userControlled(scope))
       continue;
-    if (SOURCE_TOKENS3.test(scope))
+    if (NORMALIZERS.test(l) || NORMALIZERS.test(scope))
       continue;
-    const inlineConcat = /\.\s*\$[A-Za-z_]\w*/.test(l);
-    const assignConcat = /(?:^|\n)\s*\$[A-Za-z_]\w*\s*(?:\.=|=)\s*[^;\n]*["'][^"']*["']\s*\.\s*\$[A-Za-z_]\w*/.test(scope);
-    if (!inlineConcat && !assignConcat)
+    if (/preg_match\s*\(\s*["'][^"']*\^[^"']*\$[^"']*["']/.test(l))
       continue;
     out.push({
       file,
-      line: ln,
-      type: "sql_injection",
-      category: "SQL injection (raw string-interpolated query)",
+      line: i + 1,
+      type: "route_normalization_gap",
+      category: "Route confusion (missing path normalization)",
       severity: "medium",
       evidence: l.trim(),
-      detail: "A SQL sink receives a query built by string concatenation (not prepared), with no visible source in this file — trace the concatenated variable back to a request source; if user-controlled, this is SQL injection (CWE-89)."
+      detail: "Route matched against user input without visible normalization (strtolower/rtrim/urldecode) — route desync possible."
     });
   }
 }
-var SECRET_FIELD_RE = new RegExp(`\\b(${SECRET_FIELDS})\\s*(?:::|=>|=|:)\\s*`, "gi");
-var SECRET_PLACEHOLDER_RE = /^(null|true|false|undefined|your_|xxx+|changeme|example|placeholder|test|secret|password|token|key|api|smtp|localhost|root|admin|pass|change|me|none|na|foo|bar|dummy)$/i;
-var ENTROPY_EXCLUDE_VAR = /\b(data|payload|content|body|base64|encoded|encode|image|binary|blob|hash|digest|checksum|nonce|uuid|etag|signature|sig|cipher|iv|ciphertext|plaintext|thumb|thumbnail)\b/i;
-function detectHardcodedSecret(code, file, out) {
-  const ls = lines2(code);
-  const clean = stripCommentsOnly(code);
-  const flaggedLines = new Set;
-  SECRET_FIELD_RE.lastIndex = 0;
-  let m;
-  while ((m = SECRET_FIELD_RE.exec(clean)) !== null) {
-    const field = m[1];
-    const rest = clean.slice(m.index + m[0].length);
-    const lineEnd = rest.search(/\r?\n/);
-    const valueRaw = (lineEnd === -1 ? rest : rest.slice(0, lineEnd)).trim();
-    let value = "";
-    const qm = valueRaw.match(/^["']([^"']{4,})["']/);
-    if (qm)
-      value = qm[1];
-    else
-      value = (valueRaw.match(/^([A-Za-z0-9._/+=@-]{8,})/) ?? [])[1] ?? "";
-    if (!value)
-      continue;
-    if (SECRET_PLACEHOLDER_RE.test(value))
-      continue;
-    if (/\$[A-Za-z_]|[{}\[\]]|process\.env|getenv|os\.environ|config\s*\(|env\s*\(/.test(valueRaw))
-      continue;
-    const ln = lineNo2(code, m.index);
-    flaggedLines.add(ln);
-    out.push({
-      file,
-      line: ln,
-      type: "hardcoded_secret",
-      category: "Hardcoded secret (credential in source)",
-      severity: "high",
-      evidence: (ls[ln - 1] ?? "").trim(),
-      detail: `Secret field '${field}' is assigned a hardcoded value in source — the credential is exposed to anyone with code access (CWE-798 Hard-coded Credentials). Rotate it and load from the environment instead.`
-    });
-  }
-  for (const fmt of SECRET_FORMATS) {
-    fmt.re.lastIndex = 0;
-    let fm;
-    while ((fm = fmt.re.exec(clean)) !== null) {
-      const ln = lineNo2(code, fm.index);
-      if (flaggedLines.has(ln))
-        continue;
-      flaggedLines.add(ln);
-      out.push({
-        file,
-        line: ln,
-        type: "hardcoded_secret",
-        category: "Hardcoded secret (known format)",
-        severity: "high",
-        evidence: (ls[ln - 1] ?? "").trim(),
-        detail: `A ${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798). Rotate it and load from the environment instead.`
-      });
-    }
-  }
-  const isMinified = /\.min\.(js|css)$/i.test(file) || /[\\/](bundle|vendor|dist|build)[\\/]/i.test(file);
-  if (!isMinified) {
-    const entropyRe = /(\b[A-Za-z_]\w*)\s*(?:::|=>|=|:)\s*["']([A-Za-z0-9_-]{32,})["']/g;
-    entropyRe.lastIndex = 0;
-    let em;
-    while ((em = entropyRe.exec(clean)) !== null) {
-      const varName = em[1];
-      const value = em[2];
-      const ln = lineNo2(code, em.index);
-      if (flaggedLines.has(ln))
-        continue;
-      if (ENTROPY_EXCLUDE_VAR.test(varName))
-        continue;
-      if (!/[A-Z]/.test(value) || !/[a-z]/.test(value) || !/[0-9]/.test(value))
-        continue;
-      if (shannonEntropy(value) < 4.5)
-        continue;
-      flaggedLines.add(ln);
-      out.push({
-        file,
-        line: ln,
-        type: "hardcoded_secret",
-        category: "Suspected secret (high-entropy token)",
-        severity: "medium",
-        evidence: (ls[ln - 1] ?? "").trim(),
-        detail: `'${varName}' is assigned a high-entropy token (Shannon ${shannonEntropy(value).toFixed(2)} bits/char) that looks like a generated credential — verify it is not a secret key/token (CWE-798).`
-      });
-    }
-  }
+function detectRouteConfusion(code, file) {
+  const out = [];
+  detectDynamicDispatch(code, file, out);
+  detectDynamicMethod(code, file, out);
+  detectDynamicInclude(code, file, out);
+  detectBatchForwarding(code, file, out);
+  detectRouteNormalization(code, file, out);
+  return out;
 }
 
+// src/server.ts
+init_complex_bugs();
+
 // src/guidance.ts
 var SINK_DIRECTIVES = {
   sql_execution: "Validate the SQL injection live with strike_verify (use a unique MARKER and a NEGATIVE CONTROL that stays inert), or read_tool_manual for sqlmap. Only a reflected marker + inert control = confirmed.",
@@ -57393,11 +57673,15 @@ function dataRefresh() {
   };
 }
 
+// src/server.ts
+init_verify_harness();
+
 // src/benchmark.ts
 import { readFileSync as readFileSync19, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
 import { join as join18 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
+init_complex_bugs();
 var ROOT5 = join18(fileURLToPath10(new URL(".", import.meta.url)), "..");
 var CORPUS = join18(ROOT5, "bench", "corpus");
 var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join18(homedir8(), ".blitzstrike", "corpus");
@@ -57693,8 +57977,13 @@ function openCount() {
   return loadObligations().filter((o) => o.status === "open").length;
 }
 
+// src/server.ts
+init_security_state();
+init_framework_security();
+
 // src/variant-scan.ts
 init_scanner();
+init_complex_bugs();
 import { readFileSync as readFileSync22 } from "node:fs";
 
 // src/cross-file.ts
@@ -58592,6 +58881,7 @@ function analyzeJwt(token, opts = {}) {
 // src/enterprise-benchmark.ts
 import { existsSync as existsSync11, readFileSync as readFileSync23, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
 import { join as join20, resolve } from "node:path";
+init_complex_bugs();
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
   { id: "php-laravel", dir: join20(ROOT6, "php-laravel"), expected_vulns: 4 },
@@ -59245,6 +59535,13 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(dataRefresh()) }] };
   });
+  server.registerTool("run_verification", {
+    title: "Detector verification harness",
+    description: "VERIFY: run every detector against its positive (must fire) + negative (must stay silent) fixture and report TP/FP/FN per detector. This is the reproducible 'battle-tested' proof — run it to confirm the detectors still pass after any change.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(runVerificationHarness()) }] };
+  });
   server.registerTool("fofa_search", {
     title: "FOFA asset search",
     description: "STRIKE: search the FOFA asset index (needs FOFA_EMAIL + FOFA_KEY).",
@@ -60613,6 +60910,7 @@ Usage:
   blitzstrike install-tools --category recon --dry-run   Preview / filter
   blitzstrike sync-data        Fetch heavy datasets (payloads + templates) on-demand
   blitzstrike update           Check for a newer version + refresh the data cache
+  blitzstrike verify           Run every detector against TP/FP fixtures + report
   blitzstrike version          Print version
   blitzstrike --help           This help`;
 }
@@ -60664,6 +60962,14 @@ async function main() {
     console.log(`  data:    payloads ${r.data_sync.payloads.files} files, templates ${r.data_sync.templates.files} files ${r.data_sync.payloads.synced ? "(refreshed)" : ""}`);
     return;
   }
+  if (args[0] === "verify") {
+    await Promise.resolve().then(() => init_verify_harness());
+    console.log(verificationReportText());
+    const r = runVerificationHarness();
+    if (r.failed > 0)
+      process.exit(1);
+    return;
+  }
   if (args[0] === "serve") {
     await serve();
     return;