blitzstrike 2.4.67 → 2.4.69

package/dist/index.js

@@ -16263,6 +16263,8 @@ function detectComplexBugs(code, file) {
   detectGraphqlExposure(code, file, out);
   detectOauthMisconfig(code, file, out);
   detectGrpcReflection(code, file, out);
+  detectDependencyConfusion(code, file, out);
+  detectMlSupplyChain(code, file, out);
   out.push(...detectWrongSanitizer(code, file));
   out.push(...detectMissingAuthz(code, file));
   const seen = new Set;
@@ -16523,14 +16525,26 @@ function detectHardcodedSecret(code, file, out) {
       continue;
     const ln = lineNo2(code, m.index);
     flaggedLines.add(ln);
+    let sev = "high";
+    let cat = "Hardcoded secret (credential in source)";
+    let detail = `Secret field '${field}' is assigned a hardcoded value in source — the credential is exposed to anyone with code access (CWE-798 Hard-coded Credentials). Rotate it and load from the environment instead.`;
+    for (const fmt of SECRET_FORMATS) {
+      fmt.re.lastIndex = 0;
+      if (fmt.re.test(value)) {
+        sev = fmt.severity;
+        cat = `Hardcoded secret (${fmt.category}: ${fmt.name})`;
+        detail = `${fmt.name} was found hardcoded in source — the credential is exposed to anyone with code access (CWE-798, severity ${fmt.severity}). Rotate it and load from the environment instead.`;
+        break;
+      }
+    }
     out.push({
       file,
       line: ln,
       type: "hardcoded_secret",
-      category: "Hardcoded secret (credential in source)",
-      severity: "high",
+      category: cat,
+      severity: sev,
       evidence: (ls[ln - 1] ?? "").trim(),
-      detail: `Secret field '${field}' is assigned a hardcoded value in source — the credential is exposed to anyone with code access (CWE-798 Hard-coded Credentials). Rotate it and load from the environment instead.`
+      detail
     });
   }
   for (const fmt of SECRET_FORMATS) {
@@ -16667,6 +16681,78 @@ function detectGrpcReflection(code, file, out) {
     });
   }
 }
+function detectDependencyConfusion(code, file, out) {
+  const isManifest = /package\.json|requirements|pipfile|gemfile|go\.mod|pom\.xml|setup\.py|pyproject|\.npmrc|pip\.conf|dockerfile|\.ya?ml$/i.test(file);
+  if (!isManifest)
+    return;
+  const ls = lines2(code);
+  const idxRe = /--(?:extra-)?index-url\s+["']?(https?:\/\/[^"'<\s]+)["']?/gi;
+  let m;
+  while ((m = idxRe.exec(code)) !== null) {
+    if (/pypi\.org|pythonhosted|npmjs\.org|rubygems\.org|golang\.org|crates\.io|maven\.apache\.org/i.test(m[1])) {
+      const ln = lineNo2(code, m.index);
+      out.push({
+        file,
+        line: ln,
+        type: "dependency_confusion",
+        category: "Dependency confusion — public registry in resolution path",
+        severity: "high",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `A public registry (${m[1]}) is the resolution source — an internal package name that exists or can be squatted on the public registry resolves there instead of the private one, pulling attacker-controlled code (CWE-427). Pin a private registry and namespace internal packages uniquely.`
+      });
+    }
+  }
+  const hasPrivateRegistry = /--(?:index-url|registry)\s+["']?(?!https?:\/\/pypi\.org|https?:\/\/registry\.npmjs\.org)/i.test(code) || /(?:registry|index[-_]url)\s*[:=]\s*["']https?:\/\/(?!.*(?:pypi\.org|registry\.npmjs\.org))/i.test(code);
+  if (!hasPrivateRegistry) {
+    const scopedRe = /["'](@[a-z0-9][a-z0-9-]*\/[a-z0-9_.-]+)["']/g;
+    while ((m = scopedRe.exec(code)) !== null) {
+      const ln = lineNo2(code, m.index);
+      out.push({
+        file,
+        line: ln,
+        type: "dependency_confusion",
+        category: "Dependency confusion — scoped package, no private registry",
+        severity: "medium",
+        evidence: (ls[ln - 1] ?? "").trim(),
+        detail: `The scoped package ${m[1]} is referenced but no private registry is pinned — if the @scope is not registered/reserved on the public registry, an attacker can publish ${m[1]} there and the build will pull malicious code (CWE-427). Verify the registry resolution and pin it.`
+      });
+    }
+  }
+}
+function detectMlSupplyChain(code, file, out) {
+  const ls = lines2(code);
+  const clean = stripCommentsOnly(code);
+  const sinks = [
+    { re: /torch\.load\s*\(/g, name: "torch.load", note: "uses pickle; pass weights_only=True", skipIfSafe: /weights_only\s*=\s*True/ },
+    { re: /\bjoblib\.load\s*\(/g, name: "joblib.load", note: "uses pickle (no safe flag)" },
+    { re: /(?:tf\.)?keras\.models\.load_model\s*\(/g, name: "keras load_model", note: "deserializes the model graph (pickle/h5)" },
+    { re: /\bnp\.load\s*\(/g, name: "np.load", note: "allow_pickle=True is RCE", requireFlag: /allow_pickle\s*=\s*True/i }
+  ];
+  for (const s of sinks) {
+    s.re.lastIndex = 0;
+    let m;
+    while ((m = s.re.exec(clean)) !== null) {
+      const ln = lineNo2(code, m.index);
+      const l = ls[ln - 1] ?? "";
+      if (s.skipIfSafe && s.skipIfSafe.test(l))
+        continue;
+      if (s.requireFlag && !s.requireFlag.test(l))
+        continue;
+      const flagIsSignal = s.requireFlag != null;
+      if (!flagIsSignal && !SOURCE_TOKENS3.test(l) && !/https?:\/\//.test(l) && !/download|request|upload|user|input|temp|tmp/i.test(l))
+        continue;
+      out.push({
+        file,
+        line: ln,
+        type: "ml_supply_chain",
+        category: "ML supply chain — untrusted model load",
+        severity: "high",
+        evidence: l.trim(),
+        detail: `\`${s.name}\` loads a model from an untrusted source — ${s.note}. A poisoned model file executes arbitrary code on load (CWE-502). Pin hashes, load from a trusted artifact store, and use the safe flag where available.`
+      });
+    }
+  }
+}
 var SOURCE_TOKENS3, MAGIC_METHODS, SECRET_FIELD_RE, SECRET_PLACEHOLDER_RE, ENTROPY_EXCLUDE_VAR;
 var init_complex_bugs = __esm(() => {
   init_security_state();
@@ -16682,8 +16768,8 @@ var init_complex_bugs = __esm(() => {
 // src/verify-harness.ts
 function runVerificationHarness() {
   const cases = CASES.map((c) => {
-    const pos = detectComplexBugs(c.positive, "positive.php").filter((f) => f.type === c.detector);
-    const neg = detectComplexBugs(c.negative, "negative.php").filter((f) => f.type === c.detector);
+    const pos = detectComplexBugs(c.positive, c.file ?? "positive.php").filter((f) => f.type === c.detector);
+    const neg = detectComplexBugs(c.negative, c.file ?? "negative.php").filter((f) => f.type === c.detector);
     const positive_fired = pos.length > 0;
     const negative_fired = neg.length > 0;
     const tp = positive_fired;
@@ -16848,17 +16934,31 @@ $r = openai.chat.completions.create(['messages' => [['role' => 'user', 'content'
       detector: "grpc_reflection",
       positive: PHP(`$server->addService(enable_server_reflection());`),
       negative: PHP(`$server->addService($my_service);`)
+    },
+    {
+      id: "dependency-confusion",
+      detector: "dependency_confusion",
+      file: "requirements.txt",
+      positive: `--extra-index-url https://pypi.org/simple\\nnumpy==1.24.0\\n`,
+      negative: `--index-url https://pypi.internal.company.com/simple\\nnumpy==1.24.0\\n`
+    },
+    {
+      id: "ml-supply-chain",
+      detector: "ml_supply_chain",
+      file: "train.py",
+      positive: `import torch\\nmodel = torch.load(downloaded_model)\\n`,
+      negative: `import torch\\nmodel = torch.load("model.pt", weights_only=True)\\n`
     }
   ];
 });
 
 // src/variants.ts
 import { readFileSync as readFileSync19 } from "node:fs";
-import { join as join18, dirname as dirname4 } from "node:path";
+import { join as join19, dirname as dirname4 } from "node:path";
 import { fileURLToPath as fileURLToPath10 } from "node:url";
 function loadVariants() {
   try {
-    const doc = JSON.parse(readFileSync19(join18(__dirname4, "..", "intelligence", "variants.json"), "utf8"));
+    const doc = JSON.parse(readFileSync19(join19(__dirname4, "..", "intelligence", "variants.json"), "utf8"));
     return doc.variants ?? [];
   } catch {
     return [];
@@ -16867,7 +16967,7 @@ function loadVariants() {
 function scanVariants() {
   const variants = loadVariants().filter((v) => !CROSS_FILE_ONLY.has(v.class));
   const results = variants.map((v, i) => {
-    const findings = detectComplexBugs(v.code, `variant-${i}.php`).filter((f) => f.type === v.class);
+    const findings = detectComplexBugs(v.code, v.file ?? `variant-${i}.php`).filter((f) => f.type === v.class);
     return { id: `variant-${i}`, class: v.class, fired: findings.length > 0, note: v.note };
   });
   const per_class = {};
@@ -16918,7 +17018,7 @@ var init_variants = __esm(() => {
 
 // src/sync.ts
 import { mkdirSync as mkdirSync9, writeFileSync as writeFileSync8, readFileSync as readFileSync25, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 import { homedir as homedir10 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
@@ -16935,7 +17035,7 @@ function countFiles(dir) {
     const walk = (d) => {
       for (const e of readdirSync7(d, { withFileTypes: true })) {
         if (e.isDirectory())
-          walk(join22(d, e.name));
+          walk(join23(d, e.name));
         else
           n++;
       }
@@ -16949,8 +17049,8 @@ function countFiles(dir) {
 function syncData() {
   if (!dirExists(DATA_ROOT2))
     mkdirSync9(DATA_ROOT2, { recursive: true });
-  const payloadsPath = join22(DATA_ROOT2, "payloads");
-  const templatesPath = join22(DATA_ROOT2, "templates");
+  const payloadsPath = join23(DATA_ROOT2, "payloads");
+  const templatesPath = join23(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
   const hasTemplates = dirExists(templatesPath) && countFiles(templatesPath) > 0;
   if (hasPayloads && hasTemplates) {
@@ -16960,8 +17060,8 @@ function syncData() {
       data_root: DATA_ROOT2
     };
   }
-  const localPayloads = join22(ROOT7, "payloads");
-  const localTemplates = join22(ROOT7, "templates");
+  const localPayloads = join23(ROOT7, "payloads");
+  const localTemplates = join23(ROOT7, "templates");
   let payloadsSynced = false;
   let templatesSynced = false;
   if (!hasPayloads && dirExists(localPayloads)) {
@@ -16974,7 +17074,7 @@ function syncData() {
   }
   const gitOk = spawnSync4("git", ["--version"]).status === 0;
   if (gitOk && (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0 || !dirExists(templatesPath) || countFiles(templatesPath) === 0)) {
-    const tmp = join22(DATA_ROOT2, ".tmp-clone");
+    const tmp = join23(DATA_ROOT2, ".tmp-clone");
     if (dirExists(tmp))
       rmSync4(tmp, { recursive: true, force: true });
     const r = spawnSync4("git", ["clone", "--depth", "1", "--filter=blob:none", "--sparse", GITHUB_REPO, tmp], { timeout: 120000 });
@@ -16982,11 +17082,11 @@ function syncData() {
       const sparse = spawnSync4("git", ["-C", tmp, "sparse-checkout", "set", "payloads", "templates"], { timeout: 120000 });
       if (sparse.status === 0) {
         if (!dirExists(payloadsPath) || countFiles(payloadsPath) === 0) {
-          copyDir(join22(tmp, "payloads"), payloadsPath);
+          copyDir(join23(tmp, "payloads"), payloadsPath);
           payloadsSynced = true;
         }
         if (!dirExists(templatesPath) || countFiles(templatesPath) === 0) {
-          copyDir(join22(tmp, "templates"), templatesPath);
+          copyDir(join23(tmp, "templates"), templatesPath);
           templatesSynced = true;
         }
       }
@@ -17008,8 +17108,8 @@ function copyDir(src, dst) {
 function manualCopy(src, dst) {
   mkdirSync9(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
-    const s = join22(src, e.name);
-    const d = join22(dst, e.name);
+    const s = join23(src, e.name);
+    const d = join23(dst, e.name);
     if (e.isDirectory())
       manualCopy(s, d);
     else
@@ -17018,8 +17118,8 @@ function manualCopy(src, dst) {
 }
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
-  ROOT7 = join22(fileURLToPath12(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join22(homedir10(), ".blitzstrike", "data");
+  ROOT7 = join23(fileURLToPath12(new URL(".", import.meta.url)), "..");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join23(homedir10(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -17064,15 +17164,15 @@ var init_update = __esm(() => {
 });
 
 // src/release.ts
-import { readFileSync as readFileSync27, existsSync as existsSync12 } from "node:fs";
-import { join as join23 } from "node:path";
+import { readFileSync as readFileSync27, existsSync as existsSync13 } from "node:fs";
+import { join as join24 } from "node:path";
 import { fileURLToPath as fileURLToPath13 } from "node:url";
 import { execSync as execSync2 } from "node:child_process";
 function validateRelease() {
   const checks = [];
   checks.push({ name: "package.json version", ok: true, detail: VERSION });
   try {
-    const changelog = readFileSync27(join23(ROOT8, "CHANGELOG.md"), "utf8");
+    const changelog = readFileSync27(join24(ROOT8, "CHANGELOG.md"), "utf8");
     const m = changelog.match(/^##\s+\[([0-9]+\.[0-9]+\.[0-9]+)\]/m);
     const changelogVersion = m?.[1] ?? null;
     checks.push({
@@ -17104,22 +17204,22 @@ function validateRelease() {
   return { version: VERSION, checks, consistent: checks.filter((c) => !c.soft).every((c) => c.ok) };
 }
 function lockfilePresent() {
-  return existsSync12(join23(ROOT8, "package-lock.json")) || existsSync12(join23(ROOT8, "bun.lock")) || existsSync12(join23(ROOT8, "bun.lockb"));
+  return existsSync13(join24(ROOT8, "package-lock.json")) || existsSync13(join24(ROOT8, "bun.lock")) || existsSync13(join24(ROOT8, "bun.lockb"));
 }
 var ROOT8;
 var init_release = __esm(() => {
   init_version();
-  ROOT8 = join23(fileURLToPath13(new URL(".", import.meta.url)), "..");
+  ROOT8 = join24(fileURLToPath13(new URL(".", import.meta.url)), "..");
 });
 
 // src/dependency.ts
 import { readFileSync as readFileSync28 } from "node:fs";
-import { join as join24 } from "node:path";
+import { join as join25 } from "node:path";
 import { fileURLToPath as fileURLToPath14 } from "node:url";
 function checkDependencies() {
   let pkg = {};
   try {
-    pkg = JSON.parse(readFileSync28(join24(ROOT9, "package.json"), "utf8"));
+    pkg = JSON.parse(readFileSync28(join25(ROOT9, "package.json"), "utf8"));
   } catch {
     return { install_scripts: [], git_dependencies: [], total_dependencies: 0, safe: false };
   }
@@ -17142,12 +17242,12 @@ function checkDependencies() {
 }
 var ROOT9;
 var init_dependency = __esm(() => {
-  ROOT9 = join24(fileURLToPath14(new URL(".", import.meta.url)), "..");
+  ROOT9 = join25(fileURLToPath14(new URL(".", import.meta.url)), "..");
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync29, existsSync as existsSync13, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
-import { join as join25, dirname as dirname5 } from "node:path";
+import { readFileSync as readFileSync29, existsSync as existsSync14, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10 } from "node:fs";
+import { join as join26, dirname as dirname5 } from "node:path";
 import { homedir as homedir11 } from "node:os";
 import { fileURLToPath as fileURLToPath15 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
@@ -17192,7 +17292,7 @@ async function runDoctor() {
     detail: h1 ? `X-HackerOne-Research: ${h1}` : "H1_USERNAME not set",
     fix: h1 ? undefined : "export H1_USERNAME=<your-hackerone-username> (adds X-HackerOne-Research to outbound requests)"
   });
-  const dataOk = existsSync13(join25(ROOT10, "chains.json")) && existsSync13(join25(ROOT10, "tools-catalog.json"));
+  const dataOk = existsSync14(join26(ROOT10, "chains.json")) && existsSync14(join26(ROOT10, "tools-catalog.json"));
   issues.push({
     name: "Data layers (chains + tools-catalog)",
     status: dataOk ? "ok" : "fail",
@@ -17243,15 +17343,15 @@ BlitzStrike — ${verdict}`);
 function resolveCommand() {
   if (which("blitzstrike"))
     return { command: "blitzstrike", args: ["serve", "--mcp"] };
-  const src = join25(ROOT10, "src", "index.ts");
-  if (which("bun") && existsSync13(src))
+  const src = join26(ROOT10, "src", "index.ts");
+  if (which("bun") && existsSync14(src))
     return { command: "bun", args: ["run", src, "serve", "--mcp"] };
   if (which("npx"))
     return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
   if (which("bunx"))
     return { command: "bunx", args: ["blitzstrike", "serve", "--mcp"] };
-  const dist = join25(ROOT10, "dist", "index.js");
-  if (existsSync13(dist))
+  const dist = join26(ROOT10, "dist", "index.js");
+  if (existsSync14(dist))
     return { command: "bun", args: [dist, "serve", "--mcp"] };
   return { command: "npx", args: ["-y", "blitzstrike", "serve", "--mcp"] };
 }
@@ -17265,7 +17365,7 @@ function readJson(p) {
 function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname5(p);
-    if (!existsSync13(dir))
+    if (!existsSync14(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
@@ -17278,7 +17378,7 @@ function jsonMcpServersWrite(p) {
 function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname5(p);
-    if (!existsSync13(dir))
+    if (!existsSync14(dir))
       mkdirSync10(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
@@ -17290,16 +17390,16 @@ function opencodeWrite(p) {
   };
 }
 function copyOpenCodeAgents() {
-  const srcDir = join25(ROOT10, "opencode-agents");
-  const dstDir = join25(homedir11(), ".config", "opencode", "agents");
-  if (!existsSync13(srcDir))
+  const srcDir = join26(ROOT10, "opencode-agents");
+  const dstDir = join26(homedir11(), ".config", "opencode", "agents");
+  if (!existsSync14(srcDir))
     return;
-  if (!existsSync13(dstDir))
+  if (!existsSync14(dstDir))
     mkdirSync10(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
-    const src = join25(srcDir, f);
-    const dst = join25(dstDir, f);
-    if (existsSync13(src)) {
+    const src = join26(srcDir, f);
+    const dst = join26(dstDir, f);
+    if (existsSync14(src)) {
       writeFileSync9(dst, readFileSync29(src, "utf8"));
     }
   }
@@ -17307,9 +17407,9 @@ function copyOpenCodeAgents() {
 function codexWrite(p) {
   return (command, args) => {
     const dir = dirname5(p);
-    if (!existsSync13(dir))
+    if (!existsSync14(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync29(p, "utf8") : "";
+    let existing = existsSync14(p) ? readFileSync29(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
       existing += `
@@ -17326,9 +17426,9 @@ args = ${JSON.stringify(args)}
 function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname5(p);
-    if (!existsSync13(dir))
+    if (!existsSync14(dir))
       mkdirSync10(dir, { recursive: true });
-    let existing = existsSync13(p) ? readFileSync29(p, "utf8") : "";
+    let existing = existsSync14(p) ? readFileSync29(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
 `))
@@ -17355,74 +17455,74 @@ mcp_servers:
 function detectAgents() {
   const home = homedir11();
   const agents = [];
-  const claudeJson = join25(home, ".claude.json");
+  const claudeJson = join26(home, ".claude.json");
   agents.push({
     name: "Claude Code",
     detectPath: claudeJson,
-    installed: () => existsSync13(claudeJson) || which("claude"),
+    installed: () => existsSync14(claudeJson) || which("claude"),
     write: jsonMcpServersWrite(claudeJson)
   });
-  const claudeDesktop = join25(home, ".config", "Claude", "claude_desktop_config.json");
+  const claudeDesktop = join26(home, ".config", "Claude", "claude_desktop_config.json");
   agents.push({
     name: "Claude Desktop",
     detectPath: claudeDesktop,
-    installed: () => existsSync13(claudeDesktop),
+    installed: () => existsSync14(claudeDesktop),
     write: jsonMcpServersWrite(claudeDesktop)
   });
-  const cursor = join25(home, ".cursor", "mcp.json");
+  const cursor = join26(home, ".cursor", "mcp.json");
   agents.push({
     name: "Cursor",
     detectPath: cursor,
-    installed: () => existsSync13(join25(home, ".cursor")) || which("cursor"),
+    installed: () => existsSync14(join26(home, ".cursor")) || which("cursor"),
     write: jsonMcpServersWrite(cursor)
   });
-  const opencode = join25(home, ".config", "opencode", "opencode.jsonc");
+  const opencode = join26(home, ".config", "opencode", "opencode.jsonc");
   agents.push({
     name: "OpenCode",
     detectPath: opencode,
-    installed: () => existsSync13(join25(home, ".config", "opencode")) || which("opencode"),
+    installed: () => existsSync14(join26(home, ".config", "opencode")) || which("opencode"),
     write: opencodeWrite(opencode)
   });
-  const codex = join25(home, ".codex", "config.toml");
+  const codex = join26(home, ".codex", "config.toml");
   agents.push({
     name: "Codex",
     detectPath: codex,
-    installed: () => existsSync13(join25(home, ".codex")) || which("codex"),
+    installed: () => existsSync14(join26(home, ".codex")) || which("codex"),
     write: codexWrite(codex)
   });
-  const hermes = join25(home, ".hermes", "config.yaml");
+  const hermes = join26(home, ".hermes", "config.yaml");
   agents.push({
     name: "Hermes",
     detectPath: hermes,
-    installed: () => existsSync13(join25(home, ".hermes")) || which("hermes"),
+    installed: () => existsSync14(join26(home, ".hermes")) || which("hermes"),
     write: hermesWrite(hermes)
   });
-  const gemini = join25(home, ".gemini", "settings.json");
+  const gemini = join26(home, ".gemini", "settings.json");
   agents.push({
     name: "Gemini CLI",
     detectPath: gemini,
-    installed: () => existsSync13(join25(home, ".gemini")) || which("gemini"),
+    installed: () => existsSync14(join26(home, ".gemini")) || which("gemini"),
     write: jsonMcpServersWrite(gemini)
   });
-  const windsurf = join25(home, ".codeium", "windsurf", "mcp_config.json");
+  const windsurf = join26(home, ".codeium", "windsurf", "mcp_config.json");
   agents.push({
     name: "Windsurf",
     detectPath: windsurf,
-    installed: () => existsSync13(join25(home, ".codeium")) || which("windsurf"),
+    installed: () => existsSync14(join26(home, ".codeium")) || which("windsurf"),
     write: jsonMcpServersWrite(windsurf)
   });
-  const copilot = join25(home, ".copilot", "mcp.json");
+  const copilot = join26(home, ".copilot", "mcp.json");
   agents.push({
     name: "Copilot",
     detectPath: copilot,
-    installed: () => existsSync13(join25(home, ".copilot")),
+    installed: () => existsSync14(join26(home, ".copilot")),
     write: jsonMcpServersWrite(copilot)
   });
-  const cline = join25(home, ".cline", "mcp_settings.json");
+  const cline = join26(home, ".cline", "mcp_settings.json");
   agents.push({
     name: "Cline",
     detectPath: cline,
-    installed: () => existsSync13(join25(home, ".cline")),
+    installed: () => existsSync14(join26(home, ".cline")),
     write: jsonMcpServersWrite(cline)
   });
   return agents;
@@ -17540,7 +17640,7 @@ var init_cli = __esm(() => {
   init_release();
   init_dependency();
   init_mcp_status();
-  ROOT10 = join25(fileURLToPath15(new URL(".", import.meta.url)), "..");
+  ROOT10 = join26(fileURLToPath15(new URL(".", import.meta.url)), "..");
 });
 
 // node_modules/zod/v3/helpers/util.js
@@ -57779,7 +57879,16 @@ var ALIASES = {
   "header injection": "crlf_injection",
   "http response splitting": "crlf_injection",
   "wrong sanitizer": "wrong_sanitizer",
-  "wrong context sanitization": "wrong_sanitizer"
+  "wrong context sanitization": "wrong_sanitizer",
+  "dependency confusion": "dependency_confusion",
+  "dep confusion": "dependency_confusion",
+  "supply chain": "dependency_confusion",
+  "supply chain attack": "dependency_confusion",
+  "ml supply chain": "ml_supply_chain",
+  "ai supply chain": "ml_supply_chain",
+  "model poisoning": "ml_supply_chain",
+  "ml security": "ml_supply_chain",
+  "ai ml security": "ml_supply_chain"
 };
 function normalize(term) {
   return term.trim().toLowerCase().replace(/[_-]+/g, " ").replace(/\s+/g, " ").trim();
@@ -57868,6 +57977,185 @@ function submissionGate(input) {
   };
 }
 
+// src/git-history.ts
+init_complex_bugs();
+import { execFileSync as execFileSync4 } from "node:child_process";
+import { existsSync as existsSync10 } from "node:fs";
+import { join as join17 } from "node:path";
+function parseDeletions(output) {
+  const out = [];
+  let commit = "";
+  let msg = "";
+  for (const line of output.split(`
+`)) {
+    if (line.startsWith("__COMMIT__ ")) {
+      const rest = line.slice("__COMMIT__ ".length);
+      const sp = rest.indexOf(" ");
+      commit = sp === -1 ? rest : rest.slice(0, sp);
+      msg = sp === -1 ? "" : rest.slice(sp + 1);
+    } else if (line.startsWith("D\t") || line.startsWith("D ")) {
+      const path = line.slice(2).trim();
+      if (path && commit)
+        out.push({ commit, commit_msg: msg, path });
+    }
+  }
+  return out;
+}
+function blobBeforeDeletion(root, commit, path) {
+  return execFileSync4("git", ["-C", root, "show", `${commit}^:${path}`], {
+    encoding: "utf8",
+    maxBuffer: 10 * 1024 * 1024
+  });
+}
+function scanGitHistory(root, opts) {
+  const limit = opts?.limit ?? 30;
+  const findings = [];
+  if (!existsSync10(join17(root, ".git"))) {
+    return { root, is_git_repo: false, total: 0, findings: [], error: "not a git repository (no .git dir)" };
+  }
+  if (opts?.secretPattern) {
+    try {
+      const pick = execFileSync4("git", ["-C", root, "log", "-S", opts.secretPattern, "--all", "--format=__COMMIT__ %H %s"], { encoding: "utf8", maxBuffer: 5 * 1024 * 1024 });
+      const commits = pick.split(`
+`).filter(Boolean).map((l) => {
+        const rest = l.startsWith("__COMMIT__ ") ? l.slice("__COMMIT__ ".length) : l;
+        const sp = rest.indexOf(" ");
+        return { hash: sp === -1 ? rest : rest.slice(0, sp), msg: sp === -1 ? "" : rest.slice(sp + 1) };
+      });
+      return {
+        root,
+        is_git_repo: true,
+        mode: "pickaxe",
+        pattern: opts.secretPattern,
+        total: commits.length,
+        commits,
+        hint: "Commits where the pattern was added or removed — inspect each to recover the secret value."
+      };
+    } catch (e) {
+      return { root, is_git_repo: true, mode: "pickaxe", pattern: opts.secretPattern, total: 0, error: String(e) };
+    }
+  }
+  try {
+    const log = execFileSync4("git", ["-C", root, "log", "--all", "--diff-filter=D", "--name-status", "--format=__COMMIT__ %H %s", "--no-renames"], { encoding: "utf8", maxBuffer: 10 * 1024 * 1024 });
+    const deletions = parseDeletions(log);
+    const seen = new Set;
+    let checked = 0;
+    for (const d of deletions) {
+      if (findings.length >= limit)
+        break;
+      const key = `${d.path}`;
+      if (seen.has(key))
+        continue;
+      seen.add(key);
+      try {
+        const blob = blobBeforeDeletion(root, d.commit, d.path);
+        checked++;
+        const hits = detectComplexBugs(blob, d.path).filter((f) => f.type === "hardcoded_secret");
+        for (const h of hits) {
+          findings.push({
+            path: d.path,
+            commit: d.commit,
+            commit_msg: d.commit_msg,
+            severity: h.severity,
+            category: h.category,
+            evidence: h.evidence,
+            detail: `A ${h.category} was found in a file DELETED from HEAD but still present in git history (commit ${d.commit}). Removed-later is not fixed — anyone with the repo history can recover it.`
+          });
+        }
+      } catch {}
+    }
+    return {
+      root,
+      is_git_repo: true,
+      mode: "deleted_files",
+      deletion_commits: deletions.length,
+      blobs_checked: checked,
+      total: findings.length,
+      findings,
+      hint: "Secrets in deleted files remain in .git history. Rotate any recovered credential and rewrite/scrub history."
+    };
+  } catch (e) {
+    return { root, is_git_repo: true, mode: "deleted_files", total: 0, findings: [], error: String(e) };
+  }
+}
+
+// src/key-validation.ts
+function parseValueFromBlob(text, varName) {
+  const re = new RegExp(`${varName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\s*[=:]\\s*["']?([^"'\\n]+)`);
+  const m = text.match(re);
+  if (!m)
+    throw new Error(`variable ${varName} not found in blob`);
+  return m[1].trim();
+}
+async function httpGet3(url, headers) {
+  try {
+    const res = await fetch(url, { headers, redirect: "follow" });
+    return { status: res.status, body: await res.text() };
+  } catch (e) {
+    return { status: null, body: String(e) };
+  }
+}
+async function validateLeakedKey(input) {
+  const endpoints = input.endpoints ?? ["/items"];
+  const scheme = input.scheme ?? "Bearer {value}";
+  const header = input.header ?? "Authorization";
+  let key = input.key ?? "";
+  if (!key && input.blobUrl) {
+    const blobRes = await httpGet3(input.blobUrl, { "User-Agent": "Mozilla/5.0 (recon-agent)" });
+    if (blobRes.status !== 200) {
+      return { ok: false, error: `blob fetch failed (HTTP ${blobRes.status}) — leak gone, privatized, or wrong sha`, step: "blob_fetch" };
+    }
+    try {
+      key = parseValueFromBlob(blobRes.body, input.varName ?? "SECRET_KEY");
+    } catch (e) {
+      return { ok: false, error: String(e), step: "parse" };
+    }
+  }
+  if (!key) {
+    return { ok: false, error: "no key provided and no blobUrl to recover one from", step: "key" };
+  }
+  const authHeader = { [header]: scheme.replace("{value}", key) };
+  const results = [];
+  let proven = false;
+  for (const ep of endpoints) {
+    const url = input.apiBase.replace(/\/$/, "") + (ep.startsWith("/") ? ep : "/" + ep);
+    const r0 = await httpGet3(url, { "User-Agent": "Mozilla/5.0 (recon-agent)" });
+    const r1 = await httpGet3(url, { "User-Agent": "Mozilla/5.0 (recon-agent)", ...authHeader });
+    let verdict = "-";
+    if (r0.status === null || r1.status === null)
+      verdict = "ERROR";
+    else if ((r0.status === 401 || r0.status === 403) && r1.status === 200) {
+      verdict = "BYPASS";
+      proven = true;
+    }
+    let records = null;
+    if (r1.status === 200) {
+      try {
+        records = (JSON.parse(r1.body).data ?? []).length;
+      } catch {
+        records = null;
+      }
+    }
+    results.push({
+      endpoint: ep,
+      no_auth: r0.status,
+      with_key: r1.status,
+      records,
+      verdict,
+      error: verdict === "ERROR" ? r0.status === null ? r0.body : r1.body : undefined
+    });
+  }
+  return {
+    ok: true,
+    proven,
+    key_len: key.length,
+    header,
+    scheme,
+    results,
+    verdict: proven ? "AUTH BYPASS PROVEN — leaked credential valid on live system (read-only)" : "not proven — rotated? different header scheme? check manually"
+  };
+}
+
 // src/severity.ts
 var VRT_MAP = {
   sql_injection: { vrt: "injection > sql_injection", priority: "P1", severity: "critical", rationale: "SQL injection reaches sensitive data or enables admin takeover." },
@@ -57885,7 +58173,13 @@ var VRT_MAP = {
   prototype_pollution: { vrt: "injection > prototype_pollution", priority: "P2", severity: "high", rationale: "Object prototype corruption can escalate to code execution in gadget-heavy runtimes." },
   crlf_injection: { vrt: "injection > crlf_injection", priority: "P3", severity: "medium", rationale: "Header injection enables cookie poisoning or cache poisoning." },
   missing_nonce: { vrt: "broken_access_control > cross_site_request_forgery", priority: "P3", severity: "medium", rationale: "A state-changing action lacks an anti-CSRF token." },
-  wrong_sanitizer: { vrt: "injection > improper_input_validation", priority: "P3", severity: "medium", rationale: "A value sanitized for the wrong context still reaches the sink; severity follows the sink." }
+  wrong_sanitizer: { vrt: "injection > improper_input_validation", priority: "P3", severity: "medium", rationale: "A value sanitized for the wrong context still reaches the sink; severity follows the sink." },
+  llm_injection: { vrt: "injection > prompt_injection", priority: "P2", severity: "high", rationale: "Prompt injection can exfiltrate the system prompt, RAG data, or trigger privileged tool use." },
+  graphql_exposure: { vrt: "misconfiguration > graphql_introspection", priority: "P4", severity: "low", rationale: "GraphQL introspection exposes the schema but is not directly exploitable." },
+  oauth_misconfig: { vrt: "authentication > oauth_misconfiguration", priority: "P2", severity: "high", rationale: "An OAuth/open-redirect misconfiguration can leak authorization codes → account takeover." },
+  grpc_reflection: { vrt: "misconfiguration > debug_information_exposure", priority: "P5", severity: "low", rationale: "gRPC reflection exposes the API contract but is not directly exploitable." },
+  dependency_confusion: { vrt: "insecure_design > dependency_confusion", priority: "P2", severity: "high", rationale: "An internal package resolves from a squattable public registry → attacker-controlled code in the build." },
+  ml_supply_chain: { vrt: "injection > insecure_deserialization", priority: "P1", severity: "critical", rationale: "Untrusted model loading via pickle (torch/joblib/numpy) → arbitrary code execution on load." }
 };
 function severityCalibrate(input) {
   const type = input.type?.toLowerCase() ?? "";
@@ -57925,12 +58219,12 @@ function listSeverityMap() {
 
 // src/datarefresh.ts
 import { readFileSync as readFileSync18 } from "node:fs";
-import { join as join17, dirname as dirname3 } from "node:path";
+import { join as join18, dirname as dirname3 } from "node:path";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 var __dirname3 = dirname3(fileURLToPath9(import.meta.url));
 function loadJson2(rel) {
   try {
-    return JSON.parse(readFileSync18(join17(__dirname3, "..", rel), "utf8"));
+    return JSON.parse(readFileSync18(join18(__dirname3, "..", rel), "utf8"));
   } catch {
     return null;
   }
@@ -57966,13 +58260,13 @@ init_variants();
 
 // src/benchmark.ts
 import { readFileSync as readFileSync20, readdirSync as readdirSync5, writeFileSync as writeFileSync6, rmSync as rmSync3, mkdirSync as mkdirSync7 } from "node:fs";
-import { join as join19 } from "node:path";
+import { join as join20 } from "node:path";
 import { fileURLToPath as fileURLToPath11 } from "node:url";
 import { tmpdir as tmpdir3, homedir as homedir8 } from "node:os";
 init_complex_bugs();
-var ROOT5 = join19(fileURLToPath11(new URL(".", import.meta.url)), "..");
-var CORPUS = join19(ROOT5, "bench", "corpus");
-var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join19(homedir8(), ".blitzstrike", "corpus");
+var ROOT5 = join20(fileURLToPath11(new URL(".", import.meta.url)), "..");
+var CORPUS = join20(ROOT5, "bench", "corpus");
+var CAPTURED_CORPUS_DIR = process.env.BLITZSTRIKE_CORPUS_DIR ?? join20(homedir8(), ".blitzstrike", "corpus");
 function parseCorpusFile(path) {
   let text;
   try {
@@ -58032,7 +58326,7 @@ function loadDir(dir) {
     for (const f of readdirSync5(dir)) {
       if (!f.endsWith(".md"))
         continue;
-      const e = parseCorpusFile(join19(dir, f));
+      const e = parseCorpusFile(join20(dir, f));
       if (e)
         entries.push(e);
     }
@@ -58059,7 +58353,7 @@ function captureFalsePositive(input) {
     input.code,
     "```"
   ].filter((l) => l !== null);
-  const path = join19(CAPTURED_CORPUS_DIR, `${id}.md`);
+  const path = join20(CAPTURED_CORPUS_DIR, `${id}.md`);
   writeFileSync6(path, lines.join(`
 `) + `
 `, "utf8");
@@ -58081,7 +58375,7 @@ function detect(entry) {
   }
   const lang = entry.language;
   if (lang === "php") {
-    const tmp = join19(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
+    const tmp = join20(tmpdir3(), `blitzstrike-bench-${entry.id}-${process.pid}.php`);
     writeFileSync6(tmp, entry.code);
     const r = analyzeDataFlow2(tmp);
     rmSync3(tmp, { force: true });
@@ -58150,21 +58444,21 @@ function runBenchmark() {
 }
 
 // src/obligations.ts
-import { readFileSync as readFileSync21, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync10, writeFileSync as writeFileSync7 } from "node:fs";
-import { join as join20 } from "node:path";
+import { readFileSync as readFileSync21, appendFileSync as appendFileSync4, mkdirSync as mkdirSync8, existsSync as existsSync11, writeFileSync as writeFileSync7 } from "node:fs";
+import { join as join21 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 import { homedir as homedir9 } from "node:os";
-var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join20(homedir9(), ".blitzstrike");
-var OBLIGATION_PATH = join20(HOME_DIR4, "obligations.jsonl");
+var HOME_DIR4 = process.env.BLITZSTRIKE_HOME ?? join21(homedir9(), ".blitzstrike");
+var OBLIGATION_PATH = join21(HOME_DIR4, "obligations.jsonl");
 function ensureDir3() {
-  if (!existsSync10(HOME_DIR4))
+  if (!existsSync11(HOME_DIR4))
     mkdirSync8(HOME_DIR4, { recursive: true });
 }
 function shortId2(claim) {
   return `obl-${createHash6("sha256").update(`${claim}\x00${Date.now()}`).digest("hex").slice(0, 12)}`;
 }
 function loadObligations() {
-  if (!existsSync10(OBLIGATION_PATH))
+  if (!existsSync11(OBLIGATION_PATH))
     return [];
   try {
     const out = [];
@@ -59167,17 +59461,17 @@ function analyzeJwt(token, opts = {}) {
 }
 
 // src/enterprise-benchmark.ts
-import { existsSync as existsSync11, readFileSync as readFileSync24, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import { join as join21, resolve } from "node:path";
+import { existsSync as existsSync12, readFileSync as readFileSync24, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
+import { join as join22, resolve } from "node:path";
 init_complex_bugs();
 var ROOT6 = resolve(process.cwd(), "bench", "enterprise");
 var ENTERPRISE_FIXTURES = [
-  { id: "php-laravel", dir: join21(ROOT6, "php-laravel"), expected_vulns: 4 },
-  { id: "js-express", dir: join21(ROOT6, "js-express"), expected_vulns: 2 },
-  { id: "py-django", dir: join21(ROOT6, "py-django"), expected_vulns: 2 },
-  { id: "java-spring", dir: join21(ROOT6, "java-spring"), expected_vulns: 2 },
-  { id: "wp-batch-route", dir: join21(ROOT6, "wp-batch-route"), expected_vulns: 3 },
-  { id: "php-complex", dir: join21(ROOT6, "php-complex"), expected_vulns: 4 }
+  { id: "php-laravel", dir: join22(ROOT6, "php-laravel"), expected_vulns: 4 },
+  { id: "js-express", dir: join22(ROOT6, "js-express"), expected_vulns: 2 },
+  { id: "py-django", dir: join22(ROOT6, "py-django"), expected_vulns: 2 },
+  { id: "java-spring", dir: join22(ROOT6, "java-spring"), expected_vulns: 2 },
+  { id: "wp-batch-route", dir: join22(ROOT6, "wp-batch-route"), expected_vulns: 3 },
+  { id: "php-complex", dir: join22(ROOT6, "php-complex"), expected_vulns: 4 }
 ];
 function sourceFiles(root) {
   const out = [];
@@ -59189,7 +59483,7 @@ function sourceFiles(root) {
       return;
     }
     for (const e of entries) {
-      const p = join21(dir, e);
+      const p = join22(dir, e);
       let st;
       try {
         st = statSync3(p);
@@ -59228,7 +59522,7 @@ function detectFixture(dir) {
 function runEnterpriseBenchmark() {
   const fixtures = [];
   for (const fx of ENTERPRISE_FIXTURES) {
-    if (!existsSync11(fx.dir)) {
+    if (!existsSync12(fx.dir)) {
       fixtures.push({ id: fx.id, available: false, detected: 0, expected: fx.expected_vulns, recall: 0 });
       continue;
     }
@@ -59405,7 +59699,7 @@ function createServer() {
 ` + `- A hard block (Cloudflare/WAF/IP-block/captcha) is NOT the end: mark the finding blocked + note the required vantage (residential / authorized / correct-SNI / --resolve direct-to-origin), then CONTINUE to the next lead (origin bypass, non-prod cluster, mobile APK, subdomain).
 ` + `- Keep trying every lead AND every chain step until each is verified/executed or blocked, THEN generate_report. Never deliver a bare surface map, and never stop at 'found X' when X enables more.
 
-` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified.\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
+` + "TWO PATHS:\\n" + "- Source path on disk -> blitz_scan / taint_file / eagle_eye2 (static).\\n" + "- Live URL -> live_recon / active_scan / strike_verify (web-hunting).\\n\\n" + "DEEPEN A FINDING: attack_plan(target, tech, params) to get the prioritized vector plan (decide what to test next with data); list_chains (escalation), chain_links (compose), technique_lookup(cls), payload_lookup, bypass_lookup (blocked). Ground any detector hit empirically with pattern_lookup(id) — it returns the class's CWE, real-world signature, escalation chains, citable references, per-class bypass techniques, and the high-value assets (crown jewels) that class hits, so a raw hit becomes a class-aware finding. Resolve free-form terminology first with synonym_lookup(term) (IDOR/BOLA/SQLi/prompt-injection → canonical id). For an llm_injection hit, its pattern carries a validation discipline — the RUN-TWICE RULE (reproduce token-for-token across two fresh sessions), NON-GUESSABLE ANCHOR (must leak a real key/URL, not a plausible guess), and OOB PROOF (a verifiable callback log) — apply all three before reporting. BEFORE generating a report, run submission_gate(...) and only ship a finding that passes all 7 questions (reproducible, in-scope, real-impact, no-privileged-assumption, verified-live, evidence-redacted, severity-derived); one false = kill it. Calibrate severity with severity_calibrate(type, cvss) to get a P1–P5 tier + VRT-style category. Start each engagement with engagement_scaffold(target, scope) for the folder + scope.md structure, and check data_refresh() to confirm the data layers are consistent. Phase doctrine: read_skill(bs-orchestrate-engagement | bs-web-hunting | bs-source-audit | bs-verify-finding). Campaign plan: read_playbook(target-type). On any failure call retry_guidance(signal) / model_fallback(signal) before giving up.\n" + "KNOWLEDGE BASE (discover, don't guess): skillLookup(topic) / listSkills for the 40 attack-path + hunting skills (ap-*, hp-*, bs-*); list_attack_vectors / attack_vectors(cat) for the 34-category vector taxonomy; taxonomy(kind) for OWASP/CWE/ASVS/API-top-10; read_playbook(type) for the 17 campaign playbooks; list_manuals / read_tool_manual for 317 tool references; list_tools / run_catalog_tool for the 141-tool catalog. Every tool, skill, and data layer is reachable from these. CROSS-TARGET INTELLIGENCE: strike_resolve auto-records confirmed/false_positive verdicts into the empirical ledger; query it with intelligence(action=hit_rates/top_vectors/recall) so a new target on a known tech inherits historical hit-rates (attack_plan already blends them into success_probability). intelligence(action=recall, tech, target) is the per-engagement pattern recall — it returns which patterns historically CONFIRMED on that tech (prioritize them) versus which only ever produced false positives (avoid them), so a new engagement starts from the empirical playbook of past ones. LIVE PENTEST + TARGETING (black-box, WAF-safe): cache_gap(base_url, endpoint) fuzzes path-normalization + static-extension variants for cache deception/poisoning; blind_oracle(base_url, param, value) detects which SINK a param reaches (sql/ssti/xss) via benign arithmetic (id=1+0, test${7*7}) WITHOUT a malicious payload; param_precedence(base_url, param, A, B) maps duplicate-parameter precedence (first/last-wins) for WAF-bypass. SOURCE TARGETING: action_surface(code) maps every wp_ajax_* action to its vuln class + DERIVED priority (what to look for WHERE); security_state(sanitizers, sink) gives a wrong-context sanitization verdict; framework_knowledge(framework) returns auth/nonce primitives for 9 frameworks; variant_scan(root, signature) mass-sweeps an install base for ONE bug family; patch_analyze(old, new) REVERSES a security patch into the 0-day, and its mine_signature feeds variant_scan to sweep unpatched copies. All of these are DETECTION HINTS — verify each live (strike_verify / browser_validate) before it enters the report. NEWEST DETECTORS — understand AND try them: variant_scan also emits priv_esc (privilege escalation — a role/capability/user change fed by request input, traced cross-file via reverse call-graph, e.g. set_role($id, sanitize_key($_POST['um-role'])) or update_user_meta(...,'wp_capabilities', $_POST[...])) and flags uploadAllow=>array('all') unrestricted-upload configs as file_upload (the file-manager/connector shape). TO TRY a priv_esc hit: submit the role field with 'administrator' (or send wp_capabilities meta) and confirm the account actually gains admin. TO TRY an unrestricted-upload hit: POST a .php/.phtml and confirm it lands web-reachable + executes. variant_scan also emits hardcoded_secret (CWE-798) in three tiers: a secret field (api_key/db_password/access_token/aws_*) assigned a literal (HIGH), a known secret FORMAT (JWT eyJ…/AWS AKIA…/GitHub ghp_…/Slack xoxb-…/…) regardless of name (HIGH), or a high-entropy suspect token (MEDIUM — verify before reporting). Verify a frontend/JS secret live via drive_devtools (inspect the JS bundle / network response and confirm the key is actually exposed), and for a backend secret confirm it is reachable/valid. A static hit is a HYPOTHESIS until verified live — never report unverified. For a repo, also scan_git_history(root) — secrets DELETED from HEAD still live in .git history (the removed-later-is-not-fixed trap), and it feeds every recovered pre-deletion blob through the same secret detector. Once you recover a credential, prove it is still ACTIVE with validate_leaked_key(apiBase, endpoints, key|blobUrl) — a READ-ONLY differential test (401-without-key vs 200-with-key = auth bypass PROVEN). Two supply-chain detectors: dependency_confusion (a manifest/build file resolving a package from a public registry — pypi.org/npmjs.org --extra-index-url, or a scoped @company/pkg with no private registry) and ml_supply_chain (torch.load without weights_only=True / joblib.load / np.load(allow_pickle=True) / keras load_model on an untrusted model → pickle RCE).\n" + `PRECISION ANALYSIS — chrome-devtools MCP is MANDATORY, not optional:
 ` + `- When a lead needs DOM/JS precision — DOM-XSS sink execution, AJAX endpoint + payload interception, JS runtime errors, redirect chains, SSO/token flow, or anything a static HTML glance cannot prove — call drive_devtools(target). It spawns chrome-devtools-mcp and drives a REAL headless browser (navigate -> list_network_requests -> list_console_messages -> evaluate_script), giving reproducible evidence instead of a guess.
 ` + `- Before calling it, check_mcp() to confirm the browser MCP is available; if not, blitzstrike install-tools or npm i -g chrome-devtools-mcp. Never substitute eyeballing minified JS or a static sink guess when a live browser can PROVE it. This is the precision + consistency layer.
 ` + "EXTERNAL MCP SERVERS (verified, connect them — NOT one-shot CLIs): chrome-devtools-mcp (29 tools: list_network_requests/get_network_request for raw HTTP interception, list_console_messages for JS errors + DOM-XSS, evaluate_script to run JS, take_screenshot) -> stdio chrome-devtools-mcp --headless --chromeArg=--no-sandbox --chromeArg=--disable-gpu (as root/container this is MANDATORY or the browser crashes; add --proxyServer http://127.0.0.1:8080 to route through Burp, --acceptInsecureCerts for bad TLS). burp-suite-mcp (proxy history + active scan + repeater) -> NOT npm: build the JAR (git clone https://github.com/PortSwigger/mcp-server.git && cd mcp-server && ./gradlew embedProxyJar), load it in Burp Extensions, then connect the client to http://127.0.0.1:9876 (SSE) or the stdio proxy java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876."
@@ -59849,6 +60143,32 @@ ${statusLine}` : statusLine },
     const r = synonymsFor(term);
     return { content: [{ type: "text", text: JSON.stringify({ ...r, pattern: patternLookup(r.canonical) }) }] };
   });
+  server.registerTool("scan_git_history", {
+    title: "Mine git history for deleted secrets",
+    description: "DETECT: scan a git repo's HISTORY (not just HEAD) for secrets in files that were DELETED — the 'removed later != fixed' trap. Runs git log --diff-filter=D + git show <sha>^:<path> (read-only) and feeds every recovered pre-deletion blob through the hardcoded_secret detector. Pass secretPattern to instead pickaxe-search for one specific token through all commits.",
+    inputSchema: {
+      root: string2().describe("Path to the git repo root (must contain .git)."),
+      secretPattern: string2().optional().describe("Optional: a specific secret token to pickaxe-search (git log -S) through history."),
+      limit: number2().int().optional().describe("Max findings (default 30).")
+    }
+  }, async ({ root, secretPattern, limit }) => {
+    return { content: [{ type: "text", text: JSON.stringify(scanGitHistory(root, { secretPattern, limit })) }] };
+  });
+  server.registerTool("validate_leaked_key", {
+    title: "Prove a leaked key is still active (differential)",
+    description: "VERIFY: prove a recovered credential is ACTIVE on a live API with a READ-ONLY differential test — the same endpoint is fetched without the key (expect 401/403) and with the key (expect 200). A 401-without / 200-with contrast is proof of auth bypass. Pass the raw key, or a blobUrl + varName to fetch/parse it from a leaked file first. No mutating request is ever sent.",
+    inputSchema: {
+      key: string2().optional().describe("Raw secret value to test (skip blob fetch)."),
+      blobUrl: string2().optional().describe("Or: raw-blob URL (e.g. forge raw/commit/<sha>^/<path>) to fetch + parse the key from."),
+      varName: string2().optional().describe("Variable name to parse from the blob (default SECRET_KEY)."),
+      apiBase: string2().describe("Live API base URL."),
+      endpoints: array(string2()).optional().describe("Read-only GET endpoints to probe (default ['/items'])."),
+      scheme: string2().optional().describe("Header value template, e.g. 'Bearer {value}' (default)."),
+      header: string2().optional().describe("Header name (default Authorization).")
+    }
+  }, async (input) => {
+    return { content: [{ type: "text", text: JSON.stringify(await validateLeakedKey(input)) }] };
+  });
   server.registerTool("fofa_search", {
     title: "FOFA asset search",
     description: "STRIKE: search the FOFA asset index (needs FOFA_EMAIL + FOFA_KEY).",
@@ -61193,14 +61513,14 @@ async function serve() {
 
 // src/index.ts
 init_cli();
-import { readFileSync as readFileSync30, existsSync as existsSync14 } from "node:fs";
-import { join as join26 } from "node:path";
+import { readFileSync as readFileSync30, existsSync as existsSync15 } from "node:fs";
+import { join as join27 } from "node:path";
 import { fileURLToPath as fileURLToPath16 } from "node:url";
-var ROOT11 = join26(fileURLToPath16(new URL(".", import.meta.url)), "..");
+var ROOT11 = join27(fileURLToPath16(new URL(".", import.meta.url)), "..");
 function readVersion() {
   try {
-    const p = join26(ROOT11, "package.json");
-    if (existsSync14(p))
+    const p = join27(ROOT11, "package.json");
+    if (existsSync15(p))
       return JSON.parse(readFileSync30(p, "utf8")).version ?? "1.0.0";
   } catch {}
   return "1.0.0";