blitzstrike 2.4.9 → 2.4.11

package/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.11] — 2026-09-14
+
+### Fixed — bulk-install no longer pollutes the caller's cwd
+
+- `install-tools` / `install_all_tools` now run every install command in a fixed
+  tools directory (`~/.blitzstrike/tools`, override `BLITZSTRIKE_TOOLS_DIR`), so
+  `git clone`-style tools (massdns, phpggc, radare2, testssl.sh, …) no longer
+  land in whatever directory you happened to run from.
+- Added those cloned tool dirs to `.gitignore`.
+- `blitzstrike install` now prints a hint pointing to `blitzstrike install-tools`
+  for the full 140-tool catalog.
+
+## [2.4.10] — 2026-09-14
+
+### Added — auto-install external MCP servers to every agent
+
+- chrome-devtools-mcp is now flagged `installable` in the catalog: `install-tools`
+  / `install_all_tools` provision it (npm i -g) instead of skipping all MCP
+  servers. burp-suite-mcp stays skipped (GUI/daemon — build + run manually).
+- `blitzstrike install` (register to every agent) now also auto-installs
+  chrome-devtools-mcp so all agents can drive a real browser immediately.
+
+### Fixed — doctor git stderr leak
+
+- `validateRelease` suppresses git/npm stderr, so `blitzstrike doctor` no longer
+  prints a stray `fatal: not a git repository` / `No tags can describe` line when
+  run outside a git checkout.
+
 ## [2.4.9] — 2026-09-14
 
 ### Added — evidence-first enforcement (findings are never born empty)

package/dist/index.js

@@ -7398,9 +7398,10 @@ function h1Username() {
 }
 
 // src/catalog.ts
-import { readFileSync as readFileSync6, readdirSync as readdirSync2 } from "node:fs";
+import { readFileSync as readFileSync6, readdirSync as readdirSync2, mkdirSync as mkdirSync3 } from "node:fs";
 import { join as join6 } from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
+import { homedir as homedir3 } from "node:os";
 import { spawnSync, spawn } from "node:child_process";
 function loadTools() {
   if (_toolsCache)
@@ -7517,7 +7518,8 @@ function ensureTool(name) {
   if (!cmd) {
     return { name: t.name, installed: false, action: "none", note: `no install command for ${platform}` };
   }
-  const r = spawnSync(cmd, { shell: true, timeout: 120000 });
+  mkdirSync3(TOOLS_DIR, { recursive: true });
+  const r = spawnSync(cmd, { shell: true, timeout: 120000, cwd: TOOLS_DIR });
   const ok = r.status === 0;
   return {
     name: t.name,
@@ -7616,7 +7618,8 @@ function ensureToolAsync(name, timeoutMs = 120000) {
         resolve({ name: t.name, installed: false, action: "none", note: "no install command for this platform" });
         return;
       }
-      const inst = spawn(cmd, { shell: true, timeout: timeoutMs });
+      mkdirSync3(TOOLS_DIR, { recursive: true });
+      const inst = spawn(cmd, { shell: true, timeout: timeoutMs, cwd: TOOLS_DIR });
       let out = "";
       inst.stdout?.on("data", (d) => {
         out += d.toString();
@@ -7633,9 +7636,9 @@ function ensureToolAsync(name, timeoutMs = 120000) {
 }
 async function installAllTools(opts = {}) {
   const tools = loadTools();
-  const mcp = tools.filter((t) => t.category === "mcp-server").map((t) => t.name);
+  const skippedMcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true).map((t) => t.name);
   const cat = opts.category?.toLowerCase();
-  const targets = tools.filter((t) => t.category !== "mcp-server" && (!cat || t.category === cat));
+  const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!cat || t.category === cat));
   const concurrency = Math.max(1, opts.concurrency ?? 4);
   const results = [];
   let idx = 0;
@@ -7657,14 +7660,15 @@ async function installAllTools(opts = {}) {
     installed,
     already_installed: already,
     failed,
-    skipped_mcp_servers: mcp,
+    skipped_mcp_servers: skippedMcp,
     results
   };
 }
-var ROOT2, _toolsCache = null, _skillsCache = null;
+var ROOT2, TOOLS_DIR, _toolsCache = null, _skillsCache = null;
 var init_catalog = __esm(() => {
   init_manuals();
   ROOT2 = join6(fileURLToPath3(new URL(".", import.meta.url)), "..");
+  TOOLS_DIR = process.env.BLITZSTRIKE_TOOLS_DIR ?? join6(homedir3(), ".blitzstrike", "tools");
 });
 
 // src/burp-mcp.ts
@@ -15412,9 +15416,9 @@ async function checkMcpServers() {
 var init_mcp_status = () => {};
 
 // src/sync.ts
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync6, readFileSync as readFileSync18, readdirSync as readdirSync7, statSync as statSync4, rmSync as rmSync4 } from "node:fs";
 import { join as join16 } from "node:path";
-import { homedir as homedir5 } from "node:os";
+import { homedir as homedir6 } from "node:os";
 import { fileURLToPath as fileURLToPath9 } from "node:url";
 import { spawnSync as spawnSync4 } from "node:child_process";
 function dirExists(p) {
@@ -15443,7 +15447,7 @@ function countFiles(dir) {
 }
 function syncData() {
   if (!dirExists(DATA_ROOT2))
-    mkdirSync4(DATA_ROOT2, { recursive: true });
+    mkdirSync5(DATA_ROOT2, { recursive: true });
   const payloadsPath = join16(DATA_ROOT2, "payloads");
   const templatesPath = join16(DATA_ROOT2, "templates");
   const hasPayloads = dirExists(payloadsPath) && countFiles(payloadsPath) > 0;
@@ -15501,7 +15505,7 @@ function copyDir(src, dst) {
   }
 }
 function manualCopy(src, dst) {
-  mkdirSync4(dst, { recursive: true });
+  mkdirSync5(dst, { recursive: true });
   for (const e of readdirSync7(src, { withFileTypes: true })) {
     const s = join16(src, e.name);
     const d = join16(dst, e.name);
@@ -15514,7 +15518,7 @@ function manualCopy(src, dst) {
 var ROOT7, DATA_ROOT2, GITHUB_REPO = "https://github.com/shinthink/blitzstrike.git";
 var init_sync = __esm(() => {
   ROOT7 = join16(fileURLToPath9(new URL(".", import.meta.url)), "..");
-  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join16(homedir5(), ".blitzstrike", "data");
+  DATA_ROOT2 = process.env.BLITZSTRIKE_DATA ?? join16(homedir6(), ".blitzstrike", "data");
 });
 
 // src/update.ts
@@ -15579,13 +15583,13 @@ function validateRelease() {
     checks.push({ name: "CHANGELOG version", ok: false, detail: "CHANGELOG.md not found" });
   }
   try {
-    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8" }).trim();
+    const tag = execSync4("git describe --tags --abbrev=0", { cwd: ROOT8, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "Git tag", ok: tag === `v${VERSION}`, detail: tag, soft: true });
   } catch {
-    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git)", soft: true });
+    checks.push({ name: "Git tag", ok: true, detail: "unavailable (no git/tags)", soft: true });
   }
   try {
-    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000 }).trim();
+    const published = execSync4("npm view blitzstrike version", { encoding: "utf8", timeout: 8000, stdio: ["ignore", "pipe", "ignore"] }).trim();
     checks.push({ name: "npm registry version", ok: published === VERSION, detail: published, soft: true });
   } catch {
     checks.push({ name: "npm registry version", ok: true, detail: "unavailable (offline)", soft: true });
@@ -15641,9 +15645,9 @@ var init_dependency = __esm(() => {
 });
 
 // src/cli.ts
-import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync5 } from "node:fs";
+import { readFileSync as readFileSync22, existsSync as existsSync11, writeFileSync as writeFileSync7, mkdirSync as mkdirSync6 } from "node:fs";
 import { join as join19, dirname as dirname2 } from "node:path";
-import { homedir as homedir6 } from "node:os";
+import { homedir as homedir7 } from "node:os";
 import { fileURLToPath as fileURLToPath12 } from "node:url";
 import { spawnSync as spawnSync5 } from "node:child_process";
 function which(cmd) {
@@ -15761,7 +15765,7 @@ function jsonMcpServersWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcpServers = {
       ...existing.mcpServers ?? {},
@@ -15774,7 +15778,7 @@ function opencodeWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     const existing = readJson(p) ?? {};
     existing.mcp = {
       ...existing.mcp ?? {},
@@ -15786,11 +15790,11 @@ function opencodeWrite(p) {
 }
 function copyOpenCodeAgents() {
   const srcDir = join19(ROOT10, "opencode-agents");
-  const dstDir = join19(homedir6(), ".config", "opencode", "agents");
+  const dstDir = join19(homedir7(), ".config", "opencode", "agents");
   if (!existsSync11(srcDir))
     return;
   if (!existsSync11(dstDir))
-    mkdirSync5(dstDir, { recursive: true });
+    mkdirSync6(dstDir, { recursive: true });
   for (const f of ["Blitz Strike.md", "Blitz.md", "Eagle Eye.md", "Strike.md"]) {
     const src = join19(srcDir, f);
     const dst = join19(dstDir, f);
@@ -15803,7 +15807,7 @@ function codexWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     if (!existing.trimEnd().endsWith(`
 `))
@@ -15822,7 +15826,7 @@ function hermesWrite(p) {
   return (command, args) => {
     const dir = dirname2(p);
     if (!existsSync11(dir))
-      mkdirSync5(dir, { recursive: true });
+      mkdirSync6(dir, { recursive: true });
     let existing = existsSync11(p) ? readFileSync22(p, "utf8") : "";
     existing = existing.replace(/^  blitzstrike:\n(?:    .*\n?)*/m, "");
     if (!existing.trimEnd().endsWith(`
@@ -15848,7 +15852,7 @@ mcp_servers:
   };
 }
 function detectAgents() {
-  const home = homedir6();
+  const home = homedir7();
   const agents = [];
   const claudeJson = join19(home, ".claude.json");
   agents.push({
@@ -15958,6 +15962,13 @@ Agent-specific formats: see docs/installation.md`);
   console.log(`
 Registered with ${ok}/${installed.length} agent(s).`);
   console.log("Restart your agent, then call `run_engagement` or any `blitzstrike` tool.");
+  console.log(`
+External MCP servers:`);
+  const devtools = ensureTool("chrome-devtools-mcp");
+  console.log(`  ${devtools.installed ? "OK  " : "FAIL"} chrome-devtools-mcp  ${devtools.installed ? "installed (browser MCP ready for all agents)" : devtools.command ?? "install failed"}`);
+  console.log(`  SKIP burp-suite-mcp  GUI/daemon — build manually (PortSwigger/mcp-server) + load in Burp (connect, not install)`);
+  console.log(`
+To install ALL 140 catalog tools (139 CLI + chrome-devtools-mcp), run:  blitzstrike install-tools`);
 }
 async function runInstallTools(args) {
   const getArg = (flag) => {
@@ -15975,9 +15986,9 @@ async function runInstallTools(args) {
   await Promise.resolve().then(() => init_catalog());
   if (dryRun) {
     const tools = loadTools();
-    const mcp = tools.filter((t) => t.category === "mcp-server");
-    const targets = tools.filter((t) => t.category !== "mcp-server" && (!category || t.category === category.toLowerCase()));
-    console.log(`Dry run — would attempt ${targets.length} tool(s); ${mcp.length} MCP server(s) skipped (connect, not install):`);
+    const mcp = tools.filter((t) => t.category === "mcp-server" && t.installable !== true);
+    const targets = tools.filter((t) => (t.category !== "mcp-server" || t.installable === true) && (!category || t.category === category.toLowerCase()));
+    console.log(`Dry run — would attempt ${targets.length} tool(s); ${mcp.length} MCP server(s) skipped (GUI/daemon — connect, not install):`);
     for (const t of targets)
       console.log(`  ${t.category.padEnd(11)} ${t.name}`);
     return;
@@ -31773,7 +31784,7 @@ async function browserValidate(check, target, payload) {
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
 import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
 import { join as join7 } from "node:path";
-import { homedir as homedir3 } from "node:os";
+import { homedir as homedir4 } from "node:os";
 function mcpClient(command, args) {
   const proc = spawn2(command, args, { stdio: ["pipe", "pipe", "pipe"] });
   let id = 0;
@@ -31849,7 +31860,7 @@ function findChromium() {
         return p;
     }
   }
-  const pw = join7(homedir3(), ".cache", "ms-playwright");
+  const pw = join7(homedir4(), ".cache", "ms-playwright");
   if (existsSync4(pw)) {
     for (const d of readdirSync3(pw)) {
       if (!d.startsWith("chromium"))
@@ -32179,7 +32190,7 @@ import { readFileSync as readFileSync7, existsSync as existsSync5 } from "node:f
 import { join as join8 } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 import { readdirSync as readdirSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
+import { homedir as homedir5 } from "node:os";
 var ROOT3 = join8(fileURLToPath4(new URL(".", import.meta.url)), "..");
 var INTEL = join8(ROOT3, "intelligence");
 function loadJson(name) {
@@ -32410,7 +32421,7 @@ function attackPlan(target, tech = [], params = []) {
 }
 var PACKAGE_PAYLOADS = join8(ROOT3, "payloads");
 var PACKAGE_TEMPLATES = join8(ROOT3, "templates");
-var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir4(), ".blitzstrike", "data");
+var DATA_ROOT = process.env.BLITZSTRIKE_DATA ?? join8(homedir5(), ".blitzstrike", "data");
 function payloadsDir() {
   if (existsSync5(PACKAGE_PAYLOADS))
     return PACKAGE_PAYLOADS;
@@ -34730,7 +34741,7 @@ function compactState(phase, findings) {
 }
 
 // src/tasks.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync9, writeFileSync as writeFileSync2 } from "node:fs";
 import { join as join10 } from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 function tasksDir() {
@@ -34747,7 +34758,7 @@ function load(id) {
   }
 }
 function save(t) {
-  mkdirSync3(tasksDir(), { recursive: true });
+  mkdirSync4(tasksDir(), { recursive: true });
   writeFileSync2(taskPath(t.task_id), JSON.stringify(t, null, 2));
 }
 function taskStart(id, objective, plan) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.9",
+  "version": "2.4.11",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {