blitzstrike 1.0.41 → 1.0.44

package/CHANGELOG.md

@@ -5,6 +5,58 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.44] — 2026-09-13
+
+### Added
+
+- **Autonomous no-babysitting orchestration** (the missing piece vs.
+  oh-my-open-pentest's plugin loop):
+  - `runEngagement` now returns the full deliverable **inline** — summary,
+    markdown, JSON, and SARIF — so a single call completes a source audit
+    (no separate `report` call needed).
+  - `runLiveEngagement` — a fully autonomous live engagement for URL targets:
+    scope gate → marker-reflection sweep (`strike_verify` per common parameter)
+    → canonical findings via `resolveFinding` → inline report.
+  - `run_engagement` MCP tool auto-branches: URL target → autonomous live
+    sweep; source path → full static pipeline. Scope-gated and non-destructive
+    (marker + negative control only).
+
+## [1.0.43] — 2026-09-13
+
+### Added
+
+- **Phase 8 — Production Hardening**:
+  - **Caching** (`src/cache.ts`, §46) — versioned result cache (`sha256(source) + engine_version`);
+    wired into `analyzeDataFlow2` so unchanged files skip re-parsing.
+  - **SARIF export** (`src/sarif.ts`, §32) — `toSarif()` emits a SARIF 2.1.0 document
+    (GitHub Code Scanning / GitLab / Azure DevOps).
+  - **Release validation** (`src/release.ts`, §49) — `validateRelease()` checks
+    package.json vs CHANGELOG (hard) + git tag / npm registry / lockfile (soft).
+  - **Dependency security** (`src/dependency.ts`, §50) — `checkDependencies()`
+    inspects install-time scripts and git/unusual dependency sources.
+  - **Incremental analysis** (`src/incremental.ts`, §47) — `analyzeChangedFiles()`
+    re-analyzes only the files a commit touched (git diff → changed files → engine).
+  - **CI/CD** (`.github/workflows/ci.yml`, §48) — typecheck, tests, build, npm pack,
+    release-consistency, and dependency-surface gates.
+  - `blitzstrike doctor` now reports release-metadata and dependency-surface health.
+
+## [1.0.42] — 2026-09-13
+
+### Added
+
+- **Phase 7 — MCP Orchestration** (`src/orchestration.ts`, wired into `run_engagement`):
+  - A data-driven **state machine** (10 states: scope_check → plan → recon →
+    analyze → hypothesis → select_chain → validate → evidence → finding → report).
+  - A deterministic **planner** (`buildPlan`) that emits an ordered plan with
+    per-step tool, risk level, evidence requirements, and done/pending/blocked status.
+  - A **risk policy** (`actionPermitted`) that gates high-risk actions
+    (strike_verify, confirm_finding) behind scope.
+  - **§34 agent guidance** (`computeGuidance`) — every result now exposes
+    current_state / confidence / blocking_reason / required_evidence /
+    recommended_next_action / recommended_tool.
+  - `run_engagement` output now includes `state`, `plan`, `guidance`, and
+    `risk_policy` (no new MCP tools added — the surface was deepened, not widened).
+
 ## [1.0.41] — 2026-09-13
 
 ### Added
@@ -133,6 +185,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   now use `\b` word boundaries, so `outer_exec(...)` is no longer misclassified
   as command execution.
 
+## [1.0.34] — 2026-09-13
+
+### Fixed (Phase 1 review)
+
+- `hasSecrets` rewritten as `redactSecrets(text) !== text` — deterministic
+  (fixed the `g`-flag `.test()` state bug) and no false positive on already-redacted
+  content (`password=[REDACTED]` is no longer flagged).
+- Wired `finding_updated` audit event into `transition()` / `rejectFinding()`.
+
 ## [1.0.33] — 2026-09-13
 
 ### Added
@@ -159,6 +220,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Shared `src/version.ts` — single source of truth for the package version
   (removed the duplicate VERSION readers in `server.ts`).
 
+## [1.0.32] — 2026-09-13
+
+### Added
+
+- Self-update: `blitzstrike update` CLI command + `check_update` MCP tool
+  (`src/update.ts` with semver-aware version comparison).
+
+## [1.0.31] — 2026-09-13
+
+### Changed
+
+- npm publish pipeline debug (version bump only, no functional change).
+
+## [1.0.30] — 2026-09-13
+
+### Changed
+
+- Removed source attribution from the attack-vector taxonomy data (first-party
+  content; `_comment` and notices stripped).
+
+## [1.0.29] — 2026-09-13
+
+### Added
+
+- Attack-vector taxonomy (`intelligence/attack_vectors.json`, 34 categories /
+  588 vectors) + `list_attack_vectors` + `attack_vectors` MCP tools.
+
+## [1.0.28] — 2026-09-13
+
+### Fixed
+
+- Benchmark corpus writes to the OS temp directory (hermetic; no writes inside
+  the read-only package).
+
+## [1.0.27] — 2026-09-13
+
+### Added
+
+- Documentation milestone: CHANGELOG / ROADMAP / README + docs metrics.
+
 ## [1.0.26] — 2026-09-13
 
 The first hardening milestone: the whole roadmap is implemented, measured, and