blitzstrike 1.0.44 → 1.0.47
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +61 -0
- package/dist/index.js +16034 -14879
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,67 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [1.0.47] — 2026-09-13
|
|
9
|
+
|
|
10
|
+
### Added — Autonomous Security Engine (phase 7: adaptive planner)
|
|
11
|
+
|
|
12
|
+
- **Adaptive Attack Planner** (`src/mission/planner.ts`, §11):
|
|
13
|
+
- `ATTACK_BRANCHES` — data-driven technique library across SSRF / LFI / SQLi /
|
|
14
|
+
RCE / XSS / IDOR / XXE / traversal (each with rationale, expected value,
|
|
15
|
+
risk, evidence requirements, and tool).
|
|
16
|
+
- `planNextActions()` — generates ranked next actions from unresolved
|
|
17
|
+
hypotheses (confidence × expected-value − risk), evidence-driven branching.
|
|
18
|
+
- `classifyType()` — maps hypothesis type strings to a technique class.
|
|
19
|
+
- **Escalation Graph** (`buildEscalationGraph`, §12) — integrates the 57
|
|
20
|
+
escalation chains into the Security Graph (`vuln` → `enables` → `attack_chain`),
|
|
21
|
+
seeded into every mission's world model.
|
|
22
|
+
- `@commander` now emits ranked `next_actions` from the adaptive planner.
|
|
23
|
+
|
|
24
|
+
## [1.0.46] — 2026-09-13
|
|
25
|
+
|
|
26
|
+
### Fixed (autonomous-engine milestone review)
|
|
27
|
+
|
|
28
|
+
- **Scope gate** — a URL mission without an authorized scope now terminates
|
|
29
|
+
immediately with `scope_required` (no agent runs); `@recon` also refuses
|
|
30
|
+
unscoped URL targets instead of falling through to a source scan.
|
|
31
|
+
- **Retry scheduling** — `retry` tasks are re-runnable again (treated as
|
|
32
|
+
`pending`), so failed tasks retry then resolve to `failed` instead of sticking.
|
|
33
|
+
- **Security Graph now populated** — `@source` links sink nodes to the target;
|
|
34
|
+
`@commander`/`@reviewer` read the graph (exposure + reachability) for strategy
|
|
35
|
+
and adversarial review.
|
|
36
|
+
- **Hypothesis lifecycle wired** — `@validator` promotes/rejects hypotheses
|
|
37
|
+
(validated/rejected) from STRIKE verdicts; `@reviewer` rejects low-confidence
|
|
38
|
+
or unreachable findings.
|
|
39
|
+
- **Observability** — every agent decision is recorded in `decision_log`;
|
|
40
|
+
the `@reporter` output is captured as the mission `report`.
|
|
41
|
+
|
|
42
|
+
## [1.0.45] — 2026-09-13
|
|
43
|
+
|
|
44
|
+
### Added — Autonomous Security Engine (foundation, phases 1–6 of 18)
|
|
45
|
+
|
|
46
|
+
The first milestone of the "Autonomous Security Research & Verification Engine"
|
|
47
|
+
upgrade — a Mission Control layer that wraps the existing BLITZ / EAGLE-EYE /
|
|
48
|
+
STRIKE core without replacing it.
|
|
49
|
+
|
|
50
|
+
- **Mission State** (`src/mission/state.ts`) — persistent, resumable missions
|
|
51
|
+
(`~/.blitzstrike/missions/<id>.json`).
|
|
52
|
+
- **Task Graph** (`src/mission/taskgraph.ts`) — dependency-aware, parallel
|
|
53
|
+
scheduling (pending/running/blocked/success/failed/retry/skipped/cancelled).
|
|
54
|
+
- **Security Graph** (`src/mission/graph.ts`) — shared world model (nodes +
|
|
55
|
+
typed edges).
|
|
56
|
+
- **Hypothesis Engine** (`src/mission/hypothesis.ts`) — observation/hypothesis/
|
|
57
|
+
validated/rejected with §14 confidence bands; never auto-confirms a hit.
|
|
58
|
+
- **Specialized Agents** (`src/agents.ts`) — 12 modular agents (@commander,
|
|
59
|
+
@recon, @web, @api, @source, @auth, @mobile, @cloud, @analysis, @validator,
|
|
60
|
+
@reviewer, @reporter), each wrapping an existing primitive.
|
|
61
|
+
- **Mission Control** (`src/mission/control.ts`) — the autonomous loop
|
|
62
|
+
(observe → plan → act → collect → replan → terminate), stateful + resumable,
|
|
63
|
+
mode profiles (web/api/source/mobile/cloud/bugbounty/redteam/audit).
|
|
64
|
+
- **CLI** — `blitzstrike mission <target> [--mode] [--scope]`, plus
|
|
65
|
+
list/status/report/resume/stop subcommands.
|
|
66
|
+
- **MCP Autonomous Mission API** — `mission_start` / `mission_status` /
|
|
67
|
+
`mission_resume` / `mission_stop` / `mission_list`.
|
|
68
|
+
|
|
8
69
|
## [1.0.44] — 2026-09-13
|
|
9
70
|
|
|
10
71
|
### Added
|