blitzstrike 1.0.47 → 1.0.49

package/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.49] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 9: failure recovery)
+
+- **Failure Recovery** (`src/mission/recovery.ts`, §17):
+  - `diagnoseError()` — categorizes failures (network / permission /
+    missing_tool / invalid_args / scope / unknown).
+  - `recoveryDecision()` — network → retry (bounded); missing_tool → route to an
+    alternative agent; scope / permission / invalid_args → record (no retry).
+  - `AGENT_ALTERNATIVES` — fallback specialization per agent type.
+  - `recordFailure()` — a failed-approach record with a `future_policy` so the
+    autonomous system never blindly repeats the same mistake.
+- Mission Control now routes task failures through the recovery engine and
+  persists `failed_approaches` into the mission state.
+
+## [1.0.48] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 8: coverage-driven scheduler)
+
+- **Coverage-driven Scheduler** (`src/mission/coverage.ts`, §13):
+  - `computeCoverage()` — 10 dimensions (attack surface, endpoints, technologies,
+    source files, sink classes, auth/authorization boundaries, vulnerability
+    classes, attack vectors, escalation chains).
+  - `coverageGaps()` — dimensions below a threshold.
+  - `scheduleCoverageTasks()` — auto-generates tasks for under-covered
+    dimensions, skipping already-attempted agents and mode-inappropriate ones
+    (e.g. no `@web` for source audits; endpoints/technologies resolve locally).
+  - `gapAgent()` — mode-aware dimension→agent mapping.
+- Mission Control's `replan` now runs the coverage scheduler and persists
+  per-dimension coverage into `mission.coverage.dimensions`.
+- `@recon` now links discovered endpoints into the Security Graph (so coverage
+  reflects real endpoint exploration).
+
 ## [1.0.47] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 7: adaptive planner)

package/dist/index.js

@@ -17903,7 +17903,8 @@ function newMission(id, target, scope, mode, budget) {
     coverage: { dimensions: {} },
     memory_refs: [],
     termination_reason: null,
-    decision_log: []
+    decision_log: [],
+    failed_approaches: []
   };
 }
 
@@ -18301,11 +18302,18 @@ var init_agents = __esm(() => {
         };
       }
       const r = enrichScan(ctx.mission.target, 500);
+      let graph = { nodes: [], edges: [] };
+      const tid = `target:${ctx.mission.target}`;
+      for (const ep of r.hits.filter((h) => h.type === "endpoint").slice(0, 50)) {
+        const epId = `endpoint:${ep.file}:${ep.line}`;
+        graph = upsertNode(graph, epId, "endpoint", { file: ep.file, line: ep.line, hook: ep.detail });
+        graph = addEdge2(graph, tid, epId, "exposes");
+      }
       return {
         ok: true,
         output: { files_scanned: r.files_scanned, hits: r.hits.length, sink_signals: r.sink_signals, endpoints: r.hits.filter((h) => h.type === "endpoint").length },
         hypotheses: [],
-        graph: emptyGraph()
+        graph
       };
     }
   };
@@ -18582,6 +18590,132 @@ ${m.hypotheses.map((h) => `- [${h.status}] ${h.type} @ ${h.target} (confidence $
   };
 });
 
+// src/mission/coverage.ts
+function clamp012(n) {
+  return Math.max(0, Math.min(1, n));
+}
+function computeCoverage(mission) {
+  const byType = graphStats(mission.graph).by_type;
+  const hyps = mission.hypotheses;
+  const sinkCategories = new Set(mission.graph.nodes.filter((n) => n.type === "sink").map((n) => String(n.properties.category ?? n.properties.sink ?? "unknown")));
+  const hypTypes = new Set(hyps.map((h) => h.type));
+  return {
+    attack_surface: clamp012(mission.graph.nodes.length / 25),
+    endpoints: clamp012((byType.endpoint ?? 0) / 10),
+    technologies: clamp012(mission.technologies.length / 6),
+    source_files: clamp012((byType.sink ?? 0) / 15),
+    sink_classes: clamp012(sinkCategories.size / 10),
+    auth_boundaries: hyps.length ? clamp012(hyps.filter((h) => /auth/i.test(h.evidence)).length / hyps.length) : 0,
+    authorization_boundaries: hyps.length ? clamp012(hyps.filter((h) => /missing_authorization/i.test(h.type)).length / hyps.length) : 0,
+    vulnerability_classes: clamp012(hypTypes.size / 10),
+    attack_vectors: clamp012(planNextActions(hyps, mission).length / 20),
+    escalation_chains: clamp012((byType.attack_chain ?? 0) / 57)
+  };
+}
+function coverageGaps(coverage, threshold = 0.5) {
+  return Object.entries(coverage).filter(([, v]) => v < threshold).map(([k]) => k);
+}
+function gapAgent(dimension, isUrl) {
+  if (dimension === "endpoints" && !isUrl)
+    return "recon";
+  if (dimension === "technologies" && !isUrl)
+    return "source";
+  return GAP_AGENT[dimension] ?? "analysis";
+}
+function scheduleCoverageTasks(mission, threshold = 0.5) {
+  const coverage = computeCoverage(mission);
+  const gaps = coverageGaps(coverage, threshold);
+  const attempted = new Set(mission.tasks.map((t) => t.agent_type));
+  const isUrl = /^https?:\/\//i.test(mission.target);
+  const tasks = [];
+  for (const gap of gaps) {
+    const agent = gapAgent(gap, isUrl);
+    if (attempted.has(agent))
+      continue;
+    if (!isUrl && agent === "web")
+      continue;
+    tasks.push(createTask({ objective: `close coverage gap: ${gap} (${coverage[gap].toFixed(2)})`, agent_type: agent, priority: 8 }));
+  }
+  return tasks;
+}
+var GAP_AGENT;
+var init_coverage = __esm(() => {
+  init_planner();
+  GAP_AGENT = {
+    attack_surface: "recon",
+    endpoints: "api",
+    technologies: "web",
+    source_files: "source",
+    sink_classes: "source",
+    auth_boundaries: "auth",
+    authorization_boundaries: "auth",
+    vulnerability_classes: "analysis",
+    attack_vectors: "analysis",
+    escalation_chains: "commander"
+  };
+});
+
+// src/mission/recovery.ts
+function diagnoseError(error) {
+  const e = error.toLowerCase();
+  if (/network|connect|timeout|econn|enotfound|unreachable|dns|resolve|refused|abort/i.test(e))
+    return "network";
+  if (/permission|eacces|denied|forbidden|401|403/i.test(e))
+    return "permission";
+  if (/not (installed|found)|no such|command not found|missing tool/i.test(e))
+    return "missing_tool";
+  if (/invalid|argument|usage|required|schema|type/i.test(e))
+    return "invalid_args";
+  if (/scope|authorized|out of scope|unauthorized/i.test(e))
+    return "scope";
+  return "unknown";
+}
+function recoveryDecision(task, error) {
+  const category = diagnoseError(error);
+  switch (category) {
+    case "network":
+      return task.attempts < 3 ? { action: "retry", reason: "transient network failure — retry", alternative_agent: null } : { action: "record", reason: "persistent network failure", alternative_agent: null };
+    case "missing_tool":
+      return { action: "alternative", reason: "tool unavailable — try alternative", alternative_agent: AGENT_ALTERNATIVES[task.agent_type]?.[0] ?? null };
+    case "invalid_args":
+      return { action: "record", reason: "invalid arguments — cannot auto-recover", alternative_agent: null };
+    case "scope":
+      return { action: "record", reason: "out of scope — do not retry", alternative_agent: null };
+    case "permission":
+      return { action: "record", reason: "permission denied — cannot auto-recover", alternative_agent: null };
+    default:
+      return task.attempts < 2 ? { action: "retry", reason: "unknown failure — retry once", alternative_agent: null } : { action: "record", reason: "unknown failure — give up", alternative_agent: null };
+  }
+}
+function recordFailure(task, error) {
+  const category = diagnoseError(error);
+  return {
+    technique: `${task.agent_type}:${task.objective}`,
+    target: task.objective,
+    category,
+    reason: error,
+    attempts: task.attempts,
+    future_policy: category === "scope" ? "do not retry — out of scope" : category === "missing_tool" ? "route to an alternative agent next time" : category === "network" ? "retry with backoff" : "lower priority for this technique"
+  };
+}
+var AGENT_ALTERNATIVES;
+var init_recovery = __esm(() => {
+  AGENT_ALTERNATIVES = {
+    commander: [],
+    recon: ["api", "web"],
+    web: ["api", "recon"],
+    api: ["recon", "web"],
+    source: ["analysis"],
+    auth: ["analysis", "source"],
+    mobile: ["source"],
+    cloud: ["source"],
+    analysis: ["source"],
+    validator: ["reviewer"],
+    reviewer: ["validator"],
+    reporter: []
+  };
+});
+
 // src/mission/control.ts
 import { existsSync as existsSync8, statSync as statSync4 } from "node:fs";
 function scopeAllowed(mission) {
@@ -18634,7 +18768,12 @@ function replan(mission) {
       tasks = [...tasks, createTask({ objective: "generate the final report", agent_type: "reporter", risk: "low" })];
     }
   }
-  return { ...mission, tasks };
+  const coverage = computeCoverage(mission);
+  const coverageTasks = scheduleCoverageTasks(mission);
+  if (coverageTasks.length > 0) {
+    tasks = [...tasks, ...coverageTasks];
+  }
+  return { ...mission, tasks, coverage: { dimensions: { ...mission.coverage.dimensions, ...coverage } } };
 }
 async function executeTask(task, mission, scope) {
   const agent = agentFor(task.agent_type);
@@ -18697,8 +18836,29 @@ async function runMission(mission) {
           m = { ...m, report: r.output };
         }
       } else {
-        const failed = setTask(m.tasks, r.task.task_id, { status: r.task.attempts >= 2 ? "failed" : "retry", error: r.error ?? null });
-        m = { ...m, tasks: failed, decision_log: [...m.decision_log, { at: new Date().toISOString(), agent: r.task.agent_type, decision }] };
+        const rec = recoveryDecision(r.task, r.error ?? "unknown error");
+        const stamp = { at: new Date().toISOString(), agent: r.task.agent_type, decision };
+        if (rec.action === "retry") {
+          const retried = setTask(m.tasks, r.task.task_id, { status: "retry", error: r.error ?? null });
+          m = { ...m, tasks: retried, decision_log: [...m.decision_log, stamp] };
+        } else if (rec.action === "alternative" && rec.alternative_agent) {
+          const failed = setTask(m.tasks, r.task.task_id, { status: "failed", error: r.error ?? null });
+          const alt = createTask({ objective: `[alternative] ${r.task.objective}`, agent_type: rec.alternative_agent, risk: r.task.risk, priority: r.task.priority - 1 });
+          m = {
+            ...m,
+            tasks: [...failed, alt],
+            decision_log: [...m.decision_log, stamp],
+            failed_approaches: [...m.failed_approaches, recordFailure(r.task, r.error ?? "")]
+          };
+        } else {
+          const failed = setTask(m.tasks, r.task.task_id, { status: "failed", error: r.error ?? null });
+          m = {
+            ...m,
+            tasks: failed,
+            decision_log: [...m.decision_log, stamp],
+            failed_approaches: [...m.failed_approaches, recordFailure(r.task, r.error ?? "")]
+          };
+        }
       }
     }
     m.budget.used_tasks += batch.length;
@@ -18738,6 +18898,8 @@ var init_control = __esm(() => {
   init_state();
   init_agents();
   init_planner();
+  init_coverage();
+  init_recovery();
   MODE_PROFILES = {
     web: { agents: ["recon", "web", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
     api: { agents: ["recon", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.47",
+  "version": "1.0.49",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {