blitzstrike 1.0.57 → 1.0.58

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.58] — 2026-09-13
+
+### Fixed — total-verification pass
+
+- **Backward-compat mission load** — `loadMission` now normalizes old persisted
+  missions (missing the P14 budget fields: `max_tokens`, `max_cost_usd`,
+  `per_task_budget`, `started_at`, `used_tokens`/`used_cost_usd`, and P9
+  `failed_approaches`) so `blitzstrike mission resume <old-id>` no longer crashes.
+- **Scope gate** — now rejects ANY non-local target without an authorized scope
+  (previously the `https://` regex let a bare host like `example.com` slip past
+  the upfront gate). Non-local + no scope → `scope_required`.
+- README CLI section now lists the `mission` and `benchmark` commands.
+
 ## [1.0.57] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 18: documentation & examples)

package/README.md

@@ -136,6 +136,8 @@ blitzstrike serve --mcp       # start MCP server over stdio (default)
 blitzstrike doctor            # health check: runtime + 130-tool catalog + creds
 blitzstrike install           # write MCP config to detected clients (Claude/Cursor/OpenCode)
 blitzstrike install --dry-run # preview the config without writing
+blitzstrike mission <target>  # run an autonomous mission (source or web)
+blitzstrike benchmark         # run the autonomous benchmark (--full for whole corpus)
 blitzstrike sync-data         # fetch heavy datasets (payloads + templates) on-demand
 blitzstrike update            # check for a newer version + refresh the data cache
 blitzstrike version           # print version

package/dist/index.js

@@ -36491,11 +36491,56 @@ function loadMission(id) {
   if (!existsSync7(path))
     return null;
   try {
-    return JSON.parse(readFileSync17(path, "utf8"));
+    const raw = JSON.parse(readFileSync17(path, "utf8"));
+    return normalizeMission(raw);
   } catch {
     return null;
   }
 }
+function normalizeMission(raw) {
+  const b = raw.budget ?? {};
+  const budget = {
+    max_time_seconds: b.max_time_seconds ?? 3600,
+    max_tasks: b.max_tasks ?? 200,
+    max_requests: b.max_requests ?? 1000,
+    max_tokens: b.max_tokens ?? 2000000,
+    max_cost_usd: b.max_cost_usd ?? 5,
+    max_parallel_workers: b.max_parallel_workers ?? 4,
+    risk: b.risk ?? "medium",
+    per_task_budget: b.per_task_budget ?? { max_time_seconds: 60, max_requests: 50 },
+    started_at: b.started_at ?? Date.now(),
+    used_tasks: b.used_tasks ?? 0,
+    used_requests: b.used_requests ?? 0,
+    used_tokens: b.used_tokens ?? 0,
+    used_cost_usd: b.used_cost_usd ?? 0
+  };
+  return {
+    id: raw.id ?? "MSN-unknown",
+    target: raw.target ?? "",
+    scope: raw.scope ?? [],
+    mode: raw.mode ?? "source",
+    status: raw.status ?? "initialized",
+    started_at: raw.started_at ?? new Date().toISOString(),
+    updated_at: raw.updated_at ?? new Date().toISOString(),
+    budget,
+    discovered_assets: raw.discovered_assets ?? [],
+    technologies: raw.technologies ?? [],
+    endpoints: raw.endpoints ?? [],
+    identities: raw.identities ?? [],
+    hypotheses: raw.hypotheses ?? [],
+    findings: raw.findings ?? [],
+    attack_chains: raw.attack_chains ?? [],
+    evidence: raw.evidence ?? [],
+    tasks: raw.tasks ?? [],
+    graph: raw.graph ?? { nodes: [], edges: [] },
+    coverage: { dimensions: raw.coverage?.dimensions ?? {} },
+    memory_refs: raw.memory_refs ?? [],
+    termination_reason: raw.termination_reason ?? null,
+    decision_log: raw.decision_log ?? [],
+    failed_approaches: raw.failed_approaches ?? [],
+    report: raw.report
+  };
+}
 function listMissions() {
   if (!existsSync7(DIR))
     return [];
@@ -37630,7 +37675,7 @@ async function executeTask(task, mission, scope) {
   }
 }
 async function runMission(mission) {
-  if (/^https?:\/\//i.test(mission.target) && !scopeAllowed(mission)) {
+  if (!scopeAllowed(mission)) {
     return saveMission({ ...mission, status: "terminated", termination_reason: "scope_required" });
   }
   let m = { ...mission, status: "running" };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.57",
+  "version": "1.0.58",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {