blitzstrike 1.0.64 → 1.0.66
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +35 -0
- package/dist/index.js +39847 -41464
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,41 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [1.0.66] — 2026-09-13
|
|
9
|
+
|
|
10
|
+
### Changed — LLM-driven architecture (Mission Control removed)
|
|
11
|
+
|
|
12
|
+
Aligned with the OMOP model: the LLM is the brain, Blitz Strike is the
|
|
13
|
+
deterministic hands. The deterministic "self-driving" engine is gone.
|
|
14
|
+
|
|
15
|
+
- **Removed** `src/mission/` (Mission Control loop, 13 deterministic agents,
|
|
16
|
+
task scheduler, planner, coverage, recovery, router, budget, termination,
|
|
17
|
+
mission CLI) and the `mission_start`/`status`/`resume`/`stop`/`list` MCP tools.
|
|
18
|
+
- **Added** `route_scan` + `complex_scan` MCP tools — the route-confusion and
|
|
19
|
+
complex-bug detectors are now directly callable by a driving LLM agent.
|
|
20
|
+
- **Added** `run_enterprise_benchmark` MCP tool (framework-fixture recall).
|
|
21
|
+
- **Rewrote** `src/enterprise-benchmark.ts` to drive the detectors directly
|
|
22
|
+
(no Mission Control) — 15/15 recall across the 6 fixtures.
|
|
23
|
+
- The 6 `bs-*` skills (step 2) teach the LLM how to drive these tools.
|
|
24
|
+
|
|
25
|
+
Deterministic moat intact: taint engine, universal taint, route-confusion,
|
|
26
|
+
complex-bugs, strike_verify, finding/evidence engine, browser agent, intel layer.
|
|
27
|
+
|
|
28
|
+
## [1.0.65] — 2026-09-13
|
|
29
|
+
|
|
30
|
+
### Fixed — breadth-scanner false positives (live MCP verification)
|
|
31
|
+
|
|
32
|
+
Found via an LLM-driven verification run (agent → `blitz_scan`/`eagle_eye2`):
|
|
33
|
+
|
|
34
|
+
- **Sink tokens in comments/strings no longer reported.** `scanFile`/
|
|
35
|
+
`traceFunction`/`grepInFunctions` now match against a comment- and
|
|
36
|
+
string-literal-stripped view of the source (positions + line numbers
|
|
37
|
+
preserved). A `// use extract($_REQUEST)` comment or a
|
|
38
|
+
`"https://…/system("` string is not a sink.
|
|
39
|
+
- Rebuilt `dist/` so the fix ships in the published bundle (a long-running MCP
|
|
40
|
+
server must be restarted to pick up new `dist/` code — skills load fresh from
|
|
41
|
+
`skills/`, but compiled engine code is loaded once at startup).
|
|
42
|
+
|
|
8
43
|
## [1.0.64] — 2026-09-13
|
|
9
44
|
|
|
10
45
|
### Added — agent-native skills (LLM-driven orchestration doctrine)
|