blitzstrike 1.0.72 → 1.0.74

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.74] — 2026-09-13
+
+### Fixed — banner now visibly surfaces in the terminal
+
+- `run_engagement` now returns the "orchestrator in control" banner as a
+  standalone first text block (plus a one-line status summary), instead of
+  burying it inside the JSON result — so it actually appears in the client
+  terminal when the engagement starts.
+- `bs-orchestrate-engagement` now instructs the driving agent to relay the
+  banner verbatim and drive `blitz_status` for live progress.
+
+## [1.0.73] — 2026-09-13
+
+### Added — orchestrator "in control" banner + live progress
+
+- `run_engagement` now returns a terminal-friendly banner announcing the
+  engagement ("orchestrator in control") with the target, mode, and the
+  canonical scope→recon→analyze→verify→review→report pipeline.
+- New `blitz_status` MCP tool: format a live progress snapshot (current stage,
+  checkmark/active/pending markers, finding counts, task status) so a driving
+  agent can announce progress to the user as it works.
+
 ## [1.0.72] — 2026-09-13
 
 ### Changed — coordinated agent guidance

package/dist/index.js

@@ -30787,6 +30787,33 @@ function resolveFinding(finding, verdict) {
 }
 
 // src/orchestrator.ts
+var ENGAGEMENT_STAGES = ["scope", "recon", "analyze", "verify", "review", "report"];
+function engagementBanner(target, mode) {
+  return [
+    "⚡ BLITZ engagement — orchestrator in control",
+    `   target:  ${target}`,
+    `   mode:    ${mode}`,
+    `   stages:  ${ENGAGEMENT_STAGES.join(" → ")}`
+  ].join(`
+`);
+}
+function formatStatus(opts) {
+  const lines = [];
+  const idx = opts.phase ? ENGAGEMENT_STAGES.indexOf(opts.phase) : -1;
+  lines.push(`BLITZ engagement${idx >= 0 ? ` — ${opts.phase} (${idx + 1}/${ENGAGEMENT_STAGES.length})` : ""}`);
+  if (idx >= 0) {
+    lines.push(`   stages: ${ENGAGEMENT_STAGES.map((s, i) => i < idx ? `${s} ✓` : i === idx ? `${s} ▶` : `${s} ☐`).join("  ")}`);
+  }
+  if (opts.findings) {
+    const f = opts.findings;
+    lines.push(`   findings: ${[`${f.detected ?? 0} detected`, `${f.hypothesis ?? 0} hypothesis`, `${f.confirmed ?? 0} confirmed`, `${f.false_positive ?? 0} false_positive`].join(" · ")}`);
+  }
+  if (opts.tasks && opts.tasks.length) {
+    lines.push(`   tasks: ${opts.tasks.map((t) => `${t.objective} (${t.status})`).join(" · ")}`);
+  }
+  return lines.join(`
+`);
+}
 var _chainsCache = null;
 function loadChains() {
   if (_chainsCache)
@@ -30904,6 +30931,7 @@ function enrichScan(path, maxFiles = 2000) {
 }
 function runEngagement(target, scope = "", mode = "bug-bounty", maxFiles = 2000, remember = true) {
   const report = {
+    banner: engagementBanner(target, mode),
     target,
     mode,
     tiers: {},
@@ -31057,7 +31085,7 @@ function listChains() {
 }
 var LIVE_SWEEP_PARAMS = ["q", "search", "query", "s", "id", "url", "redirect", "name", "page"];
 async function runLiveEngagement(url, scope = "", mode = "bug-bounty") {
-  const report = { target: url, mode, findings: [], scope: null, status: "" };
+  const report = { banner: engagementBanner(url, mode), target: url, mode, findings: [], scope: null, status: "" };
   const sc = scopeCheck(url, scope, mode);
   report.scope = sc;
   if (!sc.allowed) {
@@ -53490,8 +53518,28 @@ function createServer() {
   }, async ({ target, scope, mode, max_files, remember }) => {
     const isUrl = /^https?:\/\//i.test(target);
     const r = isUrl ? await runLiveEngagement(target, scope ?? "", mode ?? "bug-bounty") : runEngagement(target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
+    const banner = typeof r.banner === "string" ? r.banner : "";
+    const statusLine = r.status === "BLOCKED" ? `✋ BLOCKED — ${r.reason ?? "scope required"}` : `→ ${Array.isArray(r.findings) ? r.findings.length : 0} finding(s), status=${r.status ?? "COMPLETE"}`;
     return {
-      content: [{ type: "text", text: JSON.stringify(r) }]
+      content: [
+        { type: "text", text: banner ? `${banner}
+
+${statusLine}` : statusLine },
+        { type: "text", text: JSON.stringify(r) }
+      ]
+    };
+  });
+  server.registerTool("blitz_status", {
+    title: "Engagement progress banner",
+    description: "Format a terminal-friendly live progress snapshot of the running engagement — current stage (of the scope→recon→analyze→verify→review→report pipeline), finding counts, and task status. Call it to announce progress to the user as you drive the audit.",
+    inputSchema: {
+      phase: string2().optional().describe("Current stage: scope/recon/analyze/verify/review/report"),
+      findings: record(string2(), number2()).optional().describe("Finding counts, e.g. {detected:4,hypothesis:2,confirmed:1,false_positive:0}"),
+      tasks: array(object2({ id: string2(), objective: string2(), status: string2() })).optional().describe("Task list with status")
+    }
+  }, async ({ phase, findings, tasks }) => {
+    return {
+      content: [{ type: "text", text: formatStatus({ phase, findings, tasks }) }]
     };
   });
   server.registerTool("list_chains", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.72",
+  "version": "1.0.74",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-orchestrate-engagement.md

@@ -15,6 +15,12 @@ deterministic MCP tools; never guess a finding — produce it from tool output.
    Static source paths on disk are always in-scope; live URLs require an
    explicit scope.
 
+   **Announce takeover.** When you start an engagement, `run_engagement`
+   returns a `banner` ("orchestrator in control") as a standalone text block.
+   RELAY that banner verbatim to the user — it is the visible signal that you
+   have taken control, not a detail to bury in a JSON dump. Then drive
+   `blitz_status` at each stage to show live progress.
+
 2. **Recon (passive-first).** For a live target: `live_recon` (fingerprint, WAF,
    endpoints, tech). For a source tree: `blitz_scan` (entry points + sinks),
    `detect_framework`, `list_attack_vectors`.