blitzstrike 1.0.74 → 1.0.76

package/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.76] — 2026-09-13
+
+### Changed — native plan + sub-agent orchestration doctrine
+
+- `bs-orchestrate-engagement` now instructs the driving agent to use its
+  platform's native planning + delegation (e.g. Hermes `plan`/`todo` +
+  `delegate_task`) to run the engagement in parallel — recon / analyze /
+  deep-classes as sub-agents, then collect → verify → report — instead of
+  serial tool calls.
+
+## [1.0.75] — 2026-09-13
+
+### Added — plan checklist in the engagement banner
+
+- `run_engagement` now renders its engagement plan as a checkbox checklist
+  (`[✓] done / [☐] pending`) right under the "orchestrator in control" banner,
+  so the terminal shows both the takeover notice and what was/will be done.
+
 ## [1.0.74] — 2026-09-13
 
 ### Fixed — banner now visibly surfaces in the terminal

package/dist/index.js

@@ -30814,6 +30814,16 @@ function formatStatus(opts) {
   return lines.join(`
 `);
 }
+function formatPlanChecklist(plan) {
+  const mark = (s) => s === "done" ? "✓" : s === "pending" ? "☐" : "▶";
+  const items = plan.map((p) => `[${mark(p.status)}] ${p.state}`);
+  const rows = [];
+  for (let i = 0;i < items.length; i += 3) {
+    rows.push("   " + items.slice(i, i + 3).map((s) => s.padEnd(22)).join(""));
+  }
+  return rows.join(`
+`);
+}
 var _chainsCache = null;
 function loadChains() {
   if (_chainsCache)
@@ -53519,10 +53529,14 @@ function createServer() {
     const isUrl = /^https?:\/\//i.test(target);
     const r = isUrl ? await runLiveEngagement(target, scope ?? "", mode ?? "bug-bounty") : runEngagement(target, scope ?? "", mode ?? "bug-bounty", max_files ?? 2000, remember ?? true);
     const banner = typeof r.banner === "string" ? r.banner : "";
+    const planText = Array.isArray(r.plan) && r.plan.length ? `
+
+plan:
+${formatPlanChecklist(r.plan)}` : "";
     const statusLine = r.status === "BLOCKED" ? `✋ BLOCKED — ${r.reason ?? "scope required"}` : `→ ${Array.isArray(r.findings) ? r.findings.length : 0} finding(s), status=${r.status ?? "COMPLETE"}`;
     return {
       content: [
-        { type: "text", text: banner ? `${banner}
+        { type: "text", text: banner ? `${banner}${planText}
 
 ${statusLine}` : statusLine },
         { type: "text", text: JSON.stringify(r) }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.74",
+  "version": "1.0.76",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-orchestrate-engagement.md

@@ -37,6 +37,30 @@ deterministic MCP tools; never guess a finding — produce it from tool output.
 
 6. **Report.** Emit `generate_report` + `cvss_score` + `write-report`.
 
+## Orchestration pattern (native plan + sub-agents)
+
+You are the orchestrator — use your platform's native planning and delegation
+mechanisms (e.g. Hermes `plan`/`todo` + `delegate_task`) to run the engagement
+in parallel, instead of serial tool calls. This is what makes the flow
+no-babysitting, not a single `run_engagement` call:
+
+1. **Plan.** Lay out the stages as a todo/plan: scope → recon → analyze →
+   verify → review → report. Assign each independent workstream to a sub-agent.
+2. **Delegate (parallel).** Spawn sub-agents for independent workstreams:
+   - *Recon* → `blitz_scan` + `live_recon` + `detect_framework` + `list_chains`.
+   - *Analyze* → `eagle_eye2` + `taint_scan` + `trace_data_flow` (source→sink).
+   - *Deep classes* → `complex_scan` (POP/type-juggling/mass-assignment) +
+     `route_scan` (route confusion).
+   Each sub-agent returns deterministic findings — give it the target, the
+   exact tools to call, and require evidence (file:line, sink, chain), never prose.
+3. **Collect + verify.** Merge sub-agent findings, `dedup_findings` by root
+   cause, then prove each hypothesis with `strike_verify` (baseline + marker +
+   negative control) before it becomes a finding.
+4. **Report.** `generate_report` + `cvss_score` + `write-report`.
+
+Announce the takeover banner and progress (`blitz_status`) between steps so the
+user sees you working, not a silent tool call.
+
 ## The skill chain (load the right one per phase)
 
 | Phase | Skill |