blitzstrike 1.0.86 → 1.0.88

package/CHANGELOG.md

@@ -5,6 +5,32 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.88] — 2026-09-13
+
+### Added — hypothesis expansion doctrine (findings → follow-ups)
+
+- `bs-orchestrate-engagement` gained a "Hypothesis expansion" section, and the
+  MCP `instructions` a matching "HYPOTHESIS EXPANSION" block: from each finding
+  or sink, enumerate every follow-up (escalate via list_chains/chain_links,
+  chain via chain_links, bypass via bypass_lookup, pivot to new endpoints) —
+  and turn each into a verified or rejected verdict before reporting.
+- Codifies the anti-speculation rule: "might/could/possibly" belong in the
+  hypothesis list, never in the report; every report line is a verified fact.
+
+## [1.0.87] — 2026-09-13
+
+### Added — engagement state (deterministic orchestration bookkeeping)
+
+- New `engagement.ts` module + 4 MCP tools: `engagement_start` (open an
+  engagement), `engagement_phase` (advance the lifecycle phase),
+  `engagement_track` (record each hypothesis as pending/confirmed/rejected),
+  `engagement_status` (deterministic "am I done?" — returns the exact unmet
+  termination criteria instead of a feeling).
+- This is Blitz Strike's own orchestration-state answer: the LLM is the brain;
+  these tools are the hands that keep the phase + hypotheses + termination
+  state so the LLM never relies on its own memory for progress or completion.
+- `bs-orchestrate-engagement` documents the track-state loop.
+
 ## [1.0.86] — 2026-09-13
 
 ### Added — orchestration framework (`orchestration`)

package/dist/index.js

@@ -31848,6 +31848,75 @@ async function activeScan(target, scope = "", mode = "bug-bounty", allowed = und
   return result;
 }
 
+// src/engagement.ts
+var PHASES = ["scope", "recon", "analyze", "deep", "verify", "report"];
+var current = null;
+function ts() {
+  return new Date().toISOString();
+}
+function startEngagement(target, kind = "source") {
+  current = {
+    id: `eng-${Date.now().toString(36)}`,
+    target,
+    kind,
+    phase: "scope",
+    startedAt: ts(),
+    hypotheses: []
+  };
+  return { started: true, ...current };
+}
+function setPhase(phase) {
+  if (!current)
+    return { found: false, error: "no active engagement — call engagement_start first" };
+  const p = phase.toLowerCase().trim();
+  if (!PHASES.includes(p)) {
+    return { found: false, error: `unknown phase '${phase}'`, valid: PHASES };
+  }
+  current.phase = p;
+  return { found: true, phase: current.phase };
+}
+function trackHypothesis(sink, status = "pending") {
+  if (!current)
+    return { found: false, error: "no active engagement — call engagement_start first" };
+  const existing = current.hypotheses.find((h) => h.sink === sink);
+  if (existing)
+    existing.status = status;
+  else
+    current.hypotheses.push({ sink, status });
+  return { found: true, tracked: current.hypotheses.length };
+}
+function engagementStatus() {
+  if (!current)
+    return { found: false, error: "no active engagement — call engagement_start first" };
+  const pending = current.hypotheses.filter((h) => h.status === "pending").length;
+  const confirmed = current.hypotheses.filter((h) => h.status === "confirmed").length;
+  const rejected = current.hypotheses.filter((h) => h.status === "rejected").length;
+  const unmet = [];
+  if (current.phase !== "report") {
+    unmet.push(`phase is '${current.phase}', not 'report' — the report has not been emitted`);
+  }
+  if (pending > 0) {
+    unmet.push(`${pending} hypothesis(es) still pending — verify or reject each one`);
+  }
+  if (current.hypotheses.length === 0) {
+    unmet.push("no hypotheses tracked — nothing was verified");
+  }
+  const idx = PHASES.indexOf(current.phase);
+  const next = idx >= PHASES.length - 1 ? "done" : PHASES[idx + 1];
+  return {
+    found: true,
+    id: current.id,
+    target: current.target,
+    kind: current.kind,
+    phase: current.phase,
+    startedAt: current.startedAt,
+    hypotheses: current.hypotheses,
+    counts: { pending, confirmed, rejected, total: current.hypotheses.length },
+    termination: { done: unmet.length === 0, unmet },
+    next_phase: next
+  };
+}
+
 // src/dataflow.ts
 init_scanner();
 import { readFileSync as readFileSync9 } from "node:fs";
@@ -53465,7 +53534,7 @@ function createServer() {
     version: "1.0.0"
   }, {
     instructions: "Blitz Strike is a universal penetration-testing toolbelt with three tiers — " + "BLITZ (reconnaissance / attack-surface mapping), EAGLE-EYE (source-to-sink " + "analysis), STRIKE (live validation) — plus a canonical evidence-first finding " + "engine and a multi-language taint engine.\\n\\n" + "CORE MENTAL MODEL:\\n" + "- A scanner hit is a HYPOTHESIS, not a finding. Live verification (or data-flow " + "  proof) is the verdict. Never report an unverified hit as a vulnerability.\\n" + "- Distinguish REACHABLE from mere PRESENT: a sink is only a finding when tainted " + "  input reaches it AND it is not neutralized by a sanitizer and not guarded by an " + "  auth gate.\\n\\n" + "HOW TO RUN AN AUDIT (start here):\\n" + "0. ROUTE BY TARGET. Classify the target automatically - no need to ask. A " + "   URL - with or without http/https (example.com, 192.168.1.1, host:8080) - " + "   is LIVE (scope-gated, then live_recon + active_scan + strike_verify). A " + "   filesystem path (exists on disk, or a code extension) is SOURCE audit " + "   (blitz_scan + eagle_eye2 + complex_scan/route_scan). If the scheme is " + "   missing, prepend https://. run_engagement auto-detects both internally.\\n" + "1. SCOPE FIRST. Call scope_check(target, scope, mode) before ANY active testing. " + "   Passive analysis (reading source, fingerprinting public pages) needs no gate; " + "   active probing (exploitation, fuzzing, path brute-force) is blocked until scope " + "   authorizes it.\\n" + "2. MAP THE SURFACE (BLITZ). For a source tree use blitz_scan (tree) or blitz_file " + "   (single file) then enrich_scan to match sinks to escalation chains. For a live " + "   URL use live_recon for a full pass (fingerprint/WAF/tech/version/crawler/params/" + "   subdomains/API endpoints/intel correlation) — it returns next_steps. active_scan " + "   is the lighter gated alternative. Both re-check scope internally.\\n" + "3. TRACE REACHABILITY (EAGLE-EYE). For every sink, determine whether attacker " + "   input actually reaches it:\\n" + "   - PHP/JS/TS/Python/Java source: taint_file (auto-detects language) or " + "     taint_scan/taint_tree (PHP AST). list_languages shows what's supported.\\n" + "   - Any language: trace_data_flow (window heuristic) and eagle_eye/eagle_grep " + "     (function-scoped view of sinks + auth gates). Beyond taint: route_scan (route confusion / dispatch abuse / batch forwarding) and complex_scan (deserialization->POP, type juggling, mass assignment) catch classes plain taint misses.\\n" + "   A sink counts only if tainted input reaches it unsanitized and unguarded.\\n" + "4. VALIDATE (STRIKE). Confirm live with strike_verify using a MARKER plus a " + "   NEGATIVE CONTROL plus a BASELINE. The verdict is deterministic: marker " + "   reflected AND control inert = confirmed; both reflected = false_positive; " + "   marker not reflected = unconfirmed. Feed the verdict to strike_resolve to " + "   advance the finding lifecycle (hypothesis->validating->confirmed). Use " + "   read_tool_manual for the exploit tool's manual, payload_lookup for payloads, " + "   detect_waf/tech_correlation for context.\\n" + "5. RECORD + REPORT. Create a canonical finding with finding_create, advance it " + "   through the lifecycle with finding_transition, attach confidence_score, and " + "   redact any secrets before persisting. Only report findings that survived " + "   verification.\\n\\n" + "SUPPORTING LAYERS:\\n" + "- run_engagement: ONE call does the whole audit (no babysitting). Source path -> " + "  full static pipeline + inline report (markdown/JSON/SARIF). URL target -> " + "  autonomous live marker sweep + confirmed findings + report. Prefer this first.\\n" + "- list_chains: 57 escalation chains (source -> sink -> impact).\\n" + "- list_languages / taint_file: multi-language taint (PHP, JS/TS, Python, Java).\\n" + "- tool_lookup / ensure_tool / list_tools: 130-tool catalog, auto-install.\\n" + "- read_playbook / list_playbooks: 17 engagement playbooks (web-app, api-security, " + "  source-code-audit, active-directory, mobile, external-attack-surface, ...).\\n" + "- skill_lookup / read_skill / list_skills: 38 skills (6 bs-* agent doctrine + " + "  technique playbooks: WP/PHP 0-day, AD, malware, mobile, cloud).\\n" + "- read_tool_manual / list_manuals: 317 tool manuals (sqlmap, nmap, commix, ...).\\n" + "- payload_lookup / read_payload: 66 payload collections (sqli, xss, ssti, xxe, lfi).\\n" + "- detect_waf / tech_correlation / cve_correlation / port_correlation: signature " + "  + correlation intelligence.\\n" + "- nvd_lookup / fofa_search: CVE + asset reconnaissance (FOFA needs env creds).\\n" + "- remember / memory_lookup / memory_list: persist + recall verified knowledge.\\n\\n" + "RESOURCE MAP (know what to reach for):\\n" + "- ORCHESTRATION = the engagement framework. orchestration() returns the " + "  lifecycle (scope->recon->analyze->deep->verify->report, each with " + "  entry/exit criteria) + sub-agent team + handoff contract + termination " + "  criteria. Load it at engagement start.\\n" + "- TOOL = acts (scan, taint, verify, record, correlate). Call it to DO something.\\n" + "- PLAYBOOK = campaign plan for a target TYPE. read_playbook(web-application) " + "  BEFORE a full engagement of that type.\\n" + "- SKILL = procedure doctrine. Load the bs-* skill for the phase you are on " + "  (orchestrate, scope, source-audit, verify, review, report); load a technique " + "  skill for the specific technique (WP 0-day, AD, malware).\\n" + "- MANUAL = deep reference for ONE tool. read_tool_manual right before using it.\\n" + "- PAYLOAD = attack payloads for a class. payload_lookup before crafting a probe.\\n" + "- INTELLIGENCE = knowledge. list_attack_vectors (34 categories) maps the " + "  full surface during RECON; list_chains (36) turns a finding into impact; " + "  chain_links composes chains for complex bugs; bypass_lookup when blocked; " + "  payload_lookup when crafting a probe. Reach for them at that moment.\\n\\n" + "NO-BABYSITTING (while scanning + testing):\\n" + "- Scan the WHOLE surface before reporting - every file, entry point, and sink. " + "  Do not stop after the first hit to ask; keep enumerating the full tree.\\n" + "- Test every hypothesis through its full verification cycle - vary probes on " + "  failure, apply bypasses when blocked, keep going. Do not pause to ask.\\n" + "- Persist through partial results: a scan that surfaces few sinks is NOT done - " + "  widen the surface, escalate detectors, dig into each reachable sink.\\n" + "- Only surface to the user when: scope/authorization is genuinely unclear, a " + "  destructive or DoS action needs explicit consent, or the engagement is complete.\\n\\n" + "PERSISTENCE (complex bugs - do not give up):\\n" + "- On any failure (empty output, blocked probe, failed sub-agent/model), call " + "  retry_guidance(signal) for concrete recovery actions before giving up.\\n" + "- One failed probe != not vulnerable. Vary: alternative sinks, other params, " + "  encoding/case/whitespace bypasses, different injection context.\\n" + "- Empty output != no findings. Re-run (server may be stale after an upgrade - " + "  /reload-mcp), or escalate to route_scan / complex_scan for classes taint " + "  misses (POP chains, type juggling, mass assignment, route confusion).\\n" + "- A 'sanitized' sink may not be safe. Challenge the sanitizer: loose == vs ===, " + "  missing EXTR_SKIP, int cast truncation, weak regex.\\n" + "- An unconfirmed hypothesis is KEPT as hypothesis - try alternate verification, " + "  then let adversarial review decide.\\n" + "- Complex chains (deserialization->POP, LFI->RCE) need the FULL chain traced, " + `  not just the first sink.\\n
-` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding usually escalates. list_chains and match it " + "  to a multi-stage chain (SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell) instead " + "  of stopping at the first vuln.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
+` + "- When a probe is BLOCKED by a WAF/filter/sanitizer, call bypass_lookup(defense) " + "  for concrete techniques (encoding, case, comment insertion, chunked, null byte, " + "  double-encoding, verb tampering, header spoofing) and apply them - do not give up.\\n" + "- CHAIN findings: a low-severity finding usually escalates. list_chains and match it " + "  to a multi-stage chain (SSRF->metadata, SQLi->RCE, LFI->RCE, upload->shell) instead " + "  of stopping at the first vuln.\\n\\n" + "- Complex bugs chain ACROSS chains: after confirming one chain, chain_links " + "  shows what follows (SSRF->metadata then default-creds->pivot via stolen IAM). " + "  Trace the full composition, not just a single chain.\\n\\n" + "HYPOTHESIS EXPANSION (from each finding, enumerate + verify every follow-up):\\n" + "- A confirmed finding is the START, not the end. From each one, enumerate " + "  the follow-ups: ESCALATE (list_chains + chain_links), CHAIN (chain_links " + "  from->to), BYPASS (bypass_lookup), PIVOT (new endpoints/sinks now reachable).\\n" + "- Every follow-up (this might happen, this could chain, maybe bypassable) is " + "  a HYPOTHESIS, not a finding. Verify EACH via strike_verify (marker + negative " + "  control) before it enters the report.\\n" + "- Never report speculation: might / could / possibly live in the " + "  hypothesis list, never in the report. Every report line is a verified fact.\\n\\n" + "IRON RULES:\\n" + "- Scope first; authorized targets only. Refuse out-of-scope or destructive/DoS work.\\n" + "- A hit is a hypothesis; a verified exploit (or proven data-flow) is the finding.\\n" + "- Prefer the one-call run_engagement path; fall back to granular tools when you " + "  need finer control."
   });
   server.registerTool("blitz_scan", {
     title: "BLITZ scan",
@@ -53986,6 +54055,42 @@ ${statusLine}` : statusLine },
   }, async ({ part }) => {
     return { content: [{ type: "text", text: JSON.stringify(orchestration(part)) }] };
   });
+  server.registerTool("engagement_start", {
+    title: "Start an engagement",
+    description: "ORCHESTRATION: open an engagement and track its state. Call at the start of a full audit so subsequent engagement_phase / engagement_track / engagement_status calls have a state to update. The LLM is the brain; this is the deterministic bookkeeping hand.",
+    inputSchema: {
+      target: string2().describe("The target (source path or live URL)."),
+      kind: _enum(["source", "live"]).optional().describe("source path or live URL. Defaults to source.")
+    }
+  }, async ({ target, kind }) => {
+    return { content: [{ type: "text", text: JSON.stringify(startEngagement(target, kind)) }] };
+  });
+  server.registerTool("engagement_phase", {
+    title: "Advance the engagement phase",
+    description: "ORCHESTRATION: move the engagement to the next lifecycle phase (scope, recon, analyze, deep, verify, report). The phase tracks where the audit is; engagement_status uses it for the termination check.",
+    inputSchema: {
+      phase: string2().describe("One of: scope, recon, analyze, deep, verify, report.")
+    }
+  }, async ({ phase }) => {
+    return { content: [{ type: "text", text: JSON.stringify(setPhase(phase)) }] };
+  });
+  server.registerTool("engagement_track", {
+    title: "Track a hypothesis",
+    description: "ORCHESTRATION: record a hypothesis (a candidate finding keyed by its sink) with its status — pending, confirmed, or rejected. engagement_status derives the termination check from these; an untracked hypothesis is one the LLM has to remember, which is exactly what this avoids.",
+    inputSchema: {
+      sink: string2().describe("The sink / candidate identifier (e.g. 'POST /upload -> eval()')."),
+      status: _enum(["pending", "confirmed", "rejected"]).optional().describe("Defaults to pending.")
+    }
+  }, async ({ sink, status }) => {
+    return { content: [{ type: "text", text: JSON.stringify(trackHypothesis(sink, status)) }] };
+  });
+  server.registerTool("engagement_status", {
+    title: "Engagement status + termination check",
+    description: "ORCHESTRATION: return the current engagement state — phase, hypotheses, counts — and a deterministic termination check (done or the exact unmet criteria). Call this instead of asking yourself 'am I done?'. Also drives blitz_status-style progress.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(engagementStatus()) }] };
+  });
   server.registerTool("read_payload", {
     title: "Read a payload collection",
     description: "INTEL: read the full payload collection for a category (or a specific file).",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.86",
+  "version": "1.0.88",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-orchestrate-engagement.md

@@ -63,6 +63,28 @@ step you are on. Do not improvise a plan the playbook already spells out.
 
 6. **Report.** Emit `generate_report` + `cvss_score` + `write-report`.
 
+## Hypothesis expansion (findings → follow-ups)
+
+A confirmed finding is the START, not the end. From each finding or interesting
+sink, enumerate EVERY follow-up as a hypothesis, then verify each one — never
+stop at the first result:
+
+1. **Escalate** — `list_chains` + `chain_links`: what does this chain into?
+2. **Chain** — does it compose with another bug (`chain_links` from → to)?
+3. **Bypass** — is there a defense in the way (`bypass_lookup`)? Can the
+   sanitizer/WAF/auth-gate be evaded to reach something deeper?
+4. **Pivot** — what other endpoints/sinks/roles are now reachable?
+
+Each follow-up ("this might happen", "this could chain", "maybe this is
+bypassable") is a HYPOTHESIS — not a finding. Turn every one of them into a
+verified or rejected verdict before the report:
+
+- Confirmed → `finding_create` + `finding_transition` (evidence attached).
+- Not confirmed → rejected, or kept as a hypothesis with `NEEDS_MORE_EVIDENCE`.
+- **Never report speculation.** "Might", "could", "possibly" belong in the
+  hypothesis list, never in the report. Every line of the report is a verified
+  fact (marker + negative control), not a guess.
+
 ## Lifecycle, team, and termination
 
 Load the full framework with `orchestration` (or focus it:
@@ -84,6 +106,12 @@ reference — do not improvise the shape of the engagement:
   the surface is wider than the scan, hypotheses remain unverified, or a
   low-severity finding hasn't been checked for escalation (`chain_links`).
 
+Track the state deterministically so you never rely on your own memory:
+`engagement_start` (open the engagement) → `engagement_phase` (advance the
+phase) → `engagement_track` (record each hypothesis with pending/confirmed/
+rejected) → `engagement_status` (deterministic "am I done?" — returns the exact
+unmet criteria, not a feeling).
+
 ## Orchestration pattern (native plan + sub-agents)
 
 You are the orchestrator — use your platform's native planning and delegation