blitzstrike 1.1.5 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.1.5",
+  "version": "1.2.0",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {

package/skills/bs-orchestrate-engagement.md

@@ -177,8 +177,18 @@ user sees you working, not a silent tool call.
   reporting — every file, entry point, sink. Test every hypothesis through its
   full cycle — vary probes on failure, apply bypasses when blocked, keep going.
   A scan that surfaces few sinks is not done: widen the surface and escalate
-  detectors. Only pause for the user when scope is genuinely unclear, a
-  destructive action needs consent, or the engagement is complete.
+  detectors. NEVER ask "should I continue?" or "do you want me to stop?" —
+  continue autonomously; the moment one step verifies, start the next. Pause
+  only when a genuinely destructive/DoS action needs consent, an external
+  dependency beyond your control blocks you, or you are delivering the final
+  report.
+- **Parallel by default.** Your default is parallel fan-out; sequential is the
+  exception. For each batch, ask not "should I parallelize?" but "what blocks
+  me from firing all of them in one message?" — only a NAMED input dependency
+  (one task reads another's output) or a file conflict. Everything else
+  dispatches together.
+- **No retry cap.** A failed probe/sub-agent is diagnosed and resumed until
+  verified or definitively ruled out — never move on unverified.
 - **Persist — complex bugs do not give up.** A failed probe is not "not
   vulnerable" (vary sinks, params, encodings); empty output is not "no
   findings" (re-run or escalate to `route_scan`/`complex_scan`); a "sanitized"