blitzstrike 1.1.7 → 1.3.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +38 -1
- package/dist/index.js +1806 -1686
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,9 +5,46 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [1.3.0] — 2026-09-13
|
|
9
|
+
|
|
10
|
+
### Added — deterministic live security checks (deeper one-call pipeline)
|
|
11
|
+
|
|
12
|
+
- `run_engagement` on a URL target now runs deterministic checks beyond the
|
|
13
|
+
reflected-input sweep: missing security headers (HSTS/CSP/X-Frame-Options/
|
|
14
|
+
X-Content-Type-Options/Referrer-Policy), open redirect (Location reflection),
|
|
15
|
+
path traversal (`../../etc/passwd` → `root:`), and CORS (reflected/wildcard
|
|
16
|
+
origin + credentials). Each is a pure HTTP observation, so the one-call live
|
|
17
|
+
audit covers 5 vuln classes with zero false positives on header checks.
|
|
18
|
+
|
|
19
|
+
## [1.2.2] — 2026-09-13
|
|
20
|
+
|
|
21
|
+
### Changed — changelog wording cleanup (no functional change)
|
|
22
|
+
|
|
23
|
+
## [1.2.1] — 2026-09-13
|
|
24
|
+
|
|
25
|
+
### Fixed — resolve routing ambiguity (no "or", decide the default)
|
|
26
|
+
|
|
27
|
+
- Routing doctrine now states the DEFAULT explicitly: prefer `run_engagement`
|
|
28
|
+
(one call) for a whole engagement; drive `live_recon`/`blitz_scan`/
|
|
29
|
+
`strike_verify` manually only for targeted follow-up on a specific finding.
|
|
30
|
+
- Fixed a stale instruction description ("autonomous live marker sweep" →
|
|
31
|
+
"full autonomous live pipeline: recon + marker/negative-control sweep").
|
|
32
|
+
|
|
33
|
+
## [1.2.0] — 2026-09-13
|
|
34
|
+
|
|
35
|
+
### Added — deterministic full live pipeline (no-babysitting)
|
|
36
|
+
|
|
37
|
+
- `run_engagement` on a URL target now runs the FULL autonomous live pipeline in
|
|
38
|
+
one deterministic call: `live_recon` (fingerprint, WAF, tech, crawl,
|
|
39
|
+
subdomains, DNS, API discovery, intel, next_steps) + marker/negative-control
|
|
40
|
+
reflected-input sweep + inline report. The LLM no longer drives recon →
|
|
41
|
+
analyze → verify step-by-step; a single call maps the whole surface and
|
|
42
|
+
verifies reflections. The server-side orchestrator (not the LLM) drives the
|
|
43
|
+
flow, so it cannot stall to ask the user.
|
|
44
|
+
|
|
8
45
|
## [1.1.7] — 2026-09-13
|
|
9
46
|
|
|
10
|
-
### Improved — no-babysitting doctrine
|
|
47
|
+
### Improved — no-babysitting doctrine hardened (3 precise pause conditions)
|
|
11
48
|
|
|
12
49
|
- Pause conditions now precise (3): destructive/DoS needs consent, external
|
|
13
50
|
dependency beyond control blocks (e.g. phone OTP), or engagement complete.
|