blitzstrike 1.9.0 → 2.4.0

package/CHANGELOG.md

@@ -5,14 +5,499 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [1.8.0] — 2026-09-14
+## [2.4.0] — 2026-09-14
+
+### Added — bulk tool installation (install the whole catalog at once)
+
+- `installAllTools({ category?, concurrency? })` + `ensureToolAsync()`: install
+  every non-MCP-server catalog tool in parallel (bounded concurrency), skipping
+  MCP servers (they are connected, not installed). Returns installed /
+  already_installed / failed + per-tool result.
+- CLI: `blitzstrike install-tools` (all), `--category recon` (filter),
+  `--concurrency 8` (workers), `--dry-run` (preview without installing).
+- MCP tool `install_all_tools` so the driving agent can mass-provision the
+  toolbelt instead of ensure_tool one-by-one.
+
+## [2.3.4] — 2026-09-14
+
+### Fixed — CI failure (browser checks threw on missing Chromium binary)
+
+- Root cause: `chromium.launch()` sat OUTSIDE the try/catch in all four browser
+  checks, so a clean CI runner (playwright-core installed but no Chromium binary)
+  threw an uncaught error → the browser-dispatch unit test failed.
+- Added `launchHeadless()` which returns null on launch failure; every browser
+  check now degrades to `unavailable` instead of throwing. Verified by running the
+  browser dispatch with `PLAYWRIGHT_BROWSERS_PATH=/nonexistent`.
+
+## [2.3.3] — 2026-09-14
+
+### Added — Burp Suite MCP auto-verification (SSE detect + handshake)
+
+- New `src/burp-mcp.ts`: `driveBurpMCP(url)` detects whether the Burp MCP SSE
+  server is alive (default http://127.0.0.1:9876/sse), then performs the MCP SSE
+  handshake (endpoint event → initialize → tools/list) and returns the server
+  info + tool list — or a clear, actionable "start Burp + load the extension"
+  error when it is unreachable.
+- The `burp` chain hint now auto-verifies: `executeChainSteps` probes the SSE
+  endpoint and reports alive/not-alive instead of returning a connect string.
+
+## [2.3.2] — 2026-09-14
+
+### Added — chrome-devtools-mcp auto-verification (Blitz becomes an MCP client)
+
+- New `src/devtools.ts`: a minimal MCP stdio client + `driveChromeDevtools(target)`.
+  Blitz now spawns chrome-devtools-mcp, performs the initialize handshake, and
+  DRIVES its tools (list_pages → navigate_page → list_network_requests →
+  list_console_messages → evaluate_script) against a target, returning live traffic,
+  console messages, and a JS eval.
+- The `browser_devtools` chain hint now auto-executes: `executeChainSteps` spawns
+  and drives a real browser session instead of returning a connect string.
+- New MCP tool `drive_devtools` so the driving agent can open any URL in a live
+  Chrome and capture network/console/eval on demand.
+- Discovers a usable Chromium (system Chrome → playwright cache) and passes
+  `--no-sandbox --disable-gpu` for root/container runs.
+
+## [2.3.1] — 2026-09-14
+
+### Fixed — verified both MCP servers live (no more "pajangan")
+
+- **chrome-devtools-mcp** verified end-to-end over stdio: initialize handshake OK,
+  `navigate_page` → httpbin 200, `list_network_requests` returns real traffic,
+  `evaluate_script` runs JS. Root/container runs crash with "Target closed" unless
+  `--chromeArg=--no-sandbox --chromeArg=--disable-gpu` is passed — the `serve`
+  string and doctrine now include these.
+- **burp-suite-mcp** connection details corrected: it is NOT an npm package / BApp
+  store entry — it's a Burp Java extension built via `./gradlew embedProxyJar`
+  (→ build/libs/burp-mcp-all.jar), loaded in Burp → Extensions, default SSE
+  `http://127.0.0.1:9876`, plus the packaged stdio proxy
+  `java -jar mcp-proxy-all.jar --sse-url http://127.0.0.1:9876`.
+- Doctrine EXTERNAL MCP SERVERS line now carries the exact, tested commands.
+
+## [2.3.0] — 2026-09-14
+
+### Added — external MCP server integration (chrome-devtools + burp-suite)
+
+- Added `chrome-devtools-mcp` + `burp-suite-mcp` to the catalog (now 141 tools) as
+  a new `mcp-server` category. These are discoverable via list_tools, installable
+  via ensure_tool, and carry a `serve` connection string.
+- `runCatalogTool` detects `mcp-server` entries and returns the connection string
+  (npx / Burp extension) instead of spawning a long-running daemon as a one-shot
+  subprocess; the chain executor surfaces them as a deferred "connect" step.
+- `toolForHint("burp")` now resolves to `burp-suite-mcp` (previously deferred).
+- Added an EXTERNAL MCP SERVERS doctrine line so the driving agent knows to CONNECT
+  chrome-devtools-mcp (raw network/console/cookie inspection) and burp-suite-mcp
+  (proxy + active scanning) for depth the built-in browser can't reach.
+
+## [2.2.4] — 2026-09-14
+
+### Added — browser chain steps auto-execute (no longer deferred)
+
+- Mapped the `browser` / `browser_devtools` chain hints to a finding-level browser
+  validation. The executor now drives a real headless Chromium to validate the
+  finding (DOM XSS / open redirect / auth bypass / CSRF), choosing the check from
+  the finding's class via a data map — the browser tool is the same for every
+  chain, only the check type varies.
+
+## [2.2.3] — 2026-09-14
+
+### Added — catalog tools for previously-unresolved chain hints
+
+- Added 9 catalog tools so more chain steps execute instead of deferring to the
+  LLM: inql (GraphQL), smuggler (request smuggling), subjs (JS endpoint extract),
+  subzy (subdomain takeover), tplmap (SSTI), kubectl, interactsh-client (OOB),
+  rogue-jndi (JNDI), ssh. Catalog now 139 tools.
+- `toolForHint` now strips ALL non-alphanumerics when matching, so `rogue_jndi`,
+  `rogue-jndi` and `roguejndi` resolve to the same tool.
+
+## [2.2.2] — 2026-09-14
+
+### Fixed — interconnection audit bugs
+
+- **runCatalogTool dropped the target for 34 no-required-flag tools** (curl, httpx,
+  nmap, dnsx, trufflehog, ...) — the command was built with no target at all. Now
+  falls back to an unambiguous target flag (-u/--url/--domain/--target) or a
+  positional argument. Extracted `buildCatalogCommand` for deterministic testing.
+- **CRLF probe double-encoded** — `encodeURIComponent("%0d%0a…")` produced
+  `%250d%250a`, so the CRLF was never injected (permanent false negative). The
+  probe is now pre-encoded and sent as-is.
+- **Stale run_autonomous note** — still told the LLM to "follow next_steps to
+  verify" after the chain executor began auto-executing those steps; updated.
+
+## [2.2.1] — 2026-09-14
+
+### Changed — chain executor is now generic name-based dispatch (no semantic buckets)
+
+- Removed the hardcoded `tool_hint ~ verify/crack/scan` category mapping. The
+  executor now resolves each chain step's `tool_hint` by NAME against a Blitz
+  finding-tool registry (strike_verify / crack_hash / scan_leaked_source + chain
+  aliases), then the external-tool catalog, then manual. Whatever tool the chain
+  names for a finding runs — per-target, per-finding, no per-vuln or per-category
+  hardcoding.
+
+## [2.2.0] — 2026-09-14
+
+### Added — catalog tool execution (LLM ↔ tools ↔ external tools connected)
+
+- `runCatalogTool(hint, target, extra_flags)` + `toolForHint(hint)`: map a chain
+  step's tool_hint (sqlmap, nuclei, jwt_tool, hydra, subfinder, ...) to a catalog
+  tool, ensure it is installed (auto-install via ensure_tool), and RUN it against
+  the finding's target with the tool's required flags auto-built. Returns exit code
+  + capped output. Non-interactive; no destructive flags beyond the tool's own.
+- Chain executor now runs catalog-tool hints as a "tool" outcome — a chain step
+  that says `sqlmap` executes sqlmap instead of being deferred to the LLM.
+- New MCP tool `run_catalog_tool` so the driving agent can run external tools
+  directly against a target.
+
+## [2.1.0] — 2026-09-14
+
+### Added — generic chain executor (findings advance through their chain in the pipeline)
+
+- New `src/chain-executor.ts`: `executeChainSteps(finding, steps)` interprets each
+  chain step's `tool_hint` and runs the matching deterministic operation, so the
+  PIPELINE executes a finding's escalation chain instead of leaving it as a
+  hypothesis for the LLM. Target-agnostic: works for SQLi, SSRF, SSTI, LFI, JWT,
+  deserialization, etc.
+  - `tool_hint ~ verify` → strike_verify (marker + negative control) → confirmed/blocked
+  - `tool_hint ~ crack` → crack_hash on any hashes in the finding's evidence
+  - `tool_hint ~ scan` → scan_leaked_source on the finding's evidence text
+  - otherwise → flagged `deferred` with the exact action + tool
+- `run_autonomous` now executes the chain steps for every finding and attaches
+  `escalation.executed` (one result per step) alongside the `next_steps`.
+
+## [2.0.0] — 2026-09-14
+
+### Added — full-power attack-vector expansion (JWT / CRLF / host-header / origin bypass)
+
+- **JWT alg-confusion check** — detects JWTs in cookies/headers/body, tests
+  alg:none acceptance (signature stripped), and flags RS/ES → HS256 confusion
+  candidates.
+- **CRLF / header-injection check** — injects `%0d%0aX-BlitzStrike: injected` into
+  redirect/url/next/state/token params and flags any reflected header.
+- **Host-header injection check** — sends an attacker Host and detects reflection
+  in Location / Set-Cookie / body.
+- **Origin-exposure flag (direct-to-origin bypass)** — live_recon now classifies
+  every resolved host/IP against known CDN ranges (Cloudflare/CloudFront/Fastly/
+  Akamai/DDoS-Guard/Imperva) and surfaces `origin_exposed` + a next_step for
+  `--resolve` direct-to-origin testing (WAF/CDN layer evaporates).
+
+## [1.19.4] — 2026-09-14
+
+### Fixed — engagement model: recon is input, not the deliverable
+
+- Added a DELIVERABLE + PERSISTENCE doctrine: the deliverable is a HackerOne-grade
+  FINDING report (generate_report), never a hand-written recon/surface map; verify
+  every lead (strike_verify marker+control / browser_validate) before it becomes a
+  finding; a hard block (Cloudflare/WAF/IP/captcha) is NOT the end — mark it
+  blocked + note the required vantage, then continue to the next lead; keep trying
+  every lead until verified or blocked, THEN generate_report.
+- generate_report description now states it is the FINAL deliverable and enumerates
+  the full HackerOne-grade section layout.
+
+## [1.19.3] — 2026-09-14
+
+### Fixed — full interconnection audit (no dead/orphan layer)
+
+- Added a KNOWLEDGE BASE line to the MCP instructions so the driving agent can
+  discover every layer on demand: skillLookup/listSkills (40 skills),
+  list_attack_vectors/attack_vectors (34-category taxonomy), taxonomy(kind)
+  (OWASP/CWE/ASVS/API-top-10), read_playbook (17), list_manuals/read_tool_manual
+  (317). Verified end-to-end: 97 tools → 35 data functions → 26 data files; 40
+  skills loadable; 53 techniques, 57 chains, 18 chain_links, 588 vectors all
+  resolve.
+- Fixed taxonomy CWE lookup: `taxonomy("cwe", "89")` now matches CWE-89 (query
+  normalized to the bare number).
+
+## [1.19.2] — 2026-09-14
+
+### Fixed — sink scan now fires on EVERY response, not just detected probes
+
+- `probeWithBypass` scans every response for leaked sinks regardless of whether
+  the specific injection was detected — an SSTI/SSRF/XSS probe that hits a 500
+  traceback now still captures the eval()/SECRET_KEY/requests.get sinks it
+  reveals. Sink collection was also moved BEFORE the detection early-return so a
+  non-detecting probe still contributes its leaked sinks.
+- `strike_verify` now returns a `leaked_sinks` field — the baseline/marker/
+  control responses are scanned for tracebacks and any revealed sink is attached
+  to the verdict.
+
+## [1.19.1] — 2026-09-14
+
+### Fixed — sink enumeration now deterministic (not eyeball-dependent) + no-babysitting hardening
+
+- `probeWithBypass` now scans every error/traceback response for sinks and
+  `runAdvancedChecks` turns each distinct sink into its own hypothesis Finding.
+  An SQL-error traceback that also shows `eval()` + `SECRET_KEY` + `requests.get`
+  now yields an RCE finding + a credential finding + an SSRF finding
+  automatically — the driving agent no longer has to notice them by hand.
+- No-babysitting rule hardened: "say the word / want me to pursue / should I
+  continue" are explicit hard violations — execute the full chain until COMPLETE.
+
+## [1.19.0] — 2026-09-14
+
+### Added — generalized leaked-source sink scan + deterministic hash cracking
+
+- `scan_leaked_source` tool + `sinks.ts`: scan ARBITRARY leaked text (any 500
+  traceback, debug page, source dump, config, error message, credential dump)
+  for dangerous sinks — eval/exec/os.system/subprocess (RCE),
+  render_template_string (SSTI), SQL string-building, requests.get (SSRF),
+  file read (LFI), SECRET_KEY/API keys, hardcoded creds, pickle/unserialize,
+  XML parse (XXE). Each hit returns the line, snippet, and next action. Not
+  Werkzeug-specific — works on any leak.
+- `live_recon` now auto-scans the root response for source leaks and attaches
+  the enumerated sinks to the recon output.
+- `crack_hash` tool + `hash.ts`: identify the hash type and immediately try a
+  built-in common-password list offline, then return the exact hashcat/john
+  command for a full crack — so "crack the hashes" becomes an action, not a
+  recommendation.
+- Doctrine: "a 'next chain' you write is a TODO — run it, never leave it as a
+  recommendation" (scan_leaked_source / crack_hash as the execute-now tools).
+
+## [1.18.1] — 2026-09-14
+
+### Fixed — Werkzeug skill over-fixated on the PIN, missing the easier RCE path
+
+- The Flask debug skill previously led with PIN derivation, which caused the
+  driving agent to get stuck on "one PIN away" and miss the SOURCE-DISCLOSURE
+  path (every 500 leaks app source → read it → find eval()/SECRET_KEY/hardcoded
+  creds → exploit directly). Reordered: source-disclosure is now Path 1 (read
+  the leaked source line-by-line, run blitz_file/taint_file on it), PIN is
+  Path 2. Doctrine updated to match.
+
+## [1.18.0] — 2026-09-14
+
+### Added — Werkzeug debug console PIN derivation (RCE follow-through)
+
+- New skill `bs-flask-debug-rce` + technique class `flask_debug_pin`: when the
+  LLM finds a PIN-locked Werkzeug/Flask debug console it now derives the PIN
+  (deterministically computed from username + modname + app name + mod_path +
+  MAC-decimal + machine-id) instead of stopping at "one PIN away from RCE".
+  Includes the full SHA1 algorithm, a brute-force matrix for unknown bits, and
+  marker + negative-control verification.
+- Flask framework tricks now note the PIN-derivation chain.
+- Doctrine hardened: "EXECUTE follow-ups NOW, not as next phase" — debug console
+  → derive the PIN, dumped hashes → crack/reuse, hidden-content IDOR → test the
+  direct route.
+
+## [1.17.2] — 2026-09-14
+
+### Fixed — SSRF false positives + fuller chain composition
+
+- The fetch-reflect SSRF probe used `http://example.com/` → "Example Domain",
+  which matched the target's own content (23 false-positive CRITICALs on
+  example.com). Now uses a unique canary
+  (`http://httpbin.org/anything/blitzstrike-ssrf-canary`) so only a real
+  server-side fetch reflects it.
+- Escalation mapping now points each chainId at the richer composition chain
+  (more steps + a `leads_to` entry): ssti→ssti_to_full_rce,
+  deserialization→deserialization_to_rce, path_traversal→
+  path_traversal_to_credential_theft, idor→idor_to_admin_takeover,
+  open_redirect→open_redirect_to_oauth_theft.
+
+## [1.17.1] — 2026-09-14
+
+### Fixed — chain escalation was silently broken + restored chain-aware doctrine
+
+- `run_autonomous` escalation lookup was broken: a finding's `chain_id`
+  (e.g. `sql_injection`) never matched the chains.json ids (e.g. `sqli_to_rce`),
+  so every finding's `escalation` was null. Added a chain-id mapping and now
+  attach the escalation chain (steps + tools) AND a `leads_to` composition
+  (from chain_links.json) — e.g. SQLi → `sqli_to_hash_dump_and_crack` +
+  `path_traversal_to_credential_theft`.
+- Restored a compact "CHAIN DECISIONS" doctrine to the MCP instructions: a
+  confirmed finding is the START, not the end — enumerate ESCALATE / CHAIN /
+  BYPASS / PIVOT follow-ups and ask "I found X → what can I now read/do/access?"
+  (SQLi → query for creds + console PIN + source), verifying each follow-up.
+
+## [1.17.0] — 2026-09-14
+
+### Added — attack_plan (data-driven attack-vector decisions)
+
+- New `attack_plan(target, tech, params)` tool: turns recon context (detected
+  tech + discovered params) into a prioritized list of attack vectors to test,
+  each with a reason and the specific tool. Base injection vectors are always
+  listed; param hints (id→idor/sqli, url→ssrf/redirect, cmd→command-injection)
+  and tech hints (wordpress/laravel/flask/spring/...) add and reprioritize.
+- The MCP instructions now point to `attack_plan` as the way to "decide what to
+  test next" — the driving agent enumerates the full vector surface with data
+  instead of guessing a few checks.
+
+## [1.16.0] — 2026-09-14
+
+### Added — more injection vectors (command injection + real XSS + fetch-reflect SSRF)
+
+- **Command injection (CWE-78)** — new advanced check: injects `; id` into 14
+  command-ish params (cmd/command/exec/run/ping/host/ip/file/path/...) and flags
+  a hit on `uid=`/`gid=`/`www-data`/shell output.
+- **Reflected XSS (CWE-79)** — now tests REAL payloads, not just a random
+  marker: `<script>alert(document.domain)</script>` (script context) and
+  `"><img src=x onerror=alert(1)>` (attribute breakout), flagging UNESCAPED
+  reflection. The previous reflected-input sweep only detected reflection, not
+  whether XSS was actually possible.
+- **SSRF** — added a second probe (`http://example.com/` → "Example Domain") to
+  catch fetch-reflect SSRF, and expanded the param list (fetch/download/import/
+  feed/source/load/next).
+- writeup engine + report now carry command-injection and XSS impact/remediation.
+
+## [1.15.1] — 2026-09-14
+
+### Changed — every finding now carries a full CVSS v3.1 vector
+
+- The report emits a complete CVSS v3.1 vector string (e.g.
+  `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) alongside the score. When a
+  finding has no explicit CVSS, a severity-band metric set is used to compute
+  both score and vector, so the detailed-findings table always shows the vector.
+
+## [1.15.0] — 2026-09-14
+
+### Added — HackerOne-grade report generation
+
+- New `writeup` engine (`src/writeup.ts`) turns every finding into the prose a
+  professional report needs: description, root cause, numbered reproduction
+  steps, impact, remediation, and references — pulling structured content from
+  the technique knowledge base (summary + how_to_test) and the finding's own
+  CWE/severity/chain.
+- `reportMarkdown` rewritten to a full assessment-report format: Executive
+  Summary, Scope, Methodology, Summary of Findings table, per-finding detailed
+  sections (severity/CVSS/CWE/status/confidence + description + root cause +
+  reproduction + impact + remediation + references), Recommendations, and an
+  Appendix (unverified hypotheses + cleared false positives).
+- CVSS falls back to a severity-band default (critical 9.8 / high 8.1 / medium
+  6.1 / low 3.1) when a finding has no explicit CVSS, so the report never shows
+  a bare "—".
+
+## [1.14.1] — 2026-09-14
+
+### Fixed — LLM wasn't reliably reaching for tools (instructions were a 14KB manual)
+
+- MCP `instructions` shrunk 13,989 → 1,720 chars. The old text was a full
+  methodology manual; smaller driving models (e.g. GLM) drowned in it and missed
+  the one directive that matters. Now the FIRST lines are the actionable trigger:
+  "user says test/scan/audit → call run_engagement FIRST", followed by the
+  non-negotiable rules. Detailed methodology stays in the skills (loaded
+  on-demand via read_skill).
+- `run_engagement` / `run_autonomous` descriptions now lead with the trigger
+  ("the DEFAULT first call when the user asks to test/scan/audit") instead of a
+  weak "prefer this".
+
+## [1.14.0] — 2026-09-14
+
+### Fixed — live pipeline timeout (parallelized request trees)
+
+- The full live engagement was exceeding the 120s MCP tool timeout because every
+  request was sequential. Now parallelized:
+  - `dnsBrute` (51 lookups), `scanPorts` (26 probes), `discoverApi` (14 paths)
+    run concurrently via `Promise.allSettled`.
+  - Passive recon phases (subdomains / DNS / Wayback / API) run in parallel.
+  - Reflected sweep (9 params), deterministic checks (open-redirect + traversal),
+    and advanced checks (SSTI/SSRF/SQLi — 40 params) all run in parallel.
+  - Wayback CDX timeout 60s → 25s.
+- `run_engagement` on a live URL now completes in ~15-20s instead of timing out.
+
+## [1.13.2] — 2026-09-14
+
+### Fixed — OpenCode connection + server version reporting
+
+- `opencodeWrite` now writes the RESOLVED command (global `blitzstrike` binary
+  first, npx only as fallback) instead of hardcoding `npx -y blitzstrike`, which
+  could pull a stale npm-registry version. A locally-installed build is always
+  preferred.
+- MCP `serverInfo.version` now reports the real package version (was hardcoded
+  "1.0.0"), so a driving agent can see exactly which build it is talking to.
+
+## [1.13.1] — 2026-09-14
+
+### Changed — cross-agent consistency (100% one doctrine)
+
+- Rewrote the OpenCode orchestrator persona (`opencode-agents/Blitz Strike.md`)
+  and fixed `Strike.md` — removed the stale scope/authorization gate language
+  ("approval gate", "authorize=true", "authorized targets only", "ask before
+  proceeding") so every persona now matches the MCP instructions: scope is
+  intel-only, no authorization gate, `run_engagement` = FIRST + ONLY action,
+  WAF bypass is automatic.
+- Portable persona (AGENTS.md / CLAUDE.md / SKILL.md) synced to the same
+  doctrine + added the scope/WAF-bypass section.
+- MCP instructions now state that `strike_verify` + live checks AUTO-attempt WAF
+  bypass (do not report "needs WAF bypass" without re-probing).
+
+## [1.13.0] — 2026-09-14
+
+### Added — WAF-bypass-aware verification
+
+- `strike_verify` now detects a WAF block (403/406 or a block-page signature —
+  "Akses Dibatasi" / F5 / Cloudflare / ModSecurity / etc.) and, instead of
+  declaring "unconfirmed", retries the marker through 6 evasion variants
+  (double URL-encode, case variation, HTML entity, inline comment split,
+  separator, null byte). A variant that reflects the original marker = confirmed
+  with the bypass technique recorded.
+- The advanced live checks (SSTI / SSRF / error-based SQLi) now use the same
+  bypass re-probe, so a WAF-gated injection is actually tested rather than
+  reported as "needs WAF bypass".
+
+## [1.12.0] — 2026-09-14
+
+### Changed — scope is intel-only (never a gate)
+
+- `scope_check` / `active_scan` / `run_engagement` no longer refuse a URL for
+  lack of scope. Scope is classified (in_scope / out_of_scope / not_in_scope /
+  unscoped) and recorded for the report, but `allowed` is always true — the repo
+  disclaimer carries responsibility (exactly like nmap/sqlmap/Burp).
+- Routing doctrine hardened: when the user says "test / scan / audit / pentest",
+  the FIRST and ONLY action is `run_engagement` (or `run_autonomous`) — never a
+  manual live_recon/blitz_scan first, never a fallback to manual probing.
+
+## [1.11.2] — 2026-09-14
+
+### Changed — live_recon result caps lifted
+
+- Response body cap 50KB → 500KB (no longer truncates large HTML/sitemap/crt.sh
+  responses, so no links/endpoints/certs are silently dropped).
+- Wayback CDX limit 500 → 10000 historical URLs.
+- DNS subdomain display cap 8 → 50 in next_steps.
+
+## [1.11.1] — 2026-09-14
+
+### Fixed — live engagement friction (scope wildcard + timeout recovery)
+
+- Scope matching now handles `*.host` wildcards correctly (apex + subdomains,
+  and no loose substring false matches). Previously `*.vuln-web-app.onrender.com`
+  failed to match the apex host, forcing a retry loop.
+- Added a `timeout` recovery mode to `retry_guidance` (slow/free-tier targets:
+  split into lighter probes, add explicit scope, target one endpoint, retry
+  after cold-start).
+
+## [1.11.0] — 2026-09-14
+
+### Changed — no-babysitting doctrine wired into an autonomous loop
+
+- Added an explicit AUTONOMOUS LOOP to the MCP instructions: plan → run_autonomous
+  → delegate → task checkpoint/resume → watchdog → context_prune → terminate.
+  No-babysitting is now GUARANTEED by the interconnected tools (code-driven), not
+  just by a "never ask" prompt.
+- Fixed the one remaining contradiction: the DAST skill said "always confirm with
+  the user"; aligned it to the destructive-consent pause condition (the only
+  consent pause; non-destructive steps proceed autonomously).
+
+## [1.10.0] — 2026-09-14
+
+### Fixed — live pipeline false positives (hypothesis is not a finding)
+
+- SSTI detector used the weak marker `{{7*7}}` → `49`, which matched "49"
+  appearing randomly in any HTML page (12 false-positive "Critical" on a clean
+  target). Switched to the distinctive `{{7*'7'}}` → `7777777` evaluation.
+- Reflected-input sweep reported every tested parameter as a finding even when
+  the marker was NOT reflected (9 noise "unconfirmed" findings). Now only a
+  CONFIRMED reflection is a finding; negative results are tracked separately
+  in `report.tested`.
+
+## [1.9.0] — 2026-09-14
 
 ### Fixed — manuals data layer not bundled in npm tarball
 
 - `manuals-index.json` was missing from the package `files` list, so
   `list_manuals` / `read_tool_manual` / `read_playbook` returned empty from an
   npm install (the 317 manuals + 17 playbooks were not indexed). Added the
-  index file to the tarball.
+  index file to the tarball. Also added a data-layer smoke test
+  (`test/data-smoke.ts`) covering every runtime data file (30 checks).
 
 ## [1.7.1] — 2026-09-14