blitzstrike 2.4.105 → 2.4.106

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.106] — 2026-09-17
+
+### Added — report assembly (metadata + vulnerability-location block)
+
+- `reportMarkdown` now emits a `## 0. Report Metadata` table (Report ID,
+  Program/Scope, tool version, optional timestamp). The Report ID is DERIVED
+  deterministically (djb2 of title+scope → `BS-XXXXXX`) unless overridden via
+  `report_id`, so reports stay byte-reproducible.
+- Added `param` + `method` to `FindingTarget`; each detailed finding now renders
+  a Vulnerability Location block (Affected URL, Endpoint, Parameter, Method)
+  alongside the existing Severity/CWE/Status/Confidence/Source/Sink/CVSS table —
+  matching the report-template structure (Executive Summary → Location →
+  Description → numbered Steps → Impact → Remediation → References).
+
 ## [2.4.105] — 2026-09-17
 
 ### Added — technique depth (concrete tools + payloads in the technique base)

package/dist/index.js

@@ -35752,13 +35752,30 @@ function summarize(findings) {
     evidence_less_findings: evidenceLess
   };
 }
+function djb2(s) {
+  let h = 5381;
+  for (let i = 0;i < s.length; i++)
+    h = (h << 5) + h + s.charCodeAt(i) >>> 0;
+  return h.toString(16).padStart(8, "0").toUpperCase();
+}
 function reportMarkdown(findings, opts = {}) {
   const summary = summarize(findings);
   const lines = [];
   const title = opts.title ?? "Blitz Strike — Security Assessment Report";
   const scope = opts.scope ?? "(unset)";
+  const reportId = opts.report_id ?? `BS-${djb2(`${title}|${scope}`).slice(0, 6)}`;
   lines.push(`# ${title}`);
   lines.push("");
+  lines.push("## 0. Report Metadata");
+  lines.push("");
+  lines.push("| Field | Value |");
+  lines.push("|-------|-------|");
+  lines.push(`| Report ID | \`${reportId}\` |`);
+  lines.push(`| Program / Scope | ${scope} |`);
+  lines.push(`| Tool version | ${opts.version ?? "unknown"} |`);
+  if (opts.include_timestamp)
+    lines.push(`| Generated | ${new Date().toISOString()} |`);
+  lines.push("");
   const confirmed = findings.filter((f) => f.status === "confirmed");
   const hypotheses = findings.filter((f) => f.status === "hypothesis" || f.status === "validating");
   const fps = findings.filter((f) => f.status === "false_positive");
@@ -35830,6 +35847,12 @@ function reportMarkdown(findings, opts = {}) {
       lines.push(`| Confidence | ${f.confidence ?? "—"} (${f.confidence_level ?? "unscored"}) |`);
       if (target)
         lines.push(`| Affected | ${target} |`);
+      if (f.target?.endpoint)
+        lines.push(`| Endpoint | \`${f.target.endpoint}\` |`);
+      if (f.target?.param)
+        lines.push(`| Parameter | \`${f.target.param}\` |`);
+      if (f.target?.method)
+        lines.push(`| Method | \`${f.target.method}\` |`);
       if (f.source?.type || f.source?.name)
         lines.push(`| Source | ${f.source?.type ?? ""} \`${f.source?.name ?? ""}\``);
       if (f.sink?.type || f.sink?.symbol)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.105",
+  "version": "2.4.106",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {