blitzstrike 2.4.106 → 2.4.107

package/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.107] — 2026-09-17
+
+### Added — `review_harness` (per-file review, full-coverage deterministic rubric)
+
+- New `review_harness(path)` tool implementing the "harness beats model"
+  discipline: applies a FIXED 5-signal rubric (entry_points / auth_gates /
+  sinks / secrets / logic_bugs) to EVERY enumerated source file and emits a
+  structured per-file verdict + a full-coverage report (files reviewed, clean vs
+  with-findings, per-class signal frequency). Guarantees no file is skipped and
+  every file is reviewed the same way — a COMPLETE map of the codebase, not a
+  partial scan. Most signal-dense files are sorted first.
+
+### Fixed — scanner endpoint detection blanked string-embedded hooks
+
+- `scanFile` matched endpoint hooks against `stripComments`, which blanks string
+  literals as well as comments — so `add_action('wp_ajax_nopriv_…')` /
+  `register_rest_route('…')` (always quoted) were never detected. Added
+  `stripCommentsOnly` (comments only, strings preserved) and matched endpoint
+  hooks against it; sinks still use the string-blanking strip. Regression-tested:
+  `wp_ajax_nopriv_` now detected.
+
 ## [2.4.106] — 2026-09-17
 
 ### Added — report assembly (metadata + vulnerability-location block)