blitzstrike 2.4.167 → 2.4.169

package/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.169] — 2026-10-11
+
+### Added — finding retest loop (post-confirmation lifecycle)
+
+- The finding lifecycle no longer ends at `confirmed`: added `retesting`, `fixed`,
+  and `still_vulnerable` states with the transitions `confirmed -> retesting ->
+  fixed | still_vulnerable`, and `still_vulnerable -> retesting` (re-retest after
+  the next patch window; `fixed` is terminal).
+- New `retest_finding` tool: pass a confirmed/still_vulnerable finding + a retest
+  verdict (`fixed` or `still_vulnerable`) + reason; it advances the lifecycle and
+  records the verdict + reason as evidence. Run `strike_verify` first to obtain the
+  live verdict, then record it here.
+
+## [2.4.168] — 2026-10-11
+
+### Fixed — blind_sqli_extract: space extraction + drift-proof time fallback
+
+- Added SPACE (+ parens/comma) to the extraction linear-fallback charset, so
+  version/database strings with embedded spaces (e.g. "Microsoft SQL Server 2012")
+  extract fully instead of stopping at the first space.
+- Auto-fall back to the TIME oracle when a marker-less byte-count boolean oracle
+  extracts nothing — the time oracle is deterministic and immune to page-size
+  drift on dynamic remote pages.
+- Excluded WAF-sensitive chars (#, =, <, >, quotes, %, &, ;, |, *) from the
+  charset: a WAF that strips one of them turns the comparison into `= ''`
+  (always-true past the string end), which previously produced a false trailing run.
+
 ## [2.4.167] — 2026-10-11
 
 ### Fixed — blind_oracle detection false-negative + false-positive (real target)

package/dist/index.js

@@ -33277,7 +33277,10 @@ var LIFECYCLE_TRANSITIONS = {
   triaged: ["hypothesis", "rejected", "out_of_scope"],
   hypothesis: ["validating", "false_positive", "rejected", "blocked"],
   validating: ["confirmed", "false_positive", "blocked", "out_of_scope"],
-  confirmed: [],
+  confirmed: ["retesting"],
+  retesting: ["fixed", "still_vulnerable", "false_positive"],
+  fixed: [],
+  still_vulnerable: ["retesting"],
   false_positive: [],
   rejected: [],
   blocked: [],
@@ -33440,6 +33443,17 @@ function rejectFinding(finding, status, reason, evidence) {
     timestamps: { ...updated.timestamps, updated: new Date().toISOString() }
   };
 }
+function retestFinding(finding, opts) {
+  const retesting = transition(finding, "retesting");
+  const ev = opts.evidence?.map((e) => makeEvidence(e)) ?? [];
+  const result = transition(retesting, opts.verdict);
+  return {
+    ...result,
+    remediation: { ...result.remediation, retest_note: opts.reason },
+    evidence: [...result.evidence, ...ev],
+    timestamps: { ...result.timestamps, updated: new Date().toISOString() }
+  };
+}
 
 // src/sinks.ts
 init_secrets();
@@ -62729,7 +62743,7 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
       }
     }
   }
-  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@";
+  const charset = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{}_/.-:@(), ";
   const caseInsensitive = p.dbms === "mysql" || p.dbms === "mssql";
   const bsCharset = caseInsensitive ? "0123456789abcdefghijklmnopqrstuvwxyz" : "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
   const baseTpl = (channel === "time" ? p.extraction.time : p.extraction.boolean).replace(/^'/, ctx);
@@ -62792,6 +62806,9 @@ async function blindSqliExtract(baseUrl, param, value, dbms, target, opts = {})
     out += ch;
   }
   out = out.trimEnd();
+  if (out.length === 0 && channel === "boolean" && !marker) {
+    return await blindSqliExtract(baseUrl, param, value, dbms, target, { ...opts, channel: "time" });
+  }
   return {
     dbms,
     target,
@@ -66338,7 +66355,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("finding_transition", {
     title: "Advance a finding lifecycle (STATEFUL)",
-    description: "FINDINGS: advance a canonical Finding through its lifecycle (detected->triaged->hypothesis->validating->confirmed) and RETURN the updated finding. STATEFUL — pass the FULL finding JSON (from finding_create / run_engagement), not a status string. Rejects illegal transitions with the legal next states. Confirmed is terminal. To confirm FROM a live verdict use strike_resolve instead.",
+    description: "FINDINGS: advance a canonical Finding through its lifecycle (detected->triaged->hypothesis->validating->confirmed, then the retest loop confirmed->retesting->fixed|still_vulnerable) and RETURN the updated finding. STATEFUL — pass the FULL finding JSON (from finding_create / run_engagement), not a status string. Rejects illegal transitions with the legal next states. To confirm FROM a live verdict use strike_resolve; to re-verify a confirmed finding use retest_finding.",
     inputSchema: {
       finding: string2().describe("JSON of the canonical Finding object (from finding_create / run_engagement)"),
       to: string2().describe("Target status (triaged/hypothesis/validating/confirmed/false_positive/rejected/blocked/out_of_scope)")
@@ -66367,6 +66384,46 @@ ${statusLine}` : statusLine },
       }]
     };
   });
+  server.registerTool("retest_finding", {
+    title: "Re-verify a confirmed finding (retest loop)",
+    description: "FINDINGS: re-verify a CONFIRMED (or still_vulnerable) finding to check whether the vendor patched it. Pass the full finding JSON + the retest verdict: 'fixed' (the exploit no longer reproduces — patch applied) or 'still_vulnerable' (still exploitable). Advances confirmed -> retesting -> fixed|still_vulnerable and records the verdict + reason as evidence. still_vulnerable findings can be re-retested later. Run strike_verify FIRST to get the live verdict, then record it here.",
+    inputSchema: {
+      finding: string2().describe("JSON of the canonical Finding object (status confirmed or still_vulnerable)"),
+      verdict: _enum(["fixed", "still_vulnerable"]).describe("Retest outcome: fixed (patch applied) or still_vulnerable (still exploitable)"),
+      reason: string2().describe("Short note: what changed / what still reproduces"),
+      evidence: string2().optional().describe("Optional JSON array of evidence entries [{type, description, content}]")
+    }
+  }, async ({ finding, verdict, reason, evidence }) => {
+    let f;
+    try {
+      f = JSON.parse(finding);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid finding JSON — pass the full Finding object" }) }] };
+    }
+    const from = f.status ?? "detected";
+    if (!(from === "confirmed" || from === "still_vulnerable")) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: `retest only valid from 'confirmed' or 'still_vulnerable', not '${from}'`, legal_next: LIFECYCLE_TRANSITIONS[from] ?? [] }) }] };
+    }
+    let ev = [];
+    if (evidence) {
+      try {
+        ev = JSON.parse(evidence);
+      } catch {
+        ev = [];
+      }
+    }
+    const updated = retestFinding(f, { verdict, reason, evidence: ev });
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          ...updated,
+          transition: `${from} -> retesting -> ${updated.status}`,
+          ...updated.status === "fixed" ? { hint: "FIXED — the vendor patched it. The retest closes this finding's loop." } : { hint: "STILL_VULNERABLE — re-retest later via retest_finding after the next patch window." }
+        })
+      }]
+    };
+  });
   server.registerTool("capture_false_positive", {
     title: "Capture a verified false positive (self-hardening)",
     description: "SELF-HARDENING: record a VERIFIED false positive (a code pattern the detector flagged but live verification ruled out) into the writable benchmark corpus, so the next run_benchmark measures whether the detector STILL flags it. Pass the triggering CODE + language + detector + a short note. Every capture makes the detector more precise — close the loop, never just discard a refuted lead.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.167",
+  "version": "2.4.169",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {