blitzstrike 2.4.168 → 2.4.169

package/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.169] — 2026-10-11
+
+### Added — finding retest loop (post-confirmation lifecycle)
+
+- The finding lifecycle no longer ends at `confirmed`: added `retesting`, `fixed`,
+  and `still_vulnerable` states with the transitions `confirmed -> retesting ->
+  fixed | still_vulnerable`, and `still_vulnerable -> retesting` (re-retest after
+  the next patch window; `fixed` is terminal).
+- New `retest_finding` tool: pass a confirmed/still_vulnerable finding + a retest
+  verdict (`fixed` or `still_vulnerable`) + reason; it advances the lifecycle and
+  records the verdict + reason as evidence. Run `strike_verify` first to obtain the
+  live verdict, then record it here.
+
 ## [2.4.168] — 2026-10-11
 
 ### Fixed — blind_sqli_extract: space extraction + drift-proof time fallback

package/dist/index.js

@@ -33277,7 +33277,10 @@ var LIFECYCLE_TRANSITIONS = {
   triaged: ["hypothesis", "rejected", "out_of_scope"],
   hypothesis: ["validating", "false_positive", "rejected", "blocked"],
   validating: ["confirmed", "false_positive", "blocked", "out_of_scope"],
-  confirmed: [],
+  confirmed: ["retesting"],
+  retesting: ["fixed", "still_vulnerable", "false_positive"],
+  fixed: [],
+  still_vulnerable: ["retesting"],
   false_positive: [],
   rejected: [],
   blocked: [],
@@ -33440,6 +33443,17 @@ function rejectFinding(finding, status, reason, evidence) {
     timestamps: { ...updated.timestamps, updated: new Date().toISOString() }
   };
 }
+function retestFinding(finding, opts) {
+  const retesting = transition(finding, "retesting");
+  const ev = opts.evidence?.map((e) => makeEvidence(e)) ?? [];
+  const result = transition(retesting, opts.verdict);
+  return {
+    ...result,
+    remediation: { ...result.remediation, retest_note: opts.reason },
+    evidence: [...result.evidence, ...ev],
+    timestamps: { ...result.timestamps, updated: new Date().toISOString() }
+  };
+}
 
 // src/sinks.ts
 init_secrets();
@@ -66341,7 +66355,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("finding_transition", {
     title: "Advance a finding lifecycle (STATEFUL)",
-    description: "FINDINGS: advance a canonical Finding through its lifecycle (detected->triaged->hypothesis->validating->confirmed) and RETURN the updated finding. STATEFUL — pass the FULL finding JSON (from finding_create / run_engagement), not a status string. Rejects illegal transitions with the legal next states. Confirmed is terminal. To confirm FROM a live verdict use strike_resolve instead.",
+    description: "FINDINGS: advance a canonical Finding through its lifecycle (detected->triaged->hypothesis->validating->confirmed, then the retest loop confirmed->retesting->fixed|still_vulnerable) and RETURN the updated finding. STATEFUL — pass the FULL finding JSON (from finding_create / run_engagement), not a status string. Rejects illegal transitions with the legal next states. To confirm FROM a live verdict use strike_resolve; to re-verify a confirmed finding use retest_finding.",
     inputSchema: {
       finding: string2().describe("JSON of the canonical Finding object (from finding_create / run_engagement)"),
       to: string2().describe("Target status (triaged/hypothesis/validating/confirmed/false_positive/rejected/blocked/out_of_scope)")
@@ -66370,6 +66384,46 @@ ${statusLine}` : statusLine },
       }]
     };
   });
+  server.registerTool("retest_finding", {
+    title: "Re-verify a confirmed finding (retest loop)",
+    description: "FINDINGS: re-verify a CONFIRMED (or still_vulnerable) finding to check whether the vendor patched it. Pass the full finding JSON + the retest verdict: 'fixed' (the exploit no longer reproduces — patch applied) or 'still_vulnerable' (still exploitable). Advances confirmed -> retesting -> fixed|still_vulnerable and records the verdict + reason as evidence. still_vulnerable findings can be re-retested later. Run strike_verify FIRST to get the live verdict, then record it here.",
+    inputSchema: {
+      finding: string2().describe("JSON of the canonical Finding object (status confirmed or still_vulnerable)"),
+      verdict: _enum(["fixed", "still_vulnerable"]).describe("Retest outcome: fixed (patch applied) or still_vulnerable (still exploitable)"),
+      reason: string2().describe("Short note: what changed / what still reproduces"),
+      evidence: string2().optional().describe("Optional JSON array of evidence entries [{type, description, content}]")
+    }
+  }, async ({ finding, verdict, reason, evidence }) => {
+    let f;
+    try {
+      f = JSON.parse(finding);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid finding JSON — pass the full Finding object" }) }] };
+    }
+    const from = f.status ?? "detected";
+    if (!(from === "confirmed" || from === "still_vulnerable")) {
+      return { content: [{ type: "text", text: JSON.stringify({ error: `retest only valid from 'confirmed' or 'still_vulnerable', not '${from}'`, legal_next: LIFECYCLE_TRANSITIONS[from] ?? [] }) }] };
+    }
+    let ev = [];
+    if (evidence) {
+      try {
+        ev = JSON.parse(evidence);
+      } catch {
+        ev = [];
+      }
+    }
+    const updated = retestFinding(f, { verdict, reason, evidence: ev });
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          ...updated,
+          transition: `${from} -> retesting -> ${updated.status}`,
+          ...updated.status === "fixed" ? { hint: "FIXED — the vendor patched it. The retest closes this finding's loop." } : { hint: "STILL_VULNERABLE — re-retest later via retest_finding after the next patch window." }
+        })
+      }]
+    };
+  });
   server.registerTool("capture_false_positive", {
     title: "Capture a verified false positive (self-hardening)",
     description: "SELF-HARDENING: record a VERIFIED false positive (a code pattern the detector flagged but live verification ruled out) into the writable benchmark corpus, so the next run_benchmark measures whether the detector STILL flags it. Pass the triggering CODE + language + detector + a short note. Every capture makes the detector more precise — close the loop, never just discard a refuted lead.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.168",
+  "version": "2.4.169",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {