blitzstrike 2.4.172 → 2.4.173

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.173] — 2026-10-11
+
+### Added — goal tracking + prove_goal (completion signal)
+
+- New `goals` engine + 3 tools: `goal_set` (register free-text goals + optional
+  quantitative condition), `prove_goal` (mark met with evidence + reason), and
+  `goal_status` (list goals + `all_met` — the task's completion signal).
+- A goal with a quantitative condition must have its measured value verified before
+  proving it met; the task is complete only when `all_met` is true.
+
 ## [2.4.172] — 2026-10-11
 
 ### Added — operation constraint registry (deterministic red lines)

package/dist/index.js

@@ -63918,6 +63918,37 @@ function checkConstraint(action, target) {
   return { allowed: true, mode: "denylist", matched: null, reason: "denylist mode: no deny rule matches — default allow" };
 }
 
+// src/goals.ts
+var goals = [];
+var counter2 = 0;
+function nextId2() {
+  counter2 += 1;
+  return `G-${String(counter2).padStart(3, "0")}`;
+}
+function setGoals(texts) {
+  for (const t of texts) {
+    const text = typeof t === "string" ? t : t.text;
+    const condition = typeof t === "string" ? undefined : t.condition;
+    const now = new Date().toISOString();
+    goals.push({ id: nextId2(), text, condition, status: "pending", created: now, updated: now });
+  }
+  return [...goals];
+}
+function proveGoal(id, evidence, reason) {
+  const g = goals.find((x) => x.id === id);
+  if (!g)
+    return { ok: false, error: `no goal '${id}'` };
+  g.status = "met";
+  g.met_evidence = evidence;
+  g.met_reason = reason;
+  g.updated = new Date().toISOString();
+  return { ok: true, goal: { ...g } };
+}
+function goalStatus() {
+  const met = goals.filter((g) => g.status === "met").length;
+  return { goals: [...goals], all_met: goals.length > 0 && met === goals.length, met, total: goals.length };
+}
+
 // src/sibling-scan.ts
 var SIBLING_SUFFIXES = [
   "export",
@@ -65854,6 +65885,35 @@ ${statusLine}` : statusLine },
   }, async ({ id }) => {
     return { content: [{ type: "text", text: JSON.stringify({ removed: clearConstraint(id), id }) }] };
   });
+  server.registerTool("goal_set", {
+    title: "Register engagement goals",
+    description: "GOALS: register one or more free-text goals (each with an optional quantitative condition like 'coverage >= 80%'). goal_status then tracks which are met; the task is COMPLETE only when all_met is true. Use before planning routes so every route traces back to a goal.",
+    inputSchema: {
+      goals: array(object2({ text: string2(), condition: string2().optional() })).describe("Goals to register (text + optional quantitative condition)")
+    }
+  }, async ({ goals }) => {
+    setGoals(goals);
+    return { content: [{ type: "text", text: JSON.stringify(goalStatus()) }] };
+  });
+  server.registerTool("prove_goal", {
+    title: "Mark a goal met with evidence",
+    description: "GOALS: mark a goal met, citing the evidence that proved it + a reason. Before proving a goal with a QUANTITATIVE condition, verify the measured value (coverage %, findings count, privilege) actually meets it — never stamp a goal met early. When the last pending goal is proven, the task is complete.",
+    inputSchema: {
+      id: string2().describe("Goal id (G-XXX) from goal_status"),
+      evidence: string2().describe("Evidence id / artifact that proved this goal (e.g. finding id, coverage value)"),
+      reason: string2().describe("Why this goal is met")
+    }
+  }, async ({ id, evidence, reason }) => {
+    const r = proveGoal(id, evidence, reason);
+    return { content: [{ type: "text", text: JSON.stringify({ ...r, ...goalStatus() }) }] };
+  });
+  server.registerTool("goal_status", {
+    title: "List goals + completion state",
+    description: "GOALS: return every goal with its status + all_met flag (true when every goal is met — the task's completion signal). Check this before declaring the engagement complete; any pending goal means the work is not done.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(goalStatus()) }] };
+  });
   server.registerTool("hunting_doctrine", {
     title: "High-ROI hunting doctrine (sibling rule, A→B, follow-the-money)",
     description: "Return the hunting doctrine — the high-ROI heuristics the agent applies while selecting targets/endpoints/classes: the Sibling Rule (check every sibling endpoint — ~30% of paid IDOR/auth bugs), A→B Signal Method, impact-first, follow-the-money, less-saturated classes, new==unreviewed, two-account IDOR test, PoC escalation, credential-proof, CI/CD + SAML/SSO attack surface, 20-minute rotation, plus the always-rejected kill-list. Use when deciding WHAT to hunt next.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.172",
+  "version": "2.4.173",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {