blitzstrike 2.4.175 → 2.4.176

package/CHANGELOG.md

@@ -5,6 +5,15 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.176] — 2026-10-11
+
+### Added — retest context (completes the retest loop)
+
+- New `retest_context` tool: given a confirmed/still_vulnerable/inconclusive
+  finding, return everything needed to re-verify it — finding key fields, PoC
+  evidence grouped by role (proof/baseline/verification) + reproducible flag,
+  the active operation constraints, and the current goal state.
+
 ## [2.4.175] — 2026-10-11
 
 ### Added — evidence roles (structured proof/baseline/verification/supporting)

package/dist/index.js

@@ -66811,6 +66811,48 @@ ${statusLine}` : statusLine },
     ].filter(Boolean);
     return { content: [{ type: "text", text: JSON.stringify({ ...roles, missing: missing.length ? missing : undefined, hint: roles.reproducible ? "reproducible — evidence complete" : "NOT reproducible — attach the missing roles via finding_attach_evidence" }) }] };
   });
+  server.registerTool("retest_context", {
+    title: "Build the retest context for a confirmed finding",
+    description: "RETEST: given a CONFIRMED (or still_vulnerable/inconclusive) finding, return everything needed to re-verify it in one shot: the finding's key fields (target/method/param/severity), its PoC evidence grouped by role (proof/baseline/verification) + reproducible flag, the active operation constraints (red lines), and the current goal state. Then re-run the proof request and record the verdict with retest_finding.",
+    inputSchema: {
+      finding: string2().describe("JSON of the Finding object to retest")
+    }
+  }, async ({ finding }) => {
+    let f;
+    try {
+      f = JSON.parse(finding);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid finding JSON" }) }] };
+    }
+    const ev = f.evidence ?? [];
+    const roles = evidenceRoles(ev);
+    const byRole = { proof: [], baseline: [], verification: [], supporting: [] };
+    for (const e of ev)
+      byRole[e.role].push({ evidence_id: e.evidence_id, type: e.type, description: e.description, artifacts: e.artifacts.map((a) => a.name) });
+    const missing = ["proof", "baseline", "verification"].filter((r) => !roles[r]);
+    const goals = goalStatus();
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          finding: {
+            id: f.id,
+            status: f.status,
+            title: f.title,
+            severity: f.classification?.severity,
+            cwe: f.classification?.cwe,
+            target: f.target,
+            method: f.target?.method,
+            param: f.target?.param
+          },
+          poc: { ...byRole, reproducible: roles.reproducible, missing: missing.length ? missing : undefined },
+          constraints: listConstraints(),
+          goals: { all_met: goals.all_met, met: goals.met, total: goals.total },
+          retest_hint: "Re-run the proof request (or the original PoC path) against the CURRENT target. Still reproduces → retest_finding(verdict=still_vulnerable); no longer reproduces → fixed; a blocker (WAF/target down/missing login) prevents a verdict → inconclusive."
+        })
+      }]
+    };
+  });
   server.registerTool("redact", {
     title: "Redact secrets from text",
     description: "EVIDENCE: redact passwords/API keys/tokens/cookies/private keys from text before persisting evidence or reporting.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.175",
+  "version": "2.4.176",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {