blitzstrike 2.4.175 → 2.4.177

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.177] — 2026-10-11
+
+### Added — surface coverage tracker (quantitative progress)
+
+- New `surface-coverage` engine + 3 tools: `surface_add` (register a discovered
+  endpoint/param/host/subdomain/route/class), `surface_verdict` (mark a terminal
+  verdict: confirmed/dead/partial/skipped), and `coverage` (total/terminal/pending
+  + coverage % + by-kind/by-verdict breakdown).
+- Gives the agent a measurable "how done are we" number — a goal like
+  "coverage >= 80%" is now verifiable against the measured pct before prove_goal.
+
+## [2.4.176] — 2026-10-11
+
+### Added — retest context (completes the retest loop)
+
+- New `retest_context` tool: given a confirmed/still_vulnerable/inconclusive
+  finding, return everything needed to re-verify it — finding key fields, PoC
+  evidence grouped by role (proof/baseline/verification) + reproducible flag,
+  the active operation constraints, and the current goal state.
+
 ## [2.4.175] — 2026-10-11
 
 ### Added — evidence roles (structured proof/baseline/verification/supporting)

package/dist/index.js

@@ -64006,6 +64006,59 @@ function lineage(id) {
   return { fact, ancestors, descendants };
 }
 
+// src/surface-coverage.ts
+var surface = [];
+var counter4 = 0;
+function nextId4() {
+  counter4 += 1;
+  return `SRF-${String(counter4).padStart(4, "0")}`;
+}
+function surfaceAdd(kind, ref) {
+  const existing = surface.find((s) => s.kind === kind && s.ref === ref);
+  if (existing)
+    return existing;
+  const item = { id: nextId4(), kind, ref, verdict: null, updated: new Date().toISOString() };
+  surface.push(item);
+  return item;
+}
+function surfaceVerdict(idOrRef, verdict) {
+  const item = surface.find((s) => s.id === idOrRef || s.ref === idOrRef);
+  if (!item)
+    return { ok: false, error: `no surface item '${idOrRef}'` };
+  item.verdict = verdict;
+  item.updated = new Date().toISOString();
+  return { ok: true, item: { ...item } };
+}
+function coverageSummary() {
+  const by_kind = {
+    endpoint: { total: 0, terminal: 0 },
+    param: { total: 0, terminal: 0 },
+    host: { total: 0, terminal: 0 },
+    subdomain: { total: 0, terminal: 0 },
+    route: { total: 0, terminal: 0 },
+    class: { total: 0, terminal: 0 }
+  };
+  const by_verdict = { confirmed: 0, dead: 0, partial: 0, skipped: 0 };
+  let terminal = 0;
+  for (const s of surface) {
+    by_kind[s.kind].total += 1;
+    if (s.verdict) {
+      terminal += 1;
+      by_kind[s.kind].terminal += 1;
+      by_verdict[s.verdict] += 1;
+    }
+  }
+  const total = surface.length;
+  return {
+    total,
+    terminal,
+    pending: total - terminal,
+    pct: total === 0 ? 0 : Math.round(terminal / total * 1000) / 10,
+    by_kind,
+    by_verdict
+  };
+}
+
 // src/sibling-scan.ts
 var SIBLING_SUFFIXES = [
   "export",
@@ -66000,6 +66053,35 @@ ${statusLine}` : statusLine },
   }, async ({ id }) => {
     return { content: [{ type: "text", text: JSON.stringify(lineage(id)) }] };
   });
+  server.registerTool("surface_add", {
+    title: "Register a discovered attack-surface item",
+    description: "COVERAGE: register a discovered surface item (endpoint/param/host/subdomain/route/class) so the coverage tracker can measure progress. Deduped by kind+ref. Pair with surface_verdict (mark terminal verdict) and coverage (the % done). Use every time recon/param_surface/asset_discovery surfaces a new endpoint, param, host, or class.",
+    inputSchema: {
+      kind: _enum(["endpoint", "param", "host", "subdomain", "route", "class"]).describe("What kind of surface item"),
+      ref: string2().describe("The endpoint/param/host/etc. (e.g. '/api/users', 'id', 'app.example.com')")
+    }
+  }, async ({ kind, ref }) => {
+    const item = surfaceAdd(kind, ref);
+    return { content: [{ type: "text", text: JSON.stringify({ ...item, ...coverageSummary() }) }] };
+  });
+  server.registerTool("surface_verdict", {
+    title: "Mark a terminal verdict on a surface item",
+    description: "COVERAGE: mark a surface item's terminal verdict — confirmed (a verified finding), dead (tested + disproved/blocked), partial (tested, some shapes remain), or skipped (out of scope / tool blocked). An item stays PENDING until it has a verdict; pending items drag the coverage % down. Accepts the item id (SRF-XXXX) or its ref.",
+    inputSchema: {
+      id_or_ref: string2().describe("Surface item id (SRF-XXXX) or its ref"),
+      verdict: _enum(["confirmed", "dead", "partial", "skipped"]).describe("Terminal verdict")
+    }
+  }, async ({ id_or_ref, verdict }) => {
+    const r = surfaceVerdict(id_or_ref, verdict);
+    return { content: [{ type: "text", text: JSON.stringify({ ...r, ...coverageSummary() }) }] };
+  });
+  server.registerTool("coverage", {
+    title: "Coverage % of the discovered attack surface",
+    description: "COVERAGE: return the quantitative progress — total surface items, how many have a terminal verdict, coverage % (terminal/total), pending count, and the breakdown by kind and by verdict. Check this before proving a goal like 'coverage >= 80%'; a goal with a quantitative condition must be checked against this measured pct before prove_goal.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(coverageSummary()) }] };
+  });
   server.registerTool("hunting_doctrine", {
     title: "High-ROI hunting doctrine (sibling rule, A→B, follow-the-money)",
     description: "Return the hunting doctrine — the high-ROI heuristics the agent applies while selecting targets/endpoints/classes: the Sibling Rule (check every sibling endpoint — ~30% of paid IDOR/auth bugs), A→B Signal Method, impact-first, follow-the-money, less-saturated classes, new==unreviewed, two-account IDOR test, PoC escalation, credential-proof, CI/CD + SAML/SSO attack surface, 20-minute rotation, plus the always-rejected kill-list. Use when deciding WHAT to hunt next.",
@@ -66811,6 +66893,48 @@ ${statusLine}` : statusLine },
     ].filter(Boolean);
     return { content: [{ type: "text", text: JSON.stringify({ ...roles, missing: missing.length ? missing : undefined, hint: roles.reproducible ? "reproducible — evidence complete" : "NOT reproducible — attach the missing roles via finding_attach_evidence" }) }] };
   });
+  server.registerTool("retest_context", {
+    title: "Build the retest context for a confirmed finding",
+    description: "RETEST: given a CONFIRMED (or still_vulnerable/inconclusive) finding, return everything needed to re-verify it in one shot: the finding's key fields (target/method/param/severity), its PoC evidence grouped by role (proof/baseline/verification) + reproducible flag, the active operation constraints (red lines), and the current goal state. Then re-run the proof request and record the verdict with retest_finding.",
+    inputSchema: {
+      finding: string2().describe("JSON of the Finding object to retest")
+    }
+  }, async ({ finding }) => {
+    let f;
+    try {
+      f = JSON.parse(finding);
+    } catch {
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid finding JSON" }) }] };
+    }
+    const ev = f.evidence ?? [];
+    const roles = evidenceRoles(ev);
+    const byRole = { proof: [], baseline: [], verification: [], supporting: [] };
+    for (const e of ev)
+      byRole[e.role].push({ evidence_id: e.evidence_id, type: e.type, description: e.description, artifacts: e.artifacts.map((a) => a.name) });
+    const missing = ["proof", "baseline", "verification"].filter((r) => !roles[r]);
+    const goals = goalStatus();
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          finding: {
+            id: f.id,
+            status: f.status,
+            title: f.title,
+            severity: f.classification?.severity,
+            cwe: f.classification?.cwe,
+            target: f.target,
+            method: f.target?.method,
+            param: f.target?.param
+          },
+          poc: { ...byRole, reproducible: roles.reproducible, missing: missing.length ? missing : undefined },
+          constraints: listConstraints(),
+          goals: { all_met: goals.all_met, met: goals.met, total: goals.total },
+          retest_hint: "Re-run the proof request (or the original PoC path) against the CURRENT target. Still reproduces → retest_finding(verdict=still_vulnerable); no longer reproduces → fixed; a blocker (WAF/target down/missing login) prevents a verdict → inconclusive."
+        })
+      }]
+    };
+  });
   server.registerTool("redact", {
     title: "Redact secrets from text",
     description: "EVIDENCE: redact passwords/API keys/tokens/cookies/private keys from text before persisting evidence or reporting.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.175",
+  "version": "2.4.177",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {