blitzstrike 2.4.176 → 2.4.177

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.177] — 2026-10-11
+
+### Added — surface coverage tracker (quantitative progress)
+
+- New `surface-coverage` engine + 3 tools: `surface_add` (register a discovered
+  endpoint/param/host/subdomain/route/class), `surface_verdict` (mark a terminal
+  verdict: confirmed/dead/partial/skipped), and `coverage` (total/terminal/pending
+  + coverage % + by-kind/by-verdict breakdown).
+- Gives the agent a measurable "how done are we" number — a goal like
+  "coverage >= 80%" is now verifiable against the measured pct before prove_goal.
+
 ## [2.4.176] — 2026-10-11
 
 ### Added — retest context (completes the retest loop)

package/dist/index.js

@@ -64006,6 +64006,59 @@ function lineage(id) {
   return { fact, ancestors, descendants };
 }
 
+// src/surface-coverage.ts
+var surface = [];
+var counter4 = 0;
+function nextId4() {
+  counter4 += 1;
+  return `SRF-${String(counter4).padStart(4, "0")}`;
+}
+function surfaceAdd(kind, ref) {
+  const existing = surface.find((s) => s.kind === kind && s.ref === ref);
+  if (existing)
+    return existing;
+  const item = { id: nextId4(), kind, ref, verdict: null, updated: new Date().toISOString() };
+  surface.push(item);
+  return item;
+}
+function surfaceVerdict(idOrRef, verdict) {
+  const item = surface.find((s) => s.id === idOrRef || s.ref === idOrRef);
+  if (!item)
+    return { ok: false, error: `no surface item '${idOrRef}'` };
+  item.verdict = verdict;
+  item.updated = new Date().toISOString();
+  return { ok: true, item: { ...item } };
+}
+function coverageSummary() {
+  const by_kind = {
+    endpoint: { total: 0, terminal: 0 },
+    param: { total: 0, terminal: 0 },
+    host: { total: 0, terminal: 0 },
+    subdomain: { total: 0, terminal: 0 },
+    route: { total: 0, terminal: 0 },
+    class: { total: 0, terminal: 0 }
+  };
+  const by_verdict = { confirmed: 0, dead: 0, partial: 0, skipped: 0 };
+  let terminal = 0;
+  for (const s of surface) {
+    by_kind[s.kind].total += 1;
+    if (s.verdict) {
+      terminal += 1;
+      by_kind[s.kind].terminal += 1;
+      by_verdict[s.verdict] += 1;
+    }
+  }
+  const total = surface.length;
+  return {
+    total,
+    terminal,
+    pending: total - terminal,
+    pct: total === 0 ? 0 : Math.round(terminal / total * 1000) / 10,
+    by_kind,
+    by_verdict
+  };
+}
+
 // src/sibling-scan.ts
 var SIBLING_SUFFIXES = [
   "export",
@@ -66000,6 +66053,35 @@ ${statusLine}` : statusLine },
   }, async ({ id }) => {
     return { content: [{ type: "text", text: JSON.stringify(lineage(id)) }] };
   });
+  server.registerTool("surface_add", {
+    title: "Register a discovered attack-surface item",
+    description: "COVERAGE: register a discovered surface item (endpoint/param/host/subdomain/route/class) so the coverage tracker can measure progress. Deduped by kind+ref. Pair with surface_verdict (mark terminal verdict) and coverage (the % done). Use every time recon/param_surface/asset_discovery surfaces a new endpoint, param, host, or class.",
+    inputSchema: {
+      kind: _enum(["endpoint", "param", "host", "subdomain", "route", "class"]).describe("What kind of surface item"),
+      ref: string2().describe("The endpoint/param/host/etc. (e.g. '/api/users', 'id', 'app.example.com')")
+    }
+  }, async ({ kind, ref }) => {
+    const item = surfaceAdd(kind, ref);
+    return { content: [{ type: "text", text: JSON.stringify({ ...item, ...coverageSummary() }) }] };
+  });
+  server.registerTool("surface_verdict", {
+    title: "Mark a terminal verdict on a surface item",
+    description: "COVERAGE: mark a surface item's terminal verdict — confirmed (a verified finding), dead (tested + disproved/blocked), partial (tested, some shapes remain), or skipped (out of scope / tool blocked). An item stays PENDING until it has a verdict; pending items drag the coverage % down. Accepts the item id (SRF-XXXX) or its ref.",
+    inputSchema: {
+      id_or_ref: string2().describe("Surface item id (SRF-XXXX) or its ref"),
+      verdict: _enum(["confirmed", "dead", "partial", "skipped"]).describe("Terminal verdict")
+    }
+  }, async ({ id_or_ref, verdict }) => {
+    const r = surfaceVerdict(id_or_ref, verdict);
+    return { content: [{ type: "text", text: JSON.stringify({ ...r, ...coverageSummary() }) }] };
+  });
+  server.registerTool("coverage", {
+    title: "Coverage % of the discovered attack surface",
+    description: "COVERAGE: return the quantitative progress — total surface items, how many have a terminal verdict, coverage % (terminal/total), pending count, and the breakdown by kind and by verdict. Check this before proving a goal like 'coverage >= 80%'; a goal with a quantitative condition must be checked against this measured pct before prove_goal.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(coverageSummary()) }] };
+  });
   server.registerTool("hunting_doctrine", {
     title: "High-ROI hunting doctrine (sibling rule, A→B, follow-the-money)",
     description: "Return the hunting doctrine — the high-ROI heuristics the agent applies while selecting targets/endpoints/classes: the Sibling Rule (check every sibling endpoint — ~30% of paid IDOR/auth bugs), A→B Signal Method, impact-first, follow-the-money, less-saturated classes, new==unreviewed, two-account IDOR test, PoC escalation, credential-proof, CI/CD + SAML/SSO attack surface, 20-minute rotation, plus the always-rejected kill-list. Use when deciding WHAT to hunt next.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.176",
+  "version": "2.4.177",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {