blitzstrike 2.4.176 → 2.4.178

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.178] — 2026-10-11
+
+### Added — goal decomposition (six-phase plan)
+
+- New `decompose_goal` tool: decompose a high-level goal into the standard
+  six-phase sub-goal plan (ENUMERATION → SURFACE → DISCOVERY → VERIFICATION →
+  ESCALATION → REPORT), each with its own quantitative condition. `goal_tree`
+  shows the parent → sub-goal hierarchy and per-parent progress.
+
+## [2.4.177] — 2026-10-11
+
+### Added — surface coverage tracker (quantitative progress)
+
+- New `surface-coverage` engine + 3 tools: `surface_add` (register a discovered
+  endpoint/param/host/subdomain/route/class), `surface_verdict` (mark a terminal
+  verdict: confirmed/dead/partial/skipped), and `coverage` (total/terminal/pending
+  + coverage % + by-kind/by-verdict breakdown).
+- Gives the agent a measurable "how done are we" number — a goal like
+  "coverage >= 80%" is now verifiable against the measured pct before prove_goal.
+
 ## [2.4.176] — 2026-10-11
 
 ### Added — retest context (completes the retest loop)

package/dist/index.js

@@ -63938,15 +63938,36 @@ function nextId2() {
   counter2 += 1;
   return `G-${String(counter2).padStart(3, "0")}`;
 }
+var STANDARD_SUBGOALS = [
+  { text: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
+  { text: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
+  { text: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
+  { text: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
+  { text: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
+  { text: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
+];
 function setGoals(texts) {
   for (const t of texts) {
     const text = typeof t === "string" ? t : t.text;
     const condition = typeof t === "string" ? undefined : t.condition;
+    const parent_id = typeof t === "string" ? undefined : t.parent_id;
     const now = new Date().toISOString();
-    goals.push({ id: nextId2(), text, condition, status: "pending", created: now, updated: now });
+    goals.push({ id: nextId2(), text, condition, status: "pending", ...parent_id ? { parent_id } : {}, created: now, updated: now });
   }
   return [...goals];
 }
+function decomposeGoal(text) {
+  const now = new Date().toISOString();
+  const parent = { id: nextId2(), text, status: "pending", created: now, updated: now };
+  goals.push(parent);
+  const sub_goals = [];
+  for (const sg of STANDARD_SUBGOALS) {
+    const g = { id: nextId2(), text: sg.text, condition: sg.condition, status: "pending", parent_id: parent.id, created: now, updated: now };
+    goals.push(g);
+    sub_goals.push(g);
+  }
+  return { parent, sub_goals };
+}
 function proveGoal(id, evidence, reason) {
   const g = goals.find((x) => x.id === id);
   if (!g)
@@ -63961,6 +63982,13 @@ function goalStatus() {
   const met = goals.filter((g) => g.status === "met").length;
   return { goals: [...goals], all_met: goals.length > 0 && met === goals.length, met, total: goals.length };
 }
+function goalTree() {
+  const parents = goals.filter((g) => !g.parent_id);
+  return parents.map((p) => {
+    const children = goals.filter((g) => g.parent_id === p.id);
+    return { parent: p, children, children_met: children.filter((c) => c.status === "met").length };
+  });
+}
 
 // src/facts.ts
 var facts = [];
@@ -64006,6 +64034,59 @@ function lineage(id) {
   return { fact, ancestors, descendants };
 }
 
+// src/surface-coverage.ts
+var surface = [];
+var counter4 = 0;
+function nextId4() {
+  counter4 += 1;
+  return `SRF-${String(counter4).padStart(4, "0")}`;
+}
+function surfaceAdd(kind, ref) {
+  const existing = surface.find((s) => s.kind === kind && s.ref === ref);
+  if (existing)
+    return existing;
+  const item = { id: nextId4(), kind, ref, verdict: null, updated: new Date().toISOString() };
+  surface.push(item);
+  return item;
+}
+function surfaceVerdict(idOrRef, verdict) {
+  const item = surface.find((s) => s.id === idOrRef || s.ref === idOrRef);
+  if (!item)
+    return { ok: false, error: `no surface item '${idOrRef}'` };
+  item.verdict = verdict;
+  item.updated = new Date().toISOString();
+  return { ok: true, item: { ...item } };
+}
+function coverageSummary() {
+  const by_kind = {
+    endpoint: { total: 0, terminal: 0 },
+    param: { total: 0, terminal: 0 },
+    host: { total: 0, terminal: 0 },
+    subdomain: { total: 0, terminal: 0 },
+    route: { total: 0, terminal: 0 },
+    class: { total: 0, terminal: 0 }
+  };
+  const by_verdict = { confirmed: 0, dead: 0, partial: 0, skipped: 0 };
+  let terminal = 0;
+  for (const s of surface) {
+    by_kind[s.kind].total += 1;
+    if (s.verdict) {
+      terminal += 1;
+      by_kind[s.kind].terminal += 1;
+      by_verdict[s.verdict] += 1;
+    }
+  }
+  const total = surface.length;
+  return {
+    total,
+    terminal,
+    pending: total - terminal,
+    pct: total === 0 ? 0 : Math.round(terminal / total * 1000) / 10,
+    by_kind,
+    by_verdict
+  };
+}
+
 // src/sibling-scan.ts
 var SIBLING_SUFFIXES = [
   "export",
@@ -65971,6 +66052,23 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(goalStatus()) }] };
   });
+  server.registerTool("decompose_goal", {
+    title: "Decompose a high-level goal into the six-phase plan",
+    description: "GOALS: decompose a high-level goal (e.g. 'audit app.example.com') into the standard six-phase sub-goal plan — ENUMERATION → SURFACE → DISCOVERY → VERIFICATION → ESCALATION → REPORT — each registered in the ledger with its own condition (pending). Returns the parent + sub-goals. Then prove each sub-goal with prove_goal as it completes; the task is done only when all are met.",
+    inputSchema: {
+      goal: string2().describe("The high-level goal to decompose")
+    }
+  }, async ({ goal }) => {
+    const r = decomposeGoal(goal);
+    return { content: [{ type: "text", text: JSON.stringify({ ...r, ...goalStatus() }) }] };
+  });
+  server.registerTool("goal_tree", {
+    title: "View the goal hierarchy (parents + sub-goals)",
+    description: "GOALS: return the goal tree — each top-level goal with its sub-goals and how many of each are met. Use to see progress through a decomposed plan.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(goalTree()) }] };
+  });
   server.registerTool("record_fact", {
     title: "Record an exploration observation (fact)",
     description: "FACTS: record an observation/conclusion that is NOT a vuln (finding_create) and NOT an asset (asset_discovery) — e.g. 'admin panel is behind SSO', 'upload strips .php', 'param id is reflected'. Pass text, confidence (observed = you triggered it; inferred = deduced from a fingerprint/diff — never report inferred as confirmed), optional target, and optional parent_ids (facts this derives from). Use this so negative/neutral observations are written down instead of lost.",
@@ -66000,6 +66098,35 @@ ${statusLine}` : statusLine },
   }, async ({ id }) => {
     return { content: [{ type: "text", text: JSON.stringify(lineage(id)) }] };
   });
+  server.registerTool("surface_add", {
+    title: "Register a discovered attack-surface item",
+    description: "COVERAGE: register a discovered surface item (endpoint/param/host/subdomain/route/class) so the coverage tracker can measure progress. Deduped by kind+ref. Pair with surface_verdict (mark terminal verdict) and coverage (the % done). Use every time recon/param_surface/asset_discovery surfaces a new endpoint, param, host, or class.",
+    inputSchema: {
+      kind: _enum(["endpoint", "param", "host", "subdomain", "route", "class"]).describe("What kind of surface item"),
+      ref: string2().describe("The endpoint/param/host/etc. (e.g. '/api/users', 'id', 'app.example.com')")
+    }
+  }, async ({ kind, ref }) => {
+    const item = surfaceAdd(kind, ref);
+    return { content: [{ type: "text", text: JSON.stringify({ ...item, ...coverageSummary() }) }] };
+  });
+  server.registerTool("surface_verdict", {
+    title: "Mark a terminal verdict on a surface item",
+    description: "COVERAGE: mark a surface item's terminal verdict — confirmed (a verified finding), dead (tested + disproved/blocked), partial (tested, some shapes remain), or skipped (out of scope / tool blocked). An item stays PENDING until it has a verdict; pending items drag the coverage % down. Accepts the item id (SRF-XXXX) or its ref.",
+    inputSchema: {
+      id_or_ref: string2().describe("Surface item id (SRF-XXXX) or its ref"),
+      verdict: _enum(["confirmed", "dead", "partial", "skipped"]).describe("Terminal verdict")
+    }
+  }, async ({ id_or_ref, verdict }) => {
+    const r = surfaceVerdict(id_or_ref, verdict);
+    return { content: [{ type: "text", text: JSON.stringify({ ...r, ...coverageSummary() }) }] };
+  });
+  server.registerTool("coverage", {
+    title: "Coverage % of the discovered attack surface",
+    description: "COVERAGE: return the quantitative progress — total surface items, how many have a terminal verdict, coverage % (terminal/total), pending count, and the breakdown by kind and by verdict. Check this before proving a goal like 'coverage >= 80%'; a goal with a quantitative condition must be checked against this measured pct before prove_goal.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(coverageSummary()) }] };
+  });
   server.registerTool("hunting_doctrine", {
     title: "High-ROI hunting doctrine (sibling rule, A→B, follow-the-money)",
     description: "Return the hunting doctrine — the high-ROI heuristics the agent applies while selecting targets/endpoints/classes: the Sibling Rule (check every sibling endpoint — ~30% of paid IDOR/auth bugs), A→B Signal Method, impact-first, follow-the-money, less-saturated classes, new==unreviewed, two-account IDOR test, PoC escalation, credential-proof, CI/CD + SAML/SSO attack surface, 20-minute rotation, plus the always-rejected kill-list. Use when deciding WHAT to hunt next.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.176",
+  "version": "2.4.178",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {