blitzstrike 2.4.177 → 2.4.179

package/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.179] — 2026-10-11
+
+### Added — WordPress P1-P6 vulnerability pattern taxonomy
+
+- `intelligence/frameworks.json` (id=wordpress) now carries a `patterns` taxonomy:
+  P1 RCE, P2 arbitrary file upload, P3 unauthenticated account takeover, P4
+  unauthenticated password reset, P5 privilege escalation, P6 AJAX/REST
+  authorization failure — each with source signals, detect (what to trace),
+  fixed (the correct control), and anchor WPVDB record ids.
+- `frameworkProfile()` exposes `patterns`; `framework_intel` returns them.
+
+## [2.4.178] — 2026-10-11
+
+### Added — goal decomposition (six-phase plan)
+
+- New `decompose_goal` tool: decompose a high-level goal into the standard
+  six-phase sub-goal plan (ENUMERATION → SURFACE → DISCOVERY → VERIFICATION →
+  ESCALATION → REPORT), each with its own quantitative condition. `goal_tree`
+  shows the parent → sub-goal hierarchy and per-parent progress.
+
 ## [2.4.177] — 2026-10-11
 
 ### Added — surface coverage tracker (quantitative progress)

package/dist/index.js

@@ -63938,15 +63938,36 @@ function nextId2() {
   counter2 += 1;
   return `G-${String(counter2).padStart(3, "0")}`;
 }
+var STANDARD_SUBGOALS = [
+  { text: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
+  { text: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
+  { text: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
+  { text: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
+  { text: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
+  { text: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
+];
 function setGoals(texts) {
   for (const t of texts) {
     const text = typeof t === "string" ? t : t.text;
     const condition = typeof t === "string" ? undefined : t.condition;
+    const parent_id = typeof t === "string" ? undefined : t.parent_id;
     const now = new Date().toISOString();
-    goals.push({ id: nextId2(), text, condition, status: "pending", created: now, updated: now });
+    goals.push({ id: nextId2(), text, condition, status: "pending", ...parent_id ? { parent_id } : {}, created: now, updated: now });
   }
   return [...goals];
 }
+function decomposeGoal(text) {
+  const now = new Date().toISOString();
+  const parent = { id: nextId2(), text, status: "pending", created: now, updated: now };
+  goals.push(parent);
+  const sub_goals = [];
+  for (const sg of STANDARD_SUBGOALS) {
+    const g = { id: nextId2(), text: sg.text, condition: sg.condition, status: "pending", parent_id: parent.id, created: now, updated: now };
+    goals.push(g);
+    sub_goals.push(g);
+  }
+  return { parent, sub_goals };
+}
 function proveGoal(id, evidence, reason) {
   const g = goals.find((x) => x.id === id);
   if (!g)
@@ -63961,6 +63982,13 @@ function goalStatus() {
   const met = goals.filter((g) => g.status === "met").length;
   return { goals: [...goals], all_met: goals.length > 0 && met === goals.length, met, total: goals.length };
 }
+function goalTree() {
+  const parents = goals.filter((g) => !g.parent_id);
+  return parents.map((p) => {
+    const children = goals.filter((g) => g.parent_id === p.id);
+    return { parent: p, children, children_met: children.filter((c) => c.status === "met").length };
+  });
+}
 
 // src/facts.ts
 var facts = [];
@@ -66024,6 +66052,23 @@ ${statusLine}` : statusLine },
   }, async () => {
     return { content: [{ type: "text", text: JSON.stringify(goalStatus()) }] };
   });
+  server.registerTool("decompose_goal", {
+    title: "Decompose a high-level goal into the six-phase plan",
+    description: "GOALS: decompose a high-level goal (e.g. 'audit app.example.com') into the standard six-phase sub-goal plan — ENUMERATION → SURFACE → DISCOVERY → VERIFICATION → ESCALATION → REPORT — each registered in the ledger with its own condition (pending). Returns the parent + sub-goals. Then prove each sub-goal with prove_goal as it completes; the task is done only when all are met.",
+    inputSchema: {
+      goal: string2().describe("The high-level goal to decompose")
+    }
+  }, async ({ goal }) => {
+    const r = decomposeGoal(goal);
+    return { content: [{ type: "text", text: JSON.stringify({ ...r, ...goalStatus() }) }] };
+  });
+  server.registerTool("goal_tree", {
+    title: "View the goal hierarchy (parents + sub-goals)",
+    description: "GOALS: return the goal tree — each top-level goal with its sub-goals and how many of each are met. Use to see progress through a decomposed plan.",
+    inputSchema: {}
+  }, async () => {
+    return { content: [{ type: "text", text: JSON.stringify(goalTree()) }] };
+  });
   server.registerTool("record_fact", {
     title: "Record an exploration observation (fact)",
     description: "FACTS: record an observation/conclusion that is NOT a vuln (finding_create) and NOT an asset (asset_discovery) — e.g. 'admin panel is behind SSO', 'upload strips .php', 'param id is reflected'. Pass text, confidence (observed = you triggered it; inferred = deduced from a fingerprint/diff — never report inferred as confirmed), optional target, and optional parent_ids (facts this derives from). Use this so negative/neutral observations are written down instead of lost.",
@@ -67154,7 +67199,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("framework_intel", {
     title: "Framework security knowledge",
-    description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware) and optionally scan code with those patterns.",
+    description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware, and — for WordPress — the P1-P6 vulnerability pattern taxonomy: RCE / upload / ATO / reset / priv-esc / AJAX-REST-authz, each with signals, detect, fixed, and anchor WPVDB ids) and optionally scan code with those patterns.",
     inputSchema: {
       framework: string2().describe("Framework id (see list_frameworks)"),
       code: string2().optional().describe("Optional source code to scan with the framework's patterns")

package/intelligence/frameworks.json

@@ -576,6 +576,135 @@
           "pattern": "plugins_loaded",
           "label": "plugin lifecycle"
         }
+      ],
+      "patterns": [
+        {
+          "id": "P1",
+          "name": "Remote code execution",
+          "signals": [
+            "dynamic callbacks/templates",
+            "generated PHP",
+            "command/process functions",
+            "executable writes"
+          ],
+          "detect": [
+            "eval",
+            "assert",
+            "variable functions",
+            "call_user_func*",
+            "shell/process APIs",
+            "include paths",
+            "generated PHP",
+            "executable writes"
+          ],
+          "fixed": "closed allow-list, least-privilege gate, no request input in generated/evaluated PHP",
+          "anchors": [
+            "69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f",
+            "df32569a-e4fe-430b-8310-df7be80d7249",
+            "9bb1a4ca-976c-461d-82de-8a3b04a56fbc"
+          ]
+        },
+        {
+          "id": "P2",
+          "name": "Arbitrary file upload",
+          "signals": [
+            "$_FILES",
+            "remote import",
+            "base64 file content",
+            "move_uploaded_file",
+            "wp_handle_upload",
+            "custom directories"
+          ],
+          "detect": [
+            "local filesystem upload",
+            "WordPress media upload",
+            "remote-fetch/local-copy",
+            "third-party storage (confused-deputy)"
+          ],
+          "fixed": "auth/capability + nonce (CSRF only) + server-derived dest + normalized name + extension+MIME+content allow-list + executable denial",
+          "anchors": [
+            "e424157e-b79f-4000-8dcc-51413581fdec",
+            "043f449f-fc65-4218-83d2-7742e62f2af3",
+            "110db433-01ec-47ea-b74f-c3faa1757a3c"
+          ]
+        },
+        {
+          "id": "P3",
+          "name": "Unauthenticated account takeover",
+          "signals": [
+            "weak SSO/payment callbacks",
+            "QR/OTP login",
+            "auto-login helpers",
+            "selected user IDs/emails",
+            "bad signatures",
+            "wp_set_auth_cookie"
+          ],
+          "detect": [
+            "all paths to session establishment",
+            "identity lookup"
+          ],
+          "fixed": "verify canonical provider signatures, bind state/code to one account+flow, short expiry/one-time/attempts+rate limits",
+          "anchors": [
+            "6576dcd1-aea6-47c0-9157-4ca56f426612",
+            "d9f1b40f-526a-44ed-a3ec-a3c1ce0f1ece",
+            "56fdcba6-c7b1-443d-9f9d-b738ecaadabc"
+          ]
+        },
+        {
+          "id": "P4",
+          "name": "Unauthenticated password reset",
+          "signals": [
+            "public reset routes",
+            "request-selected account/key/password/email-body data"
+          ],
+          "detect": [
+            "core/custom reset APIs",
+            "mail-body filters"
+          ],
+          "fixed": "expiring one-time server key bound to account + core validation + trusted reset URL/body",
+          "anchors": [
+            "79fa8b91-f88e-4249-9f17-9e98e879f6fa",
+            "6c2d4489-de82-472d-a5f7-dc01b305fdd0"
+          ]
+        },
+        {
+          "id": "P5",
+          "name": "Privilege escalation",
+          "signals": [
+            "client-controlled role/capabilities/custom meta/options",
+            "user insertion/update",
+            "restore auto-login"
+          ],
+          "detect": [
+            "requests into user/role/cap/meta/option/import/restore mutations"
+          ],
+          "fixed": "server-side field allow-list, discard public role/capability metadata, operation-specific capability, prohibit arbitrary option names",
+          "anchors": [
+            "04d64797-751a-4cdd-a37d-70afbad5d784",
+            "929f243b-2f1c-4eca-88bc-03b1a86270ed",
+            "be3d5432-8f8c-4d45-b6e7-de24352378a8"
+          ]
+        },
+        {
+          "id": "P6",
+          "name": "AJAX/REST authorization failure",
+          "signals": [
+            "wp_ajax_nopriv_*",
+            "both auth states",
+            "public REST permissions",
+            "public/shared nonce",
+            "role check without ownership"
+          ],
+          "detect": [
+            "every AJAX/REST/admin-post registration -> callback, permissions, request-selected IDs, sink"
+          ],
+          "fixed": "nonce (CSRF) + authentication (identity) + current_user_can (authority) + object policy (ownership)",
+          "anchors": [
+            "030939ee-9aa9-4082-934e-c9a07fc3dfc3",
+            "c81aa489-0663-40b7-b2ce-f4c8f2edd4b6",
+            "e31c9bf0-7340-4bd7-ad6e-6ad01737654a"
+          ]
+        }
       ]
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.177",
+  "version": "2.4.179",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {