blitzstrike 2.4.178 → 2.4.180

package/CHANGELOG.md

@@ -5,6 +5,39 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.180] — 2026-10-11
+
+### Changed — goal decomposition corrected (goal = deliverable, not process)
+
+- `decompose_goal` now registers the goal as ONE final deliverable (optional
+  vulnclass) and returns the decomposition rules + the six-phase PROCESS plan as
+  a reference — the process (recon→report) is the HOW and is no longer registered
+  as goals. `goal_set` accepts a `vulnclass` tag.
+
+### Changed — constraint self-containment + out-of-scope fact
+
+- Constraints must be self-contained (replace pronouns with the concrete host/port);
+  a new target discovered outside the constraints is recorded as an out-of-scope
+  fact and skipped, never authorized.
+
+### Added — 4 doctrine rules
+
+- `constraint_self_contained`, `record_is_memory` (write-back is anti-compaction
+  long-term memory — record immediately, only increments), `wrapup_highest_priority`
+  (land conclusions then stop), `high_value_surface` (parsing/charset, upload,
+  (de)serialization, cache race, TOCTOU, type confusion, mass assignment).
+
+## [2.4.179] — 2026-10-11
+
+### Added — WordPress P1-P6 vulnerability pattern taxonomy
+
+- `intelligence/frameworks.json` (id=wordpress) now carries a `patterns` taxonomy:
+  P1 RCE, P2 arbitrary file upload, P3 unauthenticated account takeover, P4
+  unauthenticated password reset, P5 privilege escalation, P6 AJAX/REST
+  authorization failure — each with source signals, detect (what to trace),
+  fixed (the correct control), and anchor WPVDB record ids.
+- `frameworkProfile()` exposes `patterns`; `framework_intel` returns them.
+
 ## [2.4.178] — 2026-10-11
 
 ### Added — goal decomposition (six-phase plan)

package/dist/index.js

@@ -63774,6 +63774,26 @@ var HUNTING_DOCTRINE = [
     id: "observed_vs_inferred",
     title: "Observed vs Inferred — Never Upgrade Inferred to Confirmed",
     rule: "Tag every conclusion with its confidence honestly: OBSERVED (you directly triggered it and hold the request/response or command output) vs INFERRED (you deduced it from a fingerprint/version/diff/phenomenon without actually triggering it). A version/CVE match, a 'looks injectable' param, or a patch-diff inference is INFERRED and must never be reported as a confirmed finding — record it as a hypothesis and verify it live (strike_verify / OOB / a clean oracle) before it can claim confirmed. Disproof is worth as much as proof: an honest dead verdict is a deliverable, an overstated inferred-as-confirmed is a retraction waiting to happen."
+  },
+  {
+    id: "constraint_self_contained",
+    title: "Constraints Are Self-Contained; New Target Outside Them Is Not Authorization",
+    rule: "Every operation constraint MUST be self-contained: replace 'this target' / 'current port' / 'this host' with the CONCRETE host/port/domain, because constraints are injected into later prompts standalone and a pronoun means nothing out of context. And a new target/port/host you discover OUTSIDE the active constraints is NOT authorization: record it as an out-of-scope fact (record_fact, confidence=observed) and skip — never derive an intent or action for it, and never widen a subdomain up to its root domain unless the user explicitly named the whole root."
+  },
+  {
+    id: "record_is_memory",
+    title: "Write-Back Is Your Long-Term Memory — Record Immediately, Only Increments",
+    rule: "Persist every result IMMEDIATELY as you produce it — never accumulate findings in your head or in a scratch note to save for the end (a session can be cut short and everything un-persisted is lost; only what is written down survives). Written records (finding_create / record_fact / surface_add / asset_discovery) are your anti-compaction long-term memory, not just bookkeeping. Write ONLY INCREMENTS: before recording, scan the existing ledger (list_facts / list_findings / coverage) and record only what is NEW — re-wording an existing conclusion just bloats state and misleads you into thinking you made progress. A conclusion that merely corroborates an existing one adds nothing and should not be re-recorded."
+  },
+  {
+    id: "wrapup_highest_priority",
+    title: "Wrap-Up Is the Highest Priority — Land Conclusions, Then Stop",
+    rule: "When you receive a wrap-up/finish signal (or self-judge the goal met / all reasonable routes exhausted), STOP all probing and commands IMMEDIATELY — 'continue exploring / try once more / exhaust this chain / wait for a command result' are all OVERRIDDEN by the wrap-up signal. Land everything still in flight first: write back every un-persisted conclusion (findings, facts, surface verdicts, coverage), then produce a concise plain-language summary of what was achieved, which routes were taken, which findings are confirmed (with PoC locations), and which directions are blocked and why. Report only what was actually done — never pad the wrap-up with unverified 'maybe' leads."
+  },
+  {
+    id: "high_value_surface",
+    title: "High-Value Attack Surface — The Often-Overlooked Faces",
+    rule: "When mapping the attack surface, prioritize these often-overlooked high-value faces (pick what applies, not a checklist obligation): input parsing / encoding / charset boundaries; file upload; (de)serialization; built-in routing + pre-auth-reachable handlers; error-handling leaks; cache poisoning / cache race; race conditions (TOCTOU); type confusion (scalar vs array); and mass assignment. These are where the highest-impact bugs hide when the obvious endpoints come up clean — before declaring a surface exhausted, confirm none of these faces remain untested."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [
@@ -63938,35 +63958,37 @@ function nextId2() {
   counter2 += 1;
   return `G-${String(counter2).padStart(3, "0")}`;
 }
-var STANDARD_SUBGOALS = [
-  { text: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
-  { text: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
-  { text: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
-  { text: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
-  { text: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
-  { text: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
+var PROCESS_PLAN = [
+  { phase: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
+  { phase: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
+  { phase: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
+  { phase: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
+  { phase: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
+  { phase: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
 ];
 function setGoals(texts) {
   for (const t of texts) {
     const text = typeof t === "string" ? t : t.text;
+    const vulnclass = typeof t === "string" ? undefined : t.vulnclass;
     const condition = typeof t === "string" ? undefined : t.condition;
     const parent_id = typeof t === "string" ? undefined : t.parent_id;
     const now = new Date().toISOString();
-    goals.push({ id: nextId2(), text, condition, status: "pending", ...parent_id ? { parent_id } : {}, created: now, updated: now });
+    goals.push({ id: nextId2(), text, status: "pending", ...vulnclass ? { vulnclass } : {}, ...condition ? { condition } : {}, ...parent_id ? { parent_id } : {}, created: now, updated: now });
   }
   return [...goals];
 }
-function decomposeGoal(text) {
+function decomposeGoal(text, vulnclass) {
   const now = new Date().toISOString();
-  const parent = { id: nextId2(), text, status: "pending", created: now, updated: now };
-  goals.push(parent);
-  const sub_goals = [];
-  for (const sg of STANDARD_SUBGOALS) {
-    const g = { id: nextId2(), text: sg.text, condition: sg.condition, status: "pending", parent_id: parent.id, created: now, updated: now };
-    goals.push(g);
-    sub_goals.push(g);
-  }
-  return { parent, sub_goals };
+  const goal = { id: nextId2(), text, status: "pending", ...vulnclass ? { vulnclass } : {}, created: now, updated: now };
+  goals.push(goal);
+  const rules = [
+    "A goal is a FINAL, verifiable deliverable — never a process step (recon/scan/vuln-analysis/attack-step/verification are NOT goals).",
+    "One final result -> one goal; multiple INDEPENDENT deliverables -> separate goals (via goal_set), each with its own vulnclass.",
+    "Never invent a goal the user did not state; tag vulnclass only when the deliverable maps to a clear class.",
+    "Extract operation constraints (set_constraint) BEFORE decomposing; a constraint is self-contained (no pronouns — replace 'this target' with the concrete host/port).",
+    "Minimal scope: only the exact target the user named; never widen a subdomain to its root domain."
+  ];
+  return { goal, rules, process_plan: PROCESS_PLAN };
 }
 function proveGoal(id, evidence, reason) {
   const g = goals.find((x) => x.id === id);
@@ -65976,16 +65998,16 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("constraint_set", {
     title: "Set an operation constraint (red line)",
-    description: "CONSTRAINTS: register an operation allow/deny rule — the HIGHEST-priority red line that bounds WHAT the agent may DO (beyond mere target scope). Pass mode (deny/allow), action (brute_force / scan / enumerate / upload / exploit / write / exfiltrate / dos / social_eng / credential_use / probe / active / *), an optional target glob (host/port/param, * wildcard), and a reason. DENY rules always win. Use 'active' as an umbrella for all active ops; '*' for everything. Then use constraint_check before any action to get a deterministic answer.",
+    description: "CONSTRAINTS: register an operation allow/deny rule — the HIGHEST-priority red line that bounds WHAT the agent may DO (beyond mere target scope). Pass mode (deny/allow), action (brute_force / scan / enumerate / upload / exploit / write / exfiltrate / dos / social_eng / credential_use / probe / active / *), an optional target glob (host/port/param, * wildcard), and a reason. DENY rules always win. Write the target SELF-CONTAINED: replace 'this target/current port' with the CONCRETE host/port — constraints are injected standalone and a pronoun means nothing out of context. Use 'active' as an umbrella for all active ops; '*' for everything. Then use constraint_check before any action.",
     inputSchema: {
       mode: _enum(["deny", "allow"]).describe("deny = forbid this action; allow = explicitly permit it"),
       action: string2().describe("Action: brute_force/scan/enumerate/upload/exploit/write/exfiltrate/dos/social_eng/credential_use/probe/active/*"),
-      target: string2().optional().describe("Optional host/port/param glob (* wildcard); unset = applies to every target"),
+      target: string2().optional().describe("Optional host/port/param glob (* wildcard) — write it self-contained (concrete value, no pronoun); unset = applies to every target"),
       reason: string2().describe("Why this constraint exists")
     }
   }, async ({ mode, action, target, reason }) => {
     const rule = setConstraint({ mode, action, target, reason });
-    return { content: [{ type: "text", text: JSON.stringify({ ...rule, hint: "DENY rules always win. Check before acting with constraint_check." }) }] };
+    return { content: [{ type: "text", text: JSON.stringify({ ...rule, hint: "DENY rules always win. Check before acting with constraint_check. A new target outside these constraints is NOT authorization — record it as an out-of-scope fact and skip." }) }] };
   });
   server.registerTool("constraint_check", {
     title: "Deterministically check whether an action is allowed",
@@ -66024,10 +66046,10 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify({ removed: clearConstraint(id), id }) }] };
   });
   server.registerTool("goal_set", {
-    title: "Register engagement goals",
-    description: "GOALS: register one or more free-text goals (each with an optional quantitative condition like 'coverage >= 80%'). goal_status then tracks which are met; the task is COMPLETE only when all_met is true. Use before planning routes so every route traces back to a goal.",
+    title: "Register final deliverables (goals)",
+    description: "GOALS: register one or more FINAL DELIVERABLES — verifiable results (e.g. 'get RCE', 'read admin PII', 'take over admin'), NOT process steps (recon/scan/analysis/verify are NOT goals). Each goal carries an optional vulnclass (rce/ato/priv-esc/upload/reset/ajax-rest/...) and an optional quantitative condition. goal_status tracks which are met; COMPLETE only when all_met is true.",
     inputSchema: {
-      goals: array(object2({ text: string2(), condition: string2().optional() })).describe("Goals to register (text + optional quantitative condition)")
+      goals: array(object2({ text: string2(), vulnclass: string2().optional(), condition: string2().optional() })).describe("Deliverables to register (text + optional vulnclass + optional quantitative condition)")
     }
   }, async ({ goals }) => {
     setGoals(goals);
@@ -66053,13 +66075,14 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify(goalStatus()) }] };
   });
   server.registerTool("decompose_goal", {
-    title: "Decompose a high-level goal into the six-phase plan",
-    description: "GOALS: decompose a high-level goal (e.g. 'audit app.example.com') into the standard six-phase sub-goal plan — ENUMERATION → SURFACE → DISCOVERY → VERIFICATION → ESCALATION → REPORT — each registered in the ledger with its own condition (pending). Returns the parent + sub-goals. Then prove each sub-goal with prove_goal as it completes; the task is done only when all are met.",
+    title: "Decompose a high-level goal into one final deliverable + process plan",
+    description: "GOALS: register a high-level goal as ONE final deliverable (optionally vulnclass-tagged) and return the decomposition RULES (goal ≠ process step; one result = one goal; never invent goals) plus the six-phase PROCESS plan (ENUMERATION→SURFACE→DISCOVERY→VERIFICATION→ESCALATION→REPORT) as a REFERENCE — the process is the HOW and is NOT registered as goals. To split a goal into MULTIPLE independent deliverables, use goal_set with each deliverable's own vulnclass.",
     inputSchema: {
-      goal: string2().describe("The high-level goal to decompose")
+      goal: string2().describe("The high-level goal / final deliverable to register"),
+      vulnclass: string2().optional().describe("Optional vuln class (rce/ato/priv-esc/upload/reset/ajax-rest/...)")
     }
-  }, async ({ goal }) => {
-    const r = decomposeGoal(goal);
+  }, async ({ goal, vulnclass }) => {
+    const r = decomposeGoal(goal, vulnclass);
     return { content: [{ type: "text", text: JSON.stringify({ ...r, ...goalStatus() }) }] };
   });
   server.registerTool("goal_tree", {
@@ -67199,7 +67222,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("framework_intel", {
     title: "Framework security knowledge",
-    description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware) and optionally scan code with those patterns.",
+    description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware, and — for WordPress — the P1-P6 vulnerability pattern taxonomy: RCE / upload / ATO / reset / priv-esc / AJAX-REST-authz, each with signals, detect, fixed, and anchor WPVDB ids) and optionally scan code with those patterns.",
     inputSchema: {
       framework: string2().describe("Framework id (see list_frameworks)"),
       code: string2().optional().describe("Optional source code to scan with the framework's patterns")

package/intelligence/frameworks.json

@@ -576,6 +576,135 @@
           "pattern": "plugins_loaded",
           "label": "plugin lifecycle"
         }
+      ],
+      "patterns": [
+        {
+          "id": "P1",
+          "name": "Remote code execution",
+          "signals": [
+            "dynamic callbacks/templates",
+            "generated PHP",
+            "command/process functions",
+            "executable writes"
+          ],
+          "detect": [
+            "eval",
+            "assert",
+            "variable functions",
+            "call_user_func*",
+            "shell/process APIs",
+            "include paths",
+            "generated PHP",
+            "executable writes"
+          ],
+          "fixed": "closed allow-list, least-privilege gate, no request input in generated/evaluated PHP",
+          "anchors": [
+            "69f9dcd8-ab3c-46ed-ac6b-2f1db35f8d1f",
+            "df32569a-e4fe-430b-8310-df7be80d7249",
+            "9bb1a4ca-976c-461d-82de-8a3b04a56fbc"
+          ]
+        },
+        {
+          "id": "P2",
+          "name": "Arbitrary file upload",
+          "signals": [
+            "$_FILES",
+            "remote import",
+            "base64 file content",
+            "move_uploaded_file",
+            "wp_handle_upload",
+            "custom directories"
+          ],
+          "detect": [
+            "local filesystem upload",
+            "WordPress media upload",
+            "remote-fetch/local-copy",
+            "third-party storage (confused-deputy)"
+          ],
+          "fixed": "auth/capability + nonce (CSRF only) + server-derived dest + normalized name + extension+MIME+content allow-list + executable denial",
+          "anchors": [
+            "e424157e-b79f-4000-8dcc-51413581fdec",
+            "043f449f-fc65-4218-83d2-7742e62f2af3",
+            "110db433-01ec-47ea-b74f-c3faa1757a3c"
+          ]
+        },
+        {
+          "id": "P3",
+          "name": "Unauthenticated account takeover",
+          "signals": [
+            "weak SSO/payment callbacks",
+            "QR/OTP login",
+            "auto-login helpers",
+            "selected user IDs/emails",
+            "bad signatures",
+            "wp_set_auth_cookie"
+          ],
+          "detect": [
+            "all paths to session establishment",
+            "identity lookup"
+          ],
+          "fixed": "verify canonical provider signatures, bind state/code to one account+flow, short expiry/one-time/attempts+rate limits",
+          "anchors": [
+            "6576dcd1-aea6-47c0-9157-4ca56f426612",
+            "d9f1b40f-526a-44ed-a3ec-a3c1ce0f1ece",
+            "56fdcba6-c7b1-443d-9f9d-b738ecaadabc"
+          ]
+        },
+        {
+          "id": "P4",
+          "name": "Unauthenticated password reset",
+          "signals": [
+            "public reset routes",
+            "request-selected account/key/password/email-body data"
+          ],
+          "detect": [
+            "core/custom reset APIs",
+            "mail-body filters"
+          ],
+          "fixed": "expiring one-time server key bound to account + core validation + trusted reset URL/body",
+          "anchors": [
+            "79fa8b91-f88e-4249-9f17-9e98e879f6fa",
+            "6c2d4489-de82-472d-a5f7-dc01b305fdd0"
+          ]
+        },
+        {
+          "id": "P5",
+          "name": "Privilege escalation",
+          "signals": [
+            "client-controlled role/capabilities/custom meta/options",
+            "user insertion/update",
+            "restore auto-login"
+          ],
+          "detect": [
+            "requests into user/role/cap/meta/option/import/restore mutations"
+          ],
+          "fixed": "server-side field allow-list, discard public role/capability metadata, operation-specific capability, prohibit arbitrary option names",
+          "anchors": [
+            "04d64797-751a-4cdd-a37d-70afbad5d784",
+            "929f243b-2f1c-4eca-88bc-03b1a86270ed",
+            "be3d5432-8f8c-4d45-b6e7-de24352378a8"
+          ]
+        },
+        {
+          "id": "P6",
+          "name": "AJAX/REST authorization failure",
+          "signals": [
+            "wp_ajax_nopriv_*",
+            "both auth states",
+            "public REST permissions",
+            "public/shared nonce",
+            "role check without ownership"
+          ],
+          "detect": [
+            "every AJAX/REST/admin-post registration -> callback, permissions, request-selected IDs, sink"
+          ],
+          "fixed": "nonce (CSRF) + authentication (identity) + current_user_can (authority) + object policy (ownership)",
+          "anchors": [
+            "030939ee-9aa9-4082-934e-c9a07fc3dfc3",
+            "c81aa489-0663-40b7-b2ce-f4c8f2edd4b6",
+            "e31c9bf0-7340-4bd7-ad6e-6ad01737654a"
+          ]
+        }
       ]
     },
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.178",
+  "version": "2.4.180",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {