blitzstrike 2.4.179 → 2.4.180

package/CHANGELOG.md

@@ -5,6 +5,28 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.180] — 2026-10-11
+
+### Changed — goal decomposition corrected (goal = deliverable, not process)
+
+- `decompose_goal` now registers the goal as ONE final deliverable (optional
+  vulnclass) and returns the decomposition rules + the six-phase PROCESS plan as
+  a reference — the process (recon→report) is the HOW and is no longer registered
+  as goals. `goal_set` accepts a `vulnclass` tag.
+
+### Changed — constraint self-containment + out-of-scope fact
+
+- Constraints must be self-contained (replace pronouns with the concrete host/port);
+  a new target discovered outside the constraints is recorded as an out-of-scope
+  fact and skipped, never authorized.
+
+### Added — 4 doctrine rules
+
+- `constraint_self_contained`, `record_is_memory` (write-back is anti-compaction
+  long-term memory — record immediately, only increments), `wrapup_highest_priority`
+  (land conclusions then stop), `high_value_surface` (parsing/charset, upload,
+  (de)serialization, cache race, TOCTOU, type confusion, mass assignment).
+
 ## [2.4.179] — 2026-10-11
 
 ### Added — WordPress P1-P6 vulnerability pattern taxonomy

package/dist/index.js

@@ -63774,6 +63774,26 @@ var HUNTING_DOCTRINE = [
     id: "observed_vs_inferred",
     title: "Observed vs Inferred — Never Upgrade Inferred to Confirmed",
     rule: "Tag every conclusion with its confidence honestly: OBSERVED (you directly triggered it and hold the request/response or command output) vs INFERRED (you deduced it from a fingerprint/version/diff/phenomenon without actually triggering it). A version/CVE match, a 'looks injectable' param, or a patch-diff inference is INFERRED and must never be reported as a confirmed finding — record it as a hypothesis and verify it live (strike_verify / OOB / a clean oracle) before it can claim confirmed. Disproof is worth as much as proof: an honest dead verdict is a deliverable, an overstated inferred-as-confirmed is a retraction waiting to happen."
+  },
+  {
+    id: "constraint_self_contained",
+    title: "Constraints Are Self-Contained; New Target Outside Them Is Not Authorization",
+    rule: "Every operation constraint MUST be self-contained: replace 'this target' / 'current port' / 'this host' with the CONCRETE host/port/domain, because constraints are injected into later prompts standalone and a pronoun means nothing out of context. And a new target/port/host you discover OUTSIDE the active constraints is NOT authorization: record it as an out-of-scope fact (record_fact, confidence=observed) and skip — never derive an intent or action for it, and never widen a subdomain up to its root domain unless the user explicitly named the whole root."
+  },
+  {
+    id: "record_is_memory",
+    title: "Write-Back Is Your Long-Term Memory — Record Immediately, Only Increments",
+    rule: "Persist every result IMMEDIATELY as you produce it — never accumulate findings in your head or in a scratch note to save for the end (a session can be cut short and everything un-persisted is lost; only what is written down survives). Written records (finding_create / record_fact / surface_add / asset_discovery) are your anti-compaction long-term memory, not just bookkeeping. Write ONLY INCREMENTS: before recording, scan the existing ledger (list_facts / list_findings / coverage) and record only what is NEW — re-wording an existing conclusion just bloats state and misleads you into thinking you made progress. A conclusion that merely corroborates an existing one adds nothing and should not be re-recorded."
+  },
+  {
+    id: "wrapup_highest_priority",
+    title: "Wrap-Up Is the Highest Priority — Land Conclusions, Then Stop",
+    rule: "When you receive a wrap-up/finish signal (or self-judge the goal met / all reasonable routes exhausted), STOP all probing and commands IMMEDIATELY — 'continue exploring / try once more / exhaust this chain / wait for a command result' are all OVERRIDDEN by the wrap-up signal. Land everything still in flight first: write back every un-persisted conclusion (findings, facts, surface verdicts, coverage), then produce a concise plain-language summary of what was achieved, which routes were taken, which findings are confirmed (with PoC locations), and which directions are blocked and why. Report only what was actually done — never pad the wrap-up with unverified 'maybe' leads."
+  },
+  {
+    id: "high_value_surface",
+    title: "High-Value Attack Surface — The Often-Overlooked Faces",
+    rule: "When mapping the attack surface, prioritize these often-overlooked high-value faces (pick what applies, not a checklist obligation): input parsing / encoding / charset boundaries; file upload; (de)serialization; built-in routing + pre-auth-reachable handlers; error-handling leaks; cache poisoning / cache race; race conditions (TOCTOU); type confusion (scalar vs array); and mass assignment. These are where the highest-impact bugs hide when the obvious endpoints come up clean — before declaring a surface exhausted, confirm none of these faces remain untested."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [
@@ -63938,35 +63958,37 @@ function nextId2() {
   counter2 += 1;
   return `G-${String(counter2).padStart(3, "0")}`;
 }
-var STANDARD_SUBGOALS = [
-  { text: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
-  { text: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
-  { text: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
-  { text: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
-  { text: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
-  { text: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
+var PROCESS_PLAN = [
+  { phase: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
+  { phase: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
+  { phase: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
+  { phase: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
+  { phase: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
+  { phase: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
 ];
 function setGoals(texts) {
   for (const t of texts) {
     const text = typeof t === "string" ? t : t.text;
+    const vulnclass = typeof t === "string" ? undefined : t.vulnclass;
     const condition = typeof t === "string" ? undefined : t.condition;
     const parent_id = typeof t === "string" ? undefined : t.parent_id;
     const now = new Date().toISOString();
-    goals.push({ id: nextId2(), text, condition, status: "pending", ...parent_id ? { parent_id } : {}, created: now, updated: now });
+    goals.push({ id: nextId2(), text, status: "pending", ...vulnclass ? { vulnclass } : {}, ...condition ? { condition } : {}, ...parent_id ? { parent_id } : {}, created: now, updated: now });
   }
   return [...goals];
 }
-function decomposeGoal(text) {
+function decomposeGoal(text, vulnclass) {
   const now = new Date().toISOString();
-  const parent = { id: nextId2(), text, status: "pending", created: now, updated: now };
-  goals.push(parent);
-  const sub_goals = [];
-  for (const sg of STANDARD_SUBGOALS) {
-    const g = { id: nextId2(), text: sg.text, condition: sg.condition, status: "pending", parent_id: parent.id, created: now, updated: now };
-    goals.push(g);
-    sub_goals.push(g);
-  }
-  return { parent, sub_goals };
+  const goal = { id: nextId2(), text, status: "pending", ...vulnclass ? { vulnclass } : {}, created: now, updated: now };
+  goals.push(goal);
+  const rules = [
+    "A goal is a FINAL, verifiable deliverable — never a process step (recon/scan/vuln-analysis/attack-step/verification are NOT goals).",
+    "One final result -> one goal; multiple INDEPENDENT deliverables -> separate goals (via goal_set), each with its own vulnclass.",
+    "Never invent a goal the user did not state; tag vulnclass only when the deliverable maps to a clear class.",
+    "Extract operation constraints (set_constraint) BEFORE decomposing; a constraint is self-contained (no pronouns — replace 'this target' with the concrete host/port).",
+    "Minimal scope: only the exact target the user named; never widen a subdomain to its root domain."
+  ];
+  return { goal, rules, process_plan: PROCESS_PLAN };
 }
 function proveGoal(id, evidence, reason) {
   const g = goals.find((x) => x.id === id);
@@ -65976,16 +65998,16 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("constraint_set", {
     title: "Set an operation constraint (red line)",
-    description: "CONSTRAINTS: register an operation allow/deny rule — the HIGHEST-priority red line that bounds WHAT the agent may DO (beyond mere target scope). Pass mode (deny/allow), action (brute_force / scan / enumerate / upload / exploit / write / exfiltrate / dos / social_eng / credential_use / probe / active / *), an optional target glob (host/port/param, * wildcard), and a reason. DENY rules always win. Use 'active' as an umbrella for all active ops; '*' for everything. Then use constraint_check before any action to get a deterministic answer.",
+    description: "CONSTRAINTS: register an operation allow/deny rule — the HIGHEST-priority red line that bounds WHAT the agent may DO (beyond mere target scope). Pass mode (deny/allow), action (brute_force / scan / enumerate / upload / exploit / write / exfiltrate / dos / social_eng / credential_use / probe / active / *), an optional target glob (host/port/param, * wildcard), and a reason. DENY rules always win. Write the target SELF-CONTAINED: replace 'this target/current port' with the CONCRETE host/port — constraints are injected standalone and a pronoun means nothing out of context. Use 'active' as an umbrella for all active ops; '*' for everything. Then use constraint_check before any action.",
     inputSchema: {
       mode: _enum(["deny", "allow"]).describe("deny = forbid this action; allow = explicitly permit it"),
       action: string2().describe("Action: brute_force/scan/enumerate/upload/exploit/write/exfiltrate/dos/social_eng/credential_use/probe/active/*"),
-      target: string2().optional().describe("Optional host/port/param glob (* wildcard); unset = applies to every target"),
+      target: string2().optional().describe("Optional host/port/param glob (* wildcard) — write it self-contained (concrete value, no pronoun); unset = applies to every target"),
       reason: string2().describe("Why this constraint exists")
     }
   }, async ({ mode, action, target, reason }) => {
     const rule = setConstraint({ mode, action, target, reason });
-    return { content: [{ type: "text", text: JSON.stringify({ ...rule, hint: "DENY rules always win. Check before acting with constraint_check." }) }] };
+    return { content: [{ type: "text", text: JSON.stringify({ ...rule, hint: "DENY rules always win. Check before acting with constraint_check. A new target outside these constraints is NOT authorization — record it as an out-of-scope fact and skip." }) }] };
   });
   server.registerTool("constraint_check", {
     title: "Deterministically check whether an action is allowed",
@@ -66024,10 +66046,10 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify({ removed: clearConstraint(id), id }) }] };
   });
   server.registerTool("goal_set", {
-    title: "Register engagement goals",
-    description: "GOALS: register one or more free-text goals (each with an optional quantitative condition like 'coverage >= 80%'). goal_status then tracks which are met; the task is COMPLETE only when all_met is true. Use before planning routes so every route traces back to a goal.",
+    title: "Register final deliverables (goals)",
+    description: "GOALS: register one or more FINAL DELIVERABLES — verifiable results (e.g. 'get RCE', 'read admin PII', 'take over admin'), NOT process steps (recon/scan/analysis/verify are NOT goals). Each goal carries an optional vulnclass (rce/ato/priv-esc/upload/reset/ajax-rest/...) and an optional quantitative condition. goal_status tracks which are met; COMPLETE only when all_met is true.",
     inputSchema: {
-      goals: array(object2({ text: string2(), condition: string2().optional() })).describe("Goals to register (text + optional quantitative condition)")
+      goals: array(object2({ text: string2(), vulnclass: string2().optional(), condition: string2().optional() })).describe("Deliverables to register (text + optional vulnclass + optional quantitative condition)")
     }
   }, async ({ goals }) => {
     setGoals(goals);
@@ -66053,13 +66075,14 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify(goalStatus()) }] };
   });
   server.registerTool("decompose_goal", {
-    title: "Decompose a high-level goal into the six-phase plan",
-    description: "GOALS: decompose a high-level goal (e.g. 'audit app.example.com') into the standard six-phase sub-goal plan — ENUMERATION → SURFACE → DISCOVERY → VERIFICATION → ESCALATION → REPORT — each registered in the ledger with its own condition (pending). Returns the parent + sub-goals. Then prove each sub-goal with prove_goal as it completes; the task is done only when all are met.",
+    title: "Decompose a high-level goal into one final deliverable + process plan",
+    description: "GOALS: register a high-level goal as ONE final deliverable (optionally vulnclass-tagged) and return the decomposition RULES (goal ≠ process step; one result = one goal; never invent goals) plus the six-phase PROCESS plan (ENUMERATION→SURFACE→DISCOVERY→VERIFICATION→ESCALATION→REPORT) as a REFERENCE — the process is the HOW and is NOT registered as goals. To split a goal into MULTIPLE independent deliverables, use goal_set with each deliverable's own vulnclass.",
     inputSchema: {
-      goal: string2().describe("The high-level goal to decompose")
+      goal: string2().describe("The high-level goal / final deliverable to register"),
+      vulnclass: string2().optional().describe("Optional vuln class (rce/ato/priv-esc/upload/reset/ajax-rest/...)")
     }
-  }, async ({ goal }) => {
-    const r = decomposeGoal(goal);
+  }, async ({ goal, vulnclass }) => {
+    const r = decomposeGoal(goal, vulnclass);
     return { content: [{ type: "text", text: JSON.stringify({ ...r, ...goalStatus() }) }] };
   });
   server.registerTool("goal_tree", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.179",
+  "version": "2.4.180",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {