blitzstrike 2.4.179 → 2.4.181

package/CHANGELOG.md

@@ -5,6 +5,30 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.180] — 2026-10-11
+
+### Changed — goal decomposition corrected (goal = deliverable, not process)
+
+- `decompose_goal` now registers the goal as ONE final deliverable (optional
+  vulnclass) and returns the decomposition rules + the six-phase PROCESS plan as
+  a reference — the process (recon→report) is the HOW and is no longer registered
+  as goals. `goal_set` accepts a `vulnclass` tag.
+
+### Changed — constraint self-containment + out-of-scope fact
+
+- Constraints must be self-contained (replace pronouns with the concrete host/port);
+  a new target discovered outside the constraints is recorded as an out-of-scope
+  fact and skipped, never authorized.
+
+### Added — 4 doctrine rules
+
+- `constraint_self_contained`, `record_is_memory` (write-back is anti-compaction
+  long-term memory — record immediately, only increments), `wrapup_highest_priority`
+  (land conclusions then stop), `high_value_surface` (parsing/charset, upload,
+  (de)serialization, cache race, TOCTOU, type confusion, mass assignment),
+  `serial_chain_discipline` (each chain step consumes the prior step's REAL output),
+  `compression_discipline` (synthesize causally, preserve observed/inferred + source ids).
+
 ## [2.4.179] — 2026-10-11
 
 ### Added — WordPress P1-P6 vulnerability pattern taxonomy

package/dist/index.js

@@ -63774,6 +63774,36 @@ var HUNTING_DOCTRINE = [
     id: "observed_vs_inferred",
     title: "Observed vs Inferred — Never Upgrade Inferred to Confirmed",
     rule: "Tag every conclusion with its confidence honestly: OBSERVED (you directly triggered it and hold the request/response or command output) vs INFERRED (you deduced it from a fingerprint/version/diff/phenomenon without actually triggering it). A version/CVE match, a 'looks injectable' param, or a patch-diff inference is INFERRED and must never be reported as a confirmed finding — record it as a hypothesis and verify it live (strike_verify / OOB / a clean oracle) before it can claim confirmed. Disproof is worth as much as proof: an honest dead verdict is a deliverable, an overstated inferred-as-confirmed is a retraction waiting to happen."
+  },
+  {
+    id: "constraint_self_contained",
+    title: "Constraints Are Self-Contained; New Target Outside Them Is Not Authorization",
+    rule: "Every operation constraint MUST be self-contained: replace 'this target' / 'current port' / 'this host' with the CONCRETE host/port/domain, because constraints are injected into later prompts standalone and a pronoun means nothing out of context. And a new target/port/host you discover OUTSIDE the active constraints is NOT authorization: record it as an out-of-scope fact (record_fact, confidence=observed) and skip — never derive an intent or action for it, and never widen a subdomain up to its root domain unless the user explicitly named the whole root."
+  },
+  {
+    id: "record_is_memory",
+    title: "Write-Back Is Your Long-Term Memory — Record Immediately, Only Increments",
+    rule: "Persist every result IMMEDIATELY as you produce it — never accumulate findings in your head or in a scratch note to save for the end (a session can be cut short and everything un-persisted is lost; only what is written down survives). Written records (finding_create / record_fact / surface_add / asset_discovery) are your anti-compaction long-term memory, not just bookkeeping. Write ONLY INCREMENTS: before recording, scan the existing ledger (list_facts / list_findings / coverage) and record only what is NEW — re-wording an existing conclusion just bloats state and misleads you into thinking you made progress. A conclusion that merely corroborates an existing one adds nothing and should not be re-recorded."
+  },
+  {
+    id: "wrapup_highest_priority",
+    title: "Wrap-Up Is the Highest Priority — Land Conclusions, Then Stop",
+    rule: "When you receive a wrap-up/finish signal (or self-judge the goal met / all reasonable routes exhausted), STOP all probing and commands IMMEDIATELY — 'continue exploring / try once more / exhaust this chain / wait for a command result' are all OVERRIDDEN by the wrap-up signal. Land everything still in flight first: write back every un-persisted conclusion (findings, facts, surface verdicts, coverage), then produce a concise plain-language summary of what was achieved, which routes were taken, which findings are confirmed (with PoC locations), and which directions are blocked and why. Report only what was actually done — never pad the wrap-up with unverified 'maybe' leads."
+  },
+  {
+    id: "high_value_surface",
+    title: "High-Value Attack Surface — The Often-Overlooked Faces",
+    rule: "When mapping the attack surface, prioritize these often-overlooked high-value faces (pick what applies, not a checklist obligation): input parsing / encoding / charset boundaries; file upload; (de)serialization; built-in routing + pre-auth-reachable handlers; error-handling leaks; cache poisoning / cache race; race conditions (TOCTOU); type confusion (scalar vs array); and mass assignment. These are where the highest-impact bugs hide when the obvious endpoints come up clean — before declaring a surface exhausted, confirm none of these faces remain untested."
+  },
+  {
+    id: "serial_chain_discipline",
+    title: "Serial Chain — Each Step Depends on the Prior Step's REAL Output",
+    rule: "For a serial exploitation chain (①→②→③, where each later step consumes the PRIOR step's actual output — a leaked key, an auth cookie, a session id, a written file, a generated nonce): drive it ONE STEP AT A TIME. Execute step ① and capture its REAL output first; only then design and run step ② against that concrete output; never imagine or assume the output of a step you have not actually run, and never plan/execute step ③ while step ②'s prerequisite still does not exist. Across codebases/interfaces, actively pull the FULL detail of every known clue into the current session to chain gadgets together — do not stop at the summary. A chain is only as real as the weakest link you actually produced."
+  },
+  {
+    id: "compression_discipline",
+    title: "Compression — Synthesize Causally, Preserve Confidence + Provenance",
+    rule: "When summarizing or compressing a set of related exploration nodes (facts/intents/findings), do NOT enumerate — synthesize: trace the causality (which fact birthed which intent, which intent produced which conclusion) and state what this region of the exploration CONCLUDED. Preserve distinctions between different conclusions (do not merge them into one vague sentence). Preserve evidence strength: mark observed vs inferred, and flag an inferred NEGATIVE/doubtful conclusion as inference-that-can-be-rechecked, never as a settled fact. Tag each conclusion with its source id(s) (e.g. #12, #28) so it can be traced back. State only what the inputs contain — never introduce a judgment the inputs do not support. Let length follow content: short when the conclusions are few, long only when they are many and genuinely distinct — always well under the sum of the inputs."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [
@@ -63938,35 +63968,37 @@ function nextId2() {
   counter2 += 1;
   return `G-${String(counter2).padStart(3, "0")}`;
 }
-var STANDARD_SUBGOALS = [
-  { text: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
-  { text: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
-  { text: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
-  { text: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
-  { text: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
-  { text: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
+var PROCESS_PLAN = [
+  { phase: "ENUMERATION — discover every in-scope asset", condition: "every host/subdomain/endpoint enumerated (asset_discovery)" },
+  { phase: "SURFACE — map every endpoint, parameter, and action", condition: "coverage >= 100% (every surface item has a terminal verdict)" },
+  { phase: "DISCOVERY — find vulnerabilities across every class", condition: "each eligible class × shape carries a terminal verdict" },
+  { phase: "VERIFICATION — verify each hypothesis live", condition: "every hypothesis verified (strike_verify/OOB) or refuted" },
+  { phase: "ESCALATION — drive each finding to real impact", condition: "every foothold escalated to records/admin/PII or genuinely blocked" },
+  { phase: "REPORT — write findings", condition: "generate_report run; zero open obligations" }
 ];
 function setGoals(texts) {
   for (const t of texts) {
     const text = typeof t === "string" ? t : t.text;
+    const vulnclass = typeof t === "string" ? undefined : t.vulnclass;
     const condition = typeof t === "string" ? undefined : t.condition;
     const parent_id = typeof t === "string" ? undefined : t.parent_id;
     const now = new Date().toISOString();
-    goals.push({ id: nextId2(), text, condition, status: "pending", ...parent_id ? { parent_id } : {}, created: now, updated: now });
+    goals.push({ id: nextId2(), text, status: "pending", ...vulnclass ? { vulnclass } : {}, ...condition ? { condition } : {}, ...parent_id ? { parent_id } : {}, created: now, updated: now });
   }
   return [...goals];
 }
-function decomposeGoal(text) {
+function decomposeGoal(text, vulnclass) {
   const now = new Date().toISOString();
-  const parent = { id: nextId2(), text, status: "pending", created: now, updated: now };
-  goals.push(parent);
-  const sub_goals = [];
-  for (const sg of STANDARD_SUBGOALS) {
-    const g = { id: nextId2(), text: sg.text, condition: sg.condition, status: "pending", parent_id: parent.id, created: now, updated: now };
-    goals.push(g);
-    sub_goals.push(g);
-  }
-  return { parent, sub_goals };
+  const goal = { id: nextId2(), text, status: "pending", ...vulnclass ? { vulnclass } : {}, created: now, updated: now };
+  goals.push(goal);
+  const rules = [
+    "A goal is a FINAL, verifiable deliverable — never a process step (recon/scan/vuln-analysis/attack-step/verification are NOT goals).",
+    "One final result -> one goal; multiple INDEPENDENT deliverables -> separate goals (via goal_set), each with its own vulnclass.",
+    "Never invent a goal the user did not state; tag vulnclass only when the deliverable maps to a clear class.",
+    "Extract operation constraints (set_constraint) BEFORE decomposing; a constraint is self-contained (no pronouns — replace 'this target' with the concrete host/port).",
+    "Minimal scope: only the exact target the user named; never widen a subdomain to its root domain."
+  ];
+  return { goal, rules, process_plan: PROCESS_PLAN };
 }
 function proveGoal(id, evidence, reason) {
   const g = goals.find((x) => x.id === id);
@@ -65976,16 +66008,16 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("constraint_set", {
     title: "Set an operation constraint (red line)",
-    description: "CONSTRAINTS: register an operation allow/deny rule — the HIGHEST-priority red line that bounds WHAT the agent may DO (beyond mere target scope). Pass mode (deny/allow), action (brute_force / scan / enumerate / upload / exploit / write / exfiltrate / dos / social_eng / credential_use / probe / active / *), an optional target glob (host/port/param, * wildcard), and a reason. DENY rules always win. Use 'active' as an umbrella for all active ops; '*' for everything. Then use constraint_check before any action to get a deterministic answer.",
+    description: "CONSTRAINTS: register an operation allow/deny rule — the HIGHEST-priority red line that bounds WHAT the agent may DO (beyond mere target scope). Pass mode (deny/allow), action (brute_force / scan / enumerate / upload / exploit / write / exfiltrate / dos / social_eng / credential_use / probe / active / *), an optional target glob (host/port/param, * wildcard), and a reason. DENY rules always win. Write the target SELF-CONTAINED: replace 'this target/current port' with the CONCRETE host/port — constraints are injected standalone and a pronoun means nothing out of context. Use 'active' as an umbrella for all active ops; '*' for everything. Then use constraint_check before any action.",
     inputSchema: {
       mode: _enum(["deny", "allow"]).describe("deny = forbid this action; allow = explicitly permit it"),
       action: string2().describe("Action: brute_force/scan/enumerate/upload/exploit/write/exfiltrate/dos/social_eng/credential_use/probe/active/*"),
-      target: string2().optional().describe("Optional host/port/param glob (* wildcard); unset = applies to every target"),
+      target: string2().optional().describe("Optional host/port/param glob (* wildcard) — write it self-contained (concrete value, no pronoun); unset = applies to every target"),
       reason: string2().describe("Why this constraint exists")
     }
   }, async ({ mode, action, target, reason }) => {
     const rule = setConstraint({ mode, action, target, reason });
-    return { content: [{ type: "text", text: JSON.stringify({ ...rule, hint: "DENY rules always win. Check before acting with constraint_check." }) }] };
+    return { content: [{ type: "text", text: JSON.stringify({ ...rule, hint: "DENY rules always win. Check before acting with constraint_check. A new target outside these constraints is NOT authorization — record it as an out-of-scope fact and skip." }) }] };
   });
   server.registerTool("constraint_check", {
     title: "Deterministically check whether an action is allowed",
@@ -66024,10 +66056,10 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify({ removed: clearConstraint(id), id }) }] };
   });
   server.registerTool("goal_set", {
-    title: "Register engagement goals",
-    description: "GOALS: register one or more free-text goals (each with an optional quantitative condition like 'coverage >= 80%'). goal_status then tracks which are met; the task is COMPLETE only when all_met is true. Use before planning routes so every route traces back to a goal.",
+    title: "Register final deliverables (goals)",
+    description: "GOALS: register one or more FINAL DELIVERABLES — verifiable results (e.g. 'get RCE', 'read admin PII', 'take over admin'), NOT process steps (recon/scan/analysis/verify are NOT goals). Each goal carries an optional vulnclass (rce/ato/priv-esc/upload/reset/ajax-rest/...) and an optional quantitative condition. goal_status tracks which are met; COMPLETE only when all_met is true.",
     inputSchema: {
-      goals: array(object2({ text: string2(), condition: string2().optional() })).describe("Goals to register (text + optional quantitative condition)")
+      goals: array(object2({ text: string2(), vulnclass: string2().optional(), condition: string2().optional() })).describe("Deliverables to register (text + optional vulnclass + optional quantitative condition)")
     }
   }, async ({ goals }) => {
     setGoals(goals);
@@ -66053,13 +66085,14 @@ ${statusLine}` : statusLine },
     return { content: [{ type: "text", text: JSON.stringify(goalStatus()) }] };
   });
   server.registerTool("decompose_goal", {
-    title: "Decompose a high-level goal into the six-phase plan",
-    description: "GOALS: decompose a high-level goal (e.g. 'audit app.example.com') into the standard six-phase sub-goal plan — ENUMERATION → SURFACE → DISCOVERY → VERIFICATION → ESCALATION → REPORT — each registered in the ledger with its own condition (pending). Returns the parent + sub-goals. Then prove each sub-goal with prove_goal as it completes; the task is done only when all are met.",
+    title: "Decompose a high-level goal into one final deliverable + process plan",
+    description: "GOALS: register a high-level goal as ONE final deliverable (optionally vulnclass-tagged) and return the decomposition RULES (goal ≠ process step; one result = one goal; never invent goals) plus the six-phase PROCESS plan (ENUMERATION→SURFACE→DISCOVERY→VERIFICATION→ESCALATION→REPORT) as a REFERENCE — the process is the HOW and is NOT registered as goals. To split a goal into MULTIPLE independent deliverables, use goal_set with each deliverable's own vulnclass.",
     inputSchema: {
-      goal: string2().describe("The high-level goal to decompose")
+      goal: string2().describe("The high-level goal / final deliverable to register"),
+      vulnclass: string2().optional().describe("Optional vuln class (rce/ato/priv-esc/upload/reset/ajax-rest/...)")
     }
-  }, async ({ goal }) => {
-    const r = decomposeGoal(goal);
+  }, async ({ goal, vulnclass }) => {
+    const r = decomposeGoal(goal, vulnclass);
     return { content: [{ type: "text", text: JSON.stringify({ ...r, ...goalStatus() }) }] };
   });
   server.registerTool("goal_tree", {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.179",
+  "version": "2.4.181",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {