blitzstrike 2.4.181 → 2.4.183

package/CHANGELOG.md

@@ -5,7 +5,23 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [2.4.180] — 2026-10-11
+## [2.4.183] — 2026-11-03
+
+### Fixed — corrected stale CHANGELOG release dates
+
+- Entries 2.4.169–2.4.178 were dated 2026-10-11 but published 2026-10-12;
+  2.4.179 published 2026-10-18; 2.4.182 published 2026-11-03. Dates corrected
+  to match the npm publish times.
+
+## [2.4.182] — 2026-11-03
+
+### Added — HTTP-level asset fingerprinting (Shodan-style MMH3)
+
+- New `favicon_hash` tool + `src/fingerprint.ts`: MurmurHash3 (x86 32-bit) favicon
+  fingerprint — the Shodan-compatible `http.favicon.hash` (verified against the
+  python `mmh3` reference: 9/9 vectors match) — plus body SHA-256 for content dedup
+  and the base64 `mmh3:` form. The same favicon hash means the same product/tech
+  even across unrelated hosts, so it is the strongest web-asset pivoting signal.
 
 ### Changed — goal decomposition corrected (goal = deliverable, not process)
 
@@ -20,7 +36,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   a new target discovered outside the constraints is recorded as an out-of-scope
   fact and skipped, never authorized.
 
-### Added — 4 doctrine rules
+### Added — 6 doctrine rules
 
 - `constraint_self_contained`, `record_is_memory` (write-back is anti-compaction
   long-term memory — record immediately, only increments), `wrapup_highest_priority`
@@ -29,7 +45,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   `serial_chain_discipline` (each chain step consumes the prior step's REAL output),
   `compression_discipline` (synthesize causally, preserve observed/inferred + source ids).
 
-## [2.4.179] — 2026-10-11
+## [2.4.179] — 2026-10-18
 
 ### Added — WordPress P1-P6 vulnerability pattern taxonomy
 
@@ -40,7 +56,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   fixed (the correct control), and anchor WPVDB record ids.
 - `frameworkProfile()` exposes `patterns`; `framework_intel` returns them.
 
-## [2.4.178] — 2026-10-11
+## [2.4.178] — 2026-10-12
 
 ### Added — goal decomposition (six-phase plan)
 
@@ -49,7 +65,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   ESCALATION → REPORT), each with its own quantitative condition. `goal_tree`
   shows the parent → sub-goal hierarchy and per-parent progress.
 
-## [2.4.177] — 2026-10-11
+## [2.4.177] — 2026-10-12
 
 ### Added — surface coverage tracker (quantitative progress)
 
@@ -60,7 +76,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Gives the agent a measurable "how done are we" number — a goal like
   "coverage >= 80%" is now verifiable against the measured pct before prove_goal.
 
-## [2.4.176] — 2026-10-11
+## [2.4.176] — 2026-10-12
 
 ### Added — retest context (completes the retest loop)
 
@@ -69,7 +85,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   evidence grouped by role (proof/baseline/verification) + reproducible flag,
   the active operation constraints, and the current goal state.
 
-## [2.4.175] — 2026-10-11
+## [2.4.175] — 2026-10-12
 
 ### Added — evidence roles (structured proof/baseline/verification/supporting)
 
@@ -79,7 +95,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   returns the role breakdown + a `reproducible` flag (true only when a finding has
   proof + baseline + verification — the three roles a HackerOne-grade PoC needs).
 
-## [2.4.174] — 2026-10-11
+## [2.4.174] — 2026-10-12
 
 ### Added — observation ledger + lineage (third write-back channel)
 
@@ -89,7 +105,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - Completes the three write-back channels: findings (vulns), assets (asset_discovery),
   and facts (neutral/negative observations that would otherwise be lost).
 
-## [2.4.173] — 2026-10-11
+## [2.4.173] — 2026-10-12
 
 ### Added — goal tracking + prove_goal (completion signal)
 
@@ -99,7 +115,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 - A goal with a quantitative condition must have its measured value verified before
   proving it met; the task is complete only when `all_met` is true.
 
-## [2.4.172] — 2026-10-11
+## [2.4.172] — 2026-10-12
 
 ### Added — operation constraint registry (deterministic red lines)
 
@@ -111,11 +127,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   (host/port/param). DENY rules always win; allowlist mode fails closed.
 - The operation red line is injected as the top rule of the system prompt.
 
-## [2.4.171] — 2026-10-11
+## [2.4.171] — 2026-10-12
 
 ### Changed — internal docs cleanup
 
-## [2.4.170] — 2026-10-11
+## [2.4.170] — 2026-10-12
 
 ### Added — 3-way retest verdict + planner discipline
 
@@ -129,7 +145,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
   re-check once), `observed_vs_inferred` (never upgrade a version/CVE/inferred hit
   to confirmed).
 
-## [2.4.169] — 2026-10-11
+## [2.4.169] — 2026-10-12
 
 ### Added — finding retest loop (post-confirmation lifecycle)
 

package/dist/index.js

@@ -64119,6 +64119,81 @@ function coverageSummary() {
   };
 }
 
+// src/fingerprint.ts
+function mmh3(data, seed = 0) {
+  const c1 = 3432918353;
+  const c2 = 461845907;
+  let h1 = seed | 0;
+  const len = data.length;
+  const nblocks = len >> 2;
+  for (let i = 0;i < nblocks; i++) {
+    const o = i << 2;
+    let k1 = data[o] | data[o + 1] << 8 | data[o + 2] << 16 | data[o + 3] << 24 | 0;
+    k1 = Math.imul(k1, c1) | 0;
+    k1 = k1 << 15 | k1 >>> 17;
+    k1 = Math.imul(k1, c2) | 0;
+    h1 ^= k1;
+    h1 = h1 << 13 | h1 >>> 19;
+    h1 = Math.imul(h1, 5) + 3864292196 | 0;
+  }
+  let k1 = 0;
+  const tail = nblocks << 2;
+  switch (len & 3) {
+    case 3:
+      k1 ^= data[tail + 2] << 16;
+    case 2:
+      k1 ^= data[tail + 1] << 8;
+    case 1:
+      k1 ^= data[tail];
+      k1 = Math.imul(k1, c1) | 0;
+      k1 = k1 << 15 | k1 >>> 17;
+      k1 = Math.imul(k1, c2) | 0;
+      h1 ^= k1;
+  }
+  h1 ^= len;
+  h1 ^= h1 >>> 16;
+  h1 = Math.imul(h1, 2246822507) | 0;
+  h1 ^= h1 >>> 13;
+  h1 = Math.imul(h1, 3266489909) | 0;
+  h1 ^= h1 >>> 16;
+  return h1 | 0;
+}
+function faviconHash(bytes) {
+  return mmh3(bytes, 0);
+}
+function fingerprintBundle(faviconBytes, body) {
+  let favicon_mmh3 = null;
+  let favicon_mmh3_b64 = null;
+  if (faviconBytes && faviconBytes.length > 0) {
+    favicon_mmh3 = faviconHash(faviconBytes);
+    const buf = new ArrayBuffer(4);
+    const dv = new DataView(buf);
+    dv.setInt32(0, favicon_mmh3, false);
+    favicon_mmh3_b64 = btoa(String.fromCharCode(...new Uint8Array(buf)));
+  }
+  return { favicon_mmh3, favicon_mmh3_b64, body_sha256: sha256(body) };
+}
+function decodeFavicon(data, encoding = "base64") {
+  try {
+    if (encoding === "hex") {
+      const s = data.replace(/[^0-9a-fA-F]/g, "");
+      if (s.length % 2 !== 0 || s.length === 0)
+        return null;
+      const out = new Uint8Array(s.length / 2);
+      for (let i = 0;i < out.length; i++)
+        out[i] = parseInt(s.slice(i * 2, i * 2 + 2), 16);
+      return out;
+    }
+    const bin = atob(data);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0;i < bin.length; i++)
+      out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+
 // src/sibling-scan.ts
 var SIBLING_SUFFIXES = [
   "export",
@@ -67230,6 +67305,21 @@ ${statusLine}` : statusLine },
       }]
     };
   });
+  server.registerTool("favicon_hash", {
+    title: "Favicon MMH3 hash (Shodan-style asset fingerprint)",
+    description: "RECON: compute the Shodan-compatible MurmurHash3 (MMH3) fingerprint of a favicon (or any raw bytes) — the strongest pivoting signal for web assets: the SAME favicon hash means the SAME product/tech even across unrelated hosts. Pass base64/hex-encoded favicon bytes (or the response body to also get its SHA-256 for content dedup). Use to fingerprint a live target, dedup assets by body hash, and pivot to every host serving the same favicon.",
+    inputSchema: {
+      data: string2().describe("Favicon bytes as base64 (default) or hex"),
+      encoding: _enum(["base64", "hex"]).optional().describe("How `data` is encoded (default base64)"),
+      body: string2().optional().describe("Optional response body — returns its SHA-256 for content-based asset dedup")
+    }
+  }, async ({ data, encoding, body }) => {
+    const bytes = decodeFavicon(data, encoding ?? "base64");
+    if (!bytes)
+      return { content: [{ type: "text", text: JSON.stringify({ error: "invalid favicon data" }) }] };
+    const bundle = fingerprintBundle(bytes, body ?? "");
+    return { content: [{ type: "text", text: JSON.stringify(bundle) }] };
+  });
   server.registerTool("framework_intel", {
     title: "Framework security knowledge",
     description: "PHASE 5: return a framework's security knowledge (sources, sinks, sanitizers, auth gates, routing, ORM, middleware, and — for WordPress — the P1-P6 vulnerability pattern taxonomy: RCE / upload / ATO / reset / priv-esc / AJAX-REST-authz, each with signals, detect, fixed, and anchor WPVDB ids) and optionally scan code with those patterns.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.181",
+  "version": "2.4.183",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {