blitzstrike 2.4.185 → 2.4.186

package/CHANGELOG.md

@@ -5,7 +5,7 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
-## [2.4.185] — 2026-11-03
+## [2.4.186] — 2026-11-03
 
 ### Added — 5 doctrine rules (multi-agent pentest orchestration)
 

package/dist/index.js

@@ -63824,6 +63824,11 @@ var HUNTING_DOCTRINE = [
     id: "technical_channel_english",
     title: "Technical Channel Stays English — Log in the User's Language",
     rule: "Operate on two channels and never mix them: the TECHNICAL channel (external search queries, vector-store/knowledge-base lookups and writes, runtime commands, code/identifiers, and any stored reusable technique) stays in English — the index and the shared store are English-only, so a non-English query retrieves nothing and a non-English stored entry becomes unreachable. The ENGAGEMENT LOG (your running commentary and the final report for the human) stays in the user's language. Preserve technical identifiers (CVEs, tool names, IPs, ports, file paths, code) verbatim when translating prose into the log language. When storing a reusable technique, ANONYMIZE first: replace target IPs/domains/credentials/tokens with {target_ip} / {target_domain} / {username} / {password} / {token} so the stored knowledge stays reusable across engagements."
+  },
+  {
+    id: "compression_preserve_oob",
+    title: "Compression Must Never Drop OOB Infrastructure — Summaries Are Lossless",
+    rule: "When compressing or summarizing context, NEVER drop out-of-band (OOB) infrastructure — the public callback IP, listener ports, DNS exfiltration domains, and callback URLs. These are the most fragile context (a single line, easily lost in a summary) yet the most load-bearing: you need them to re-establish or verify blind RCE/SSRF/XXE, and once dropped they cannot be reconstructed. Preserve them verbatim in any summary. Likewise, when re-summarizing content that is ALREADY a summary, retain EVERY previously-distilled point — a summary-of-a-summary must be lossless, never a lossy re-compression that silently discards a prior conclusion."
   }
 ];
 var DOMAIN_EXHAUSTION_CHECKLIST = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.185",
+  "version": "2.4.186",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {