blitzstrike 2.4.27 → 2.4.29
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +28 -0
- package/dist/index.js +484 -189
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,34 @@ All notable changes to Blitz Strike are documented here.
|
|
|
5
5
|
The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/).
|
|
7
7
|
|
|
8
|
+
## [2.4.29] — 2026-09-14
|
|
9
|
+
|
|
10
|
+
### Added — Enterprise compliance mapping (CWE -> frameworks)
|
|
11
|
+
|
|
12
|
+
- New `src/compliance.ts`: data-driven mapping of 25 web/app CWEs to OWASP
|
|
13
|
+
Top 10 (2021), OWASP ASVS v4.0, PCI DSS v4.0, ISO 27001:2022 Annex A, and
|
|
14
|
+
NIST SP 800-53.
|
|
15
|
+
- New `compliance` tool: map a single CWE or an aggregate list.
|
|
16
|
+
- `generate_report` now emits a "## 6. Compliance Mapping" section — a CISO/
|
|
17
|
+
auditor can see which controls every finding violates, not just a CVSS.
|
|
18
|
+
|
|
19
|
+
## [2.4.28] — 2026-09-14
|
|
20
|
+
|
|
21
|
+
### Added — Enterprise Empirical Intelligence Ledger (LOOP 2, cross-target)
|
|
22
|
+
|
|
23
|
+
- New `src/intelligence.ts`: append-only JSONL ledger
|
|
24
|
+
(`~/.blitzstrike/intelligence.jsonl`) that records VERIFIED verdicts
|
|
25
|
+
(confirmed/false_positive) as (vector, tech) outcomes — the enterprise
|
|
26
|
+
layer that makes Blitz Strike COMPOUND across engagements.
|
|
27
|
+
- `strike_resolve` now auto-records every confirmed/false_positive verdict
|
|
28
|
+
into the ledger (sink type -> attack-vector name via sinkToVector).
|
|
29
|
+
- `attack_plan`'s success_probability is now a Bayesian posterior: the formula
|
|
30
|
+
prior is upgraded by the empirical hit-rate (Beta-binomial, prior strength
|
|
31
|
+
K=5), falling back tech-specific -> any-tech -> formula. A new Laravel target
|
|
32
|
+
inherits the hit-rates of past Laravel engagements.
|
|
33
|
+
- New `intelligence` tool: query hit-rates / top-vectors / raw ledger.
|
|
34
|
+
- System prompt: cross-target intelligence directive.
|
|
35
|
+
|
|
8
36
|
## [2.4.27] — 2026-09-14
|
|
9
37
|
|
|
10
38
|
### Added — SELF-HARDENING loop (false-positives -> corpus -> benchmark)
|