blitzstrike 2.4.36 → 2.4.37

package/CHANGELOG.md

@@ -5,6 +5,14 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.37] — 2026-09-14
+
+### Fixed — benchmark top-level recall/f1 (self-audit)
+
+- `run_benchmark` now returns top-level `recall` and `f1` (previously only
+  `detection_rate` held the recall value, and no top-level f1). Matches the
+  per-detector shape for consistency. No functional change.
+
 ## [2.4.36] — 2026-09-14
 
 ### Changed — Framework Knowledge Graph is now MULTI-framework (not WordPress-only)

package/dist/index.js

@@ -56936,6 +56936,8 @@ function runBenchmark() {
   const detectionRate = tp + fn > 0 ? tp / (tp + fn) : 0;
   const falsePositiveRate = fp + tn > 0 ? fp / (fp + tn) : 0;
   const precision = tp + fp > 0 ? tp / (tp + fp) : 0;
+  const recall = detectionRate;
+  const f1 = precision + recall > 0 ? 2 * precision * recall / (precision + recall) : 0;
   const byDetector = {};
   for (const r of results) {
     const d = r.entry.detector ?? "taint";
@@ -56960,6 +56962,8 @@ function runBenchmark() {
     detection_rate: Number(detectionRate.toFixed(3)),
     false_positive_rate: Number(falsePositiveRate.toFixed(3)),
     precision: Number(precision.toFixed(3)),
+    recall: Number(recall.toFixed(3)),
+    f1: Number(f1.toFixed(3)),
     by_detector: detectorMetrics,
     captured_false_positives: {
       total: captured.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.36",
+  "version": "2.4.37",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {