blitzstrike 2.4.8 → 2.4.9

package/CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [2.4.9] — 2026-09-14
+
+### Added — evidence-first enforcement (findings are never born empty)
+
+- `makeFinding` + `finding_create` now accept `evidence` at creation — a finding
+  can carry its observed artifact (headers/URL/response) the moment it is
+  created, instead of relying on a separate attach call that gets skipped.
+- `finding_create` warns when a finding is created with no evidence.
+- `reportMarkdown` now flags evidence-less findings with an explicit
+  "Evidence-first violation" block (ids listed) — detection without proof is
+  surfaced instead of silently shipped.
+
 ## [2.4.8] — 2026-09-14
 
 ### Added — MCP integration health checks

package/dist/index.js

@@ -31064,7 +31064,7 @@ function makeFinding(input) {
   const status = input.status ?? "detected";
   const factors = confidenceFactorsFor(input);
   const confidence = computeConfidence(factors);
-  const finding = {
+  let finding = {
     id: nextFindingId(),
     status,
     title: input.title,
@@ -31087,6 +31087,16 @@ function makeFinding(input) {
     remediation: {},
     timestamps: { created: now, updated: now }
   };
+  if (input.evidence?.length) {
+    for (const e of input.evidence) {
+      const ev = makeEvidence({
+        type: e.type,
+        description: e.description,
+        artifacts: e.content ? [{ name: "artifact", kind: "evidence", content: e.content }] : []
+      });
+      finding = attachEvidence(finding, ev);
+    }
+  }
   recordAudit("finding_created", { tool: "eagle-eye", target: input.target.host ?? input.target.endpoint, result: status, correlationId: finding.id });
   return finding;
 }
@@ -33009,11 +33019,15 @@ function summarize(findings) {
   const byStatus = {};
   const bySeverity = {};
   let evidenceArtifacts = 0;
+  let evidenceLess = 0;
   for (const f of findings) {
     byStatus[f.status ?? "detected"] = (byStatus[f.status ?? "detected"] ?? 0) + 1;
     const sev = f.classification?.severity ?? "informational";
     bySeverity[sev] = (bySeverity[sev] ?? 0) + 1;
-    evidenceArtifacts += f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+    const arts = f.evidence?.reduce((n, e) => n + (e.artifacts?.length ?? 0), 0) ?? 0;
+    evidenceArtifacts += arts;
+    if ((f.evidence ?? []).length === 0)
+      evidenceLess += 1;
   }
   const groups = dedupFindings(findings);
   return {
@@ -33023,7 +33037,8 @@ function summarize(findings) {
     by_severity: bySeverity,
     confirmed: byStatus["confirmed"] ?? 0,
     false_positives: byStatus["false_positive"] ?? 0,
-    evidence_artifacts: evidenceArtifacts
+    evidence_artifacts: evidenceArtifacts,
+    evidence_less_findings: evidenceLess
   };
 }
 function reportMarkdown(findings, opts = {}) {
@@ -33047,6 +33062,11 @@ function reportMarkdown(findings, opts = {}) {
   }
   lines.push(`Detailed findings, reproduction steps, impact, and remediation follow in section 5.`);
   lines.push("");
+  if (summary.evidence_less_findings > 0) {
+    const evLess = findings.filter((f) => (f.evidence ?? []).length === 0).map((f) => f.id).join(", ");
+    lines.push(`> ⚠️ **Evidence-first violation:** **${summary.evidence_less_findings}** finding(s) carry NO evidence artifacts (${evLess}). ` + `Detection is not proof — every finding must carry the observed artifact (headers, URL, response body). Attach evidence via finding_attach_evidence before finalizing.`);
+    lines.push("");
+  }
   lines.push("## 2. Scope");
   lines.push("");
   lines.push(`- **Target(s):** ${scope}`);
@@ -57170,7 +57190,7 @@ ${statusLine}` : statusLine },
   });
   server.registerTool("finding_create", {
     title: "Create a canonical finding",
-    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending).",
+    description: "FINDINGS: create a canonical, evidence-first finding. Severity describes impact; confidence (deterministic) describes certainty. Default status=detected (hypothesis-pending). Pass `evidence` (JSON array of {type, description, content}) to attach observed artifacts AT CREATION — a finding must never be born empty when you already hold the artifact (headers, URL, response body).",
     inputSchema: {
       title: string2().describe("Finding title"),
       target_type: string2().optional().describe("Target type (web/api/source/mobile/network/other)"),
@@ -57182,9 +57202,18 @@ ${statusLine}` : statusLine },
       source_name: string2().describe("Source name"),
       sink_type: string2().describe("Sink type (e.g. sql_execution, command_execution, file_operations)"),
       sink_symbol: string2().optional().describe("Sink symbol (e.g. '->query(')"),
-      chain_id: string2().optional().describe("Escalation chain id")
+      chain_id: string2().optional().describe("Escalation chain id"),
+      evidence: string2().optional().describe("JSON array of evidence entries: [{type, description, content?}] — attached at creation (redacted + SHA-256 tagged)")
+    }
+  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id, evidence }) => {
+    let evs = [];
+    if (evidence) {
+      try {
+        evs = JSON.parse(evidence);
+      } catch {
+        return { content: [{ type: "text", text: JSON.stringify({ error: "invalid evidence JSON" }) }] };
+      }
     }
-  }, async ({ title, target_type, host, endpoint, severity, cwe, source_type, source_name, sink_type, sink_symbol, chain_id }) => {
     const f = makeFinding({
       title,
       target: { type: target_type ?? "web", host, endpoint },
@@ -57193,9 +57222,19 @@ ${statusLine}` : statusLine },
       source: { type: source_type, name: source_name },
       sink: { type: sink_type, symbol: sink_symbol },
       chainId: chain_id ?? null,
-      status: "detected"
+      status: "detected",
+      evidence: evs
     });
-    return { content: [{ type: "text", text: JSON.stringify(f) }] };
+    const empty = (f.evidence ?? []).length === 0;
+    return {
+      content: [{
+        type: "text",
+        text: JSON.stringify({
+          ...f,
+          _warning: empty ? "finding created with NO evidence — if you hold the observed artifact (headers/URL/body), attach it now via `evidence` or finding_attach_evidence" : undefined
+        })
+      }]
+    };
   });
   server.registerTool("finding_transition", {
     title: "Advance a finding lifecycle",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "2.4.8",
+  "version": "2.4.9",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {