blitzstrike 1.0.51 → 1.0.52

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.52] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 12: browser automation agent)
+
+- **Browser Automation Agent** (`src/browser-agent.ts`, §16):
+  - Session-based (one persistent page) so multi-step flows work.
+  - Ops: `open`/`navigate`/`click`/`type`/`evaluate`/`screenshot`/`back`/`forward`/
+    `get_cookie`/`set_cookie`, plus `detectAuthForm()` and `browserDiagnostics()`.
+  - Graceful degradation — every op reports `unavailable` when `playwright-core`
+    (optional peer) is missing, never throws.
+- New `@browser` mission agent (URL-scope-gated) — detects login forms and JS
+  runtime errors and emits auth-flow hypotheses.
+- New MCP tool `browser_agent` (session ops + detect_auth_form + diagnostics + close).
+
 ## [1.0.51] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 11: adversarial reviewer)

package/dist/index.js

@@ -17722,6 +17722,219 @@ var init_universal_taint = __esm(() => {
   extensionMap = new Map;
 });
 
+// src/browser-agent.ts
+async function ensureChromium2() {
+  if (chromiumCache2)
+    return chromiumCache2;
+  try {
+    chromiumCache2 = await import("playwright-core");
+    return chromiumCache2;
+  } catch {
+    return null;
+  }
+}
+async function ensureSession() {
+  if (page)
+    return { available: true };
+  const chr = await ensureChromium2();
+  if (!chr)
+    return { available: false, reason: "playwright-core not installed (optional peer dependency)" };
+  try {
+    browser = await chr.chromium.launch({ headless: true });
+    page = await browser.newPage();
+    page.on("console", (m) => {
+      const msg = m;
+      if (msg.type() === "error")
+        consoleErrors.push(msg.text());
+    });
+    page.on("pageerror", (e) => pageErrors.push(String(e)));
+    return { available: true };
+  } catch (e) {
+    return { available: false, reason: e instanceof Error ? e.message : String(e) };
+  }
+}
+function unavailable2(op, reason) {
+  return { op, ok: false, unavailable: true, detail: reason };
+}
+function fail(op, e) {
+  return { op, ok: false, unavailable: false, detail: e instanceof Error ? e.message : String(e) };
+}
+async function browserOpen(url) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("open", s.reason ?? "unavailable");
+  try {
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 20000 });
+    return { op: "open", ok: true, unavailable: false, detail: `opened ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("open", e);
+  }
+}
+async function browserNavigate(url) {
+  return browserOpen(url);
+}
+async function browserClick(selector) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("click", s.reason ?? "unavailable");
+  try {
+    await page.click(selector);
+    return { op: "click", ok: true, unavailable: false, detail: `clicked ${selector}` };
+  } catch (e) {
+    return fail("click", e);
+  }
+}
+async function browserType(selector, text) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("type", s.reason ?? "unavailable");
+  try {
+    await page.fill(selector, text);
+    return { op: "type", ok: true, unavailable: false, detail: `typed into ${selector}` };
+  } catch (e) {
+    return fail("type", e);
+  }
+}
+async function browserEvaluate(js) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("evaluate", s.reason ?? "unavailable");
+  try {
+    const value = await page.evaluate((code) => {
+      const fn = new Function(`"use strict"; return (${code})`)();
+      return typeof fn === "function" ? fn() : fn;
+    }, js);
+    return { op: "evaluate", ok: true, unavailable: false, detail: "evaluated", value };
+  } catch (e) {
+    return fail("evaluate", e);
+  }
+}
+async function browserScreenshot(path) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("screenshot", s.reason ?? "unavailable");
+  try {
+    const buf = await page.screenshot(path ? { path } : {});
+    return { op: "screenshot", ok: true, unavailable: false, detail: path ? `saved ${path}` : "captured (in-memory)", value: path ? undefined : buf.byteLength };
+  } catch (e) {
+    return fail("screenshot", e);
+  }
+}
+async function browserBack() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("back", s.reason ?? "unavailable");
+  try {
+    await page.goBack();
+    return { op: "back", ok: true, unavailable: false, detail: `back to ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("back", e);
+  }
+}
+async function browserForward() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("forward", s.reason ?? "unavailable");
+  try {
+    await page.goForward();
+    return { op: "forward", ok: true, unavailable: false, detail: `forward to ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("forward", e);
+  }
+}
+async function browserGetCookie(name) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("get_cookie", s.reason ?? "unavailable");
+  try {
+    const cookies = await page.context().cookies();
+    const hit = cookies.filter((c) => c.name === name);
+    return { op: "get_cookie", ok: true, unavailable: false, detail: hit.length ? "found" : "not found", value: hit };
+  } catch (e) {
+    return fail("get_cookie", e);
+  }
+}
+async function browserSetCookie(name, value) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("set_cookie", s.reason ?? "unavailable");
+  try {
+    const url = page.url();
+    await page.context().addCookies([{ name, value, url }]);
+    return { op: "set_cookie", ok: true, unavailable: false, detail: `set ${name}` };
+  } catch (e) {
+    return fail("set_cookie", e);
+  }
+}
+async function browserClose() {
+  if (browser) {
+    await browser.close().catch(() => {
+      return;
+    });
+    browser = null;
+    page = null;
+  }
+}
+async function detectAuthForm() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("evaluate", s.reason ?? "unavailable");
+  try {
+    const value = await page.evaluate(() => {
+      const forms = Array.from(document.querySelectorAll("form"));
+      const loginForm = forms.find((f) => /login|signin|auth/i.test(f.action || "") || f.querySelector('input[type="password"]'));
+      if (!loginForm)
+        return { found: false };
+      const userField = loginForm.querySelector('input[type="email"], input[type="text"], input[name*="user"], input[name*="email"], input[name*="login"]');
+      const passField = loginForm.querySelector('input[type="password"]');
+      return {
+        found: true,
+        action: loginForm.action || "(self)",
+        has_user: Boolean(userField),
+        has_pass: Boolean(passField),
+        user_selector: userField ? `input[name="${userField.name || ""}"], input[type="${userField.type}"]` : null,
+        pass_selector: passField ? 'input[type="password"]' : null
+      };
+    });
+    return { op: "evaluate", ok: true, unavailable: false, detail: value.found ? "login form detected" : "no login form", value };
+  } catch (e) {
+    return fail("evaluate", e);
+  }
+}
+async function browserAgent(op, args = []) {
+  switch (op) {
+    case "open":
+      return browserOpen(args[0] ?? "");
+    case "navigate":
+      return browserNavigate(args[0] ?? "");
+    case "click":
+      return browserClick(args[0] ?? "");
+    case "type":
+      return browserType(args[0] ?? "", args[1] ?? "");
+    case "evaluate":
+      return browserEvaluate(args[0] ?? "");
+    case "screenshot":
+      return browserScreenshot(args[0] || undefined);
+    case "back":
+      return browserBack();
+    case "forward":
+      return browserForward();
+    case "get_cookie":
+      return browserGetCookie(args[0] ?? "");
+    case "set_cookie":
+      return browserSetCookie(args[0] ?? "", args[1] ?? "");
+  }
+}
+function browserDiagnostics() {
+  return { console_errors: [...consoleErrors], page_errors: [...pageErrors] };
+}
+var chromiumCache2 = null, browser = null, page = null, consoleErrors, pageErrors;
+var init_browser_agent = __esm(() => {
+  init_evidence();
+  consoleErrors = [];
+  pageErrors = [];
+});
+
 // src/sync.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync16, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync3 } from "node:fs";
 import { join as join12 } from "node:path";
@@ -18359,7 +18572,7 @@ function sourceFiles(root, max = 500) {
 function agentFor(type) {
   return AGENTS[type];
 }
-var reconAgent, webAgent, sourceAgent, analysisAgent, authAgent, validatorAgent, reviewerAgent, reporterAgent, mobileAgent, cloudAgent, commanderAgent, apiAgent, AGENTS;
+var reconAgent, webAgent, sourceAgent, analysisAgent, authAgent, validatorAgent, reviewerAgent, browserAgent2, reporterAgent, mobileAgent, cloudAgent, commanderAgent, apiAgent, AGENTS;
 var init_agents = __esm(() => {
   init_planner();
   init_reviewer();
@@ -18556,6 +18769,52 @@ var init_agents = __esm(() => {
       return { ok: true, output: { outcomes: results.map((r) => ({ id: r.hypothesis_id, outcome: r.outcome })) }, hypotheses, graph: emptyGraph() };
     }
   };
+  browserAgent2 = {
+    type: "browser",
+    responsibility: "Drive a real browser to detect DOM issues and auth flows.",
+    tools: ["browser_open", "browser_click", "browser_type", "browser_evaluate", "browser_screenshot", "browser_navigate", "browser_back", "browser_forward", "browser_get_cookie", "browser_set_cookie"],
+    async execute(_task, ctx) {
+      if (!/^https?:\/\//i.test(ctx.mission.target) || !ctx.scopeAllowed) {
+        return { ok: false, output: {}, hypotheses: [], graph: emptyGraph(), error: "browser agent requires an authorized URL target" };
+      }
+      await Promise.resolve().then(() => init_browser_agent());
+      const opened = await browserOpen(ctx.mission.target);
+      if (opened.unavailable) {
+        return { ok: false, output: {}, hypotheses: [], graph: emptyGraph(), error: opened.detail };
+      }
+      const auth = await detectAuthForm();
+      const diag = browserDiagnostics();
+      await browserClose();
+      const hypotheses = [];
+      const authInfo = auth.value ?? {};
+      if (authInfo.found) {
+        hypotheses.push(makeHypothesis({
+          type: "auth_flow_detected",
+          target: ctx.mission.target,
+          evidence: `login form detected (user_field=${authInfo.has_user}, pass_field=${authInfo.has_pass})`,
+          confidence: 0.6,
+          required_validation: "login flow",
+          potential_impact: "auth boundary"
+        }));
+      }
+      if (diag.console_errors.length > 0 || diag.page_errors.length > 0) {
+        hypotheses.push(makeHypothesis({
+          type: "js_runtime_error",
+          target: ctx.mission.target,
+          evidence: `console_errors=${diag.console_errors.length} page_errors=${diag.page_errors.length}`,
+          confidence: 0.4,
+          required_validation: "review",
+          potential_impact: "unspecified"
+        }));
+      }
+      return {
+        ok: true,
+        output: { opened: opened.ok, auth_form: authInfo.found ?? false, console_errors: diag.console_errors.length, page_errors: diag.page_errors.length },
+        hypotheses,
+        graph: emptyGraph()
+      };
+    }
+  };
   reporterAgent = {
     type: "reporter",
     responsibility: "Produce the final structured mission report.",
@@ -18666,7 +18925,8 @@ ${m.hypotheses.map((h) => `- [${h.status}] ${h.type} @ ${h.target} (confidence $
     analysis: analysisAgent,
     validator: validatorAgent,
     reviewer: reviewerAgent,
-    reporter: reporterAgent
+    reporter: reporterAgent,
+    browser: browserAgent2
   };
 });
 
@@ -18792,7 +19052,8 @@ var init_recovery = __esm(() => {
     analysis: ["source"],
     validator: ["reviewer"],
     reviewer: ["validator"],
-    reporter: []
+    reporter: [],
+    browser: ["web"]
   };
 });
 
@@ -53121,6 +53382,7 @@ async function browserValidate(check, target, payload) {
 }
 
 // src/server.ts
+init_browser_agent();
 init_universal_taint();
 
 // src/guidance.ts
@@ -54684,6 +54946,28 @@ function createServer() {
     const result = await browserValidate(check, target, payload);
     return { content: [{ type: "text", text: JSON.stringify(result) }] };
   });
+  server.registerTool("browser_agent", {
+    title: "Browser automation agent (session)",
+    description: "PHASE 12: drive a real headless-Chromium session. Ops: open, navigate, click, type, evaluate, screenshot, back, forward, get_cookie, set_cookie, plus detect_auth_form, diagnostics, close. Enables multi-step flows (login/MFA) and DOM issue detection. Requires playwright-core (optional peer dependency).",
+    inputSchema: {
+      op: _enum(["open", "navigate", "click", "type", "evaluate", "screenshot", "back", "forward", "get_cookie", "set_cookie", "detect_auth_form", "diagnostics", "close"]),
+      args: array(string2()).optional().describe("Positional args (url, selector, text, js, cookie name/value, screenshot path)")
+    }
+  }, async ({ op, args }) => {
+    if (op === "detect_auth_form") {
+      const r = await detectAuthForm();
+      return { content: [{ type: "text", text: JSON.stringify(r) }] };
+    }
+    if (op === "diagnostics") {
+      return { content: [{ type: "text", text: JSON.stringify(browserDiagnostics()) }] };
+    }
+    if (op === "close") {
+      await browserClose();
+      return { content: [{ type: "text", text: JSON.stringify({ ok: true, detail: "session closed" }) }] };
+    }
+    const r = await browserAgent(op, args ?? []);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
   server.registerTool("taint_tree", {
     title: "Whole-tree taint scan",
     description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.51",
+  "version": "1.0.52",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {