blitzstrike 1.0.51 → 1.0.53

package/CHANGELOG.md

@@ -5,6 +5,36 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.53] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 13: model router)
+
+- **Model Router** (`src/mission/router.ts`, §21):
+  - Pure routing layer — never calls a model. Deterministic by default.
+  - `routeTask()` — maps an agent type to a model tier (`large`/`medium`/`small`)
+    only when a provider is configured; otherwise routes to `none`.
+  - `AGENT_TIER` — §21 mapping (planning/source/review → large; attack execution
+    → medium; verification → small).
+  - `loadRouterConfig()` — reads `BLITZSTRIKE_MODEL_PROVIDER` / `_LARGE` /
+    `_MEDIUM` / `_SMALL` env vars.
+  - `routingPlan()` — full plan (all `none` when deterministic).
+- Mission Control records the routing decision (tier) per task and the overall
+  routing plan in the mission `decision_log`.
+
+## [1.0.52] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 12: browser automation agent)
+
+- **Browser Automation Agent** (`src/browser-agent.ts`, §16):
+  - Session-based (one persistent page) so multi-step flows work.
+  - Ops: `open`/`navigate`/`click`/`type`/`evaluate`/`screenshot`/`back`/`forward`/
+    `get_cookie`/`set_cookie`, plus `detectAuthForm()` and `browserDiagnostics()`.
+  - Graceful degradation — every op reports `unavailable` when `playwright-core`
+    (optional peer) is missing, never throws.
+- New `@browser` mission agent (URL-scope-gated) — detects login forms and JS
+  runtime errors and emits auth-flow hypotheses.
+- New MCP tool `browser_agent` (session ops + detect_auth_form + diagnostics + close).
+
 ## [1.0.51] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 11: adversarial reviewer)

package/dist/index.js

@@ -17722,6 +17722,219 @@ var init_universal_taint = __esm(() => {
   extensionMap = new Map;
 });
 
+// src/browser-agent.ts
+async function ensureChromium2() {
+  if (chromiumCache2)
+    return chromiumCache2;
+  try {
+    chromiumCache2 = await import("playwright-core");
+    return chromiumCache2;
+  } catch {
+    return null;
+  }
+}
+async function ensureSession() {
+  if (page)
+    return { available: true };
+  const chr = await ensureChromium2();
+  if (!chr)
+    return { available: false, reason: "playwright-core not installed (optional peer dependency)" };
+  try {
+    browser = await chr.chromium.launch({ headless: true });
+    page = await browser.newPage();
+    page.on("console", (m) => {
+      const msg = m;
+      if (msg.type() === "error")
+        consoleErrors.push(msg.text());
+    });
+    page.on("pageerror", (e) => pageErrors.push(String(e)));
+    return { available: true };
+  } catch (e) {
+    return { available: false, reason: e instanceof Error ? e.message : String(e) };
+  }
+}
+function unavailable2(op, reason) {
+  return { op, ok: false, unavailable: true, detail: reason };
+}
+function fail(op, e) {
+  return { op, ok: false, unavailable: false, detail: e instanceof Error ? e.message : String(e) };
+}
+async function browserOpen(url) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("open", s.reason ?? "unavailable");
+  try {
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 20000 });
+    return { op: "open", ok: true, unavailable: false, detail: `opened ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("open", e);
+  }
+}
+async function browserNavigate(url) {
+  return browserOpen(url);
+}
+async function browserClick(selector) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("click", s.reason ?? "unavailable");
+  try {
+    await page.click(selector);
+    return { op: "click", ok: true, unavailable: false, detail: `clicked ${selector}` };
+  } catch (e) {
+    return fail("click", e);
+  }
+}
+async function browserType(selector, text) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("type", s.reason ?? "unavailable");
+  try {
+    await page.fill(selector, text);
+    return { op: "type", ok: true, unavailable: false, detail: `typed into ${selector}` };
+  } catch (e) {
+    return fail("type", e);
+  }
+}
+async function browserEvaluate(js) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("evaluate", s.reason ?? "unavailable");
+  try {
+    const value = await page.evaluate((code) => {
+      const fn = new Function(`"use strict"; return (${code})`)();
+      return typeof fn === "function" ? fn() : fn;
+    }, js);
+    return { op: "evaluate", ok: true, unavailable: false, detail: "evaluated", value };
+  } catch (e) {
+    return fail("evaluate", e);
+  }
+}
+async function browserScreenshot(path) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("screenshot", s.reason ?? "unavailable");
+  try {
+    const buf = await page.screenshot(path ? { path } : {});
+    return { op: "screenshot", ok: true, unavailable: false, detail: path ? `saved ${path}` : "captured (in-memory)", value: path ? undefined : buf.byteLength };
+  } catch (e) {
+    return fail("screenshot", e);
+  }
+}
+async function browserBack() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("back", s.reason ?? "unavailable");
+  try {
+    await page.goBack();
+    return { op: "back", ok: true, unavailable: false, detail: `back to ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("back", e);
+  }
+}
+async function browserForward() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("forward", s.reason ?? "unavailable");
+  try {
+    await page.goForward();
+    return { op: "forward", ok: true, unavailable: false, detail: `forward to ${redactSecrets(page.url())}` };
+  } catch (e) {
+    return fail("forward", e);
+  }
+}
+async function browserGetCookie(name) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("get_cookie", s.reason ?? "unavailable");
+  try {
+    const cookies = await page.context().cookies();
+    const hit = cookies.filter((c) => c.name === name);
+    return { op: "get_cookie", ok: true, unavailable: false, detail: hit.length ? "found" : "not found", value: hit };
+  } catch (e) {
+    return fail("get_cookie", e);
+  }
+}
+async function browserSetCookie(name, value) {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("set_cookie", s.reason ?? "unavailable");
+  try {
+    const url = page.url();
+    await page.context().addCookies([{ name, value, url }]);
+    return { op: "set_cookie", ok: true, unavailable: false, detail: `set ${name}` };
+  } catch (e) {
+    return fail("set_cookie", e);
+  }
+}
+async function browserClose() {
+  if (browser) {
+    await browser.close().catch(() => {
+      return;
+    });
+    browser = null;
+    page = null;
+  }
+}
+async function detectAuthForm() {
+  const s = await ensureSession();
+  if (!s.available || !page)
+    return unavailable2("evaluate", s.reason ?? "unavailable");
+  try {
+    const value = await page.evaluate(() => {
+      const forms = Array.from(document.querySelectorAll("form"));
+      const loginForm = forms.find((f) => /login|signin|auth/i.test(f.action || "") || f.querySelector('input[type="password"]'));
+      if (!loginForm)
+        return { found: false };
+      const userField = loginForm.querySelector('input[type="email"], input[type="text"], input[name*="user"], input[name*="email"], input[name*="login"]');
+      const passField = loginForm.querySelector('input[type="password"]');
+      return {
+        found: true,
+        action: loginForm.action || "(self)",
+        has_user: Boolean(userField),
+        has_pass: Boolean(passField),
+        user_selector: userField ? `input[name="${userField.name || ""}"], input[type="${userField.type}"]` : null,
+        pass_selector: passField ? 'input[type="password"]' : null
+      };
+    });
+    return { op: "evaluate", ok: true, unavailable: false, detail: value.found ? "login form detected" : "no login form", value };
+  } catch (e) {
+    return fail("evaluate", e);
+  }
+}
+async function browserAgent(op, args = []) {
+  switch (op) {
+    case "open":
+      return browserOpen(args[0] ?? "");
+    case "navigate":
+      return browserNavigate(args[0] ?? "");
+    case "click":
+      return browserClick(args[0] ?? "");
+    case "type":
+      return browserType(args[0] ?? "", args[1] ?? "");
+    case "evaluate":
+      return browserEvaluate(args[0] ?? "");
+    case "screenshot":
+      return browserScreenshot(args[0] || undefined);
+    case "back":
+      return browserBack();
+    case "forward":
+      return browserForward();
+    case "get_cookie":
+      return browserGetCookie(args[0] ?? "");
+    case "set_cookie":
+      return browserSetCookie(args[0] ?? "", args[1] ?? "");
+  }
+}
+function browserDiagnostics() {
+  return { console_errors: [...consoleErrors], page_errors: [...pageErrors] };
+}
+var chromiumCache2 = null, browser = null, page = null, consoleErrors, pageErrors;
+var init_browser_agent = __esm(() => {
+  init_evidence();
+  consoleErrors = [];
+  pageErrors = [];
+});
+
 // src/sync.ts
 import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync4, readFileSync as readFileSync16, readdirSync as readdirSync5, statSync as statSync3, rmSync as rmSync3 } from "node:fs";
 import { join as join12 } from "node:path";
@@ -18359,7 +18572,7 @@ function sourceFiles(root, max = 500) {
 function agentFor(type) {
   return AGENTS[type];
 }
-var reconAgent, webAgent, sourceAgent, analysisAgent, authAgent, validatorAgent, reviewerAgent, reporterAgent, mobileAgent, cloudAgent, commanderAgent, apiAgent, AGENTS;
+var reconAgent, webAgent, sourceAgent, analysisAgent, authAgent, validatorAgent, reviewerAgent, browserAgent2, reporterAgent, mobileAgent, cloudAgent, commanderAgent, apiAgent, AGENTS;
 var init_agents = __esm(() => {
   init_planner();
   init_reviewer();
@@ -18556,6 +18769,52 @@ var init_agents = __esm(() => {
       return { ok: true, output: { outcomes: results.map((r) => ({ id: r.hypothesis_id, outcome: r.outcome })) }, hypotheses, graph: emptyGraph() };
     }
   };
+  browserAgent2 = {
+    type: "browser",
+    responsibility: "Drive a real browser to detect DOM issues and auth flows.",
+    tools: ["browser_open", "browser_click", "browser_type", "browser_evaluate", "browser_screenshot", "browser_navigate", "browser_back", "browser_forward", "browser_get_cookie", "browser_set_cookie"],
+    async execute(_task, ctx) {
+      if (!/^https?:\/\//i.test(ctx.mission.target) || !ctx.scopeAllowed) {
+        return { ok: false, output: {}, hypotheses: [], graph: emptyGraph(), error: "browser agent requires an authorized URL target" };
+      }
+      await Promise.resolve().then(() => init_browser_agent());
+      const opened = await browserOpen(ctx.mission.target);
+      if (opened.unavailable) {
+        return { ok: false, output: {}, hypotheses: [], graph: emptyGraph(), error: opened.detail };
+      }
+      const auth = await detectAuthForm();
+      const diag = browserDiagnostics();
+      await browserClose();
+      const hypotheses = [];
+      const authInfo = auth.value ?? {};
+      if (authInfo.found) {
+        hypotheses.push(makeHypothesis({
+          type: "auth_flow_detected",
+          target: ctx.mission.target,
+          evidence: `login form detected (user_field=${authInfo.has_user}, pass_field=${authInfo.has_pass})`,
+          confidence: 0.6,
+          required_validation: "login flow",
+          potential_impact: "auth boundary"
+        }));
+      }
+      if (diag.console_errors.length > 0 || diag.page_errors.length > 0) {
+        hypotheses.push(makeHypothesis({
+          type: "js_runtime_error",
+          target: ctx.mission.target,
+          evidence: `console_errors=${diag.console_errors.length} page_errors=${diag.page_errors.length}`,
+          confidence: 0.4,
+          required_validation: "review",
+          potential_impact: "unspecified"
+        }));
+      }
+      return {
+        ok: true,
+        output: { opened: opened.ok, auth_form: authInfo.found ?? false, console_errors: diag.console_errors.length, page_errors: diag.page_errors.length },
+        hypotheses,
+        graph: emptyGraph()
+      };
+    }
+  };
   reporterAgent = {
     type: "reporter",
     responsibility: "Produce the final structured mission report.",
@@ -18666,7 +18925,8 @@ ${m.hypotheses.map((h) => `- [${h.status}] ${h.type} @ ${h.target} (confidence $
     analysis: analysisAgent,
     validator: validatorAgent,
     reviewer: reviewerAgent,
-    reporter: reporterAgent
+    reporter: reporterAgent,
+    browser: browserAgent2
   };
 });
 
@@ -18792,7 +19052,8 @@ var init_recovery = __esm(() => {
     analysis: ["source"],
     validator: ["reviewer"],
     reviewer: ["validator"],
-    reporter: []
+    reporter: [],
+    browser: ["web"]
   };
 });
 
@@ -18824,6 +19085,55 @@ var init_memory2 = __esm(() => {
   init_memory();
 });
 
+// src/mission/router.ts
+function isModelConfigured(config) {
+  return Boolean(config?.provider);
+}
+function routeTask(agent, config) {
+  if (!isModelConfigured(config)) {
+    return { agent, tier: "none", model: null, deterministic: true };
+  }
+  const tier = AGENT_TIER[agent] ?? "medium";
+  const key = `model_${tier}`;
+  const model = config?.[key] ?? null;
+  return { agent, tier, model, deterministic: model === null };
+}
+function loadRouterConfig(env = process.env) {
+  return {
+    provider: env.BLITZSTRIKE_MODEL_PROVIDER || undefined,
+    model_large: env.BLITZSTRIKE_MODEL_LARGE || undefined,
+    model_medium: env.BLITZSTRIKE_MODEL_MEDIUM || undefined,
+    model_small: env.BLITZSTRIKE_MODEL_SMALL || undefined
+  };
+}
+function routingPlan(config) {
+  if (!isModelConfigured(config)) {
+    const out = {};
+    for (const k of Object.keys(AGENT_TIER))
+      out[k] = "none";
+    return out;
+  }
+  return { ...AGENT_TIER };
+}
+var AGENT_TIER;
+var init_router = __esm(() => {
+  AGENT_TIER = {
+    commander: "large",
+    source: "large",
+    analysis: "large",
+    reviewer: "large",
+    recon: "medium",
+    web: "medium",
+    api: "medium",
+    auth: "medium",
+    mobile: "medium",
+    cloud: "medium",
+    reporter: "medium",
+    validator: "small",
+    browser: "small"
+  };
+});
+
 // src/mission/control.ts
 import { existsSync as existsSync8, statSync as statSync4 } from "node:fs";
 function scopeAllowed(mission) {
@@ -18903,6 +19213,11 @@ async function runMission(mission) {
   let m = { ...mission, status: "running" };
   m.tasks = buildInitialTasks(m);
   m.graph = loadEscalationGraph(m.graph);
+  const routerCfg = loadRouterConfig();
+  m.decision_log = [
+    ...m.decision_log,
+    { at: new Date().toISOString(), agent: "router", decision: isModelConfigured(routerCfg) ? `model routing active: ${JSON.stringify(routingPlan(routerCfg))}` : "deterministic (no model provider configured)" }
+  ];
   m = saveMission(m);
   const scope = m.scope.join(",");
   let iterations = 0;
@@ -18932,20 +19247,22 @@ async function runMission(mission) {
     const results = await Promise.all(batch.map((t) => executeTask(t, m, scope)));
     for (const r of results) {
       const decision = r.ok ? `${r.task.agent_type} completed (${Object.keys(r.output).length} output fields, ${r.hypotheses.length} hypotheses)` : `${r.task.agent_type} failed: ${r.error ?? "unknown"}`;
+      const route = routeTask(r.task.agent_type, routerCfg);
+      const logEntry = (entryDecision) => ({ at: new Date().toISOString(), agent: r.task.agent_type, decision: entryDecision, tier: route.tier });
       if (r.ok) {
         m = {
           ...m,
           tasks: setTask(m.tasks, r.task.task_id, { status: "success", result: r.output }),
           hypotheses: mergeHypotheses(m.hypotheses, r.hypotheses),
           graph: mergeGraphs(m.graph, r.graph),
-          decision_log: [...m.decision_log, { at: new Date().toISOString(), agent: r.task.agent_type, decision }]
+          decision_log: [...m.decision_log, logEntry(decision)]
         };
         if (r.task.agent_type === "reporter") {
           m = { ...m, report: r.output };
         }
       } else {
         const rec = recoveryDecision(r.task, r.error ?? "unknown error");
-        const stamp = { at: new Date().toISOString(), agent: r.task.agent_type, decision };
+        const stamp = logEntry(decision);
         if (rec.action === "retry") {
           const retried = setTask(m.tasks, r.task.task_id, { status: "retry", error: r.error ?? null });
           m = { ...m, tasks: retried, decision_log: [...m.decision_log, stamp] };
@@ -19013,6 +19330,7 @@ var init_control = __esm(() => {
   init_coverage();
   init_recovery();
   init_memory2();
+  init_router();
   MODE_PROFILES = {
     web: { agents: ["recon", "web", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
     api: { agents: ["recon", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
@@ -53121,6 +53439,7 @@ async function browserValidate(check, target, payload) {
 }
 
 // src/server.ts
+init_browser_agent();
 init_universal_taint();
 
 // src/guidance.ts
@@ -54684,6 +55003,28 @@ function createServer() {
     const result = await browserValidate(check, target, payload);
     return { content: [{ type: "text", text: JSON.stringify(result) }] };
   });
+  server.registerTool("browser_agent", {
+    title: "Browser automation agent (session)",
+    description: "PHASE 12: drive a real headless-Chromium session. Ops: open, navigate, click, type, evaluate, screenshot, back, forward, get_cookie, set_cookie, plus detect_auth_form, diagnostics, close. Enables multi-step flows (login/MFA) and DOM issue detection. Requires playwright-core (optional peer dependency).",
+    inputSchema: {
+      op: _enum(["open", "navigate", "click", "type", "evaluate", "screenshot", "back", "forward", "get_cookie", "set_cookie", "detect_auth_form", "diagnostics", "close"]),
+      args: array(string2()).optional().describe("Positional args (url, selector, text, js, cookie name/value, screenshot path)")
+    }
+  }, async ({ op, args }) => {
+    if (op === "detect_auth_form") {
+      const r = await detectAuthForm();
+      return { content: [{ type: "text", text: JSON.stringify(r) }] };
+    }
+    if (op === "diagnostics") {
+      return { content: [{ type: "text", text: JSON.stringify(browserDiagnostics()) }] };
+    }
+    if (op === "close") {
+      await browserClose();
+      return { content: [{ type: "text", text: JSON.stringify({ ok: true, detail: "session closed" }) }] };
+    }
+    const r = await browserAgent(op, args ?? []);
+    return { content: [{ type: "text", text: JSON.stringify(r) }] };
+  });
   server.registerTool("taint_tree", {
     title: "Whole-tree taint scan",
     description: "EAGLE-EYE: run inter-procedural taint analysis across an entire source tree.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.51",
+  "version": "1.0.53",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {