blitzstrike 1.0.52 → 1.0.53

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.53] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 13: model router)
+
+- **Model Router** (`src/mission/router.ts`, §21):
+  - Pure routing layer — never calls a model. Deterministic by default.
+  - `routeTask()` — maps an agent type to a model tier (`large`/`medium`/`small`)
+    only when a provider is configured; otherwise routes to `none`.
+  - `AGENT_TIER` — §21 mapping (planning/source/review → large; attack execution
+    → medium; verification → small).
+  - `loadRouterConfig()` — reads `BLITZSTRIKE_MODEL_PROVIDER` / `_LARGE` /
+    `_MEDIUM` / `_SMALL` env vars.
+  - `routingPlan()` — full plan (all `none` when deterministic).
+- Mission Control records the routing decision (tier) per task and the overall
+  routing plan in the mission `decision_log`.
+
 ## [1.0.52] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 12: browser automation agent)

package/dist/index.js

@@ -19085,6 +19085,55 @@ var init_memory2 = __esm(() => {
   init_memory();
 });
 
+// src/mission/router.ts
+function isModelConfigured(config) {
+  return Boolean(config?.provider);
+}
+function routeTask(agent, config) {
+  if (!isModelConfigured(config)) {
+    return { agent, tier: "none", model: null, deterministic: true };
+  }
+  const tier = AGENT_TIER[agent] ?? "medium";
+  const key = `model_${tier}`;
+  const model = config?.[key] ?? null;
+  return { agent, tier, model, deterministic: model === null };
+}
+function loadRouterConfig(env = process.env) {
+  return {
+    provider: env.BLITZSTRIKE_MODEL_PROVIDER || undefined,
+    model_large: env.BLITZSTRIKE_MODEL_LARGE || undefined,
+    model_medium: env.BLITZSTRIKE_MODEL_MEDIUM || undefined,
+    model_small: env.BLITZSTRIKE_MODEL_SMALL || undefined
+  };
+}
+function routingPlan(config) {
+  if (!isModelConfigured(config)) {
+    const out = {};
+    for (const k of Object.keys(AGENT_TIER))
+      out[k] = "none";
+    return out;
+  }
+  return { ...AGENT_TIER };
+}
+var AGENT_TIER;
+var init_router = __esm(() => {
+  AGENT_TIER = {
+    commander: "large",
+    source: "large",
+    analysis: "large",
+    reviewer: "large",
+    recon: "medium",
+    web: "medium",
+    api: "medium",
+    auth: "medium",
+    mobile: "medium",
+    cloud: "medium",
+    reporter: "medium",
+    validator: "small",
+    browser: "small"
+  };
+});
+
 // src/mission/control.ts
 import { existsSync as existsSync8, statSync as statSync4 } from "node:fs";
 function scopeAllowed(mission) {
@@ -19164,6 +19213,11 @@ async function runMission(mission) {
   let m = { ...mission, status: "running" };
   m.tasks = buildInitialTasks(m);
   m.graph = loadEscalationGraph(m.graph);
+  const routerCfg = loadRouterConfig();
+  m.decision_log = [
+    ...m.decision_log,
+    { at: new Date().toISOString(), agent: "router", decision: isModelConfigured(routerCfg) ? `model routing active: ${JSON.stringify(routingPlan(routerCfg))}` : "deterministic (no model provider configured)" }
+  ];
   m = saveMission(m);
   const scope = m.scope.join(",");
   let iterations = 0;
@@ -19193,20 +19247,22 @@ async function runMission(mission) {
     const results = await Promise.all(batch.map((t) => executeTask(t, m, scope)));
     for (const r of results) {
       const decision = r.ok ? `${r.task.agent_type} completed (${Object.keys(r.output).length} output fields, ${r.hypotheses.length} hypotheses)` : `${r.task.agent_type} failed: ${r.error ?? "unknown"}`;
+      const route = routeTask(r.task.agent_type, routerCfg);
+      const logEntry = (entryDecision) => ({ at: new Date().toISOString(), agent: r.task.agent_type, decision: entryDecision, tier: route.tier });
       if (r.ok) {
         m = {
           ...m,
           tasks: setTask(m.tasks, r.task.task_id, { status: "success", result: r.output }),
           hypotheses: mergeHypotheses(m.hypotheses, r.hypotheses),
           graph: mergeGraphs(m.graph, r.graph),
-          decision_log: [...m.decision_log, { at: new Date().toISOString(), agent: r.task.agent_type, decision }]
+          decision_log: [...m.decision_log, logEntry(decision)]
         };
         if (r.task.agent_type === "reporter") {
           m = { ...m, report: r.output };
         }
       } else {
         const rec = recoveryDecision(r.task, r.error ?? "unknown error");
-        const stamp = { at: new Date().toISOString(), agent: r.task.agent_type, decision };
+        const stamp = logEntry(decision);
         if (rec.action === "retry") {
           const retried = setTask(m.tasks, r.task.task_id, { status: "retry", error: r.error ?? null });
           m = { ...m, tasks: retried, decision_log: [...m.decision_log, stamp] };
@@ -19274,6 +19330,7 @@ var init_control = __esm(() => {
   init_coverage();
   init_recovery();
   init_memory2();
+  init_router();
   MODE_PROFILES = {
     web: { agents: ["recon", "web", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
     api: { agents: ["recon", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.52",
+  "version": "1.0.53",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {