blitzstrike 1.0.52 → 1.0.54

package/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.54] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 14: budget controller)
+
+- **Budget Controller** (`src/mission/budget.ts`, §22):
+  - `budgetStatus()` — tracks time / tasks / requests / tokens / cost with
+    per-dimension overrun flags.
+  - `budgetOverrun()` — detects overruns and returns a specific reason
+    (e.g. `budget overrun: tasks, requests`).
+  - `consumeTasks()` / `consumeTokens()` — increment consumption counters.
+  - `perTaskOverrun()` — enforces the per-task request budget.
+- Extended the `Budget` type with `max_tokens`, `max_cost_usd`,
+  `per_task_budget`, `started_at`, and `used_tokens`/`used_cost_usd`.
+- Mission Control now terminates gracefully on ANY budget dimension overrun
+  (not just tasks) and records a final budget snapshot in the decision log.
+
+## [1.0.53] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 13: model router)
+
+- **Model Router** (`src/mission/router.ts`, §21):
+  - Pure routing layer — never calls a model. Deterministic by default.
+  - `routeTask()` — maps an agent type to a model tier (`large`/`medium`/`small`)
+    only when a provider is configured; otherwise routes to `none`.
+  - `AGENT_TIER` — §21 mapping (planning/source/review → large; attack execution
+    → medium; verification → small).
+  - `loadRouterConfig()` — reads `BLITZSTRIKE_MODEL_PROVIDER` / `_LARGE` /
+    `_MEDIUM` / `_SMALL` env vars.
+  - `routingPlan()` — full plan (all `none` when deterministic).
+- Mission Control records the routing decision (tier) per task and the overall
+  routing plan in the mission `decision_log`.
+
 ## [1.0.52] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 12: browser automation agent)

package/dist/index.js

@@ -18097,10 +18097,16 @@ function newMission(id, target, scope, mode, budget) {
       max_time_seconds: 3600,
       max_tasks: 200,
       max_requests: 1000,
+      max_tokens: 2000000,
+      max_cost_usd: 5,
       max_parallel_workers: 4,
       risk: "medium",
+      per_task_budget: { max_time_seconds: 60, max_requests: 50 },
+      started_at: Date.now(),
       used_tasks: 0,
       used_requests: 0,
+      used_tokens: 0,
+      used_cost_usd: 0,
       ...budget ?? {}
     },
     discovered_assets: [],
@@ -19085,6 +19091,97 @@ var init_memory2 = __esm(() => {
   init_memory();
 });
 
+// src/mission/router.ts
+function isModelConfigured(config) {
+  return Boolean(config?.provider);
+}
+function routeTask(agent, config) {
+  if (!isModelConfigured(config)) {
+    return { agent, tier: "none", model: null, deterministic: true };
+  }
+  const tier = AGENT_TIER[agent] ?? "medium";
+  const key = `model_${tier}`;
+  const model = config?.[key] ?? null;
+  return { agent, tier, model, deterministic: model === null };
+}
+function loadRouterConfig(env = process.env) {
+  return {
+    provider: env.BLITZSTRIKE_MODEL_PROVIDER || undefined,
+    model_large: env.BLITZSTRIKE_MODEL_LARGE || undefined,
+    model_medium: env.BLITZSTRIKE_MODEL_MEDIUM || undefined,
+    model_small: env.BLITZSTRIKE_MODEL_SMALL || undefined
+  };
+}
+function routingPlan(config) {
+  if (!isModelConfigured(config)) {
+    const out = {};
+    for (const k of Object.keys(AGENT_TIER))
+      out[k] = "none";
+    return out;
+  }
+  return { ...AGENT_TIER };
+}
+var AGENT_TIER;
+var init_router = __esm(() => {
+  AGENT_TIER = {
+    commander: "large",
+    source: "large",
+    analysis: "large",
+    reviewer: "large",
+    recon: "medium",
+    web: "medium",
+    api: "medium",
+    auth: "medium",
+    mobile: "medium",
+    cloud: "medium",
+    reporter: "medium",
+    validator: "small",
+    browser: "small"
+  };
+});
+
+// src/mission/budget.ts
+function clampRatio(used, max) {
+  if (max <= 0)
+    return 0;
+  return Math.max(0, Math.min(1, used / max));
+}
+function budgetStatus(budget, now = Date.now()) {
+  const elapsed = Math.max(0, (now - budget.started_at) / 1000);
+  const dims = [
+    ["time", "time (s)", elapsed, budget.max_time_seconds],
+    ["tasks", "tasks", budget.used_tasks, budget.max_tasks],
+    ["requests", "requests", budget.used_requests, budget.max_requests],
+    ["tokens", "tokens", budget.used_tokens, budget.max_tokens],
+    ["cost", "cost (USD)", budget.used_cost_usd, budget.max_cost_usd]
+  ];
+  return dims.map(([key, label, used, max]) => ({
+    key,
+    label,
+    used: Number(used.toFixed(2)),
+    max,
+    overrun: used >= max,
+    ratio: clampRatio(used, max)
+  }));
+}
+function budgetOverrun(budget, now = Date.now()) {
+  const dims = budgetStatus(budget, now).filter((d) => d.overrun);
+  if (dims.length === 0)
+    return { overrun: false, reason: null, dimensions: [] };
+  return {
+    overrun: true,
+    reason: `budget overrun: ${dims.map((d) => d.key).join(", ")}`,
+    dimensions: dims.map((d) => d.key)
+  };
+}
+function consumeTasks(budget, tasks, requests) {
+  return {
+    ...budget,
+    used_tasks: budget.used_tasks + tasks,
+    used_requests: budget.used_requests + requests
+  };
+}
+
 // src/mission/control.ts
 import { existsSync as existsSync8, statSync as statSync4 } from "node:fs";
 function scopeAllowed(mission) {
@@ -19155,7 +19252,10 @@ async function executeTask(task, mission, scope) {
   }
 }
 function budgetExhausted(mission) {
-  return mission.budget.used_tasks >= mission.budget.max_tasks;
+  return budgetOverrun(mission.budget).overrun;
+}
+function budgetReason(mission) {
+  return budgetOverrun(mission.budget).reason ?? "budget_exhausted";
 }
 async function runMission(mission) {
   if (/^https?:\/\//i.test(mission.target) && !scopeAllowed(mission)) {
@@ -19164,6 +19264,11 @@ async function runMission(mission) {
   let m = { ...mission, status: "running" };
   m.tasks = buildInitialTasks(m);
   m.graph = loadEscalationGraph(m.graph);
+  const routerCfg = loadRouterConfig();
+  m.decision_log = [
+    ...m.decision_log,
+    { at: new Date().toISOString(), agent: "router", decision: isModelConfigured(routerCfg) ? `model routing active: ${JSON.stringify(routingPlan(routerCfg))}` : "deterministic (no model provider configured)" }
+  ];
   m = saveMission(m);
   const scope = m.scope.join(",");
   let iterations = 0;
@@ -19171,7 +19276,7 @@ async function runMission(mission) {
   while (iterations < maxIterations) {
     iterations += 1;
     if (budgetExhausted(m)) {
-      m = { ...m, termination_reason: "budget_exhausted" };
+      m = { ...m, termination_reason: budgetReason(m) };
       break;
     }
     const { ready, blocked } = schedule(m.tasks);
@@ -19193,20 +19298,22 @@ async function runMission(mission) {
     const results = await Promise.all(batch.map((t) => executeTask(t, m, scope)));
     for (const r of results) {
       const decision = r.ok ? `${r.task.agent_type} completed (${Object.keys(r.output).length} output fields, ${r.hypotheses.length} hypotheses)` : `${r.task.agent_type} failed: ${r.error ?? "unknown"}`;
+      const route = routeTask(r.task.agent_type, routerCfg);
+      const logEntry = (entryDecision) => ({ at: new Date().toISOString(), agent: r.task.agent_type, decision: entryDecision, tier: route.tier });
       if (r.ok) {
         m = {
           ...m,
           tasks: setTask(m.tasks, r.task.task_id, { status: "success", result: r.output }),
           hypotheses: mergeHypotheses(m.hypotheses, r.hypotheses),
           graph: mergeGraphs(m.graph, r.graph),
-          decision_log: [...m.decision_log, { at: new Date().toISOString(), agent: r.task.agent_type, decision }]
+          decision_log: [...m.decision_log, logEntry(decision)]
         };
         if (r.task.agent_type === "reporter") {
           m = { ...m, report: r.output };
         }
       } else {
         const rec = recoveryDecision(r.task, r.error ?? "unknown error");
-        const stamp = { at: new Date().toISOString(), agent: r.task.agent_type, decision };
+        const stamp = logEntry(decision);
         if (rec.action === "retry") {
           const retried = setTask(m.tasks, r.task.task_id, { status: "retry", error: r.error ?? null });
           m = { ...m, tasks: retried, decision_log: [...m.decision_log, stamp] };
@@ -19230,7 +19337,7 @@ async function runMission(mission) {
         }
       }
     }
-    m.budget.used_tasks += batch.length;
+    m.budget = consumeTasks(m.budget, batch.length, 0);
     m = saveMission(m);
   }
   return finalize2(m);
@@ -19238,7 +19345,7 @@ async function runMission(mission) {
 function finalize2(mission) {
   let m = mission;
   if (budgetExhausted(m)) {
-    m = { ...m, status: "terminated", termination_reason: "budget_exhausted" };
+    m = { ...m, status: "terminated", termination_reason: budgetReason(m) };
   } else {
     m = { ...m, status: "completed", termination_reason: "all tasks resolved" };
   }
@@ -19251,6 +19358,8 @@ function finalize2(mission) {
   if (mem.saved > 0) {
     m = { ...m, memory_refs: [...m.memory_refs, `persisted:${mem.saved} (${mem.deduped} deduped)`] };
   }
+  const budgetSummary = budgetStatus(m.budget).map((d) => `${d.key}=${d.used}/${d.max}`).join(", ");
+  m = { ...m, decision_log: [...m.decision_log, { at: new Date().toISOString(), agent: "budget", decision: `final budget: ${budgetSummary}` }] };
   return saveMission(m);
 }
 async function startMission(target, mode, opts = {}) {
@@ -19274,6 +19383,7 @@ var init_control = __esm(() => {
   init_coverage();
   init_recovery();
   init_memory2();
+  init_router();
   MODE_PROFILES = {
     web: { agents: ["recon", "web", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
     api: { agents: ["recon", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.52",
+  "version": "1.0.54",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {