blitzstrike 1.0.53 → 1.0.54

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.54] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 14: budget controller)
+
+- **Budget Controller** (`src/mission/budget.ts`, §22):
+  - `budgetStatus()` — tracks time / tasks / requests / tokens / cost with
+    per-dimension overrun flags.
+  - `budgetOverrun()` — detects overruns and returns a specific reason
+    (e.g. `budget overrun: tasks, requests`).
+  - `consumeTasks()` / `consumeTokens()` — increment consumption counters.
+  - `perTaskOverrun()` — enforces the per-task request budget.
+- Extended the `Budget` type with `max_tokens`, `max_cost_usd`,
+  `per_task_budget`, `started_at`, and `used_tokens`/`used_cost_usd`.
+- Mission Control now terminates gracefully on ANY budget dimension overrun
+  (not just tasks) and records a final budget snapshot in the decision log.
+
 ## [1.0.53] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 13: model router)

package/dist/index.js

@@ -18097,10 +18097,16 @@ function newMission(id, target, scope, mode, budget) {
       max_time_seconds: 3600,
       max_tasks: 200,
       max_requests: 1000,
+      max_tokens: 2000000,
+      max_cost_usd: 5,
       max_parallel_workers: 4,
       risk: "medium",
+      per_task_budget: { max_time_seconds: 60, max_requests: 50 },
+      started_at: Date.now(),
       used_tasks: 0,
       used_requests: 0,
+      used_tokens: 0,
+      used_cost_usd: 0,
       ...budget ?? {}
     },
     discovered_assets: [],
@@ -19134,6 +19140,48 @@ var init_router = __esm(() => {
   };
 });
 
+// src/mission/budget.ts
+function clampRatio(used, max) {
+  if (max <= 0)
+    return 0;
+  return Math.max(0, Math.min(1, used / max));
+}
+function budgetStatus(budget, now = Date.now()) {
+  const elapsed = Math.max(0, (now - budget.started_at) / 1000);
+  const dims = [
+    ["time", "time (s)", elapsed, budget.max_time_seconds],
+    ["tasks", "tasks", budget.used_tasks, budget.max_tasks],
+    ["requests", "requests", budget.used_requests, budget.max_requests],
+    ["tokens", "tokens", budget.used_tokens, budget.max_tokens],
+    ["cost", "cost (USD)", budget.used_cost_usd, budget.max_cost_usd]
+  ];
+  return dims.map(([key, label, used, max]) => ({
+    key,
+    label,
+    used: Number(used.toFixed(2)),
+    max,
+    overrun: used >= max,
+    ratio: clampRatio(used, max)
+  }));
+}
+function budgetOverrun(budget, now = Date.now()) {
+  const dims = budgetStatus(budget, now).filter((d) => d.overrun);
+  if (dims.length === 0)
+    return { overrun: false, reason: null, dimensions: [] };
+  return {
+    overrun: true,
+    reason: `budget overrun: ${dims.map((d) => d.key).join(", ")}`,
+    dimensions: dims.map((d) => d.key)
+  };
+}
+function consumeTasks(budget, tasks, requests) {
+  return {
+    ...budget,
+    used_tasks: budget.used_tasks + tasks,
+    used_requests: budget.used_requests + requests
+  };
+}
+
 // src/mission/control.ts
 import { existsSync as existsSync8, statSync as statSync4 } from "node:fs";
 function scopeAllowed(mission) {
@@ -19204,7 +19252,10 @@ async function executeTask(task, mission, scope) {
   }
 }
 function budgetExhausted(mission) {
-  return mission.budget.used_tasks >= mission.budget.max_tasks;
+  return budgetOverrun(mission.budget).overrun;
+}
+function budgetReason(mission) {
+  return budgetOverrun(mission.budget).reason ?? "budget_exhausted";
 }
 async function runMission(mission) {
   if (/^https?:\/\//i.test(mission.target) && !scopeAllowed(mission)) {
@@ -19225,7 +19276,7 @@ async function runMission(mission) {
   while (iterations < maxIterations) {
     iterations += 1;
     if (budgetExhausted(m)) {
-      m = { ...m, termination_reason: "budget_exhausted" };
+      m = { ...m, termination_reason: budgetReason(m) };
       break;
     }
     const { ready, blocked } = schedule(m.tasks);
@@ -19286,7 +19337,7 @@ async function runMission(mission) {
         }
       }
     }
-    m.budget.used_tasks += batch.length;
+    m.budget = consumeTasks(m.budget, batch.length, 0);
     m = saveMission(m);
   }
   return finalize2(m);
@@ -19294,7 +19345,7 @@ async function runMission(mission) {
 function finalize2(mission) {
   let m = mission;
   if (budgetExhausted(m)) {
-    m = { ...m, status: "terminated", termination_reason: "budget_exhausted" };
+    m = { ...m, status: "terminated", termination_reason: budgetReason(m) };
   } else {
     m = { ...m, status: "completed", termination_reason: "all tasks resolved" };
   }
@@ -19307,6 +19358,8 @@ function finalize2(mission) {
   if (mem.saved > 0) {
     m = { ...m, memory_refs: [...m.memory_refs, `persisted:${mem.saved} (${mem.deduped} deduped)`] };
   }
+  const budgetSummary = budgetStatus(m.budget).map((d) => `${d.key}=${d.used}/${d.max}`).join(", ");
+  m = { ...m, decision_log: [...m.decision_log, { at: new Date().toISOString(), agent: "budget", decision: `final budget: ${budgetSummary}` }] };
   return saveMission(m);
 }
 async function startMission(target, mode, opts = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.53",
+  "version": "1.0.54",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {