blitzstrike 1.0.53 → 1.0.55

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to Blitz Strike are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/).
 
+## [1.0.55] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 15: termination engine)
+
+- **Termination Engine** (`src/mission/termination.ts`, §24):
+  - `evaluateTermination()` — ordered hard stops: user_interrupted →
+    budget_exhausted → safety_violation → scope_violation → max_iterations →
+    no_progress.
+  - `objectiveComplete()` — all tasks in a terminal non-failed state.
+  - `applyTermination()` — records the reason + detail into `decision_log` and
+    sets `completed`/`terminated`.
+  - `NO_PROGRESS_LIMIT` — iterations without progress before declaring stuck.
+- Mission Control now terminates on ANY traceable reason (not just budget) and
+  logs the termination decision with detail.
+
+## [1.0.54] — 2026-09-13
+
+### Added — Autonomous Security Engine (phase 14: budget controller)
+
+- **Budget Controller** (`src/mission/budget.ts`, §22):
+  - `budgetStatus()` — tracks time / tasks / requests / tokens / cost with
+    per-dimension overrun flags.
+  - `budgetOverrun()` — detects overruns and returns a specific reason
+    (e.g. `budget overrun: tasks, requests`).
+  - `consumeTasks()` / `consumeTokens()` — increment consumption counters.
+  - `perTaskOverrun()` — enforces the per-task request budget.
+- Extended the `Budget` type with `max_tokens`, `max_cost_usd`,
+  `per_task_budget`, `started_at`, and `used_tokens`/`used_cost_usd`.
+- Mission Control now terminates gracefully on ANY budget dimension overrun
+  (not just tasks) and records a final budget snapshot in the decision log.
+
 ## [1.0.53] — 2026-09-13
 
 ### Added — Autonomous Security Engine (phase 13: model router)

package/dist/index.js

@@ -18097,10 +18097,16 @@ function newMission(id, target, scope, mode, budget) {
       max_time_seconds: 3600,
       max_tasks: 200,
       max_requests: 1000,
+      max_tokens: 2000000,
+      max_cost_usd: 5,
       max_parallel_workers: 4,
       risk: "medium",
+      per_task_budget: { max_time_seconds: 60, max_requests: 50 },
+      started_at: Date.now(),
       used_tasks: 0,
       used_requests: 0,
+      used_tokens: 0,
+      used_cost_usd: 0,
       ...budget ?? {}
     },
     discovered_assets: [],
@@ -19134,6 +19140,94 @@ var init_router = __esm(() => {
   };
 });
 
+// src/mission/budget.ts
+function clampRatio(used, max) {
+  if (max <= 0)
+    return 0;
+  return Math.max(0, Math.min(1, used / max));
+}
+function budgetStatus(budget, now = Date.now()) {
+  const elapsed = Math.max(0, (now - budget.started_at) / 1000);
+  const dims = [
+    ["time", "time (s)", elapsed, budget.max_time_seconds],
+    ["tasks", "tasks", budget.used_tasks, budget.max_tasks],
+    ["requests", "requests", budget.used_requests, budget.max_requests],
+    ["tokens", "tokens", budget.used_tokens, budget.max_tokens],
+    ["cost", "cost (USD)", budget.used_cost_usd, budget.max_cost_usd]
+  ];
+  return dims.map(([key, label, used, max]) => ({
+    key,
+    label,
+    used: Number(used.toFixed(2)),
+    max,
+    overrun: used >= max,
+    ratio: clampRatio(used, max)
+  }));
+}
+function budgetOverrun(budget, now = Date.now()) {
+  const dims = budgetStatus(budget, now).filter((d) => d.overrun);
+  if (dims.length === 0)
+    return { overrun: false, reason: null, dimensions: [] };
+  return {
+    overrun: true,
+    reason: `budget overrun: ${dims.map((d) => d.key).join(", ")}`,
+    dimensions: dims.map((d) => d.key)
+  };
+}
+function consumeTasks(budget, tasks, requests) {
+  return {
+    ...budget,
+    used_tasks: budget.used_tasks + tasks,
+    used_requests: budget.used_requests + requests
+  };
+}
+
+// src/mission/termination.ts
+function evaluateTermination(mission, state) {
+  if (state.user_interrupted) {
+    return { terminate: true, reason: "user_interrupted", detail: "user requested stop" };
+  }
+  const overrun = budgetOverrun(mission.budget);
+  if (overrun.overrun) {
+    return { terminate: true, reason: "budget_exhausted", detail: overrun.reason ?? "budget limit" };
+  }
+  if (state.safety_violated) {
+    return { terminate: true, reason: "safety_violation", detail: "a safety invariant was violated" };
+  }
+  if (state.scope_violated) {
+    return { terminate: true, reason: "scope_violation", detail: "an agent attempted to leave scope" };
+  }
+  if (state.iterations >= state.max_iterations) {
+    return { terminate: true, reason: "max_iterations", detail: `reached ${state.max_iterations} iterations` };
+  }
+  if (state.iterations - state.last_progress_iteration >= NO_PROGRESS_LIMIT) {
+    return { terminate: true, reason: "no_progress", detail: `no progress for ${NO_PROGRESS_LIMIT} iterations` };
+  }
+  return { terminate: false, reason: null, detail: "" };
+}
+function objectiveComplete(mission) {
+  const done = mission.tasks.every((t) => t.status === "success" || t.status === "skipped" || t.status === "cancelled");
+  if (done && mission.tasks.length > 0) {
+    return { terminate: true, reason: "objective_complete", detail: "all tasks resolved" };
+  }
+  return { terminate: false, reason: null, detail: "" };
+}
+function applyTermination(mission, decision) {
+  if (!decision.reason)
+    return mission;
+  return {
+    ...mission,
+    status: decision.reason === "objective_complete" ? "completed" : "terminated",
+    termination_reason: decision.reason,
+    decision_log: [
+      ...mission.decision_log,
+      { at: new Date().toISOString(), agent: "termination", decision: `${decision.reason}: ${decision.detail}` }
+    ]
+  };
+}
+var NO_PROGRESS_LIMIT = 3;
+var init_termination = () => {};
+
 // src/mission/control.ts
 import { existsSync as existsSync8, statSync as statSync4 } from "node:fs";
 function scopeAllowed(mission) {
@@ -19203,9 +19297,6 @@ async function executeTask(task, mission, scope) {
     return { task, ok: false, output: {}, hypotheses: [], graph: { nodes: [], edges: [] }, error: String(e) };
   }
 }
-function budgetExhausted(mission) {
-  return mission.budget.used_tasks >= mission.budget.max_tasks;
-}
 async function runMission(mission) {
   if (/^https?:\/\//i.test(mission.target) && !scopeAllowed(mission)) {
     return saveMission({ ...mission, status: "terminated", termination_reason: "scope_required" });
@@ -19221,11 +19312,13 @@ async function runMission(mission) {
   m = saveMission(m);
   const scope = m.scope.join(",");
   let iterations = 0;
+  let lastProgress = 0;
   const maxIterations = m.budget.max_tasks + 10;
   while (iterations < maxIterations) {
     iterations += 1;
-    if (budgetExhausted(m)) {
-      m = { ...m, termination_reason: "budget_exhausted" };
+    const hard = evaluateTermination(m, { iterations, max_iterations: maxIterations, last_progress_iteration: lastProgress });
+    if (hard.terminate && hard.reason) {
+      m = applyTermination(m, hard);
       break;
     }
     const { ready, blocked } = schedule(m.tasks);
@@ -19236,8 +19329,13 @@ async function runMission(mission) {
         m = saveMission(m);
         continue;
       }
-      if (blocked.length > 0) {
-        m = { ...m, termination_reason: `blocked: ${blocked.length} task(s) with failed dependencies` };
+      const done = objectiveComplete(m);
+      if (done.terminate) {
+        m = applyTermination(m, done);
+      } else if (blocked.length > 0) {
+        m = applyTermination(m, { terminate: true, reason: "no_progress", detail: `blocked: ${blocked.length} task(s) with failed dependencies` });
+      } else {
+        m = applyTermination(m, { terminate: true, reason: "objective_complete", detail: "no ready tasks remain" });
       }
       break;
     }
@@ -19286,17 +19384,18 @@ async function runMission(mission) {
         }
       }
     }
-    m.budget.used_tasks += batch.length;
+    m.budget = consumeTasks(m.budget, batch.length, 0);
+    if (results.some((r) => r.ok))
+      lastProgress = iterations;
     m = saveMission(m);
   }
   return finalize2(m);
 }
 function finalize2(mission) {
   let m = mission;
-  if (budgetExhausted(m)) {
-    m = { ...m, status: "terminated", termination_reason: "budget_exhausted" };
-  } else {
-    m = { ...m, status: "completed", termination_reason: "all tasks resolved" };
+  if (!m.termination_reason) {
+    const done = objectiveComplete(m);
+    m = done.terminate ? applyTermination(m, done) : applyTermination(m, { terminate: true, reason: "max_iterations", detail: "iteration cap reached" });
   }
   m.coverage.dimensions = {
     ...m.coverage.dimensions,
@@ -19307,6 +19406,8 @@ function finalize2(mission) {
   if (mem.saved > 0) {
     m = { ...m, memory_refs: [...m.memory_refs, `persisted:${mem.saved} (${mem.deduped} deduped)`] };
   }
+  const budgetSummary = budgetStatus(m.budget).map((d) => `${d.key}=${d.used}/${d.max}`).join(", ");
+  m = { ...m, decision_log: [...m.decision_log, { at: new Date().toISOString(), agent: "budget", decision: `final budget: ${budgetSummary}` }] };
   return saveMission(m);
 }
 async function startMission(target, mode, opts = {}) {
@@ -19331,6 +19432,7 @@ var init_control = __esm(() => {
   init_recovery();
   init_memory2();
   init_router();
+  init_termination();
   MODE_PROFILES = {
     web: { agents: ["recon", "web", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },
     api: { agents: ["recon", "api", "auth", "validator", "reviewer", "reporter"], verify: true, risk: "medium" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blitzstrike",
-  "version": "1.0.53",
+  "version": "1.0.55",
   "description": "Blitz Strike — a universal MCP security-audit toolbelt. BLITZ sweeps the attack surface, EAGLE-EYE traces source-to-sink, STRIKE verifies live. 57 attack chains, 130-tool catalog, intelligence data layer. One server, every agent.",
   "type": "module",
   "bin": {