Tighten tool surface consistency

Four passes of audit-and-patch on the tool surface, condensed.

Tool API shape:
- Todo tools collapse to a single list-based form (one arg per tool,
  always a list, no dual-mode validator). Result-field names line up
  across the family — created_count / updated_count / marked_count /
  deleted_count, and _mark returns a single "marked" key plus the new
  status instead of marked_done / marked_pending.
- list_notes splits the overloaded total_count into filtered_count
  (matches) and total_count (grand total), matching list_todos. All
  three notes mutations now echo total_count and note_id.
- finish_scan drops the machine-code error strings; a single human
  "error" key carries the reason on every failure path.
- scope_rules delete echoes a message so the renderer's success
  branch has something to surface.

Failure-key unification: every tool now uses {"success": False,
"error": "..."} on failure paths. Touched thinking, web_search,
reporting, and finish. Trailing periods on error strings swept clean
across the whole tool tree.

Tool prompts (docstring re-imports vs main):
- create_vulnerability_report re-imports the CWE reference catalog,
  multi-part fix rules, fix_before/fix_after PR-suggestion mechanics,
  the COMMON MISTAKES list, the informational-vs-actionable
  distinction, and file-path examples.
- web_search re-imports concrete example queries.
- list_sitemap docstring fixed hasDescendants -> has_descendants
  (the camelCase reference never matched our snake_case schema).
- create_agent.skills description "Comma-separated" -> "List of".
- factory.py module docstring no longer claims there's no runtime
  skill-loading tool. agents_graph module docstring lists stop_agent.
- system_prompt nudges loading the matching skill before guessing
  payloads or syntax from memory.

TUI:
- proxy_renderer was reading stale field names from the pre-SDK
  schema (requests / total_count / statusCode / matches /
  showing_lines); now reads entries / page_info / status_code / hits
  / page+total_lines. Three proxy operations were rendering empty
  before this.
- Idle-pane placeholder text trimmed to "Loading...".

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

strix/tools/proxy/caido_api.py

@@ -324,9 +324,9 @@ async def replay_send_raw(
             "status": "ERROR",
             "error": (
                 f"Caido replay dispatch did not complete within "
-                f"{_REPLAY_SEND_TIMEOUT_SECONDS:.0f}s. The target may be "
+                f"{_REPLAY_SEND_TIMEOUT_SECONDS:.0f}s — the target may be "
                 "unroutable from the sandbox, or Caido's outbound HTTP client "
-                "is stalled. Check the target host/port and retry."
+                "is stalled; check the target host/port and retry"
             ),
             "elapsed_ms": elapsed_ms,
             "response_raw": None,

strix/tools/proxy/tools.py

@@ -453,7 +453,7 @@ async def list_sitemap(
     Workflow:
     - Start with no ``parent_id`` to list root domains (scoped by
       ``scope_id`` if you only care about in-scope hosts).
-    - Pick an entry where ``hasDescendants=true`` and pass its ``id``
+    - Pick an entry where ``has_descendants=true`` and pass its ``id``
       as ``parent_id`` to drill in. ``depth="DIRECT"`` returns only
       immediate children; ``"ALL"`` flattens the full subtree.
     - Hand any ``id`` to ``view_sitemap_entry`` for the full record
@@ -575,7 +575,7 @@ async def scope_rules(
         if action == "get":
             if not scope_id:
                 return json.dumps(
-                    {"success": False, "error": "scope_id required for get"},
+                    {"success": False, "error": "Scope_id is required for action='get'"},
                     ensure_ascii=False,
                     default=str,
                 )
@@ -586,7 +586,7 @@ async def scope_rules(
         if action == "create":
             if not scope_name:
                 return json.dumps(
-                    {"success": False, "error": "scope_name required for create"},
+                    {"success": False, "error": "Scope_name is required for action='create'"},
                     ensure_ascii=False,
                     default=str,
                 )
@@ -601,7 +601,7 @@ async def scope_rules(
                 return json.dumps(
                     {
                         "success": False,
-                        "error": "scope_id and scope_name required for update",
+                        "error": "Scope_id and scope_name are required for action='update'",
                     },
                     ensure_ascii=False,
                     default=str,
@@ -615,11 +615,19 @@ async def scope_rules(
         # action == "delete" — exhaustive Literal
         if not scope_id:
             return json.dumps(
-                {"success": False, "error": "scope_id required for delete"},
+                {"success": False, "error": "Scope_id is required for action='delete'"},
                 ensure_ascii=False,
                 default=str,
             )
         await caido_api.scope_delete(client, scope_id)
-        return json.dumps({"success": True, "deleted": scope_id}, ensure_ascii=False, default=str)
+        return json.dumps(
+            {
+                "success": True,
+                "deleted": scope_id,
+                "message": f"Scope {scope_id} deleted",
+            },
+            ensure_ascii=False,
+            default=str,
+        )
     except Exception as exc:  # noqa: BLE001
         return _err("scope_rules", exc)