refactor: SandboxAgent + SDK Shell/Filesystem; agent-browser CLI; nuke FastAPI sidecar

Combined commits 2+3 of the migration plan because the FastAPI sidecar
removal in commit 2 broke ``browser_action`` (which lived in the
sidecar); they have to land together.

Sandbox tool layer (commit 2 piece):
- ``build_strix_agent`` now returns a ``SandboxAgent`` with
  ``capabilities=[Filesystem(), Shell()]``. The SDK runtime binds the
  capabilities to the live sandbox session per-run; agents get
  ``exec_command``, ``write_stdin``, ``apply_patch``, ``view_image``
  function tools auto-merged into their tool list. Plain ``Agent``
  short-circuits capability binding (``agents/sandbox/runtime.py:190``).
- Drop ``Compaction`` from the default capability set — it's
  OpenAI-Responses-API-only and useless for our litellm-routed
  Anthropic setup.
- Delete the entire custom in-container tool layer:
  - ``strix/tools/terminal/`` (5 files, 748 LoC libtmux)
  - ``strix/tools/file_edit/`` (3 files, 276 LoC)
  - ``strix/tools/python/`` (5 files, 459 LoC)
  - ``strix/runtime/tool_server.py`` (163 LoC FastAPI sidecar)
  - ``strix/tools/_sandbox_dispatch.py`` (117 LoC)
  - ``strix/tools/registry.py`` (109 LoC)
  - ``strix/tools/context.py`` (12 LoC)
- Drop the corresponding TUI renderers (``terminal_renderer.py``,
  ``file_edit_renderer.py``, ``python_renderer.py``) and update
  ``interface/tool_components/__init__.py``.

Browser → agent-browser CLI (commit 3 piece):
- Install ``agent-browser@0.26.0`` globally in the Dockerfile right
  after the existing ``npm install -g`` block. Run
  ``agent-browser install --with-deps`` (apt, root) and
  ``agent-browser install`` (Chrome download, pentester) +
  ``agent-browser doctor --offline --quick`` smoke test.
- Drop the explicit Playwright system-deps apt list (replaced by
  ``--with-deps``) and ``RUN .venv/bin/python -m playwright install
  chromium``.
- Vendor ``agent-browser/skill-data/core/SKILL.md`` →
  ``strix/skills/tooling/agent_browser.md`` (476 lines). Adapt
  frontmatter to Strix format; strip the install/Quickstart and the
  ``agent-browser skills get electron|slack|...`` specialized-skills
  block; add the "Caido proxy is wired via env vars; do not pass
  ``--proxy``" note.
- ``_resolve_skills`` now eagerly loads ``tooling/agent_browser`` for
  every agent (matches the previous unconditional ``browser_action``
  in ``_BASE_TOOLS``).
- Delete ``strix/tools/browser/`` (5 files, 1338 LoC) and the
  ``browser_renderer.py`` TUI render.

Sandbox plumbing:
- Drop ``bearer`` token, ``tool_server_host_port`` resolution + bundle
  keys, ``TOOL_SERVER_TOKEN``/``TOOL_SERVER_PORT``/
  ``STRIX_SANDBOX_EXECUTION_TIMEOUT`` from the manifest env in
  ``session_manager.create_or_reuse``. Caido proxy env vars
  (``http_proxy``, ``https_proxy``, ``ALL_PROXY``) stay; manifest
  applies them to every ``docker exec``-spawned process.
- Drop ``sandbox_token`` and ``tool_server_host_port`` params from
  ``make_agent_context`` and the ``create_agent`` graph tool.
- Drop the tool-server health-check from ``entry.py`` (only Caido's
  ``wait_for_tcp_ready`` remains).
- ``docker-entrypoint.sh``: delete the ~30 line
  ``Starting tool server...`` block (sudo + uvicorn launch + curl
  /health poll). Add ``NO_PROXY=localhost,127.0.0.1`` to
  ``/etc/profile.d/proxy.sh`` and ``/etc/environment`` so the
  agent-browser daemon's CDP traffic on localhost isn't routed
  through Caido.

pyproject.toml:
- ``[project.optional-dependencies] sandbox = []`` (every member of
  the previous list — fastapi, uvicorn, ipython, openhands-aci,
  playwright, libtmux — is gone with the sidecar).
- Drop ``numpydoc.*``, ``IPython.*``, ``openhands_aci.*``,
  ``playwright.*``, ``uvicorn.*``, ``pyte.*``, ``libtmux.*`` from
  the missing-imports module list.
- Drop the per-file ruff ignores for the deleted modules.

Net delta: −5512 LoC. ruff drops to 3 errors (was 21 baseline). mypy
falls to 69 errors over 3 files (was 84 over 8 — the drop comes from
deleting the modules with the worst untyped-import problems).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

strix/agents/factory.py

@@ -21,8 +21,9 @@ from __future__ import annotations
 import logging
 from typing import Any
 
-from agents import Agent
 from agents.agent import StopAtTools
+from agents.sandbox import SandboxAgent
+from agents.sandbox.capabilities import Filesystem, Shell
 from agents.tool import Tool
 
 from strix.agents.prompt import render_system_prompt
@@ -34,12 +35,6 @@ from strix.tools.agents_graph.tools import (
     view_agent_graph,
     wait_for_message,
 )
-from strix.tools.browser.tool import browser_action
-from strix.tools.file_edit.tools import (
-    list_files,
-    search_files,
-    str_replace_editor,
-)
 from strix.tools.finish.tool import finish_scan
 from strix.tools.notes.tools import (
     create_note,
@@ -55,9 +50,7 @@ from strix.tools.proxy.tools import (
     send_request,
     view_request,
 )
-from strix.tools.python.tool import python_action
 from strix.tools.reporting.tool import create_vulnerability_report
-from strix.tools.terminal.tool import terminal_execute
 from strix.tools.thinking.tool import think
 from strix.tools.todo.tools import (
     create_todo,
@@ -73,7 +66,10 @@ from strix.tools.web_search.tool import web_search
 logger = logging.getLogger(__name__)
 
 
-# Tools every Strix agent has, root or child.
+# Host-side Strix tools. Sandbox shell + filesystem are added per-run
+# by the SDK via the ``Shell`` and ``Filesystem`` capabilities below
+# (they bind to the live sandbox session and emit ``exec_command`` /
+# ``write_stdin`` / ``apply_patch`` / ``view_image`` function tools).
 _BASE_TOOLS: tuple[Tool, ...] = (
     # Thinking + planning
     think,
@@ -94,16 +90,8 @@ _BASE_TOOLS: tuple[Tool, ...] = (
     # tool itself returns a structured error when not configured, so
     # always exposing it is safe)
     web_search,
-    # File edit (sandbox-bound)
-    str_replace_editor,
-    list_files,
-    search_files,
     # Reporting
     create_vulnerability_report,
-    # Sandbox primitives
-    browser_action,
-    terminal_execute,
-    python_action,
     # Caido HTTP/HTTPS proxy
     list_requests,
     view_request,
@@ -128,8 +116,15 @@ def build_strix_agent(
     is_whitebox: bool = False,
     interactive: bool = False,
     system_prompt_context: dict[str, Any] | None = None,
-) -> Agent[Any]:
-    """Build an ``agents.Agent`` configured for either root or child use.
+) -> SandboxAgent[Any]:
+    """Build a ``SandboxAgent`` configured for either root or child use.
+
+    The ``Shell`` and ``Filesystem`` capabilities are added unbound; the
+    SDK's runtime binds them per-run against the live sandbox session
+    set on ``RunConfig.sandbox`` and merges their tools (``exec_command``,
+    ``write_stdin``, ``apply_patch``, ``view_image``) into the agent's
+    final tool list. We deliberately exclude ``Compaction`` (OpenAI
+    Responses API only).
 
     Args:
         name: Agent name. Surfaces in traces and the bus's ``names`` map.
@@ -149,11 +144,6 @@ def build_strix_agent(
         system_prompt_context: Free-form dict the prompt template
             renders into the ``system_prompt_context`` variable —
             today carries the scan scope / authorization block.
-
-    Returns the ``Agent`` instance with ``model=None`` so the
-    ``RunConfig.model`` (built by ``make_run_config``) drives provider
-    selection. ``agents.Agent`` is generic on context type; we let
-    the caller's ``Runner.run(context=...)`` typing determine that.
     """
     instructions = render_system_prompt(
         skills=skills,
@@ -163,9 +153,6 @@ def build_strix_agent(
         system_prompt_context=system_prompt_context,
     )
 
-    # Tool list + termination tool depend on is_root. The tuple-then-
-    # list dance keeps _BASE_TOOLS immutable so concurrent agent builds
-    # can't accidentally mutate each other's tool list.
     if is_root:
         tools: list[Tool] = [*_BASE_TOOLS, finish_scan]
         stop_at = ("finish_scan",)
@@ -173,7 +160,7 @@ def build_strix_agent(
         tools = [*_BASE_TOOLS, agent_finish]
         stop_at = ("agent_finish",)
 
-    return Agent(
+    return SandboxAgent(
         name=name,
         instructions=instructions,
         tools=tools,
@@ -181,6 +168,7 @@ def build_strix_agent(
         # model=None so ``RunConfig.model`` drives provider selection
         # via :func:`build_multi_provider` rather than the SDK's default.
         model=None,
+        capabilities=[Filesystem(), Shell()],
     )
 
 
@@ -201,7 +189,7 @@ def make_child_factory(
     ``create_agent`` having to know about them.
     """
 
-    def _factory(*, name: str, skills: list[str]) -> Agent[Any]:
+    def _factory(*, name: str, skills: list[str]) -> SandboxAgent[Any]:
         return build_strix_agent(
             name=name,
             skills=skills,

strix/agents/prompt.py

@@ -34,10 +34,13 @@ def _resolve_skills(
 
     1. Whatever the caller asked for, in order.
     2. ``scan_modes/<mode>`` (always).
-    3. Whitebox-specific skills if applicable.
+    3. ``tooling/agent_browser`` (always — every agent has shell + the
+       agent-browser CLI).
+    4. Whitebox-specific skills if applicable.
     """
     ordered: list[str] = list(requested or [])
     ordered.append(f"scan_modes/{scan_mode}")
+    ordered.append("tooling/agent_browser")
     if is_whitebox:
         ordered.append("coordination/source_aware_whitebox")
         ordered.append("custom/source_aware_sast")