forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-25 12:22:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(safety): add contextual action review with guarded and observe modes

Browse Source 
Introduce a pre-execution safety layer that reviews effectful agent actions
against compiled, frozen evidence before they run.

`--safety-mode guarded` allows non-destructive interaction after review;
`--safety-mode observe` permits passive target interaction only. `off` stays
the default, so existing runs are unchanged.

Deterministic rules decide what they can on their own: destructive commands,
code-loading environment overrides, blocked browser actions, and mutating
requests in observe mode are refused without a model call, and a small set of
read-only commands is allowed outright. Everything else compiles an evidence
packet — command, scope, script source and its local import closure, prior
tool-call evidence, and browser snapshot context — for a bounded reviewer that
may make one isolated inspection call. Incomplete evidence fails closed.

In safety modes, user-owned local directories are copied into the run
directory so the originals are never mounted writable, while `.git`,
`.agents`, and `.codex` inside the copy stay read-only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
oyasumi
2026-08-08 00:47:21 +00:00
co-authored by Claude Opus 5
parent f8a8801d56
commit 6e5bb2e76e
40 changed files with 3860 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/advanced/configuration.mdx
+49
View File
@@ -74,6 +74,55 @@ affecting the agents that do the actual testing.
baseline when unset.
</ParamField>
## Safety Review
<ParamField path="STRIX_SAFETY_MODE" default="off" type="string">
Default action policy. Valid values: `off`, `guarded`, and `observe`.
</ParamField>
<ParamField path="STRIX_SAFETY_MODEL" type="string">
Optional model used for contextual action review. Falls back to `STRIX_LLM`.
</ParamField>
<ParamField path="STRIX_SAFETY_REASONING_EFFORT" default="low" type="string">
Reasoning effort for the safety reviewer.
</ParamField>
<ParamField path="STRIX_SAFETY_TIMEOUT" default="60" type="integer">
Timeout for one model request in a safety review. A review makes at most two
requests, so the wall-clock budget is twice this value plus the inspection
timeout.
</ParamField>
<ParamField path="STRIX_SAFETY_MAX_OUTPUT_TOKENS" default="8192" type="integer">
Output-token budget for one safety review turn. On a reasoning model this
covers reasoning tokens as well as the verdict; too small a value truncates
the decision and fails closed.
</ParamField>
<ParamField path="STRIX_SAFETY_MAX_ARTIFACT_BYTES" default="262144" type="integer">
Per-file limit for inspected script and dependency source.
</ParamField>
<ParamField path="STRIX_SAFETY_MAX_TOTAL_ARTIFACT_BYTES" default="4194304" type="integer">
Combined limit for one script's whole inspected dependency closure.
</ParamField>
<ParamField path="STRIX_SAFETY_MAX_DEPENDENCIES" default="32" type="integer">
Maximum local modules collected for one script entrypoint.
</ParamField>
<ParamField path="STRIX_SAFETY_INSPECTION_TIMEOUT" default="5" type="integer">
Wall-clock limit for the reviewer's optional isolated inspection script.
</ParamField>
<ParamField path="STRIX_SAFETY_INSPECTION_IMAGE" type="string">
Optional Docker image for isolated inspection scripts. Defaults to the scan
sandbox image. The image must provide Python 3 and a `pentester` user.
</ParamField>
See [Safety Modes](/usage/safety-modes) for behavior and limitations.
## Optional Features
<ParamField path="PERPLEXITY_API_KEY" type="string">