forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-25 04:12:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(safety): add contextual action review with guarded and observe modes

Browse Source 
Introduce a pre-execution safety layer that reviews effectful agent actions
against compiled, frozen evidence before they run.

`--safety-mode guarded` allows non-destructive interaction after review;
`--safety-mode observe` permits passive target interaction only. `off` stays
the default, so existing runs are unchanged.

Deterministic rules decide what they can on their own: destructive commands,
code-loading environment overrides, blocked browser actions, and mutating
requests in observe mode are refused without a model call, and a small set of
read-only commands is allowed outright. Everything else compiles an evidence
packet — command, scope, script source and its local import closure, prior
tool-call evidence, and browser snapshot context — for a bounded reviewer that
may make one isolated inspection call. Incomplete evidence fails closed.

In safety modes, user-owned local directories are copied into the run
directory so the originals are never mounted writable, while `.git`,
`.agents`, and `.codex` inside the copy stay read-only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
oyasumi
2026-08-08 00:47:21 +00:00
co-authored by Claude Opus 5
parent f8a8801d56
commit 6e5bb2e76e
40 changed files with 3860 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/usage/cli.mdx
+8 -1
View File
@@ -17,7 +17,7 @@ strix (--target <target> | --target-list <path>) [options]
When the target is an API spec, Strix copies it into the agent's workspace and authorizes the base URLs it declares (including those resolved from a Postman environment) as in-scope hosts - so the agent reads the contract and tests the full declared surface instead of discovering endpoints by crawling. Pair the spec with the deployed base URL (e.g. `--target ./openapi.yaml --target https://api.example.com`) so the agent has a reachable host to attack.
<Note>
A local directory is mounted into the sandbox live and **writable**, so the agent edits your real files (`.git` excepted). Commit or stash first.
With safety mode `off`, a local directory is mounted into the sandbox live and **writable**, so the agent edits your real files (`.git` excepted). `guarded` and `observe` use a writable isolated copy instead.
</Note>
<Note>
@@ -41,6 +41,13 @@ strix (--target <target> | --target-list <path>) [options]
Scan depth: `quick`, `standard`, or `deep`.
</ParamField>
<ParamField path="--safety-mode" type="string" default="off">
Action policy: `off`, `guarded`, or `observe`. Guarded mode contextually
reviews ambiguous actions and blocks destructive or persistent effects.
Observe mode permits passive target interaction only. See
[Safety Modes](/usage/safety-modes).
</ParamField>
<ParamField path="--scope-mode" type="string" default="auto">
Code scope mode: `auto` (enable PR diff-scope in CI/headless runs), `diff` (force changed-files scope), or `full` (disable diff-scope).
</ParamField>