chore(image): bump sandbox tag 0.1.13 → 0.2.0

Picks up the recent in-image deps (``pip install caido-sdk-client``
for ``python_action`` + Caido CLI bumped to v0.56.0). 0.2.0 is the
new minor since this is the first SDK-migration-era image; users
pulling the new strix should pull the matching new image.

Updated:
- ``strix/config/settings.py:64`` — ``RuntimeSettings.image`` default
- ``strix/runtime/session_manager.py`` + ``strix/orchestration/scan.py`` — docstring example
- ``HARNESS_WIKI.md`` — three references in the runtime + config docs
- ``MIGRATION_EVALUATION.md`` — the SDK-bridging note

The historical changelog row (``HARNESS_WIKI.md:744`` — "bump to
0.1.13") stays untouched on purpose; it records what commit
``640bd67`` did, not the current pin.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

HARNESS_WIKI.md

@@ -147,7 +147,7 @@ End-to-end trace of `strix --target ./app`:
 1. **CLI parse** (`interface/main.py:267-426`): parse args, validate, infer target types via `infer_target_type()` (`interface/utils.py`). Resolve diff scope if `--scope-mode=diff`.
 2. **Config layering** (`config/config.py`): apply `~/.strix/cli-config.json` (or `--config <path>` override) into `os.environ`; resolve `STRIX_LLM`, `LLM_API_KEY` via `resolve_llm_config()` at `config/config.py:199-224`.
 3. **LLM warm**: validate model reachable.
-4. **Docker pull** if needed; image pin `ghcr.io/usestrix/strix-sandbox:0.1.13` (`config/config.py:43`).
+4. **Docker pull** if needed; image pin `ghcr.io/usestrix/strix-sandbox:0.2.0` (`strix/config/settings.py:64`).
 5. **Run name + run dir**: `strix_runs/<run-name>/`. Tracer init (`telemetry/tracer.py:50+`).
 6. **Mode dispatch**: TUI (`tui.py`) or CLI (`cli.py`). Both end up calling `StrixAgent.execute_scan(scan_config)`.
 7. **Sandbox launch** (`runtime/docker_runtime.py:111-173`): container created with name `strix-scan-{scan_id}`, two random host ports mapped to container ports `48080` (Caido) and `48081` (tool server), 32-byte bearer token generated, `local_sources` tar-copied into `/workspace`.
@@ -442,7 +442,7 @@ Three layers of defense before tool output reaches the model or telemetry:
 - Self-signed CA chain at `/app/certs/{ca.key,ca.crt,ca.p12}`, 3650-day validity (lines 52-71).
 - Workspace `/workspace` owned by pentester (line 194).
 - Ports `48080` (Caido), `48081` (tool server) exposed.
-- Image pin: `ghcr.io/usestrix/strix-sandbox:0.1.13` (`strix/config/config.py:43`, bumped in `640bd67`).
+- Image pin: `ghcr.io/usestrix/strix-sandbox:0.2.0` (`strix/config/settings.py:64`).
 
 ### 8.2 Boot Sequence (`containers/docker-entrypoint.sh`)
 
@@ -637,7 +637,7 @@ There **is no separate persona file**. All agents are `StrixAgent` instances usi
 | `llm_timeout` | `"300"` | Outer LLM timeout. |
 | `perplexity_api_key` | `None` | Web search. |
 | `strix_disable_browser` | `"false"` | Skip browser tool registration. |
-| `strix_image` | `"ghcr.io/usestrix/strix-sandbox:0.1.13"` | Sandbox image pin. |
+| `strix_image` | `"ghcr.io/usestrix/strix-sandbox:0.2.0"` | Sandbox image pin. |
 | `strix_runtime_backend` | `"docker"` | Only `docker` supported. |
 | `strix_sandbox_execution_timeout` | `"120"` | Tool exec timeout (s). |
 | `strix_sandbox_connect_timeout` | `"10"` | Tool server connect timeout. |

MIGRATION_EVALUATION.md

@@ -132,7 +132,7 @@ All 13 Strix tools port. Multi-agent-graph tools are now in §4.
 
 | Strix capability | SDK equivalent | Match |
 |---|---|---|
-| Custom Kali image | `DockerSandboxClientOptions(image="ghcr.io/.../strix-sandbox:0.1.13")` | 1:1 |
+| Custom Kali image | `DockerSandboxClientOptions(image="ghcr.io/.../strix-sandbox:0.2.0")` | 1:1 |
 | `cap_add=NET_ADMIN,NET_RAW` + `extra_hosts=host.docker.internal` | **Subclass `DockerSandboxClient`, inject into `containers.create()` kwargs** | Bridgeable | ~80 LOC |
 | Caido HTTPS proxy + CA cert + system-wide proxy env | Image-baked (Dockerfile + entrypoint stay as-is); `Manifest.environment` for runtime overrides; custom `CaidoCapability` for the 7 Caido tools + system-prompt instruction block | Bridgeable | ~200 LOC capability |
 | FastAPI tool server + Bearer auth | **Stays in the image.** Function tools wrap HTTP calls to it. Network isolation + Bearer auth preserved at transport layer. SDK's "in-process tools" model becomes "function tool that POSTs to localhost:48081 inside our shared session." | 1:1 in effect |

strix/config/settings.py

@@ -61,7 +61,7 @@ class RuntimeSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
     image: str = Field(
-        default="ghcr.io/usestrix/strix-sandbox:0.1.13",
+        default="ghcr.io/usestrix/strix-sandbox:0.2.0",
         alias="STRIX_IMAGE",
     )
     backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND")

strix/orchestration/scan.py

@@ -191,7 +191,7 @@ async def run_strix_scan(
             if omitted — callers that want resume-after-crash semantics
             should pass a stable id.
         image: Docker image tag for the sandbox (e.g.
-            ``"strix-sandbox:0.1.13"``).
+            ``"strix-sandbox:0.2.0"``).
         sources_path: Host directory mounted into ``/workspace/sources``.
         tracer: Optional Strix tracer. Stored in context for the
             telemetry hook chain. Pass ``None`` for unit tests.

strix/runtime/session_manager.py

@@ -54,7 +54,7 @@ async def create_or_reuse(
 
     Args:
         scan_id: Caller-provided scan identifier (used as cache key).
-        image: Docker image tag (e.g. ``"strix-sandbox:0.1.13"``).
+        image: Docker image tag (e.g. ``"strix-sandbox:0.2.0"``).
         sources_path: Host directory mounted into the container's
             ``/workspace/sources`` so the agent can read user code.