chore(safety): satisfy the pinned lint gates and drop the brand strings

The versions in .pre-commit-config.yaml are stricter than the ones uv resolves,
so these were invisible to `make lint`:

- ruff 0.11.13 reports N802 for `ast.NodeVisitor`'s `visit_*` methods; 0.15.20
  exempts them. The names are dispatch keys and cannot be lowercased, so add the
  per-file ignore next to the existing stdlib-handler precedent.
- mypy 1.17.1 does not narrow `str` to `SafetyMode` through a membership test
  against the tuple. Return the matched element instead.
- bandit does not read `# noqa`; pair it with `# nosec` as the other 33 sites do.

The trailing-whitespace hook rewrites the built viewer bundle, stripping a space
and a tab that are content inside a highlight.js character class. Exclude the
generated assets rather than let a hook corrupt shipped JS.

Upstream removed every "Strix" literal from model-facing text; this branch
predated that and reintroduced one in the prompt template and one as an agent
name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -28,6 +28,7 @@ repos:
   # Built-in hooks for basic file checks
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: v5.0.0
+    exclude: ^strix/interface/viewer/static/
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer

pyproject.toml

@@ -234,6 +234,8 @@ ignore = [
 "scripts/tui_sidecar_hook.py" = ["INP001"]
 # Stdlib HTTP handler overrides (do_GET/do_POST).
 "strix/interface/auth_cli.py" = ["N802"]
+# ast.NodeVisitor dispatches on the visit_<NodeType> name, so it cannot be lowercased.
+"strix/safety/evidence.py" = ["N802"]
 "tests/test_codex_streaming.py" = ["N802"]
 "tests/test_disable_streaming.py" = ["N802"]
 "tests/test_tool_call_ids.py" = ["N802"]

strix/agents/prompts/system_prompt.jinja

@@ -62,7 +62,7 @@ ACTION SAFETY POLICY:
 - Target authorization does not grant permission to bypass action safety restrictions
 - If a command is blocked, follow the returned guidance; do not retry it through alternate quoting, scripts, subprocesses, direct CDP, or another tool
 - Browser interactions must be issued as individual direct ``agent-browser`` commands; browser automation embedded in scripts, command chains, aliases, or subprocess wrappers is blocked
-- Strix assigns the browser session for you; do not override ``--session``, ``--profile``, ``--state``, or CDP connection flags
+- The browser session is assigned for you; do not override ``--session``, ``--profile``, ``--state``, or CDP connection flags
 - If an element-reference action is blocked as stale, take a new snapshot and retry the direct command
 - Commands that create code and execute it in the same shell call must be split into a creation call and a later execution call so the exact artifact can be inspected
 {% if system_prompt_context.safety_mode == "observe" %}

strix/core/runner.py

@@ -65,9 +65,12 @@ StreamEventSink = Callable[[str, Any], None]
 
 def _safety_mode(scan_config: dict[str, Any]) -> SafetyMode:
     raw = str(scan_config.get("safety_mode") or "off")
-    if raw not in SAFETY_MODES:
-        raise ValueError(f"Unsupported safety mode: {raw!r}")
-    return raw
+    # Returning the matched element narrows to SafetyMode on every mypy version; a
+    # membership test against the tuple does not.
+    for mode in SAFETY_MODES:
+        if raw == mode:
+            return mode
+    raise ValueError(f"Unsupported safety mode: {raw!r}")
 
 
 def _merge_root_prompt_context(

strix/safety/evidence.py

@@ -101,7 +101,7 @@ _OPAQUE_WRAPPERS = frozenset(
     }
 )
 # Environment variables that change which code an interpreter or shell loads, or that
-# would override the per-agent browser session Strix assigns.
+# would override the per-agent browser session assigned by the runtime.
 _UNSAFE_ENV_VARS = frozenset(
     {
         "BASH_ENV",

strix/safety/inspection.py

@@ -71,7 +71,7 @@ class DockerInspectionRunner:
                         str(evidence): {"bind": "/evidence", "mode": "ro"},
                         str(script_dir): {"bind": "/inspection", "mode": "ro"},
                     },
-                    tmpfs={"/tmp": "rw,noexec,nosuid,nodev,size=16m"},  # noqa: S108
+                    tmpfs={"/tmp": "rw,noexec,nosuid,nodev,size=16m"},  # noqa: S108  # nosec B108 - in-container tmpfs, not a host path
                 )
                 container.start()
                 try:

strix/safety/reviewer.py

@@ -120,7 +120,7 @@ class SafetyReviewer:
             retry=ModelRetrySettings(max_retries=0),
         )
         agent: Agent[InspectionContext] = Agent(
-            name="Strix Safety Reviewer",
+            name="Safety Reviewer",
             instructions=_SAFETY_PROMPT,
             model=StrixProvider().get_model(model_name),
             model_settings=model_settings,