Commit Graph
697 Commits
Author SHA1 Message Date
Alex Schapiro 0f81630845 Support multiline skill descriptions 2026-08-07 01:15:14 +00:00
Alex Schapiro 77b4d37848 Simplify skill frontmatter parsing 2026-08-07 00:01:37 +00:00
Alex Schapiro 853265790e Harden skill metadata discovery 2026-08-06 23:58:23 +00:00
Alex Schapiro cc292f8139 docs: align skills table formatting 2026-08-06 23:01:01 +00:00
Alex Schapiro 440dff7f80 Expand Firebase Storage rules coverage and skill discovery 2026-08-06 23:00:09 +00:00
Ahmed Allam b08662449d ci: publish nested standalone archives as release assets v1.5.0 2026-08-06 22:03:57 +03:00
Ahmed Allam bda0f54342 ci: tolerate repr-escaped backslashes in the release TUI-sidecar check 2026-08-06 21:55:12 +03:00
Ahmed Allam c6c8bb5ca6 ci: match Windows backslash paths in the release TUI-sidecar check 2026-08-06 21:26:23 +03:00
Ahmed Allam 28747e682e chore(image): bump sandbox tag 1.2.0 -> 1.3.0 2026-08-06 20:50:07 +03:00
Ahmed Allam e71bf127fd chore: release v1.5.0 2026-08-06 20:50:07 +03:00
Ahmed Allam 709a7a1b39 docs(skills): skipped symbol search must be disclosed in reachability evidence 2026-08-06 17:06:00 +03:00
Ahmed Allam ec07f0f68f docs(skills): require per-CVE affected-symbol matching in dependency reachability analysis 2026-08-06 17:06:00 +03:00
alex s 2a9ab1d6cd feat: agent-ready — installable SKILL.md skills, AGENTS.md, coding-ag… (#926) 2026-08-06 06:54:40 -07:00
Ahmed Allam 51bcf70722 update readme 2026-08-06 15:47:45 +03:00
Ahmed Allam cea52cce8d prompt changes 2026-08-06 15:39:43 +03:00
Ahmed Allam 77c7b0df09 prompt changes 2026-08-06 15:39:43 +03:00
Ahmed Allam b69af37cb2 feat(report): keep dependency findings from distinct manifests separate in dedupe 2026-08-06 02:20:46 +03:00
Ahmed Allam 72cb15a20a feat(reporting): require repo-relative manifest_path on dependency CVE findings 2026-08-06 02:20:46 +03:00
Alex Schapiro 97336d53e4 feat(reporting): structured reachability evidence ladder for dependency CVE findings 2026-08-06 00:25:08 +03:00
devin-ai-integration[bot]andAhmed Allam 0abe82d622 fix(agents): collapse repeated waits queued inside one model turn (#979)
* fix(agents): collapse repeated waits queued inside one model turn

* fix(agents): state that one wait is enough in every prompt variant

---------

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-06 00:07:30 +03:00
devin-ai-integration[bot]andAhmed Allam 6735a6f89e fix(llm): abandon a model stream that stops producing events (#978)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-06 00:07:14 +03:00
devin-ai-integration[bot]andAhmed Allam 8bd6c8e87a fix(llm): cap the tool calls one assistant response may queue (#977)
* fix(llm): cap the tool calls one assistant response may queue

* fix(llm): cap the subscription backend's responses too

---------

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-06 00:06:59 +03:00
devin-ai-integration[bot]andAhmed Allam 68ea6fca65 fix(llm): keep tool-call ids unique so a recycled id can't erase history (#976)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-06 00:06:46 +03:00
devin-ai-integration[bot]andAhmed Allam 657aa5cbe6 feat(reporting): record transitive dependency chain on SCA findings (#971)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-04 12:34:52 -07:00
Ahmed Allam 82dcd31357 fix(tui): keep a long error inside the status row (#970) 2026-08-04 07:26:22 -07:00
Anurag Mewar 6719a70611 feat: support API specs and Postman collections as targets (#866) 2026-08-03 21:07:44 -07:00
Ahmed Allam ea6d53f4e9 build: add types-requests to dev deps
The old openai-agents pin pulled types-requests in transitively; 0.19.0 does
not, so mypy lost the requests stubs. Depend on them directly.
2026-08-04 06:14:54 +03:00
Ahmed Allam 3bcf3778f0 fix(core): settle a non-interactive agent's status before its exception unwinds
An exception escaping a non-interactive cycle re-raised before the status
handling, so a dying child stayed 'running' and its parent waited out the
timeout on a completion report the child could no longer send. Set the
terminal status and wake the parent on the way out too.
2026-08-04 06:14:54 +03:00
Ahmed Allam 4a455b1e62 fix(core): recover from hallucinated tool names instead of ending the scan
A tool call for a name Strix does not register raised ModelBehaviorError
from the SDK turn resolver, which nothing retries: the root agent's raise
tore down the whole scan and a sub-agent died before its status was set.
Opt into the SDK's tool_not_found_behavior="return_error_to_model" so the
unknown call comes back as a tool result and the agent self-corrects.

The setting landed in openai-agents 0.19.0, which requires openai>=2.45,
so both pins move.
2026-08-04 06:14:54 +03:00
Ahmed Allam 6f70b6f319 fix(tui): drop the shift+enter newline hint from the setup footer 2026-08-04 06:05:46 +03:00
Tech GuyandAhmed Allam 23f1d76d4c Create credential files with owner-only permissions (#945)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-03 19:36:59 -07:00
oyasumi 5bb9fe896b feat(tui): replace Textual with a Go/Bubble Tea interface (#941) 2026-08-03 19:23:07 -07:00
bearsyankees a51ca18666 fix: calibrate vulnerability severity to demonstrated impact 2026-08-03 23:40:32 +03:00
devin-ai-integration[bot]andAhmed Allam dbc427d816 feat(runtime): mount local targets instead of copying them in (#958)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-02 07:45:10 -07:00
Ahmed Allam b6cf156e95 fix(tools): tell a waiting parent when stop_agent stops its child 2026-08-02 15:43:43 +03:00
Ahmed Allam 002712284a fix(core): wake the parent when a child ends without a completion report 2026-08-02 15:43:43 +03:00
devin-ai-integration[bot]andAhmed Allam 797b37467e perf(cli): ~10x faster startup via lazy imports (#920)
* perf(cli): fast startup — lazy heavy imports + onedir standalone build

* perf(cli): drop legacy single-file compat from install/self-update

* perf(cli): simplify — drop constants module and extra lazy-import refactors

* refactor(update): strix --update just re-runs the install script

* perf(cli): drop packaging/install/update changes; deepen lazy imports instead

Reverts the onedir build, install.sh, and self-update changes so release
mechanics stay untouched. Startup cost is addressed purely by deferring
heavy imports (agents/openai, config.models, report state/writer, docker)
until a scan actually runs; DEFAULT_MAX_TURNS moves to strix.config.settings
so argparse no longer pulls the agents SDK.

---------

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-02 06:24:31 +03:00
devin-ai-integration[bot]andAhmed Allam c240068c2c fix(tools): accept both the string and structured form of every tool argument (#957)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-01 18:53:24 -07:00
devin-ai-integration[bot]andAhmed Allam 2e7040240d feat(config): accept STRIX_REASONING_EFFORT=max for providers that support it (#956)
Co-authored-by: Ahmed Allam <allam@usestrix.com>
2026-08-01 17:10:01 -07:00
devin-ai-integration[bot]andAhmed Allam 22d668d538 docs(llm-providers): explain the structured tool_calls requirement for local endpoints (#520) (#901)
Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-01 16:29:18 -07:00
Ahmed Allam f77805e5bc docs(prompts): text-only turns no longer end an autonomous run 2026-08-02 02:15:51 +03:00
Ahmed Allam 1c1fa49961 refactor(tools): split wait_for_message into respond_to_user + wait_for_agents
One tool was doing three jobs (wait on the user, wait on other agents, and
- wrongly - wait for a long-running command), so the driver had to guess which
one an agent meant and used parent_id as the proxy: the root waits for a human,
everyone else waits for agents. That proxy is wrong, since the user can message
any agent from the TUI's agent tree.

Tool identity now carries the intent, and the coordinator records it as a
wait_kind that survives snapshot/restore:

  respond_to_user  -> wait_kind="user",   never auto-resumed (root or not)
  wait_for_agents  -> wait_kind="agents", auto-resumed on a 300s timer
  recovery exhaust -> wait_kind="stalled"

respond_to_user fuses the message and the yield into one call, so there is no
way to answer and then forget to stop - the two-step that gpt-4o-mini skipped
2/2 in live testing. Plain text still renders as before.

Auto-resume is also bounded now: an agent that re-parks after every timeout
burned a model turn every 300s for the rest of the scan (and, since parked
children notify their parent, spammed the parent's inbox on the same cycle).
After _MAX_IDLE_AUTO_RESUMES it stays parked until a real message arrives.
2026-08-02 02:15:51 +03:00
Ahmed Allam 742f382836 docs(core): correct the rationale for notifying a stalled child's parent
The user can message any agent from the TUI, not only the root, so the
justification is that the parent is an agent with no other way to learn
the child parked - not that the child has no human resumer.
2026-08-02 02:15:51 +03:00
Ahmed Allam 8f1bb64d16 fix(core): tell the parent when an interactive subagent parks
Parking is self-service only for the root, which the user is watching.
A parked child owes its parent a report it can no longer send, so the
parent would wait out its full timeout for nothing.
2026-08-02 02:15:51 +03:00
Ahmed Allam 49057f267f fix(tools): halve the wait_for_message ceiling to 300s
A mutual wait between two agents resolves only when both hit their cap,
so the ceiling is the worst-case idle burn. Name the constants instead of
repeating the literal, and align the interactive auto-resume timeout.
2026-08-02 02:15:51 +03:00
Ahmed Allam 6eec34df24 fix(core): persist the tool-call recovery counter across resumes
An exhausted agent parked in 'waiting' got a fresh nudge budget on every
600s auto-resume, so a wedged agent could nudge-park-nudge indefinitely.
Track the count on the coordinator, snapshot it, and reset it only on
real input or an explicit lifecycle tool.
2026-08-02 02:15:51 +03:00
Ahmed Allam f6f9469e00 fix(core): stop interactive runs stalling on a missing tool call
Interactive turns ended by plain text left the agent parked in 'waiting'
forever. Require an explicit lifecycle tool in both modes and nudge a
text-only turn back into a tool call, bounded by a recovery limit.
2026-08-02 02:15:51 +03:00
devin-ai-integration[bot]andAhmed Allam dc7cc50f80 docs(prompt): teach agents to recognize Caido proxy error pages instead of chasing them (#955)
* docs(prompt): teach agents to recognize Caido proxy error pages

* docs(prompt): tighten Caido proxy error page section

---------

Co-authored-by: Ahmed Allam <ahmed39652003@gmail.com>
2026-08-02 02:01:34 +03:00
devin-ai-integration[bot] 5602bc23ca fix: pre-v1-style lifecycle resilience — mailbox delivery, uniform revival, unexitable runner, waiting timeout, broader retries, crash-safe identity (#923) 2026-08-01 11:17:08 -07:00
alex s a9deb84260 fix(llm): surface structured provider refusals (#944)
* fix(llm): surface structured provider refusals

* fix(llm): settle refused autonomous agents
2026-07-31 10:57:42 -04:00