Introduce strix view and the local dashboard: how to open a run, what
stays on your machine, and what each view (Overview, Vulnerabilities,
agent graph, History, Reports) shows.
Move the Vite frontend source into strix/viewer/frontend and rename the
built bundle to strix/viewer/static, so all the viewer's pieces live under
one directory. Updated the server bundle path, vite outDir, packaging
(pyproject exclude, PyInstaller spec), Makefile, gitignore, and docs to
match. Avoided naming the bundle dir 'dist' since gitignore matches that
unanchored and would drop the shipped bundle.
Replace the ad-hoc steer input with a faithful port of the pro app's
ScanPromptComposer: a collapsible Guide the agent pill that opens into
the Live prompt card with an auto-resizing textarea, a target picker,
and a rounded send button. Drops the Enterprise lock and bridge states
since local steering is immediate. Used under the agent graph with a
target dropdown, and docked in the agent detail modal with a static
target.
Let the in-TUI viewer send a steering message to a running agent during a
live scan, reusing the same delivery path the TUI uses. Standalone strix
view reports steering unavailable, so the web composer only shows when a
live scan is in process.
- Verify your email right on the Past runs page instead of being sent off
to the Email report page; the list unlocks in place once verified.
- Show a clean target-based title (like arch.co) and a relative time
instead of the raw run folder name everywhere runs are listed.
- Land on Agents while a scan is still live and on Overview once it is
done, without ever overriding where you navigate yourself.
- Collapse the sidebar into one ordered list of uniform two-line rows (icon +
label + short one-liner), no tier sections.
- Sidebar Pro/Enterprise rows now open an in-app FeatureDetail upsell page
instead of linking out; the page's primary CTA is the sign-up link.
- Past runs "View runs" runs a verify-only flow that never sends a report.
- Ask for a work email: helper text, an instant common-domain check, and a
friendly message when the relay rejects a personal domain.
The subtext now leads with the zero-knowledge assurance (we cannot read the
report) and frames the email step as verifying who we send to via a one-time
code, rather than unlocking a feature.
Jonathan Singer