Commit Graph
471 Commits
Author SHA1 Message Date
devin-ai-integration[bot]andyoni 7b412ac3b1 Harden local viewer authorization (session capability, history gating, expiry) (#818)
* Harden viewer authz: session capability, history gating, expiry

* Set session cookie whenever index.html is served

* Gate session capability behind bootstrap token; sync auth status with expiry

---------

Co-authored-by: yoni <yoni@usestrix.com>
2026-07-20 23:45:11 +00:00
Jonathan Singer 4be5d7716c Add a run details panel and move the privacy note to a dismissable toast 2026-07-20 19:06:40 -04:00
Jonathan Singer 68f1d19504 Show live steering messages in the agent transcript 2026-07-20 17:47:50 -04:00
Jonathan Singer dd1dab5d95 Bring the pro live-prompt composer to the local viewer
Replace the ad-hoc steer input with a faithful port of the pro app's
ScanPromptComposer: a collapsible Guide the agent pill that opens into
the Live prompt card with an auto-resizing textarea, a target picker,
and a rounded send button. Drops the Enterprise lock and bridge states
since local steering is immediate. Used under the agent graph with a
target dropdown, and docked in the agent detail modal with a static
target.
2026-07-20 17:30:38 -04:00
Jonathan Singer 09ff9aa783 Steer each agent from its modal; drop the Pro upsell there 2026-07-20 17:20:09 -04:00
Jonathan Singer 47ded9b93c Add live agent steering from the web viewer
Let the in-TUI viewer send a steering message to a running agent during a
live scan, reusing the same delivery path the TUI uses. Standalone strix
view reports steering unavailable, so the web composer only shows when a
live scan is in process.
2026-07-20 16:54:29 -04:00
Jonathan Singer 01c02d6d97 Rebuild the viewer bundle 2026-07-20 16:48:55 -04:00
Jonathan Singer 4465617134 Polish the local viewer: inline verify, clean titles, smart default view
- Verify your email right on the Past runs page instead of being sent off
  to the Email report page; the list unlocks in place once verified.
- Show a clean target-based title (like arch.co) and a relative time
  instead of the raw run folder name everywhere runs are listed.
- Land on Agents while a scan is still live and on Overview once it is
  done, without ever overriding where you navigate yourself.
2026-07-20 16:48:52 -04:00
Jonathan Singer 8f4ca2aedc Add a collapsible sidebar to the local viewer
Toggle it to a narrow icon-only rail; the choice is remembered in
localStorage and each icon keeps a hover tooltip so labels stay findable.
2026-07-20 16:48:41 -04:00
Jonathan Singer 8264eee2f5 Add surfaces to the empty-state and agents CTAs 2026-07-20 15:05:46 -04:00
Jonathan Singer 2351bf9323 Track attribution, cta surfaces, and the email funnel in the viewer 2026-07-20 15:04:29 -04:00
Jonathan Singer 10d6136352 Forward viewer email funnel events and cta surface to PostHog 2026-07-20 15:04:25 -04:00
Jonathan Singer 8b98457041 Keep report code blocks from overlapping the field labels 2026-07-20 14:51:50 -04:00
Jonathan Singer 4505ef451c Render markdown in the report PDF (bold, code, lists, headings) 2026-07-20 14:48:06 -04:00
Jonathan Singer 05e8848332 Restyle the report PDF to match the cloud pentest report 2026-07-20 14:38:17 -04:00
Jonathan Singer f3a956f5df Reword the platform CTA and the linked-email chip 2026-07-20 14:26:03 -04:00
Jonathan Singer ea0c107559 Start the email flow directly from the Overview CTA 2026-07-20 13:46:35 -04:00
Jonathan Singer cfe1073650 Center the email report page in the content area 2026-07-20 13:43:35 -04:00
Jonathan Singer 2a85e27dc0 Make the email report its own page instead of a modal 2026-07-20 13:41:34 -04:00
Jonathan Singer f91a831761 Hide the trust banner on the Pro feature pages 2026-07-20 13:36:07 -04:00
Jonathan Singer 5600650e26 Rebuild the viewer bundle 2026-07-20 13:31:19 -04:00
Jonathan Singer 9d4033d950 Pass the relay's work_email_required error through the viewer server
Classify the relay's 400 work_email_required separately from a malformed
address so the browser can show the "use your work email" message.
2026-07-20 13:31:19 -04:00
Jonathan Singer d73f319be5 Rework the viewer nav, add in-app feature pages, and verify-only past runs
- Collapse the sidebar into one ordered list of uniform two-line rows (icon +
  label + short one-liner), no tier sections.
- Sidebar Pro/Enterprise rows now open an in-app FeatureDetail upsell page
  instead of linking out; the page's primary CTA is the sign-up link.
- Past runs "View runs" runs a verify-only flow that never sends a report.
- Ask for a work email: helper text, an instant common-domain check, and a
  friendly message when the relay rejects a personal domain.
2026-07-20 13:31:13 -04:00
Jonathan Singer 2cd953b54e Tighten the email report CTA subtext 2026-07-20 12:42:13 -04:00
Jonathan Singer 7710a970b2 Reframe the email report CTA around security, not unlocking
The subtext now leads with the zero-knowledge assurance (we cannot read the
report) and frames the email step as verifying who we send to via a one-time
code, rather than unlocking a feature.
2026-07-20 12:40:53 -04:00
Jonathan Singer 54e9c0239b Show Pro descriptions under each sidebar item and widen the rail
The hover tooltips read as too subtle, so the one-liners now sit as secondary
text under each title and the left menu is a little wider to fit them.
2026-07-20 12:36:45 -04:00
Jonathan Singer dfc672c947 Label the top-bar CTA 'Run in the cloud' instead of a second 'Start free' 2026-07-20 12:35:14 -04:00
Jonathan Singer a12b9c634c Rebuild the viewer bundle 2026-07-20 12:02:16 -04:00
Jonathan Singer 4c337f93ba Add the email report dialog, past runs view, and run switcher 2026-07-20 12:02:13 -04:00
Jonathan Singer 8d9f785dc7 Add the persistent sidebar and shared Pro upsell tiles 2026-07-20 12:02:10 -04:00
Jonathan Singer 5dee36d30a Wire the viewer to run history, email auth, and report-send endpoints 2026-07-20 12:02:06 -04:00
Jonathan Singer f7cfd0d47d Add run history list, run-scoping, and email/report endpoints to the viewer server 2026-07-20 11:52:48 -04:00
Jonathan Singer 98c2e0be4e Add viewer email auth state, relay client, and encrypted PDF reports 2026-07-20 11:52:46 -04:00
Jonathan Singer da9c606c67 Add STRIX_APP_URL viewer setting for the relay base URL 2026-07-20 11:52:43 -04:00
Jonathan Singer 11c7eef082 Add a "View in web" link to the run summary, and make the logo clickable 2026-07-20 10:04:40 -04:00
Jonathan Singer 8bbcafcf1a Fix the viewer build command 2026-07-20 09:51:56 -04:00
Jonathan Singer 1e4db0098b Fix .gitignore skipping some viewer source files 2026-07-20 09:51:56 -04:00
Jonathan Singer 1ce37d7b12 Refresh the live view faster and follow new activity 2026-07-20 09:51:56 -04:00
Jonathan Singer b41abc9e58 Clean up the agent transcript view 2026-07-20 09:51:56 -04:00
Jonathan Singer 9a9b5cc1c2 Tidy up the agent modal sizing 2026-07-20 09:51:56 -04:00
Jonathan Singer db29c77b30 Open agent details in a modal 2026-07-20 09:51:56 -04:00
Jonathan Singer 46e4b16167 Add a local web viewer for runs
`strix view` opens a run in the browser, served locally from the run files
(nothing is uploaded). There's also a quick link to it from the TUI and the
end-of-run summary.
2026-07-20 09:51:56 -04:00
alex s 230324d2b8 recon asset discovery skill (#809)
* Add passive asset discovery reconnaissance skill

* Document asset discovery reconnaissance skill

* Refine asset discovery reconnaissance skill

* Add scope guidance to asset discovery skill
2026-07-19 16:47:31 -04:00
Ahmed Allam 7d5a67d234 chore(llm): shorten timeout helper docstring; update tests 2026-07-17 19:45:32 -07:00
Ahmed Allam 88ad3e4472 fix(llm): use a JSON-serializable per-turn model timeout
An httpx.Timeout in ModelSettings.extra_args crashes
ModelSettings.to_json_dict() (PydanticSerializationError) on the Chat
Completions and LiteLLM model paths, which serialize settings for their
tracing generation span — failing every model turn on those paths. Pass
the timeout as a plain float, which httpx-based clients apply as the
read (inactivity) timeout.
2026-07-17 19:45:32 -07:00
Ahmed Allam cf7689e927 fix(llm): use httpx.Timeout read-inactivity for per-turn model timeout 2026-07-17 18:40:23 -07:00
Ahmed Allam 3bb95ab43d fix(llm): add per-turn model request timeout so stalled streams fail fast and retry 2026-07-17 18:40:23 -07:00
Ahmed Allam 9aa151c687 fix(llm): retry statusless mid-stream provider errors (quota/billing)
The SDK's http_status retry policy only retries errors carrying a known
HTTP status code, but quota/billing (and other provider-side) failures
often surface inside a streamed response as a bare error with no status
code, so they were failing on the first attempt. Add a statusless retry
policy to DEFAULT_MODEL_RETRY (retry count and backoff unchanged) so they
are retried before a genuine exhaustion fails the run; user aborts are
never retried.
2026-07-17 16:47:14 -07:00
Ahmed Allam b9c2592b53 fix(llm): retry statusless mid-stream provider errors (quota/billing)
The SDK's http_status retry policy only retries errors carrying a known
HTTP status code, but quota/billing (and other provider-side) failures
often surface inside a streamed response as a bare error with no status
code, so they were failing on the first attempt. Add a statusless retry
policy to DEFAULT_MODEL_RETRY so they are retried (before any content is
streamed; user aborts are never retried), restoring the pre-SDK engine's
resilience. If the provider is genuinely exhausted, the error still
propagates and fails the scan after retries.
2026-07-17 16:47:14 -07:00
devin-ai-integration[bot] f54ecb74f9 fix(report): restore cost tracking for OpenRouter and other LiteLLM-routed models (#801) 2026-07-17 13:38:23 -07:00