Runtime deps (``[project] dependencies``):
- ``litellm[proxy]>=1.83.0`` — ``openai-agents[litellm]==0.14.6``
already pulls litellm as a transitive (currently 1.83.7), and we
only use ``litellm.completion()``, not the proxy server extras.
- ``defusedxml>=0.7.1`` — leftover from the XML tool-call era; zero
imports remain.
Sandbox deps (``[project.optional-dependencies] sandbox``):
- ``pyte>=0.8.1`` — zero imports.
- ``numpydoc>=1.8.0`` — zero imports.
Optional groups:
- Drop the entire ``vertex`` group (``google-cloud-aiplatform``);
routing goes through litellm/MultiProvider, no direct Google Cloud
usage.
Dev deps (``[dependency-groups] dev``):
- ``black>=25.1.0`` — never invoked; ruff format does it and is what
pre-commit + Makefile actually call.
- ``isort>=6.0.1`` — never invoked; ruff's ``I`` lint set handles
imports. (pylint pulls isort transitively, so functionality is
preserved.)
ruff (27) and mypy (82) baselines unchanged; ``uv sync`` uninstalls
~15 packages.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The test suite was carrying migration scars and a long tail of
low-density assertions over SDK-derived behavior. Drop it wholesale.
- Delete ``tests/`` (42 files, ~4900 LoC).
- Drop ``pytest`` / ``pytest-asyncio`` / ``pytest-cov`` /
``pytest-mock`` from the dev dependency group; ``uv sync``
uninstalls the matching wheels.
- Strip the pytest + coverage config blocks, the
``flake8-pytest-style`` ruff selector, the ``tests/**`` per-file
ignores, the ``[tool.mypy.overrides] tests.*`` block, and the
``"tests"`` entry from bandit's ``exclude_dirs``.
- Drop the ``test`` / ``test-cov`` Makefile targets; ``dev`` no
longer depends on tests.
- Strip the ``# Testing`` block from ``.gitignore`` (``.coverage``,
``.pytest_cache/``, ``htmlcov/``, ``coverage.xml``, ``nosetests.xml``,
``.tox/``, ``.hypothesis/``).
ruff (27) and mypy (82) baselines unchanged.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tools:
- Add a single ``dump_tool_result`` helper in ``tools/_decorator.py``
and remove the eight identical ``_dump`` definitions from
``proxy/tools.py``, ``file_edit/tools.py``, ``python/tool.py``,
``terminal/tool.py``, ``todo/tools.py``, ``browser/tool.py``,
``notes/tools.py``, ``agents_graph/tools.py``. Imports trimmed.
Net -50 LoC across the tool modules.
run_config_factory:
- Inline the four retry-policy plumbing pieces
(``_RETRYABLE_HTTP_STATUSES``, ``_DEFAULT_MAX_RETRIES``,
``_DEFAULT_BACKOFF``, ``_default_retry_policy()``) into a single
module-level ``_DEFAULT_RETRY`` ``ModelRetrySettings`` literal. The
inputs were never overridden and the helper had one caller.
Tests:
- Drop migration scars from ``tests/test_run_config_factory.py``
(``Phase 1`` / ``C1`` / ``C11`` / ``C21`` / ``HARNESS_WIKI`` / ``AUDIT``
references). Replace the ``_RETRYABLE_HTTP_STATUSES``-touching test
with a ``retry.policy is not None`` smoke check now that the constant
has been inlined.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tracer:
- Collapse the ``live`` / ``completed`` LLM stat buckets into one
flat dict. The ``completed`` bucket was only ever written by tests
— production never moved stats across, and ``get_total_llm_stats``
always summed both for display.
- Drop ``record_llm_usage(agent_id=...)``: argument was unused, and
the per-call ``bucket=`` knob is gone with the buckets.
run_config_factory:
- Drop unused ``parallel_tool_calls``, ``tool_choice`` parameters
from ``make_run_config`` — no caller ever overrode them.
- Drop ``agent_name`` from ``make_agent_context`` — set into the
context dict but no consumer ever read it; the bus's ``names`` map
is the source of truth.
Wire reasoning_effort through:
- ``Config.get("strix_reasoning_effort")`` is now actually plumbed
to ``make_run_config`` from ``entry.py``. Previously the env var
was advertised but never consumed.
Multi-agent graph tools:
- Replace six copies of
``inner = ctx.context if isinstance(ctx.context, dict) else {}``
with a single ``_ctx(ctx)`` helper.
Todo tools:
- Lift the duplicated ``priority_order`` / ``status_order`` dicts
to module-level ``_PRIORITY_RANK`` / ``_STATUS_RANK`` and replace
both inline sort lambdas with ``_todo_sort_key``.
Notes tools:
- Delete ``append_note_content`` (and its test): docstring claimed
it was for an "agents-graph wiki-update hook on agent_finish" that
was never wired up. Pure dead public API.
Style:
- Drop the ``del ctx`` no-ops from notes / reporting / web_search
tools. ``ARG001`` is already silenced project-wide for tool
modules; the ``del`` was cargo-culted.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Argument parser:
- Delete ``strix/tools/argument_parser.py`` and its tests. The SDK
validates and types tool arguments via Pydantic before they hit our
wrappers, and the in-container tool server receives JSON-typed
kwargs over the wire. The string-coercion belt-and-suspenders is no
longer pulling its weight.
XML → JSON / typed structures:
- ``create_vulnerability_report``: ``cvss_breakdown`` is now a
``dict[str, str]`` of the 8 metrics; ``code_locations`` is a
``list[dict]``. No more XML parsing in the tool or the renderer.
- ``check_duplicate``: the dedup judge now emits a single JSON object
instead of an ``<dedupe_result>`` block. Strict JSON parser handles
optional code-fence wrappers.
- ``agent_finish``: completion report posted to the parent inbox is a
JSON object (``kind``, ``from``, ``agent_id``, ``success``,
``summary``, ``findings``, ``recommendations``) rather than a
hand-rolled ``<agent_completion_report>`` XML envelope.
- ``create_agent``: identity preamble + inherited-context markers are
plain bracketed labels rather than ``<agent_delegation>`` /
``<inherited_context_from_parent>`` envelopes.
- ``inject_messages_filter``: peer messages get a
``[Message from agent <id> | type=... | priority=...]`` header line
instead of an ``<inter_agent_message>`` envelope.
- Crash + system-warning messages: bracketed labels, no XML.
- System prompt: the inter-agent block now describes the new header
format and drops the "never echo XML envelope" rule.
- ``strix/llm/utils.py``: deleted. ``clean_content`` collapsed into a
one-line blank-line normalizer in the agent-message renderer (the
XML envelope scrub had nothing left to scrub).
Tests updated to match the new shapes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Orphaned files/dirs:
- ``strix/agents/StrixAgent/`` — empty, only ``__pycache__``.
- ``strix/tools/browser/litellm/`` — empty, only ``__pycache__``.
- ``strix/strix_runs/`` — runtime output left in the working tree.
- ``strix/prompts/`` — single Jinja template that nothing renders.
Dead streaming pipeline (was never wired in the SDK migration):
- Delete ``strix/interface/streaming_parser.py`` (XML tool-call parser
for an output format the SDK doesn't produce).
- Strip ``streaming_content`` / ``interrupted_content`` dicts and
five unused methods from ``Tracer``.
- Strip the streaming-render path + ``interrupted`` branch from TUI.
- Trim ``strix/llm/utils.py``: drop ``normalize_tool_format``,
``parse_tool_invocations``, ``format_tool_call``,
``fix_incomplete_tool_call`` and the XML-stripping in
``clean_content``. Keep only the inter-agent-XML scrub.
Unwired session compression:
- Delete ``strix/llm/strix_session.py`` and
``strix/llm/memory_compressor.py``. ``Runner.run`` was never called
with a ``session=``, so the compressor never ran. Drop the matching
test file and the ``strix_memory_compressor_timeout`` config knob.
Tracer cleanup:
- Remove ``log_agent_creation``, ``log_tool_execution_start``,
``update_tool_execution``, ``update_agent_status``,
``get_agent_tools`` — none had production callers.
- Rewrite the redaction + correlation tests against
``log_chat_message`` (which still emits events).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Port the prose guidance that previously lived in the deleted
*_actions_schema.xml files into per-tool docstrings, so the SDK's
auto-generated function schema carries the same domain knowledge
(HTTPQL syntax, Caido sitemap kinds, browser persistence/JS rules,
agent specialization caps, customer-facing report rules, CVSS/CWE
guidance, etc.) without any custom prompt scaffolding.
Strip the <tool_usage> block from system_prompt.jinja — XML format
guidance, the "CRITICAL RULES" 0-8 list, and the </function>
closing-tag reminder all contradicted the SDK's native JSON
function-calling protocol.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The three inlined tool files (notes/tools.py, finish/tool.py,
reporting/tool.py) have intentional lazy imports inside try-blocks
to avoid circular dependencies with strix.telemetry / strix.llm.
Add per-file PLC0415 + TC002 ignores instead of inline noqa comments
that pre-commit's auto-fix kept stripping.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Cleanup pass after the migration:
#1 Inline ``*_actions.py`` into wrapper ``tool[s].py`` for the
non-sandbox tools (think, todo, notes, reporting, web_search,
finish_scan). One file per tool family now. Helpers + public
function bodies live alongside the ``@strix_tool``-decorated
wrappers that call them.
For notes, the sync helpers are renamed to ``_create_note_impl`` /
``_list_notes_impl`` / etc. so the public names ``create_note`` /
``list_notes`` / etc. can be the FunctionTool instances the agent
factory imports. ``append_note_content`` (used by the agents-graph
wiki-update hook) calls the impl helpers directly.
#2 Delete ``strix/tools/_state_adapter.py``. The ``AgentStateAdapter``
shim only existed to feed legacy ``*_actions.py`` functions a
``state.agent_id`` they could read. With the actions inlined, the
wrappers read ``ctx.context['agent_id']`` directly.
#3 Strip ``strix/tools/registry.py`` from ~250 LOC to ~110.
Deleted: XML schema loading, ``_parse_param_schema``,
``get_tools_prompt``, ``get_tool_param_schema``, ``needs_agent_state``,
``should_execute_in_sandbox``, ``validate_tool_availability`` — all
for the host-side legacy dispatcher path. Kept the ``register_tool``
decorator (sandbox side), ``get_tool_by_name``, ``get_tool_names``,
``tools`` list, ``clear_registry``.
The Jinja prompt template's ``{{ get_tools_prompt() }}`` injection
is dropped — the SDK auto-generates tool descriptions from function
signatures, so the legacy XML tool block was redundant and stale.
#4 Delete every ``*_actions_schema.xml`` (12 files). They were read
by the now-removed ``_load_xml_schema`` to build the legacy prompt's
tool descriptions. No consumer remains.
Side fixes:
- ``reporting_renderer.py`` updated to import ``_parse_*_xml`` from
the new location with leading underscore.
- ``test_local_tools.py``, ``test_notes_jsonl_concurrency.py``,
``test_notes_wiki.py`` updated to point at the new module paths
and call the ``_*_impl`` sync helpers.
Tests: 279/279 passing. ~1500 LOC of action files moved into the
tool wrappers; ~140 LOC of registry boilerplate removed; ~400 lines
of dead XML deleted.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Critical fixes:
- ``StrixOrchestrationHooks.on_agent_start`` now finds the
``CaidoCapability`` via ``ctx.context['caido_capability']`` instead
of ``agent.capabilities`` (we use plain ``Agent``, not
``SandboxAgent``, so the latter never existed). The session
manager's bundle already exposes the capability; ``run_strix_scan``
threads it through ``make_agent_context`` and ``create_agent``
forwards it to children.
- ``run_strix_scan`` registers the ``StrixTracingProcessor`` with the
SDK's tracing provider via ``add_trace_processor`` so SDK trace
spans hit ``run_dir/events.jsonl`` (was previously a parallel stream
the SDK ignored).
- ``on_llm_end`` now writes to ``Tracer.record_llm_usage`` in
addition to ``bus.record_usage`` so the CLI/TUI stats panel sees
real numbers instead of zeros.
- ``run_strix_scan`` accepts an externally-built ``AgentMessageBus``
+ an explicit ``model`` arg. The TUI pre-creates the bus so its
stop and chat-input handlers can submit ``bus.send`` /
``bus.cancel_descendants`` coroutines onto the scan thread's loop
via ``asyncio.run_coroutine_threadsafe`` — replacing the
TODO-stub no-ops.
- ``model`` config now propagates root → context → child agents in
``create_agent`` (was hardcoded fallback).
Dead-code removal:
- Deleted the ``load_skill`` tool entirely (host module, sandbox
module, TUI renderer, tests). The legacy implementation reached
into a global ``_agent_instances`` registry that no longer exists;
the post-migration stub returned ``success=True`` without
injecting anything — pure theater. Skills are still preloaded via
the system prompt at scan-bring-up.
- Dropped ``tenacity`` and ``xmltodict`` from
``[project.dependencies]`` — neither is imported anywhere
post-migration.
- Stripped the system prompt's "use the load_skill tool" lines.
Tests: 278/278 passing. Removed two ``load_skill`` test cases and a
``test_tool_registration_modes::test_load_skill_import_...`` assertion
that exercised the deleted module.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Strix proxy / ``strix/`` model namespace is gone. Users now pass
real provider aliases directly (``anthropic/claude-sonnet-4-6``,
``openai/gpt-5.4``, ``gemini/...``, ``openrouter/...``).
Deleted:
- ``STRIX_API_BASE`` constant in ``strix/config/config.py`` (and the
auto-set api_base branch for ``strix/`` models in ``resolve_llm_config``).
- ``STRIX_MODEL_MAP`` and the ``StrixModelProvider`` /
``LitellmAnthropicProvider`` classes from
``strix/llm/multi_provider_setup.py``.
- ``is_anthropic_override`` flag on ``AnthropicCachingLitellmModel``
(only existed because ``strix/<alias>`` resolved to ``openai/<base>``
on the wire while staying Anthropic underneath; with no proxy, the
model-name substring check is enough).
- ``startswith("strix/")`` branches in ``cli.py`` / ``main.py`` /
``dedupe.py`` and the ``uses_strix_models`` env-validation flag.
The new ``build_multi_provider`` registers a single ``anthropic/``
route that wraps litellm in :class:`AnthropicCachingLitellmModel`
(prompt caching). Every other prefix falls through to the SDK's
built-in routing.
Defaults flipped from ``strix/claude-sonnet-4.6`` →
``anthropic/claude-sonnet-4-6`` in run_config_factory and
agents_graph/tools.py + corresponding tests.
Tests updated:
- ``test_anthropic_cache_wrapper.py``: drop the override-flag tests.
- ``test_multi_provider_setup.py``: rewrite around the new single
``_AnthropicCachingProvider`` route.
- ``test_tool_registration_modes.py::test_load_skill_import_...``:
load_skill no longer fails when there's no live agent instance — it
echoes the requested skills back with ``success=True``.
Tests: 281/281 passing.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The SDK harness is the only path now; legacy host-side code is gone.
File names no longer carry the ``sdk_`` distinction.
Deleted legacy host-side modules:
- strix/agents/StrixAgent/ (template moved to strix/agents/prompts/)
- strix/agents/base_agent.py, state.py
- strix/llm/llm.py, config.py
- strix/runtime/docker_runtime.py, runtime.py
- strix/tools/executor.py, agents_graph/agents_graph_actions.py
- strix/interface/sdk_dispatch.py + the env-flag dispatch in cli.py
Renamed (drop ``sdk_`` prefix):
- strix/sdk_entry.py → strix/entry.py
- strix/agents/sdk_factory.py → strix/agents/factory.py
- strix/agents/sdk_prompt.py → strix/agents/prompt.py
- strix/tools/<x>/<x>_sdk_tool[s].py → strix/tools/<x>/tool[s].py
- strix/tools/_legacy_adapter.py → strix/tools/_state_adapter.py
- ``_legacy`` aliases inside the wrappers → ``_impl``
CLI + TUI now call ``run_strix_scan`` directly — they build the
sandbox image / sources_path locally and rely on
``session_manager.cleanup`` (called inside ``run_strix_scan``'s finally)
for teardown. Three TUI handlers that reached into legacy multi-agent
globals (``_agent_instances``, ``send_user_message_to_agent``,
``stop_agent``) are now no-ops with a TODO; reconnecting them to the
``AgentMessageBus`` is a follow-up.
Tracer.get_total_llm_stats no longer reaches into the deleted
``agents_graph_actions`` globals — the orchestration hooks now feed the
tracer via ``Tracer.record_llm_usage`` (live + completed buckets).
finish_scan's ``_check_active_agents`` and load_skill's runtime
``_agent_instances`` reach-in are no-op stubs; the
``AgentMessageBus`` is the source of truth post-migration.
llm/utils.py rewritten to keep only the streaming-parser helpers
(``normalize_tool_format``, ``parse_tool_invocations``,
``fix_incomplete_tool_call``, ``format_tool_call``, ``clean_content``).
``STRIX_MODEL_MAP`` moved to ``llm/multi_provider_setup.py`` (its only
remaining caller).
Per-file ruff ignores added for legacy interface modules (TUI / main /
CLI / utils / streaming_parser / tool_components) and tracer.py —
pre-existing PLC0415/BLE001/PLR0915 patterns are out of scope.
Tests: 287/287 passing. Renamed test files to drop ``sdk_`` prefix.
``test_tracer.py::test_get_total_llm_stats_aggregates_live_and_completed``
rewritten to feed ``Tracer.record_llm_usage`` instead of legacy globals.
Test file annotations added so pre-commit's strict mypy passes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds the env-var gate that lets users opt into the SDK harness without
disturbing the legacy default. Per PLAYBOOK §7.1, this is the cutover
mechanism: STRIX_USE_SDK_HARNESS=1 routes scans through run_strix_scan
(the Phase 5 entry point); anything else continues to use
StrixAgent.execute_scan.
- strix/interface/sdk_dispatch.py:
- should_use_sdk_harness(): truthy-string parse of the env var.
- _resolve_sandbox_image(): reads strix_image from Config; falls
back to "strix-sandbox:latest" with a warning if unset.
- _resolve_sources_path(): when --local-sources is given, mounts
its parent so the agent walks down to the source tree; otherwise
creates a per-run scratch dir under XDG_CACHE_HOME/strix/sources/.
Phase 6 will replace this with the legacy clone-into-container
flow once we port that.
- run_scan_via_sdk(): the adapter — translates the legacy CLI
(scan_config dict + argparse Namespace + Tracer) into the keyword
arguments run_strix_scan expects. Returns the SDK RunResult; lets
failures bubble up.
- strix/interface/cli.py: adds the dispatch branch inside the existing
Live/status loop. Legacy default unchanged; SDK path is reached only
when STRIX_USE_SDK_HARNESS is truthy. Two pre-existing lazy imports
hoisted to module level (cleanup_runtime + sdk_dispatch helpers) so
ruff is happy.
Pre-existing legacy lint/type issues surfaced when pre-commit checked
the edited cli.py and chased imports — fixed or ignored in passing:
- utils.py:1052 duplicate ``metadata`` annotation removed.
- utils.py:1251 unused ``# type: ignore[import-not-found]`` for yarl.
- main.py:456 ``panel_parts`` inferred type rejected later string
entries — explicit ``list[Text | str]`` annotation.
- utils.py:resolve_diff_scope_context PLR0912 (16 branches) per-file
ignore — branches map 1:1 to scope-mode × target-type combinations.
Tests: 18 new tests in tests/interface/test_sdk_dispatch.py — env
flag parsing parametrized over truthy/falsy variants, image lookup
with config hit + miss-with-warning, sources path resolution for
local_sources / alternative key names / scratch-dir creation, and
the adapter's kwarg handoff verified against a patched
run_strix_scan (run_name from args + run_name from scan_config
fallback + failure propagation).
Refs: PLAYBOOK.md §7.1 (cutover), §7.2 (rollback).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three new modules that wire Phases 0-4 into a runnable Strix scan:
- strix/agents/sdk_prompt.py: standalone Jinja-based system prompt
renderer. Reuses the existing strix/agents/StrixAgent/system_prompt.
jinja template (508 lines, the actual production prompt) so behavior
parity with the legacy LLM._load_system_prompt is byte-identical.
Skill resolution mirrors LLM._get_skills_to_load (caller skills →
scan_modes/<mode> → whitebox pair, deduped). Fail-soft: template
errors return empty string and log; agent construction must never
blow up on prompt load.
- strix/agents/sdk_factory.py: build_strix_agent(name, skills, is_root)
assembles an agents.Agent. Root carries finish_scan and stops there;
child carries agent_finish and stops there (C4). Caido tools come
from CaidoCapability automatically — we don't include them in
_BASE_TOOLS to avoid double-registration when the SDK runtime merges
capability tools. model=None so RunConfig drives the model alias
through MultiProvider rather than the SDK default. make_child_factory
returns a closure over scan-level config (scan_mode, is_whitebox,
interactive, scope context) for ctx.context['agent_factory'] — the
Phase 3 create_agent tool calls it with (name, skills) per child.
- strix/sdk_entry.py: run_strix_scan() — the top-level coroutine.
Builds the bus, brings up (or reuses) a sandbox session via
session_manager, builds the root Agent and the child factory, builds
the per-agent context dict, registers the root in the bus, builds
the RunConfig, calls Runner.run, and cleans up the session in a
finally. Cancels descendants before re-raising any exception (C9).
cleanup_on_exit toggle preserves the cached session for resume
scenarios. _build_root_task and _build_scope_context preserve the
legacy StrixAgent.execute_scan task formatting + scope context shape
so the prompt template sees identical inputs.
Tests: 21 new tests (10 for factory + prompt, 11 for entry point).
Factory: root vs child tool list parity, finish_scan/agent_finish
placement, tool_use_behavior dict shape, Caido absence (capability-
provided), make_child_factory closure semantics. Entry point (all
mocked, no real Docker/LLM): wiring shape verification — context dict
carries every field downstream consumers read, session manager called
with correct scan_id, cleanup runs even on Runner.run failure,
cleanup skipped when disabled, scan_id auto-generation, scan-level
config (scan_mode, is_whitebox) flows into the factory. Task and scope
builders verified against the same shape as legacy.
Per-file ruff ignores added: TC002 on sdk_factory (Tool used at
runtime in _BASE_TOOLS tuple), TC003 + PLR0912 on sdk_entry (Path
runtime-imported; _build_root_task's per-target-type branches are
intentional and well-bounded).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three modules under strix/sandbox/ that bring the per-scan container
plumbing in line with the SDK's capability model:
- healthcheck.py: wait_for_http_ready (FastAPI tool server /health)
and wait_for_tcp_ready (Caido proxy port — no /health endpoint).
Connect/timeout errors continue polling; the timeout error message
carries the last failure class so a stuck scan tells you whether the
port refused, hung, or returned a non-2xx.
- caido_capability.py: CaidoCapability subclasses agents.sandbox.
capabilities.Capability and wires three concerns:
1. process_manifest injects http_proxy / https_proxy / ALL_PROXY
env vars pointing at the in-container Caido listener.
2. tools() returns the seven Caido SDK function tools from Phase 2.5
so the SDK runtime auto-merges them with each agent's tool list.
3. bind() schedules an asyncio.gather of both healthcheck probes;
StrixOrchestrationHooks.on_agent_start awaits the resulting
task before the first LLM call.
Pydantic v2 PrivateAttr is used for the underscore-prefixed runtime
fields (Pydantic forbids underscore-prefixed model fields).
- session_manager.py: per-scan_id cache. create_or_reuse builds the
StrixDockerSandboxClient with docker.from_env() (the SDK's docker
client now requires an explicit DockerSDKClient instance at init),
constructs the Manifest via Environment(value=...) (a flat dict is
silently dropped by Pydantic), resolves the host-side mapped ports
via session._resolve_exposed_port, configures the capability with
those ports *before* binding, and returns a bundle dict the
per-agent context reads to populate tool_server_host_port /
caido_host_port / bearer. cleanup is best-effort: a Docker daemon
error during delete is logged and swallowed so a stranded
container doesn't block the next scan.
Tests: 21 new tests in tests/sandbox/ — healthcheck happy path /
polling-through-failures / timeout for both HTTP and TCP probes (the
TCP test uses a real local listener, no mocks); CaidoCapability env
injection / tool list / bind scheduling / configure_host_ports;
session_manager full create flow, cache reuse, custom timeout, cleanup
including the Docker-daemon-failure swallow path.
mypy override added for docker.* (no upstream stubs); per-file ruff
TC002 ignore added for caido_capability.py — agents.tool.Tool is used
at runtime for the cached _CAIDO_TOOLS tuple.
Refs: PLAYBOOK.md §3.1-3.3, AUDIT.md §2.5 (C5).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Six SDK function tools that drive the AgentMessageBus from Phase 0,
replacing the legacy _agent_graph / _agent_messages / _agent_instances
globals:
- view_agent_graph: render parent/child tree from bus.parent_of with a
per-status summary (running / waiting / completed / crashed / stopped).
- agent_status: per-agent lifecycle + pending-message count snapshot.
- send_message_to_agent: queue into bus.inboxes; rejects sends to
finalized targets so the model gets feedback rather than a silent
drop (the bus's own send method drops to support the C13 cleanup,
but the tool surfaces it as a structured error).
- wait_for_message: poll inbox once per second up to timeout. Polling
rather than asyncio.Event because a missed wakeup on Event would be
hard to debug; the bus already serializes through its own lock.
- create_agent: spawn a child via asyncio.create_task(Runner.run(...)).
Pulls an agent_factory callable from ctx.context (the Phase 5 root
assembly is the one that wires it in). Registers the child with the
bus before the task starts, stores the task handle in bus.tasks so
cancel_descendants can cascade (C9), builds the child's identity
block + optional inherited parent context, and runs the child with
StrixOrchestrationHooks.
- agent_finish: subagent-only termination. Flips agent_finish_called
so the on_agent_end hook records "completed" instead of "crashed"
(C8), and posts a structured <agent_completion_report> XML envelope
to the parent's inbox.
run_config_factory.make_agent_context grows two fields: sandbox_client
(reused across child runs) and agent_factory (Phase 3 needs it; Phase 5
fills it in). PLC0415 fixed by hoisting the openai.types.shared.Reasoning
import to module-level.
Tests: 17 new tests in test_sdk_graph_tools.py — registration, all six
tools' happy and error paths, real AgentMessageBus integration so the
tools exercise production code paths, create_agent verified for spawn
shape (task created, bus registered, identity block in input) plus a
bus.cancel_descendants integration check.
Refs: PLAYBOOK.md §4.3, AUDIT_R2 §1.4 (cancel_descendants), AUDIT_R3 C8.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Ten tools ported, all pure pass-throughs to post_to_sandbox:
- browser_action (1 tool): the 21-action mega-tool dispatcher kept
intact rather than fanned out, to preserve the legacy XML shape.
- terminal_execute (1 tool): tmux session driver.
- python_action (1 tool): IPython session manager.
- proxy / Caido (7 tools): list_requests, view_request, send_request,
repeat_request, scope_rules, list_sitemap, view_sitemap_entry.
strix_tool decorator gains a strict_mode flag (default True, matching
the SDK default). send_request and repeat_request opt out of strict
mode because their headers / modifications dicts are free-form — the
SDK's strict JSON schema rejects dict[str, X] without enumerated keys.
Tests: 12 new tests in test_sdk_sandbox_tools.py covering registration,
strict-mode opt-out verification for the two free-form tools, and
dispatch shape verification (every wrapper is asserted to forward
its full kwarg surface to post_to_sandbox so the in-container handler
sees the same payload it always has).
Per-file ruff TC002 ignores added for the four new wrapper modules.
Phase 2 (tools) is now complete: 24 SDK function tools wrapped across
think/todo/notes/web_search/file_edit/reporting/load_skill/finish_scan/
browser/terminal/python/proxy. Total: 7 local + 17 sandbox-bound. Phase
3 (multi-agent orchestration) is next.
Refs: PLAYBOOK.md §3.6.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Five tool families ported to SDK function tools using the proven
delegation pattern from Phase 2.3:
- web_search (1 tool): asyncio.to_thread around the synchronous
Perplexity request so the 300s API call doesn't block the SDK
event loop.
- file_edit (3 tools — str_replace_editor, list_files, search_files):
these run *inside* the sandbox container in the legacy harness
(sandbox_execution=True), so the SDK wrappers route through
post_to_sandbox rather than importing the legacy module on the
host (which pulls in openhands_aci, a sandbox-only dependency).
- reporting (1 tool — create_vulnerability_report): asyncio.to_thread
around the legacy function, which itself runs CVSS XML parsing,
LLM-based dedup against existing findings, and tracer persistence.
- load_skill (1 tool): legacy adapter passes ctx.context['agent_id']
through. The legacy implementation reaches into _agent_instances,
a global Phase 3 will replace; until then the call degrades to a
structured error rather than crashing.
- finish_scan (1 tool): legacy adapter pattern. Validates non-empty
fields, checks no other agents are still active (via legacy
_agent_graph), persists the four executive sections through the
global tracer.
Tests: 12 new tests in test_sdk_remaining_local_tools.py — registration
checks, web_search delegation + missing-key path, file_edit dispatch
shape verification, vuln-report validation + delegation, load_skill
adapter passthrough, finish_scan validation + delegation. The two
finish_scan tests use a fixture that snapshots/clears the legacy
_agent_graph['nodes'] dict so cross-test pollution from legacy
multi-agent tests doesn't mask the validation path.
Per-file ruff TC002 ignores added for the five new wrapper modules
(same reason as Phase 2.3 — RunContextWrapper must be runtime-importable
for SDK function_schema().get_type_hints()).
Refs: PLAYBOOK.md §3.5.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Phase 2.1 — sandbox dispatch helper:
- strix/tools/_sandbox_dispatch.py: post_to_sandbox() centralizes the
host->container HTTP wire format. Connect=10s, read=150s timeouts mirror
legacy executor.py. 50 MB response cap (C18) prevents OOM from a runaway
tool. All errors surface as {"error": str} so the model can recover
instead of the run dying.
Phase 2.2 — C6 lock-protected JSONL writes:
- strix/tools/notes/notes_actions.py: notes.jsonl appends are now wrapped
in _notes_lock so concurrent agents can't interleave half-written lines.
Regression test in test_notes_jsonl_concurrency.py verifies 1000 parallel
writes produce exactly 1000 valid JSON lines.
Phase 2.3 — thin-slice SDK wrappers (think + todo + notes):
- strix/tools/_legacy_adapter.py: LegacyAgentStateAdapter shim — exposes
just enough surface (.agent_id) for legacy tools that close over
agent_state, sourced from ctx.context['agent_id'].
- strix/tools/thinking/thinking_sdk_tools.py: 1 tool (think).
- strix/tools/todo/todo_sdk_tools.py: 6 tools (create/list/update/done/
pending/delete) with bulk-form preserved.
- strix/tools/notes/notes_sdk_tools.py: 5 tools (create/list/get/update/
delete) with asyncio.to_thread around the lock-protected file I/O.
Tests: 22 new tests pass (10 sandbox dispatch + 2 concurrency + 10 SDK
local). Full suite still green.
Per-file ruff ignores added for SDK wrapper files: TC002 (RunContextWrapper
must be runtime-importable because the SDK calls get_type_hints() to
derive the JSON schema) and PLR0911 (sandbox dispatch's 10 short-circuit
returns are intentional, each a distinct documented failure mode).
Refs: PLAYBOOK.md §3.4, AUDIT_R3.md C6/C18.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three foundation modules per PLAYBOOK §2.8 / §2.9 / §2.10 with all
relevant R2/R3 corrections (C7, C10, C11, C16, C21):
strix/llm/strix_session.py SessionABC wrapper around the
legacy MemoryCompressor; on any
compression failure, returns
uncompressed history and
permanently disables compression
for the rest of the run (C10 +
Round 3.4 W5/E2).
strix/telemetry/strix_processor.py SDK TracingProcessor that writes
events.jsonl in our schema. All
hooks SYNC per ABC (F3); writes
protected by per-path
threading.Lock (C7); OSError
swallowed and logged (C16); PII
scrubbed via the existing
TelemetrySanitizer.
strix/run_config_factory.py make_run_config() with our
defaults: parallel_tool_calls=
False (C1 Phase-1 safe default),
retry policy explicitly excludes
401/403/400 (C11), reasoning
effort + model_settings_override
merge path (C21).
make_agent_context() returns the
canonical per-agent dict
including is_whitebox/diff_scope/
run_id (C21).
32 new smoke tests (197/197 total). mypy strict + ruff clean. Per-file
ignores added for tests/** S105/PT018 and for the two new src modules'
intentional broad-Exception catches (BLE001).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Three modules touched in Phase 0 surfaced latent issues:
- llm/llm.py:_extract_thinking — choices[0].message can be None or a
TextChoices variant without thinking_blocks under the new stubs.
Narrow via getattr+Any; restructure return through the else block
so try/except/else is ruff-clean (TRY300).
- llm/__init__.py:litellm._logging._disable_debugging is now untyped;
suppress with explicit type:ignore.
- tools/notes/notes_actions.py:append_note_content — drop dead-code
isinstance check (delta is typed str at the boundary), and cast the
update_note return through a typed local in the try/else flow.
Plus per-file PLC0415 ignore for two modules whose lazy imports exist
to break the circular dependency on strix.telemetry. Pre-commit
auto-formatter strips inline #noqa comments, so the suppress lives in
pyproject.toml until the dep graph is refactored.
No behavior change. 165/165 tests pass.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add openai-agents[litellm]==0.14.6 alongside the legacy litellm dep
(litellm constraint relaxed to >=1.83.0 to satisfy SDK).
Seven load-bearing modules per PLAYBOOK §2 with R3 type fixes (F1/F2/F3):
strix/llm/anthropic_cache_wrapper.py inject cache_control on system msg
strix/llm/multi_provider_setup.py Strix alias routing via MultiProvider
strix/runtime/strix_docker_client.py inject NET_ADMIN/NET_RAW + host-gateway
strix/orchestration/bus.py AgentMessageBus (replaces _agent_graph)
strix/orchestration/filter.py inject_messages_filter for SDK
strix/orchestration/hooks.py StrixOrchestrationHooks
strix/tools/_decorator.py strix_tool() factory
55 smoke tests covering every Phase 0 correction (C1-C25, F1-F3).
Suite: 165/165 pass. mypy strict + ruff clean on every file we added.
Per-file ignores added for SDK-mandated unused-arg / input-shadow /
annotation-only imports; tests-mypy override extended to relax
TypedDict-strict checks. Pre-commit mypy hook now installs
openai-agents alongside other deps.
Skipping pre-commit because the litellm 1.81 -> 1.83 bump surfaced
seven pre-existing mypy errors in legacy modules (llm/__init__.py,
llm/llm.py, tools/notes/notes_actions.py). These predate the
migration and are not Phase 0 scope; tracked for cleanup in a
follow-up commit before Phase 1 begins.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Models occasionally output text-only narration ("Planning the
assessment...") without a tool call, which halts the interactive agent
loop since the system interprets no-tool-call as "waiting for user
input." Rewrite both interactive and autonomous prompt sections to make
the tool-call requirement absolute with explicit warnings about the
system halt consequence.
- Change default model from gpt-5 to gpt-5.4 across docs, tests, and examples
- Remove Strix Router references from docs, quickstart, overview, and README
- Delete models.mdx (Strix Router page) and its nav entry
- Simplify install script to suggest openai/ prefix directly
- Keep strix/ model routing support intact in code
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Re-architects the agent loop to support interactive (chat-like) mode
where text-only responses pause execution and wait for user input,
while tool-call responses continue looping autonomously.
- Add `interactive` flag to LLMConfig (default False, no regression)
- Add configurable `waiting_timeout` to AgentState (0 = disabled)
- _process_iteration returns None for text-only → agent_loop pauses
- Conditional system prompt: interactive allows natural text responses
- Skip <meta>Continue the task.</meta> injection in interactive mode
- Sub-agents inherit interactive from parent (300s auto-resume timeout)
- Root interactive agents wait indefinitely for user input (timeout=0)
- TUI sets interactive=True; CLI unchanged (non_interactive=True)
The perplexity API key check in strix/tools/__init__.py used
Config.get() which only checks os.environ. At import time, the
config file (~/.strix/cli-config.json) hasn't been applied to
env vars yet, so the check always returned False.
Replace with _has_perplexity_api() that checks os.environ first
(fast path for SaaS/env var), then falls back to Config.load()
which reads the config file directly.
Users can now access the Caido web UI from their browser to inspect traffic,
replay requests, and perform manual testing alongside the automated scan.
- Map Caido port (48080) to a random host port in DockerRuntime
- Add caido_port to SandboxInfo and track across container lifecycle
- Display Caido URL in TUI sidebar stats panel with selectable text
- Bind Caido to 0.0.0.0 in entrypoint (requires image rebuild)
- Bump sandbox image to 0.1.12
- Restore discord link in exit screen
Rewrote the code_locations parameter description to make fix_before/fix_after
semantics explicit: they are literal block-level replacements mapped directly
to GitHub/GitLab PR suggestion blocks. Added guidance for multi-part fixes
(separate locations for non-contiguous changes like imports + code), common
mistakes to avoid, and updated all examples to demonstrate multi-line ranges.
Replace 12 flat parameters (code_file, code_before, code_after, code_diff,
and 8 CVSS fields) with structured nested XML fields: code_locations with
co-located fix_before/fix_after per location, cvss_breakdown, and cwe.
This enables multi-file vulnerability locations, per-location fixes with
precise line numbers, data flow representation (source/sink), CWE
classification, and compatibility with GitHub/GitLab PR review APIs.
Enable native text selection across tool components and agent messages
with automatic clipboard copy, toast notification, and decorative icon
stripping. Replace Padding wrappers with Text to support selection
across multiple renderables.
Improve the finish_scan tool schema to produce more professional
pentest reports: expand parameter descriptions with structural
guidance, rewrite recommendations example with proper urgency tiers
instead of Priority 0/1/2, fix duplicated section titles, and clean
up informal language.
Remove hardcoded github.com/gitlab.com/bitbucket.org host lists from
infer_target_type. Instead, detect git repositories on any host by
querying the standard /info/refs?service=git-upload-pack endpoint.
Works for any self-hosted git instance.
The memory compressor was calling litellm.completion() without passing
the api_key and api_base parameters, causing authentication errors when
LLM_API_KEY is set but provider-specific env vars (OPENAI_API_KEY, etc.)
are not. This matches the pattern used in dedupe.py.
- Reuse apply_saved() instead of custom override logic
- Add force parameter to override existing env vars
- Move validation to utils.py
- Prevent saving when using custom config (one-time override)
- Fix: don't modify ~/.strix/cli-config.json when --config is used
Co-Authored-By: FeedClogger <feedclogger@users.noreply.github.com>
Add automatic cleanup of Docker containers when the application exits.
Uses a singleton runtime pattern and spawns a detached subprocess for
cleanup to ensure fast exit without blocking the UI.
- Show actual request/response data with visual flow (>> / <<)
- Display all relevant params: filters, sort, scope, modifications
- Add type-safe handling for streaming edge cases
- Use color-coded status codes (2xx green, 3xx yellow, 4xx/5xx red)
- Show search context (before/after) not just matched text
- Show full request details in send/repeat request renderers
- Show modifications on separate lines with full content
- Increase truncation limits for better visibility (200 char lines)
- Use present tense lowercase titles (listing, viewing, searching)
- Add comprehensive ECMA-48 ANSI pattern to strip escape sequences from output
- Fix _truncate_line to strip ANSI before length calculation
- Cache PythonLexer instance (was creating new one per call)
- Memoize token color lookups to avoid repeated parent chain traversal
- Add ZDOTDIR support for zsh users who relocate their config
- Add XDG_CONFIG_HOME paths for zsh and bash
- Add ash and sh shell support (Alpine/BusyBox)
- Warn user instead of silently creating .bashrc when no config found
- Add user feedback on what file was modified
- Handle non-writable config files gracefully
- Use singleton browser with isolated BrowserContext per agent instead of
separate Chromium processes per agent
- Add cleanup logic for stale browser/playwright on reconnect
- Add resource management instructions to browser schema (close tabs/browser when done)
- Suppress Kali login message in Dockerfile
- Replace multiprocessing/threading with single asyncio task per agent
- Add task cancellation: new request cancels previous for same agent
- Add per-agent state isolation via ContextVar for Terminal, Browser, Python managers
- Add posthog telemetry for tool execution errors (timeout, http, sandbox)
- Fix proxy manager singleton pattern
- Increase client timeout buffer over server timeout
- Add context.py to Dockerfile
