fix(deps): cap cryptography <49 to keep Intel macOS universal2 wheel

cryptography 49.x ships arm64-only macOS wheels (no universal2), forcing the
Intel macOS (macos-x86_64) release runner to build from sdist under
`uv sync --frozen`. Pin to 48.0.1, which still clears GHSA-537c-gmf6-5ccf
(fixed in 48.0.1) and provides a macosx_10_9_universal2 wheel.

.github/workflows/build-release.yml

@@ -6,9 +6,6 @@ on:
       - 'v*'
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   build:
     strategy:
@@ -27,15 +24,13 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
+      - uses: actions/checkout@v4
 
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
+      - uses: actions/setup-python@v5
         with:
           python-version: '3.12'
 
-      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
+      - uses: astral-sh/setup-uv@v5
 
       - name: Build
         shell: bash
@@ -55,7 +50,7 @@ jobs:
             tar -C dist/release -czvf "dist/release/strix-${VERSION}-${{ matrix.target }}.tar.gz" "strix-${VERSION}-${{ matrix.target }}"
           fi
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
+      - uses: actions/upload-artifact@v4
         with:
           name: strix-${{ matrix.target }}
           path: |
@@ -70,13 +65,13 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
+      - uses: actions/download-artifact@v4
         with:
           path: release
           merge-multiple: true
 
       - name: Create Release
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65  # v2.6.2
+        uses: softprops/action-gh-release@v2
         with:
           prerelease: ${{ !startsWith(github.ref, 'refs/tags/') }}
           generate_release_notes: true

README.md

@@ -267,20 +267,6 @@ export STRIX_REASONING_EFFORT="high"  # control thinking effort (default: high,
 > [!NOTE]
 > Strix automatically saves your configuration to `~/.strix/cli-config.json`, so you don't have to re-enter it on every run.
 
-#### Sign in with a ChatGPT subscription
-
-Instead of a metered API key, you can run Strix on your ChatGPT Plus/Pro subscription:
-
-```bash
-strix auth login chatgpt      # sign in with your ChatGPT account
-
-export STRIX_LLM="chatgpt/gpt-5.4"   # chatgpt/<model> runs on the subscription
-strix --target ./app-directory
-
-strix auth status             # show the active sign-in
-strix auth logout             # forget the sign-in
-```
-
 **Recommended models for best results:**
 
 - [OpenAI GPT-5.4](https://openai.com/api/) - `openai/gpt-5.4`

docs/advanced/configuration.mdx

@@ -35,31 +35,6 @@ Configure Strix using environment variables or a config file.
   Timeout in seconds for memory compression operations (context summarization).
 </ParamField>
 
-### Dedicated deduplication model
-
-Finding deduplication is a cheap, structured classification task. By default it
-runs on the main model, but you can route it to a smaller/cheaper model without
-affecting the agents that do the actual testing.
-
-<ParamField path="STRIX_DEDUPE_MODEL" type="string">
-  Model used to judge whether a candidate finding duplicates an existing report.
-  Falls back to `STRIX_LLM` when unset.
-</ParamField>
-
-<ParamField path="DEDUPE_LLM_API_KEY" type="string">
-  Optional provider key for the deduplication model.
-</ParamField>
-
-<ParamField path="DEDUPE_LLM_API_BASE" type="string">
-  Optional custom API base URL for the deduplication model. Use when the dedupe
-  model runs on a different endpoint than the main model.
-</ParamField>
-
-<ParamField path="STRIX_DEDUPE_REASONING_EFFORT" type="string">
-  Reasoning effort for the deduplication model. Defaults to the model's own
-  baseline when unset.
-</ParamField>
-
 ## Optional Features
 
 <ParamField path="PERPLEXITY_API_KEY" type="string">

docs/usage/cli.mdx

@@ -116,6 +116,5 @@ strix --mount ./huge-monorepo
 
 | Code | Meaning |
 |------|---------|
-| 0 | Scan completed successfully (interactive mode always exits `0`; in headless mode, `0` means no vulnerabilities were found) |
-| 1 | A fatal error occurred before or during the scan (e.g. missing environment variables, Docker unavailable, invalid config file, diff-scope resolution failure, or an unhandled error) |
+| 0 | Scan completed, no vulnerabilities found |
 | 2 | Vulnerabilities found (headless mode only) |

pyproject.toml

@@ -122,7 +122,6 @@ module = [
     "pydantic_settings.*",
     "reportlab.*",
     "pypdf.*",
-    "pygments.*",
 ]
 ignore_missing_imports = true
 disable_error_code = ["import-untyped"]
@@ -216,10 +215,6 @@ ignore = [
 # Test doubles use fixture tokens/passwords and match a callee signature whose
 # args they intentionally ignore.
 "tests/test_viewer_auth.py" = ["S105", "S106", "ARG001"]
-"tests/test_codex_auth.py" = ["S105", "S106", "SLF001"]
-# Stdlib HTTP handler overrides (do_GET/do_POST).
-"strix/interface/auth_cli.py" = ["N802"]
-"tests/test_codex_streaming.py" = ["N802"]
 "tests/test_report_pdf.py" = ["S105", "S106"]
 # Stdlib HTTP handler overrides (do_GET/do_POST) and lazy imports that avoid a
 # circular dependency with strix.telemetry / strix.viewer.report_pdf.
@@ -258,16 +253,9 @@ ignore = [
 "strix/core/runner.py" = ["TC003", "PLR0912", "PLR0915", "PLC0415"]
 # ReportState carries scan artifact/report fields and
 # a runtime ``Callable`` annotation on ``vulnerability_found_callback``.
-"strix/report/state.py" = ["TC003", "PLR0912", "PLR0915", "E501", "PERF401", "PLC0415"]
+"strix/report/state.py" = ["TC003", "PLR0912", "PLR0915", "E501", "PERF401"]
 "strix/report/usage.py" = ["PLC0415"]
-# Lazy import of strix.config.models avoids a circular dependency between the
-# report pipeline and the config layer.
-"strix/report/dedupe.py" = ["PLC0415"]
-"strix/telemetry/logging.py" = ["PLC0415"]
 "strix/config/models.py" = ["PLC0415"]
-# Heavy inference deps (httpx, openai) imported lazily so auth-status checks
-# don't pull them in.
-"strix/config/codex.py" = ["PLC0415"]
 # Interface utility branches per scope-mode / target-type combination;
 # splitting would obscure the decision tree without simplifying it.
 "strix/interface/utils.py" = ["PLR0912", "BLE001", "PLC0415"]

strix/agents/factory.py

@@ -16,7 +16,6 @@ from agents.tool import CustomTool, FunctionTool, Tool
 from pydantic import ValidationError
 
 from strix.agents.prompt import render_system_prompt
-from strix.config import load_settings
 from strix.tools.agents_graph.tools import (
     agent_finish,
     create_agent,
@@ -34,7 +33,6 @@ from strix.tools.notes.tools import (
     list_notes,
     update_note,
 )
-from strix.tools.output_store import bound_text
 from strix.tools.proxy.tools import (
     list_requests,
     list_sitemap,
@@ -105,36 +103,8 @@ def _extract_custom_input(tool: CustomTool, raw_input: str | dict[str, Any]) ->
     return value if isinstance(value, str) else ""
 
 
-def _tool_output_limits() -> tuple[int, int]:
-    context = load_settings().context
-    return context.tool_output_max_lines, context.tool_output_max_bytes
-
-
-def _bound_result(result: Any) -> Any:
-    if not isinstance(result, str):
-        return result
-    max_lines, max_bytes = _tool_output_limits()
-    return bound_text(result, max_lines=max_lines, max_bytes=max_bytes)
-
-
 def _format_tool_error(exc: Exception) -> str:
-    message = str(exc) or exc.__class__.__name__
-    max_lines, max_bytes = _tool_output_limits()
-    return bound_text(message, max_lines=max_lines, max_bytes=max_bytes)
-
-
-def _with_bounded_result(tool: FunctionTool) -> FunctionTool:
-    """Cap a tool's result size before it enters history (idempotent)."""
-    if getattr(tool, "_strix_bounded", False):
-        return tool
-    invoke_tool = tool.on_invoke_tool
-
-    async def invoke(ctx: Any, raw_input: str) -> Any:
-        return _bound_result(await invoke_tool(ctx, raw_input))
-
-    tool.on_invoke_tool = invoke
-    tool._strix_bounded = True  # type: ignore[attr-defined]
-    return tool
+    return str(exc) or exc.__class__.__name__
 
 
 def _function_tool_with_error_result(tool: FunctionTool) -> FunctionTool:
@@ -142,7 +112,7 @@ def _function_tool_with_error_result(tool: FunctionTool) -> FunctionTool:
 
     async def invoke(ctx: Any, raw_input: str) -> Any:
         try:
-            return _bound_result(await invoke_tool(ctx, raw_input))
+            return await invoke_tool(ctx, raw_input)
         except Exception as exc:  # noqa: BLE001 - tool errors should be model-visible results.
             logger.debug("Tool %s failed; returning error as result", tool.name, exc_info=True)
             return _format_tool_error(exc)
@@ -157,7 +127,7 @@ def _custom_tool_as_function_tool(tool: CustomTool) -> FunctionTool:
         if not custom_input:
             return f"`{_custom_tool_input_field(tool)}` must be a non-empty string."
         try:
-            return _bound_result(await tool.on_invoke_tool(ctx, custom_input))
+            return await tool.on_invoke_tool(ctx, custom_input)
         except Exception as exc:  # noqa: BLE001 - matches SDK CustomTool error-as-result behavior.
             logger.debug("Tool %s failed; returning error as result", tool.name, exc_info=True)
             return _format_tool_error(exc)
@@ -189,35 +159,12 @@ def _custom_tool_as_function_tool(tool: CustomTool) -> FunctionTool:
     )
 
 
-def _bound_custom_tool(tool: CustomTool) -> CustomTool:
-    """Bound a native ``CustomTool`` result in place (Responses path)."""
-    invoke_tool = tool.on_invoke_tool
-
-    async def invoke(ctx: Any, raw_input: str) -> Any:
-        return _bound_result(await invoke_tool(ctx, raw_input))
-
-    tool.on_invoke_tool = invoke
-    return tool
-
-
-def _configure_filesystem_tools(toolset: Any, *, chat_completions: bool) -> None:
+def _configure_chat_completions_filesystem_tools(toolset: Any) -> None:
     for name, tool in vars(toolset).items():
-        if chat_completions:
-            if isinstance(tool, CustomTool):
-                setattr(toolset, name, _custom_tool_as_function_tool(tool))
-            elif isinstance(tool, FunctionTool):
-                setattr(toolset, name, _function_tool_with_error_result(tool))
-        elif isinstance(tool, CustomTool):
-            setattr(toolset, name, _bound_custom_tool(tool))
+        if isinstance(tool, CustomTool):
+            setattr(toolset, name, _custom_tool_as_function_tool(tool))
         elif isinstance(tool, FunctionTool):
-            setattr(toolset, name, _with_bounded_result(tool))
-
-
-def _make_filesystem_configurator(*, chat_completions: bool) -> Any:
-    def configure(toolset: Any) -> None:
-        _configure_filesystem_tools(toolset, chat_completions=chat_completions)
-
-    return configure
+            setattr(toolset, name, _function_tool_with_error_result(tool))
 
 
 _CHARS_ESCAPE_RE = re.compile(r"\\(?:u[0-9a-fA-F]{4}|x[0-9a-fA-F]{2}|[0abtnvfr\\])")
@@ -258,16 +205,6 @@ def _format_validation_error(tool_name: str, exc: ValidationError) -> str:
     return f"{tool_name}: invalid arguments — " + "; ".join(parts)
 
 
-def _apply_shell_output_cap(parsed: dict[str, Any]) -> None:
-    """Clamp the SDK shell tools' ``max_output_tokens`` to the configured
-    ceiling; a smaller explicit value is respected."""
-    ceiling = load_settings().context.tool_output_max_tokens
-    requested = parsed.get("max_output_tokens")
-    parsed["max_output_tokens"] = (
-        ceiling if not isinstance(requested, int) or requested > ceiling else requested
-    )
-
-
 def _wrap_exec_command(tool: FunctionTool) -> FunctionTool:
     invoke_tool = tool.on_invoke_tool
 
@@ -276,10 +213,8 @@ def _wrap_exec_command(tool: FunctionTool) -> FunctionTool:
             parsed = json.loads(raw_input)
         except (json.JSONDecodeError, TypeError):
             parsed = None
-        if isinstance(parsed, dict):
-            if "shell" not in parsed:
-                parsed["shell"] = "bash"
-            _apply_shell_output_cap(parsed)
+        if isinstance(parsed, dict) and "shell" not in parsed:
+            parsed["shell"] = "bash"
             raw_input = json.dumps(parsed)
         try:
             return await invoke_tool(ctx, raw_input)
@@ -305,10 +240,8 @@ def _wrap_write_stdin(tool: FunctionTool) -> FunctionTool:
             parsed = json.loads(raw_input)
         except json.JSONDecodeError:
             parsed = None
-        if isinstance(parsed, dict):
-            if isinstance(parsed.get("chars"), str):
-                parsed["chars"] = _decode_chars_escape(parsed["chars"])
-            _apply_shell_output_cap(parsed)
+        if isinstance(parsed, dict) and isinstance(parsed.get("chars"), str):
+            parsed["chars"] = _decode_chars_escape(parsed["chars"])
             raw_input = json.dumps(parsed)
         try:
             return await invoke_tool(ctx, raw_input)
@@ -507,9 +440,6 @@ def build_strix_agent(
     else:
         tools = [*_BASE_TOOLS, *agent_tools, agent_finish]
     _ensure_unique_tool_names(tools)
-    tools = [
-        _with_bounded_result(tool) if isinstance(tool, FunctionTool) else tool for tool in tools
-    ]
 
     logger.info(
         "Built %s agent '%s' (skills=%d, tools=%d, scan_mode=%s, whitebox=%s)",
@@ -529,8 +459,8 @@ def build_strix_agent(
         model=None,
         capabilities=[
             Filesystem(
-                configure_tools=_make_filesystem_configurator(
-                    chat_completions=chat_completions_tools,
+                configure_tools=(
+                    _configure_chat_completions_filesystem_tools if chat_completions_tools else None
                 ),
             ),
             Shell(

strix/config/__init__.py

@@ -17,8 +17,6 @@ from strix.config.loader import (
     persist_current,
 )
 from strix.config.settings import (
-    ContextSettings,
-    DedupeSettings,
     IntegrationSettings,
     LlmSettings,
     RuntimeSettings,
@@ -28,8 +26,6 @@ from strix.config.settings import (
 
 
 __all__ = [
-    "ContextSettings",
-    "DedupeSettings",
     "IntegrationSettings",
     "LlmSettings",
     "RuntimeSettings",

strix/config/codex.py

@@ -1,411 +0,0 @@
-"""ChatGPT (Codex) subscription auth: OAuth login, token refresh, and the OpenAI
-client that routes inference through the ChatGPT backend.
-
-Mirrors OpenAI's Codex CLI: OAuth 2.0 + PKCE against ``auth.openai.com``, with the
-access token sent as a ``Bearer`` token to ``chatgpt.com/backend-api/codex``. Using
-a ChatGPT subscription outside OpenAI's own products is not officially supported by
-OpenAI; the user chooses this path knowingly. The OAuth constants are OpenAI's own
-Codex CLI values (the backend only accepts that client).
-"""
-
-from __future__ import annotations
-
-import base64
-import contextlib
-import hashlib
-import json
-import logging
-import secrets
-import threading
-import time
-import urllib.error
-import urllib.parse
-import urllib.request
-from pathlib import Path
-from typing import TYPE_CHECKING, Any
-
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    from openai import AsyncOpenAI
-
-
-logger = logging.getLogger(__name__)
-
-
-PROVIDER = "codex"
-
-CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann"
-AUTHORIZE_URL = "https://auth.openai.com/oauth/authorize"
-TOKEN_URL = "https://auth.openai.com/oauth/token"  # noqa: S105  # nosec B105 - URL, not a secret
-CALLBACK_HOST = "localhost"
-CALLBACK_PORT = 1455
-CALLBACK_PATH = "/auth/callback"
-REDIRECT_URI = f"http://{CALLBACK_HOST}:{CALLBACK_PORT}{CALLBACK_PATH}"
-SCOPE = "openid profile email offline_access"
-
-CODEX_BASE_URL = "https://chatgpt.com/backend-api/codex"
-ORIGINATOR = "codex_cli_rs"
-_ACCOUNT_CLAIM = "https://api.openai.com/auth"
-
-_TOKEN_TIMEOUT = 30
-_EXPIRY_SKEW_S = 300
-
-_refresh_lock = threading.Lock()
-
-# Kept separate from cli-config.json so OAuth tokens never land in the env-var config.
-AUTH_PATH = Path.home() / ".strix" / "subscription-auth.json"
-
-
-def _read_store() -> dict[str, Any]:
-    try:
-        data = json.loads(AUTH_PATH.read_text(encoding="utf-8"))
-    except (OSError, json.JSONDecodeError):
-        return {}
-    return data if isinstance(data, dict) else {}
-
-
-def _write_store(data: dict[str, Any]) -> None:
-    AUTH_PATH.parent.mkdir(parents=True, exist_ok=True)
-    tmp = AUTH_PATH.with_suffix(".json.tmp")
-    tmp.write_text(json.dumps(data, indent=2), encoding="utf-8")
-    with contextlib.suppress(OSError):
-        tmp.chmod(0o600)
-    tmp.replace(AUTH_PATH)
-    with contextlib.suppress(OSError):
-        AUTH_PATH.chmod(0o600)
-
-
-def read_record() -> dict[str, Any] | None:
-    record = _read_store().get(PROVIDER)
-    if not isinstance(record, dict) or record.get("type") != "oauth":
-        return None
-    if not (record.get("access") and record.get("refresh") and record.get("account_id")):
-        return None
-    return record
-
-
-def is_authenticated() -> bool:
-    return read_record() is not None
-
-
-def save_record(record: dict[str, Any]) -> None:
-    data = _read_store()
-    data[PROVIDER] = record
-    _write_store(data)
-
-
-def logout() -> None:
-    data = _read_store()
-    if PROVIDER not in data:
-        return
-    del data[PROVIDER]
-    if data:
-        _write_store(data)
-        return
-    with contextlib.suppress(OSError):
-        AUTH_PATH.unlink()
-
-
-@contextlib.contextmanager
-def _refresh_guard() -> Iterator[None]:
-    """Serialize token refresh within (lock) and across (flock) Strix processes,
-    so concurrent runs can't both spend the single-use refresh token."""
-    with _refresh_lock:
-        try:
-            import fcntl
-
-            lock_path = AUTH_PATH.with_suffix(".lock")
-            lock_path.parent.mkdir(parents=True, exist_ok=True)
-            handle = lock_path.open("w")
-        except (ImportError, OSError):
-            yield
-            return
-        try:
-            with contextlib.suppress(OSError):
-                fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-            yield
-        finally:
-            with contextlib.suppress(OSError):
-                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
-            handle.close()
-
-
-class CodexAuthError(Exception):
-    def __init__(self, code: str, message: str | None = None) -> None:
-        self.code = code
-        super().__init__(message or code)
-
-
-class CodexContentGuardrailError(Exception):
-    """The ChatGPT backend refused a request via its content guardrail.
-    Terminal — retrying identical content never clears the block."""
-
-    def __init__(self, model: str, original: BaseException | None = None) -> None:
-        self.model = model
-        self.original = original
-        super().__init__(
-            f"'{model}' was blocked by ChatGPT's content guardrails "
-            f"(flagged as a possible cybersecurity risk). "
-            f"Set STRIX_LLM to a model that isn't blocked and re-run."
-        )
-
-
-_GUARDRAIL_MARKERS = (
-    "flagged for possible cybersecurity risk",
-    "trusted access for cyber",
-)
-
-
-def is_content_guardrail_error(exc: BaseException) -> bool:
-    if isinstance(exc, CodexContentGuardrailError):
-        return True
-    text = str(exc).lower()
-    return any(marker in text for marker in _GUARDRAIL_MARKERS)
-
-
-def _b64url(raw: bytes) -> str:
-    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
-
-
-def generate_pkce() -> tuple[str, str]:
-    verifier = _b64url(secrets.token_bytes(64))
-    challenge = _b64url(hashlib.sha256(verifier.encode("ascii")).digest())
-    return verifier, challenge
-
-
-def create_state() -> str:
-    return secrets.token_hex(16)
-
-
-def build_authorize_url(challenge: str, state: str) -> str:
-    params = {
-        "response_type": "code",
-        "client_id": CLIENT_ID,
-        "redirect_uri": REDIRECT_URI,
-        "scope": SCOPE,
-        "code_challenge": challenge,
-        "code_challenge_method": "S256",
-        "state": state,
-        "id_token_add_organizations": "true",
-        "codex_cli_simplified_flow": "true",
-        "originator": ORIGINATOR,
-    }
-    return f"{AUTHORIZE_URL}?{urllib.parse.urlencode(params)}"
-
-
-def parse_redirect_input(value: str) -> tuple[str | None, str | None]:
-    """Extract ``(code, state)`` from a pasted redirect URL, ``code#state``,
-    query string, or bare code."""
-    value = (value or "").strip()
-    if not value:
-        return None, None
-    with contextlib.suppress(ValueError):
-        parsed = urllib.parse.urlparse(value)
-        if parsed.scheme and parsed.query:
-            query = urllib.parse.parse_qs(parsed.query)
-            return _first(query, "code"), _first(query, "state")
-    if "#" in value:
-        code, _, state = value.partition("#")
-        return code or None, state or None
-    if "code=" in value:
-        query = urllib.parse.parse_qs(value)
-        return _first(query, "code"), _first(query, "state")
-    return value, None
-
-
-def _first(query: dict[str, list[str]], key: str) -> str | None:
-    values = query.get(key)
-    return values[0] if values else None
-
-
-def _post_form(payload: dict[str, str]) -> dict[str, Any]:
-    body = urllib.parse.urlencode(payload).encode("ascii")
-    request = urllib.request.Request(  # noqa: S310 - fixed https OAuth endpoint
-        TOKEN_URL,
-        data=body,
-        headers={
-            "Content-Type": "application/x-www-form-urlencoded",
-            "Accept": "application/json",
-        },
-        method="POST",
-    )
-    try:
-        with urllib.request.urlopen(  # noqa: S310  # nosec B310 - fixed https endpoint
-            request, timeout=_TOKEN_TIMEOUT
-        ) as response:
-            data = json.loads(response.read() or b"{}")
-    except urllib.error.HTTPError as exc:
-        detail = exc.read().decode("utf-8", "replace")[:300]
-        raise CodexAuthError("token_http_error", f"HTTP {exc.code}: {detail}") from exc
-    except (urllib.error.URLError, TimeoutError, OSError) as exc:
-        raise CodexAuthError("unavailable", str(exc)) from exc
-    if not isinstance(data, dict):
-        raise CodexAuthError("bad_response", "token endpoint returned non-object")
-    return data
-
-
-def _record_from_token_response(
-    data: dict[str, Any], refresh_fallback: str | None = None
-) -> dict[str, Any]:
-    access = data.get("access_token")
-    # A refresh response may omit refresh_token when it isn't rotated; keep the old one.
-    refresh = data.get("refresh_token") or refresh_fallback
-    expires_in = data.get("expires_in")
-    if not isinstance(access, str) or not access:
-        raise CodexAuthError("bad_response", "token response missing access_token")
-    if not isinstance(refresh, str) or not refresh:
-        raise CodexAuthError("bad_response", "token response missing refresh_token")
-    account_id = _account_id_from_jwt(access) or _account_id_from_jwt(
-        data.get("id_token") if isinstance(data.get("id_token"), str) else ""
-    )
-    if not account_id:
-        raise CodexAuthError("no_account_id", "could not read chatgpt_account_id from token")
-    ttl = expires_in if isinstance(expires_in, int | float) else 3600
-    return {
-        "type": "oauth",
-        "provider": PROVIDER,
-        "access": access,
-        "refresh": refresh,
-        "account_id": account_id,
-        "expires_at": time.time() + ttl,
-    }
-
-
-def exchange_code(code: str, verifier: str) -> dict[str, Any]:
-    data = _post_form(
-        {
-            "grant_type": "authorization_code",
-            "client_id": CLIENT_ID,
-            "code": code,
-            "code_verifier": verifier,
-            "redirect_uri": REDIRECT_URI,
-        }
-    )
-    return _record_from_token_response(data)
-
-
-def refresh_tokens(refresh_token: str) -> dict[str, Any]:
-    data = _post_form(
-        {
-            "grant_type": "refresh_token",
-            "client_id": CLIENT_ID,
-            "refresh_token": refresh_token,
-        }
-    )
-    return _record_from_token_response(data, refresh_fallback=refresh_token)
-
-
-def _account_id_from_jwt(token: str | None) -> str | None:
-    """Read the account id claim without verifying the JWT (the server enforces
-    authenticity on use); it feeds the ``chatgpt-account-id`` header."""
-    if not token or token.count(".") != 2:
-        return None
-    payload_b64 = token.split(".")[1]
-    padding = "=" * (-len(payload_b64) % 4)
-    try:
-        payload = json.loads(base64.urlsafe_b64decode(payload_b64 + padding))
-    except (ValueError, json.JSONDecodeError):
-        return None
-    if not isinstance(payload, dict):
-        return None
-    auth = payload.get(_ACCOUNT_CLAIM)
-    if isinstance(auth, dict):
-        account_id = auth.get("chatgpt_account_id")
-        if isinstance(account_id, str) and account_id:
-            return account_id
-    organizations = payload.get("organizations")
-    if isinstance(organizations, list) and organizations and isinstance(organizations[0], dict):
-        org_id = organizations[0].get("id")
-        if isinstance(org_id, str) and org_id:
-            return org_id
-    return None
-
-
-def _near_expiry(record: dict[str, Any]) -> bool:
-    expires_at = record.get("expires_at")
-    if not isinstance(expires_at, int | float):
-        return True
-    return expires_at - _EXPIRY_SKEW_S <= time.time()
-
-
-def get_valid_token() -> tuple[str, str]:
-    """Return ``(access_token, account_id)``, refreshing under the cross-process
-    guard if near expiry."""
-    record = read_record()
-    if record is None:
-        raise CodexAuthError("not_authenticated", "not signed in; run: strix auth login")
-    if not _near_expiry(record):
-        return record["access"], record["account_id"]
-    with _refresh_guard():
-        record = read_record()
-        if record is None:
-            raise CodexAuthError("not_authenticated", "not signed in; run: strix auth login")
-        if not _near_expiry(record):
-            return record["access"], record["account_id"]
-        try:
-            refreshed = refresh_tokens(record["refresh"])
-        except CodexAuthError:
-            # A peer process may have already spent this single-use refresh token.
-            latest = read_record()
-            if latest and latest["refresh"] != record["refresh"] and not _near_expiry(latest):
-                return latest["access"], latest["account_id"]
-            raise
-        save_record(refreshed)
-        return refreshed["access"], refreshed["account_id"]
-
-
-def build_openai_client() -> AsyncOpenAI:
-    """An ``AsyncOpenAI`` for the ChatGPT backend. A per-request hook re-stamps a
-    fresh bearer token so long scans survive token expiry."""
-    import asyncio
-
-    import httpx
-    from openai import AsyncOpenAI
-
-    get_valid_token()  # fail fast at configure time if the sign-in is dead
-
-    async def _auth_hook(request: httpx.Request) -> None:
-        access, account_id = await asyncio.to_thread(get_valid_token)
-        request.headers["Authorization"] = f"Bearer {access}"
-        request.headers["chatgpt-account-id"] = account_id
-
-    http_client = httpx.AsyncClient(
-        timeout=httpx.Timeout(600.0, connect=30.0),
-        event_hooks={"request": [_auth_hook]},
-    )
-    return AsyncOpenAI(
-        api_key="strix-codex-oauth",  # placeholder; the hook overwrites Authorization
-        base_url=CODEX_BASE_URL,
-        http_client=http_client,
-        default_headers={
-            "OpenAI-Beta": "responses=experimental",
-            "originator": ORIGINATOR,
-        },
-    )
-
-
-_subscription_client: AsyncOpenAI | None = None
-
-
-def get_subscription_client() -> AsyncOpenAI:
-    global _subscription_client  # noqa: PLW0603
-    if _subscription_client is None:
-        _subscription_client = build_openai_client()
-    return _subscription_client
-
-
-SUBSCRIPTION_PREFIX = "chatgpt/"
-
-
-def subscription_model(model_name: str | None) -> str | None:
-    """The model slug behind a ``chatgpt/<model>`` STRIX_LLM, or None."""
-    name = (model_name or "").strip()
-    if not name.lower().startswith(SUBSCRIPTION_PREFIX):
-        return None
-    return name[len(SUBSCRIPTION_PREFIX) :] or None
-
-
-def auth_mode(model_name: str | None) -> str:
-    return "subscription" if subscription_model(model_name) else "api_key"

strix/config/models.py

@@ -2,38 +2,23 @@
 
 from __future__ import annotations
 
-import contextlib
-import inspect
 import os
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING
 
-from agents import (
-    set_default_openai_api,
-    set_default_openai_key,
-    set_tracing_disabled,
-)
-from agents.model_settings import ModelSettings
+from agents import set_default_openai_api, set_default_openai_key, set_tracing_disabled
 from agents.models.multi_provider import MultiProvider
-from agents.models.openai_responses import OpenAIResponsesModel
 from agents.retry import (
     ModelRetryBackoffSettings,
     ModelRetrySettings,
     RetryPolicyContext,
     retry_policies,
 )
-from openai.types.shared import Reasoning
-
-from strix.config import codex
-from strix.config.loader import load_settings
 
 
 if TYPE_CHECKING:
-    from collections.abc import AsyncIterator
+    from agents.models.interface import ModelProvider
 
-    from agents.models.interface import Model, ModelProvider
-    from openai import AsyncOpenAI
-
-    from strix.config.settings import ReasoningEffort, Settings
+    from strix.config.settings import Settings
 
 
 def request_timeout_extra_args(timeout_s: float | None) -> dict[str, float] | None:
@@ -48,93 +33,9 @@ def _retry_statusless_provider_errors(context: RetryPolicyContext) -> bool:
     normalized = context.normalized
     if normalized.is_abort:
         return False
-    if codex.is_content_guardrail_error(context.error):
-        return False
     return normalized.status_code is None
 
 
-class _CodexResponsesModel(OpenAIResponsesModel):
-    """Responses model for the ChatGPT subscription backend (always streamed, stateless)."""
-
-    def __init__(
-        self,
-        model: str,
-        openai_client: AsyncOpenAI,
-        *,
-        reasoning_effort: ReasoningEffort | None = None,
-    ) -> None:
-        super().__init__(model, openai_client)
-        self._reasoning_effort = reasoning_effort
-
-    def _codex_settings(self, model_settings: ModelSettings) -> ModelSettings:
-        overrides = ModelSettings(store=False, response_include=["reasoning.encrypted_content"])
-        effort = self._reasoning_effort
-        if effort and effort != "none":
-            # Clamp to efforts the backend accepts.
-            if effort == "minimal":
-                effort = "low"
-            elif effort == "xhigh":
-                effort = "high"
-            overrides = overrides.resolve(ModelSettings(reasoning=Reasoning(effort=effort)))
-        return model_settings.resolve(overrides)
-
-    async def _fetch_response(self, *args: Any, stream: bool = False, **kwargs: Any) -> Any:
-        if len(args) >= 3:  # model_settings is positional arg 2
-            args = (*args[:2], self._codex_settings(args[2]), *args[3:])
-        try:
-            events = await super()._fetch_response(*args, stream=True, **kwargs)  # type: ignore[call-overload]
-        except Exception as exc:
-            guardrail = self._as_guardrail(exc)
-            if guardrail is not None:
-                raise guardrail from exc
-            raise
-        guarded = self._guarded(events)
-        if stream:
-            return guarded
-        final_response = None
-        async for event in guarded:
-            if getattr(event, "type", None) == "response.completed":
-                final_response = event.response
-        if final_response is None:
-            msg = "ChatGPT backend stream ended without a completed response"
-            raise RuntimeError(msg)
-        return final_response
-
-    def _as_guardrail(self, exc: BaseException) -> codex.CodexContentGuardrailError | None:
-        if isinstance(exc, codex.CodexContentGuardrailError):
-            return exc
-        if codex.is_content_guardrail_error(exc):
-            return codex.CodexContentGuardrailError(self.model, exc)
-        return None
-
-    async def _guarded(self, events: Any) -> AsyncIterator[Any]:
-        """Convert mid-stream guardrail rejections and close the stream on exit."""
-        try:
-            async for event in events:
-                yield event
-        except Exception as exc:
-            guardrail = self._as_guardrail(exc)
-            if guardrail is not None:
-                raise guardrail from exc
-            raise
-        finally:
-            await self._aclose(events)
-
-    @staticmethod
-    async def _aclose(events: Any) -> None:
-        aclose = getattr(events, "aclose", None)
-        if callable(aclose):
-            with contextlib.suppress(Exception):
-                await aclose()
-            return
-        close = getattr(events, "close", None)
-        if callable(close):
-            with contextlib.suppress(Exception):
-                result = close()
-                if inspect.isawaitable(result):
-                    await result
-
-
 class StrixProvider(MultiProvider):
     """Route any non-OpenAI prefix through LiteLLM with the prefix preserved,
     so users type ``deepseek/deepseek-chat`` rather than
@@ -158,16 +59,6 @@ class StrixProvider(MultiProvider):
             return self._get_fallback_provider("litellm"), f"ollama_chat/{stripped_model_name}"
         return self._get_fallback_provider("litellm"), original_model_name
 
-    def get_model(self, model_name: str | None) -> Model:
-        slug = codex.subscription_model(model_name)
-        if slug:
-            return _CodexResponsesModel(
-                slug,
-                codex.get_subscription_client(),
-                reasoning_effort=load_settings().llm.reasoning_effort,
-            )
-        return super().get_model(model_name)
-
 
 DEFAULT_MODEL_RETRY = ModelRetrySettings(
     max_retries=5,
@@ -186,42 +77,39 @@ DEFAULT_MODEL_RETRY = ModelRetrySettings(
 )
 
 RECOMMENDED_MODEL_NAMES = (
+    "openai/gpt-5.6",
     "openai/gpt-5.6-sol",
     "openai/gpt-5.6-terra",
-    "openai/gpt-5.6-luna",
-    "openai/gpt-5.6",
-    "openai/gpt-5.5-pro",
     "openai/gpt-5.5",
+    "openai/gpt-5.5-pro",
     "openai/gpt-5.4",
     "openai/gpt-5.3-codex",
     "anthropic/claude-fable-5",
-    "anthropic/claude-opus-5",
     "anthropic/claude-opus-4-8",
+    "anthropic/claude-opus-4-7",
     "anthropic/claude-sonnet-5",
     "anthropic/claude-sonnet-4-6",
     "vertex_ai/gemini-3.1-pro-preview",
     "gemini/gemini-3.1-pro-preview",
-    "gemini/gemini-3.6-flash",
     "deepseek/deepseek-v4-pro",
     "deepseek/deepseek-v4-flash",
-    "dashscope/qwen3.8-max",
     "dashscope/qwen3.7-max-2026-06-08",
-    "moonshot/kimi-k3",
     "moonshot/kimi-k2.7-code",
+    "moonshot/kimi-k2.6",
 )
 
 _RECOMMENDED_MODEL_NAME_SET = frozenset(name.lower() for name in RECOMMENDED_MODEL_NAMES)
 
 FRONTIER_MODEL_FAMILIES = (
-    (("azure", "azure_ai", "bedrock_mantle", "chatgpt", "openai"), ("gpt-5",)),
+    (("azure", "azure_ai", "bedrock_mantle", "openai"), ("gpt-5",)),
     (
         ("anthropic", "azure_ai", "bedrock", "claude", "databricks", "snowflake", "vertex_ai"),
-        ("claude-fable-5", "claude-opus-5", "claude-opus-4", "claude-sonnet-5", "claude-sonnet-4"),
+        ("claude-fable-5", "claude-opus-4", "claude-sonnet-5", "claude-sonnet-4"),
     ),
     (("google", "gemini", "vertex_ai"), ("gemini-3",)),
     (("deepseek",), ("deepseek-v4", "deepseek-r1", "deepseek-reasoner")),
-    (("alibaba", "dashscope", "qwen"), ("qwen3.8", "qwen3.7", "qwen3-max")),
-    (("moonshot", "moonshotai", "kimi"), ("kimi-k3", "kimi-k2.7", "kimi-k2.6")),
+    (("alibaba", "dashscope", "qwen"), ("qwen3.7", "qwen3.5", "qwen3-max")),
+    (("moonshot", "moonshotai", "kimi"), ("kimi-k2.7", "kimi-k2.6", "kimi-k2.5")),
 )
 
 
@@ -229,8 +117,6 @@ def configure_sdk_model_defaults(settings: Settings) -> None:
     """Apply Strix config to SDK-native defaults."""
     llm = settings.llm
     set_tracing_disabled(True)
-    if codex.subscription_model(llm.model):
-        return
     _configure_litellm_compatibility()
     _configure_openrouter_attribution(llm.model)
     if llm.api_key:
@@ -325,8 +211,6 @@ def _configure_litellm_default(name: str, value: str) -> None:
 
 def uses_chat_completions_tool_schema(model_name: str, settings: Settings) -> bool:
     """Return whether the resolved SDK route can only receive JSON function tools."""
-    if codex.subscription_model(model_name):
-        return False
     model = model_name.strip().lower()
     if "/" in model and not model.startswith("openai/"):
         return True

strix/config/settings.py

@@ -43,38 +43,6 @@ class LlmSettings(BaseSettings):
     timeout: int = Field(default=300, alias="LLM_TIMEOUT")
 
 
-class DedupeSettings(BaseSettings):
-    model_config = _BASE_CONFIG
-
-    model: str | None = Field(default=None, alias="STRIX_DEDUPE_MODEL")
-    reasoning_effort: ReasoningEffort | None = Field(
-        default=None,
-        alias="STRIX_DEDUPE_REASONING_EFFORT",
-    )
-    api_key: str | None = Field(default=None, alias="DEDUPE_LLM_API_KEY")
-    api_base: str | None = Field(default=None, alias="DEDUPE_LLM_API_BASE")
-
-
-class ContextSettings(BaseSettings):
-    """Context-window management: per-tool-output caps and history compaction."""
-
-    model_config = _BASE_CONFIG
-
-    auto_compact: bool = Field(default=True, alias="STRIX_CONTEXT_AUTO_COMPACT")
-    compact_buffer_tokens: int = Field(default=20_000, gt=0, alias="STRIX_CONTEXT_BUFFER_TOKENS")
-    keep_tokens: int = Field(default=8_000, gt=0, alias="STRIX_CONTEXT_KEEP_TOKENS")
-    fallback_context_tokens: int = Field(
-        default=200_000, gt=0, alias="STRIX_CONTEXT_FALLBACK_TOKENS"
-    )
-    summary_max_tokens: int = Field(default=4_096, gt=0, alias="STRIX_CONTEXT_SUMMARY_TOKENS")
-    tool_output_max_tokens: int = Field(default=8_000, gt=0, alias="STRIX_TOOL_OUTPUT_MAX_TOKENS")
-    tool_output_max_lines: int = Field(default=2_000, gt=0, alias="STRIX_TOOL_OUTPUT_MAX_LINES")
-    # Floor above the truncation-notice size so a preview always fits.
-    tool_output_max_bytes: int = Field(
-        default=50 * 1024, ge=1024, alias="STRIX_TOOL_OUTPUT_MAX_BYTES"
-    )
-
-
 class RuntimeSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
@@ -117,9 +85,7 @@ class Settings(BaseSettings):
     model_config = _BASE_CONFIG
 
     llm: LlmSettings = Field(default_factory=LlmSettings)
-    dedupe: DedupeSettings = Field(default_factory=DedupeSettings)
     runtime: RuntimeSettings = Field(default_factory=RuntimeSettings)
-    context: ContextSettings = Field(default_factory=ContextSettings)
     telemetry: TelemetrySettings = Field(default_factory=TelemetrySettings)
     integrations: IntegrationSettings = Field(default_factory=IntegrationSettings)
     viewer: ViewerSettings = Field(default_factory=ViewerSettings)

strix/core/agents.py

@@ -41,7 +41,6 @@ class AgentCoordinator:
         self.names: dict[str, str] = {}
         self.metadata: dict[str, dict[str, Any]] = {}
         self.pending_counts: dict[str, int] = {}
-        self.errors: dict[str, str] = {}
         self.runtimes: dict[str, AgentRuntime] = {}
         self._lock = asyncio.Lock()
         self._snapshot_path: Path | None = None
@@ -108,23 +107,16 @@ class AgentCoordinator:
         async with self._lock:
             if agent_id in self.statuses:
                 self.statuses[agent_id] = "running"
-                self.errors.pop(agent_id, None)
         await self._maybe_snapshot()
 
     async def park_waiting(self, agent_id: str) -> None:
         await self.set_status(agent_id, "waiting")
 
-    async def set_status(
-        self, agent_id: str, status: Status | str, *, error: str | None = None
-    ) -> None:
+    async def set_status(self, agent_id: str, status: Status | str) -> None:
         async with self._lock:
             if agent_id not in self.statuses:
                 return
             self.statuses[agent_id] = status  # type: ignore[assignment]
-            if error is not None:
-                self.errors[agent_id] = error
-            elif status == "running":
-                self.errors.pop(agent_id, None)
             runtime = self.runtimes.setdefault(agent_id, AgentRuntime())
             runtime.wake.set()
         logger.info("agent.status %s=%s", agent_id, status)
@@ -254,14 +246,9 @@ class AgentCoordinator:
 
     async def graph_snapshot(
         self,
-    ) -> tuple[dict[str, str | None], dict[str, Status], dict[str, str], dict[str, str]]:
+    ) -> tuple[dict[str, str | None], dict[str, Status], dict[str, str]]:
         async with self._lock:
-            return (
-                dict(self.parent_of),
-                dict(self.statuses),
-                dict(self.names),
-                dict(self.errors),
-            )
+            return dict(self.parent_of), dict(self.statuses), dict(self.names)
 
     def _message_to_session_item(self, message: dict[str, Any]) -> TResponseInputItem:
         sender = str(message.get("from", "unknown"))
@@ -299,7 +286,6 @@ class AgentCoordinator:
                 "names": dict(self.names),
                 "metadata": {aid: dict(md) for aid, md in self.metadata.items()},
                 "pending_counts": dict(self.pending_counts),
-                "errors": dict(self.errors),
             }
 
     async def restore(self, snap: dict[str, Any]) -> None:
@@ -309,7 +295,6 @@ class AgentCoordinator:
             self.names = dict(snap.get("names", {}))
             self.metadata = {aid: dict(md) for aid, md in snap.get("metadata", {}).items()}
             self.pending_counts = dict(snap.get("pending_counts", {}))
-            self.errors = dict(snap.get("errors", {}))
             for aid in self.statuses:
                 self.runtimes.setdefault(aid, AgentRuntime())
 

strix/core/execution.py

@@ -437,8 +437,10 @@ async def _run_cycle(  # noqa: PLR0912, PLR0915
             else:
                 status = "crashed"
             logger.exception("agent run failed for %s; parking as %s", agent_id, status)
-            await coordinator.set_status(agent_id, status, error=str(exc) or type(exc).__name__)
+            await coordinator.set_status(agent_id, status)
             await _notify_parent_on_crash(coordinator, agent_id, status)
+            if context.get("parent_id") is None and status in {"failed", "crashed"}:
+                raise
             return None
         else:
             await _settle_run_result(coordinator, agent_id, interactive)

strix/core/runner.py

@@ -238,7 +238,7 @@ async def run_strix_scan(
         )
 
         root_agent = build_strix_agent(
-            name="Strix",
+            name="strix",
             skills=skills,
             is_root=True,
             scan_mode=scan_mode,
@@ -252,7 +252,7 @@ async def run_strix_scan(
         if not is_resume:
             await coordinator.register(
                 root_id,
-                "Strix",
+                "strix",
                 parent_id=None,
                 task=root_task,
                 skills=skills,

strix/interface/auth_cli.py

@@ -1,419 +0,0 @@
-"""`strix auth` — ChatGPT subscription sign-in (login / status / logout).
-
-Signing in only stores OAuth tokens (``~/.strix/subscription-auth.json``); model
-selection stays with ``STRIX_LLM``. A ``chatgpt/<model>`` STRIX_LLM runs on the
-subscription.
-"""
-
-from __future__ import annotations
-
-import argparse
-import base64
-import logging
-import threading
-import webbrowser
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from pathlib import Path
-from typing import TYPE_CHECKING, Any
-from urllib.parse import parse_qs, urlparse
-
-from rich.console import Console
-from rich.panel import Panel
-from rich.text import Text
-
-from strix.config import codex, load_settings
-
-
-if TYPE_CHECKING:
-    from collections.abc import Callable
-
-
-logger = logging.getLogger(__name__)
-
-_CALLBACK_TIMEOUT_S = 300
-
-# CLI-facing name for the login provider. Internally this is the Codex OAuth
-# flow (``codex.PROVIDER``), but users know it as ChatGPT, so that's what the
-# command and messaging say. ``codex`` is accepted as an alias.
-LOGIN_PROVIDER = "chatgpt"
-_ACCEPTED_PROVIDERS = frozenset({LOGIN_PROVIDER, codex.PROVIDER})
-
-_USAGE = "Usage:\n  strix auth login chatgpt [--manual]\n  strix auth status\n  strix auth logout"
-
-
-def run_auth(argv: list[str]) -> int:
-    """Entry point for ``strix auth …``. Returns a process exit code."""
-    console = Console()
-    # Bare `strix auth` (no subcommand) defaults to login.
-    subcommand = argv[0] if argv else "login"
-    rest = argv[1:]
-
-    if subcommand in ("-h", "--help", "help"):
-        console.print(_USAGE)
-        return 0
-
-    handlers: dict[str, Callable[[], int]] = {
-        "login": lambda: _login(console, rest),
-        "status": lambda: _status(console),
-        "logout": lambda: _logout(console),
-    }
-    handler = handlers.get(subcommand)
-    if handler is not None:
-        return handler()
-
-    console.print(f"[red]Unknown auth command:[/] {subcommand}\n")
-    console.print(_USAGE)
-    return 2
-
-
-def _login(console: Console, argv: list[str]) -> int:
-    parser = argparse.ArgumentParser(prog="strix auth login", add_help=True)
-    parser.add_argument(
-        "provider",
-        nargs="?",
-        default=LOGIN_PROVIDER,
-        help="Model provider to sign in with (default: chatgpt).",
-    )
-    parser.add_argument(
-        "--manual",
-        action="store_true",
-        help="Skip the local callback server and paste the redirect URL by hand.",
-    )
-    try:
-        args = parser.parse_args(argv)
-    except SystemExit as exc:  # argparse already printed the message
-        return int(exc.code or 2)
-
-    if args.provider.lower() not in _ACCEPTED_PROVIDERS:
-        console.print(
-            f"[red]Unsupported provider:[/] {args.provider}. "
-            f"Only '{LOGIN_PROVIDER}' (ChatGPT subscription) is supported."
-        )
-        return 2
-
-    verifier, challenge = codex.generate_pkce()
-    state = codex.create_state()
-    authorize_url = codex.build_authorize_url(challenge, state)
-
-    console.print()
-    console.print("[bold]Signing in with ChatGPT[/] [dim](provider: chatgpt)[/]")
-    console.print(
-        "[dim]This uses your ChatGPT Plus/Pro plan for inference instead of a metered API key.[/]"
-    )
-    console.print()
-
-    try:
-        record = _run_oauth_flow(console, authorize_url, verifier, state, manual=args.manual)
-    except codex.CodexAuthError as exc:
-        return _fail(console, exc)
-    except KeyboardInterrupt:
-        console.print("\n[yellow]Sign-in cancelled.[/]")
-        return 130
-
-    codex.save_record(record)
-    _print_success(console)
-    return 0
-
-
-def _run_oauth_flow(
-    console: Console,
-    authorize_url: str,
-    verifier: str,
-    state: str,
-    *,
-    manual: bool,
-) -> dict[str, Any]:
-    """Drive the browser (or manual) OAuth flow and return a token record."""
-    server = None if manual else _try_start_callback_server()
-
-    console.print("Open this URL in your browser to authorize:")
-    console.print(f"[cyan]{authorize_url}[/]")
-    console.print()
-    if not manual:
-        try:
-            webbrowser.open(authorize_url)
-        except Exception:  # noqa: BLE001 - opening a browser is best-effort
-            logger.debug("could not open browser", exc_info=True)
-
-    if server is not None:
-        console.print("[dim]Waiting for you to finish signing in…[/]")
-        result = server.wait(_CALLBACK_TIMEOUT_S)
-        server.shutdown()
-        if result is not None:
-            code, returned_state, error = result
-            if error:
-                raise codex.CodexAuthError("oauth_error", error)
-            return _finish(code, returned_state, verifier, state, require_state=True)
-        console.print("[yellow]Timed out waiting for the browser. Falling back to manual paste.[/]")
-
-    # Manual fallback: the user completes sign-in and pastes the redirect URL
-    # (the browser lands on a localhost page that won't load if no server is up;
-    # the address bar still holds the code+state).
-    console.print()
-    try:
-        pasted = console.input("Paste the full redirect URL (or code#state): ").strip()
-    except EOFError as exc:
-        raise codex.CodexAuthError("no_input", "no redirect URL provided") from exc
-    code, returned_state = codex.parse_redirect_input(pasted)
-    return _finish(code, returned_state, verifier, state, require_state=False)
-
-
-def _finish(
-    code: str | None,
-    returned_state: str | None,
-    verifier: str,
-    expected_state: str,
-    *,
-    require_state: bool,
-) -> dict[str, Any]:
-    if not code:
-        raise codex.CodexAuthError("no_code", "no authorization code found in the redirect")
-    # The loopback callback from OpenAI always carries state, so a missing or
-    # mismatched value there is forged (CSRF) and must be rejected. Manual paste
-    # is user-initiated (the user copies their own redirect), so state is only
-    # validated when the pasted value includes it.
-    if require_state and returned_state is None:
-        raise codex.CodexAuthError("state_mismatch", "missing state in callback; possible CSRF")
-    if returned_state is not None and returned_state != expected_state:
-        raise codex.CodexAuthError("state_mismatch", "state did not match; possible CSRF")
-    return codex.exchange_code(code, verifier)
-
-
-class _CallbackServer:
-    """A one-shot local HTTP server that catches the OAuth redirect."""
-
-    def __init__(self, httpd: HTTPServer, event: threading.Event, holder: dict[str, Any]) -> None:
-        self._httpd = httpd
-        self._event = event
-        self._holder = holder
-        self._thread = threading.Thread(target=httpd.serve_forever, daemon=True)
-        self._thread.start()
-
-    def wait(self, timeout: float) -> tuple[str | None, str | None, str | None] | None:
-        if not self._event.wait(timeout):
-            return None
-        return (
-            self._holder.get("code"),
-            self._holder.get("state"),
-            self._holder.get("error"),
-        )
-
-    def shutdown(self) -> None:
-        self._httpd.shutdown()
-        self._httpd.server_close()
-
-
-def _try_start_callback_server() -> _CallbackServer | None:
-    event = threading.Event()
-    holder: dict[str, Any] = {}
-
-    class Handler(BaseHTTPRequestHandler):
-        def log_message(self, *args: Any) -> None:  # silence default stderr logging
-            pass
-
-        def do_GET(self) -> None:
-            parsed = urlparse(self.path)
-            if parsed.path != codex.CALLBACK_PATH:
-                self.send_response(404)
-                self.end_headers()
-                return
-            query = parse_qs(parsed.query)
-            holder["code"] = _first(query, "code")
-            holder["state"] = _first(query, "state")
-            holder["error"] = _first(query, "error_description") or _first(query, "error")
-            body = _render_callback_html().encode("utf-8")
-            self.send_response(200)
-            self.send_header("Content-Type", "text/html; charset=utf-8")
-            self.send_header("Content-Length", str(len(body)))
-            self.end_headers()
-            self.wfile.write(body)
-            event.set()
-
-    try:
-        httpd = HTTPServer(("127.0.0.1", codex.CALLBACK_PORT), Handler)
-    except OSError:
-        logger.debug("could not bind callback port %d", codex.CALLBACK_PORT, exc_info=True)
-        return None
-    return _CallbackServer(httpd, event, holder)
-
-
-def _first(query: dict[str, list[str]], key: str) -> str | None:
-    values = query.get(key)
-    return values[0] if values else None
-
-
-def _status(console: Console) -> int:
-    record = codex.read_record()
-    if record is None:
-        console.print("[yellow]Not signed in.[/] Run [cyan]strix auth login chatgpt[/] to sign in.")
-        return 1
-    settings = load_settings()
-    console.print("[green]Signed in[/] with a ChatGPT subscription.")
-    console.print(f"  Account: [bold]{record.get('account_id')}[/]")
-    if codex.subscription_model(settings.llm.model):
-        console.print(f"  Runs use the subscription (STRIX_LLM=[bold]{settings.llm.model}[/]).")
-    else:
-        console.print(
-            "  [yellow]Note:[/] set [cyan]STRIX_LLM[/] to e.g. [cyan]chatgpt/gpt-5.4[/] "
-            "to run on the subscription."
-        )
-    return 0
-
-
-def _logout(console: Console) -> int:
-    codex.logout()
-    console.print("[green]Signed out.[/] Stored subscription credentials removed.")
-    return 0
-
-
-def _fail(console: Console, exc: codex.CodexAuthError) -> int:
-    error_text = Text()
-    error_text.append("SIGN-IN FAILED", style="bold red")
-    error_text.append("\n\n", style="white")
-    error_text.append(f"{exc}", style="white")
-    console.print()
-    console.print(
-        Panel(
-            error_text,
-            title="[bold white]STRIX",
-            title_align="left",
-            border_style="red",
-            padding=(1, 2),
-        )
-    )
-    return 1
-
-
-def _print_success(console: Console) -> None:
-    text = Text()
-    text.append("Signed in with your ChatGPT subscription", style="bold #22c55e")
-    text.append("\n\n", style="white")
-    text.append("Set ", style="white")
-    text.append("STRIX_LLM", style="bold white")
-    text.append(" to a ", style="white")
-    text.append("chatgpt/", style="bold cyan")
-    text.append(" model (e.g. ", style="white")
-    text.append("chatgpt/gpt-5.4", style="bold cyan")
-    text.append(") — runs are billed to your ChatGPT plan.", style="white")
-    text.append("\n\n", style="white")
-    text.append("Run a scan as usual, e.g. ", style="white")
-    text.append("strix --target https://example.com", style="bold cyan")
-    console.print()
-    console.print(
-        Panel(
-            text,
-            title="[bold white]STRIX",
-            title_align="left",
-            border_style="#22c55e",
-            padding=(1, 2),
-        )
-    )
-    console.print()
-
-
-_LOGO_PATH = Path(__file__).resolve().parent.parent / "viewer" / "static" / "logo.png"
-
-
-def _logo_img_tag() -> str:
-    """Return an ``<img>`` for the Strix logo as an inline data URI, or "".
-
-    The callback page is served offline by the local OAuth server, so the logo
-    is embedded rather than linked. Missing/unreadable file degrades to just the
-    "Strix" wordmark.
-    """
-    try:
-        data = _LOGO_PATH.read_bytes()
-    except OSError:
-        return ""
-    encoded = base64.b64encode(data).decode("ascii")
-    return f'<img class="logo" src="data:image/png;base64,{encoded}" alt="" />'
-
-
-def _render_callback_html() -> str:
-    return _CALLBACK_HTML.replace("<!--LOGO-->", _logo_img_tag())
-
-
-_CALLBACK_HTML = """<!doctype html>
-<html lang="en"><head><meta charset="utf-8">
-<meta name="viewport" content="width=device-width, initial-scale=1">
-<title>Strix — signed in</title>
-<style>
-  :root { color-scheme: dark; }
-  * { box-sizing: border-box; }
-  body {
-    margin: 0; min-height: 100vh; padding: 24px;
-    font-family: 'Geist', 'Geist Sans', ui-sans-serif, system-ui, -apple-system,
-      "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
-    -webkit-font-smoothing: antialiased; -moz-osx-font-smoothing: grayscale;
-    background: #000; color: #ededed;
-    display: flex; flex-direction: column; align-items: center; justify-content: center;
-  }
-  .topbar {
-    position: absolute; top: 20px; left: 22px;
-    display: flex; align-items: center; gap: 6px; text-decoration: none;
-  }
-  .topbar .logo { width: 40px; height: 40px; display: block; }
-  .topbar span {
-    font-size: 1.1rem; font-weight: 600; letter-spacing: -.01em; color: #fff;
-    transition: color .15s ease;
-  }
-  .topbar:hover span { color: #c9c9c9; }
-  .brand {
-    font-size: 2.1rem; font-weight: 700; letter-spacing: -.02em; color: #fff;
-    text-align: center; margin: 0 0 10px;
-  }
-  h1 {
-    font-size: 1.35rem; font-weight: 600; letter-spacing: -.01em; color: #f5f5f5;
-    text-align: center; margin: 0 0 28px;
-  }
-  .card {
-    width: 100%; max-width: 430px; text-align: center;
-    background: #171717; border: 1px solid rgba(255, 255, 255, .06);
-    border-radius: 24px; padding: 40px 40px 34px;
-  }
-  .badge {
-    margin: 0 auto 22px; width: 52px; height: 52px; border-radius: 50%;
-    display: flex; align-items: center; justify-content: center; font-size: 23px; color: #fff;
-    background: rgba(255, 255, 255, .05); border: 1px solid rgba(255, 255, 255, .14);
-  }
-  .msg { margin: 0 auto; max-width: 34ch; color: #b5b5b5; line-height: 1.6; font-size: .98rem; }
-  .rule { height: 1px; background: rgba(255, 255, 255, .07); margin: 26px 0 0; }
-  .tagline { margin: 22px 0 0; color: #7c7c7c; font-size: .9rem; line-height: 1.55; }
-  .tagline b { color: #ededed; font-weight: 500; }
-  .links {
-    margin-top: 18px; display: flex; gap: 8px; justify-content: center;
-    align-items: center; flex-wrap: wrap; font-size: .84rem;
-  }
-  .links a { color: #a3a3a3; text-decoration: none; transition: color .15s ease; }
-  .links a:hover { color: #fff; }
-  .links .dot { color: #3a3a3a; }
-  .close { margin: 24px 0 0; color: #5a5a5a; font-size: .78rem; text-align: center; }
-</style></head>
-<body>
-  <a class="topbar" href="https://strix.ai" target="_blank" rel="noopener"
-     aria-label="Strix — strix.ai">
-    <!--LOGO-->
-    <span>Strix</span>
-  </a>
-  <div class="brand">Strix</div>
-  <h1>You're signed in</h1>
-  <main class="card">
-    <div class="badge">✓</div>
-    <p class="msg">Strix is connected to your ChatGPT subscription. Head back to your
-      terminal — your security test runs there.</p>
-    <div class="rule"></div>
-    <p class="tagline">Autonomous AI hackers that <b>find and fix</b> your app's
-      vulnerabilities.</p>
-    <nav class="links">
-      <a href="https://strix.ai" target="_blank" rel="noopener">strix.ai</a>
-      <span class="dot">·</span>
-      <a href="https://docs.strix.ai" target="_blank" rel="noopener">docs</a>
-      <span class="dot">·</span>
-      <a href="https://discord.gg/strix-ai" target="_blank" rel="noopener">community</a>
-    </nav>
-  </main>
-  <p class="close">You can close this tab.</p>
-</body></html>"""
-
-
-__all__ = ["run_auth"]

strix/interface/main.py

@@ -8,6 +8,7 @@ import asyncio
 import os
 import shutil
 import sys
+import time
 from datetime import UTC, datetime
 from pathlib import Path
 
@@ -20,7 +21,6 @@ from rich.text import Text
 
 from strix.config import (
     apply_config_override,
-    codex,
     load_settings,
     persist_current,
 )
@@ -93,16 +93,6 @@ def validate_environment() -> None:
 
     settings = load_settings()
 
-    if codex.subscription_model(settings.llm.model):
-        if not codex.is_authenticated():
-            console.print(
-                f"[red]STRIX_LLM={settings.llm.model} uses your ChatGPT subscription, "
-                "but you're not signed in.[/] Run [cyan]strix auth login chatgpt[/] first."
-            )
-            sys.exit(1)
-        logger.info("Environment OK (ChatGPT subscription)")
-        return
-
     if not settings.llm.model:
         missing_required_vars.append("STRIX_LLM")
 
@@ -285,29 +275,6 @@ def _provider_import_hint(exc: BaseException, model: str) -> str | None:
     return None
 
 
-def _subscription_error_hint(exc: BaseException) -> str | None:
-    """Return an actionable hint for a known ChatGPT-subscription error, or None."""
-    if not codex.subscription_model(load_settings().llm.model):
-        return None
-    joined = " ".join(_exception_messages(exc)).lower()
-    if "not supported when using codex with a chatgpt account" in joined:
-        return (
-            "This model isn't available on your ChatGPT subscription. "
-            "Set STRIX_LLM to a model your plan includes (e.g. chatgpt/gpt-5.4)."
-        )
-    if (
-        "error code: 401" in joined
-        or "http 401" in joined
-        or "unauthorized" in joined
-        or "invalid_grant" in joined
-    ):
-        return (
-            "Your ChatGPT sign-in has expired or was revoked. Sign in again:\n"
-            "  strix auth login chatgpt"
-        )
-    return None
-
-
 async def warm_up_llm(show_model_warning: bool = True) -> None:
     console = Console()
     logger.info("Warming up LLM connection")
@@ -317,8 +284,8 @@ async def warm_up_llm(show_model_warning: bool = True) -> None:
         settings = load_settings()
         configure_sdk_model_defaults(settings)
         llm = settings.llm
-        raw_model = (llm.model or "").strip()
 
+        raw_model = (llm.model or "").strip()
         if (
             raw_model
             and "/" not in raw_model
@@ -394,63 +361,23 @@ async def warm_up_llm(show_model_warning: bool = True) -> None:
         )
         logger.info("LLM warm-up succeeded for model %s", (llm.model or "").strip())
 
-        if settings.dedupe.model:
-            from strix.report.dedupe import _dedupe_extra_args
-
-            dedupe_model = settings.dedupe.model.strip()
-            raw_model = dedupe_model
-            deduper = StrixProvider().get_model(dedupe_model)
-            # Match the runtime path: send the dedupe key/endpoint per call so a
-            # separate-provider dedupe model authenticates during warm-up too.
-            deduper_extra = _dedupe_extra_args(settings.dedupe)
-            deduper_settings = ModelSettings(extra_args=deduper_extra or None)
-            await asyncio.wait_for(
-                deduper.get_response(
-                    system_instructions="You are a helpful assistant.",
-                    input="Reply with just 'OK'.",
-                    model_settings=deduper_settings,
-                    tools=[],
-                    output_schema=None,
-                    handoffs=[],
-                    tracing=ModelTracing.DISABLED,
-                    previous_response_id=None,
-                    conversation_id=None,
-                    prompt=None,
-                ),
-                timeout=llm.timeout,
-            )
-            logger.info("LLM warm-up succeeded for dedupe model %s", dedupe_model)
-
     except Exception as e:
         logger.exception("LLM warm-up failed")
         error_text = Text()
-        sub_hint = _subscription_error_hint(e)
-        if sub_hint is not None:
-            # The model/backend answered with a clear, actionable rejection —
-            # show that instead of a generic "connection failed".
-            border_style = "yellow"
-            error_text.append("MODEL NOT AVAILABLE ON SUBSCRIPTION", style="bold yellow")
-            error_text.append("\n\n", style="white")
-            error_text.append(f"{sub_hint}\n", style="white")
-            error_text.append(f"\nDetails: {e}", style="dim white")
-        else:
-            border_style = "red"
-            error_text.append("LLM CONNECTION FAILED", style="bold red")
-            error_text.append("\n\n", style="white")
-            error_text.append(
-                "Could not establish connection to the language model.\n", style="white"
-            )
-            error_text.append("Please check your configuration and try again.\n", style="white")
-            hint = _provider_import_hint(e, raw_model)
-            if hint is not None:
-                error_text.append(f"\n{hint}\n", style="bold yellow")
-            error_text.append(f"\nError: {e}", style="dim white")
+        error_text.append("LLM CONNECTION FAILED", style="bold red")
+        error_text.append("\n\n", style="white")
+        error_text.append("Could not establish connection to the language model.\n", style="white")
+        error_text.append("Please check your configuration and try again.\n", style="white")
+        hint = _provider_import_hint(e, raw_model)
+        if hint is not None:
+            error_text.append(f"\n{hint}\n", style="bold yellow")
+        error_text.append(f"\nError: {e}", style="dim white")
 
         panel = Panel(
             error_text,
             title="[bold white]STRIX",
             title_align="left",
-            border_style=border_style,
+            border_style="red",
             padding=(1, 2),
         )
 
@@ -756,7 +683,6 @@ def _persist_run_record(args: argparse.Namespace) -> None:
         "status": "running",
         "start_time": datetime.now(UTC).isoformat(),
         "end_time": None,
-        "auth_mode": codex.auth_mode(load_settings().llm.model),
         "targets_info": args.targets_info,
         "scan_mode": args.scan_mode,
         "instruction": args.instruction,
@@ -814,7 +740,9 @@ def _load_resume_state(args: argparse.Namespace, parser: argparse.ArgumentParser
         args.scan_mode = persisted_scan_mode
 
 
-def display_completion_message(args: argparse.Namespace, results_path: Path) -> None:
+def display_completion_message(
+    args: argparse.Namespace, results_path: Path, web_url: str | None = None
+) -> None:
     console = Console()
     report_state = get_global_report_state()
 
@@ -853,12 +781,28 @@ def display_completion_message(args: argparse.Namespace, results_path: Path) ->
     results_text.append(str(results_path), style="#60a5fa")
     panel_parts.extend(["\n", results_text])
 
-    view_text = Text()
-    view_text.append("\n")
-    view_text.append("View", style="dim")
-    view_text.append("         ")
-    view_text.append(f"strix view {args.run_name}", style="#22c55e")
-    panel_parts.extend(["\n", view_text])
+    if web_url:
+        web_text = Text()
+        web_text.append("\n")
+        web_text.append("View in web", style="dim")
+        web_text.append("  ")
+        # OSC-8 hyperlink: clickable in modern terminals, falls back to the URL.
+        web_text.append(web_url, style=f"#60a5fa link {web_url}")
+        panel_parts.extend(["\n", web_text])
+
+        reopen_text = Text()
+        reopen_text.append("\n")
+        reopen_text.append("Reopen", style="dim")
+        reopen_text.append("       ")
+        reopen_text.append(f"strix view {args.run_name}", style="#22c55e")
+        panel_parts.extend(["\n", reopen_text])
+    else:
+        view_text = Text()
+        view_text.append("\n")
+        view_text.append("View", style="dim")
+        view_text.append("         ")
+        view_text.append(f"strix view {args.run_name}", style="#22c55e")
+        panel_parts.extend(["\n", view_text])
 
     if not scan_completed:
         resume_text = Text()
@@ -957,13 +901,6 @@ def main() -> None:
         run_view(sys.argv[2:])
         return
 
-    # `strix auth …` manages model-subscription sign-in and exits; it needs no
-    # target, Docker, or scan setup.
-    if len(sys.argv) > 1 and sys.argv[1] == "auth":
-        from strix.interface.auth_cli import run_auth
-
-        sys.exit(run_auth(sys.argv[2:]))
-
     args = parse_arguments()
 
     if args.config:
@@ -1031,7 +968,6 @@ def main() -> None:
 
     _telemetry_start_kwargs = {
         "model": load_settings().llm.model,
-        "auth_mode": codex.auth_mode(load_settings().llm.model),
         "scan_mode": args.scan_mode,
         "is_whitebox": is_whitebox_scan(args.targets_info),
         "interactive": not args.non_interactive,
@@ -1066,7 +1002,39 @@ def main() -> None:
 
     results_path = run_dir_for(args.run_name)
 
-    display_completion_message(args, results_path)
+    # For an interactive run, host the local viewer so the completion panel can
+    # show a clickable "View in web" link. Skipped in non-interactive/CI runs
+    # (no TTY to serve and it would block the process).
+    viewer_httpd = None
+    web_url = None
+    if not args.non_interactive and sys.stdout.isatty():
+        from strix.viewer.server import authorized_url, bundle_is_built, serve
+
+        if bundle_is_built():
+            try:
+                viewer_httpd, base_url, token = serve(results_path, open_browser=False)
+                # The completion panel's "View in web" link must authorize the
+                # browser, so hand it the tokened URL rather than the bare host.
+                web_url = authorized_url(base_url, token)
+                posthog.viewer_opened(source="post_scan", live=False)
+            except Exception:
+                logger.debug("could not start local viewer", exc_info=True)
+                viewer_httpd, web_url = None, None
+
+    display_completion_message(args, results_path, web_url=web_url)
+
+    if viewer_httpd is not None:
+        console = Console()
+        console.print("[dim]Hosting the local viewer. Press Ctrl-C to stop.[/]")
+        console.print()
+        try:
+            while True:
+                time.sleep(1)
+        except KeyboardInterrupt:
+            console.print("\n[dim]Viewer stopped.[/]")
+        finally:
+            viewer_httpd.shutdown()
+            viewer_httpd.server_close()
 
     if args.non_interactive:
         report_state = get_global_report_state()

strix/interface/tui/app.py

@@ -42,12 +42,6 @@ from strix.interface.tui.renderers.agent_message_renderer import AgentMessageRen
 from strix.interface.tui.renderers.user_message_renderer import UserMessageRenderer
 from strix.interface.utils import build_tui_stats_text
 from strix.report.state import ReportState, set_global_report_state
-from strix.report.writer import (
-    guess_language_name,
-    parse_fenced_code,
-    resolve_lexer,
-    safe_fence,
-)
 from strix.runtime import session_manager
 
 
@@ -336,11 +330,12 @@ class VulnerabilityDetailScreen(ModalScreen):  # type: ignore[misc]
             return "#65a30d"
         return "#6b7280"
 
-    def _highlight_python(self, code: str, language: str | None = None) -> Text:
+    def _highlight_python(self, code: str) -> Text:
         try:
+            from pygments.lexers import PythonLexer
             from pygments.styles import get_style_by_name
 
-            lexer = resolve_lexer(language, code)
+            lexer = PythonLexer()
             style = get_style_by_name("native")
             colors = {
                 token: f"#{style_def['color']}" for token, style_def in style if style_def["color"]
@@ -506,11 +501,10 @@ class VulnerabilityDetailScreen(ModalScreen):  # type: ignore[misc]
 
         poc_script_code = vuln.get("poc_script_code", "")
         if poc_script_code:
-            poc_language, poc_code = parse_fenced_code(poc_script_code)
             text.append("\n\n")
             text.append("PoC Code", style=self.FIELD_STYLE)
             text.append("\n")
-            text.append_text(self._highlight_python(poc_code, poc_language))
+            text.append_text(self._highlight_python(poc_script_code))
 
         remediation_steps = vuln.get("remediation_steps", "")
         if remediation_steps:
@@ -607,12 +601,9 @@ class VulnerabilityDetailScreen(ModalScreen):  # type: ignore[misc]
                 lines.append(vuln["poc_description"])
                 lines.append("")
             if vuln.get("poc_script_code"):
-                poc_language, poc_code = parse_fenced_code(vuln["poc_script_code"])
-                fence_lang = poc_language or guess_language_name(poc_code)
-                fence = safe_fence(poc_code)
-                lines.append(f"{fence}{fence_lang}")
-                lines.append(poc_code)
-                lines.append(fence)
+                lines.append("```python")
+                lines.append(vuln["poc_script_code"])
+                lines.append("```")
 
         if vuln.get("code_locations"):
             lines.extend(["", "## Code Analysis", ""])
@@ -628,9 +619,7 @@ class VulnerabilityDetailScreen(ModalScreen):  # type: ignore[misc]
                 if loc.get("label"):
                     lines.append(f"  {loc['label']}")
                 if loc.get("snippet"):
-                    snippet = str(loc["snippet"])
-                    snippet_fence = safe_fence(snippet)
-                    lines.append(f"{snippet_fence}\n{snippet}\n{snippet_fence}")
+                    lines.append(f"```\n{loc['snippet']}\n```")
                 if loc.get("fix_before") or loc.get("fix_after"):
                     lines.append("**Suggested Fix:**")
                     lines.append("```diff")
@@ -813,7 +802,6 @@ class StrixTUIApp(App):  # type: ignore[misc]
         self._scan_stop_event = threading.Event()
         self._scan_completed = threading.Event()
         self._scan_error: BaseException | None = None
-        self._error_noted_agents: set[str] = set()
 
         self._spinner_frame_index: int = 0
         self._sweep_num_squares: int = 6
@@ -1027,32 +1015,22 @@ class StrixTUIApp(App):  # type: ignore[misc]
             else:
                 self._agent_graph_sync_future = None
                 try:
-                    parent_of, statuses, names, errors = future.result()
+                    parent_of, statuses, names = future.result()
                 except Exception:
                     logger.exception("TUI agent graph sync failed")
                 else:
                     for agent_id, status in statuses.items():
-                        error = errors.get(agent_id)
                         self.live_view.upsert_agent(
                             agent_id,
                             name=names.get(agent_id, agent_id),
                             parent_id=parent_of.get(agent_id),
                             status=status,
-                            error_message=error,
                         )
-                        if status in {"failed", "crashed"} and error:
-                            if agent_id not in self._error_noted_agents:
-                                self._error_noted_agents.add(agent_id)
-                                self.live_view.record_agent_error(agent_id, error)
-                        else:
-                            self._error_noted_agents.discard(agent_id)
 
         if self._scan_loop is None or self._scan_loop.is_closed():
             return
 
-        async def collect() -> tuple[
-            dict[str, str | None], dict[str, Any], dict[str, str], dict[str, str]
-        ]:
+        async def collect() -> tuple[dict[str, str | None], dict[str, Any], dict[str, str]]:
             return await self.coordinator.graph_snapshot()
 
         self._agent_graph_sync_future = asyncio.run_coroutine_threadsafe(collect(), self._scan_loop)
@@ -1071,7 +1049,6 @@ class StrixTUIApp(App):  # type: ignore[misc]
                 "waiting": "⏸",
                 "completed": "🟢",
                 "failed": "🔴",
-                "crashed": "🔴",
                 "stopped": "■",
             }
 
@@ -1257,12 +1234,13 @@ class StrixTUIApp(App):  # type: ignore[misc]
             text.append(msg)
             return (text, Text(), False)
 
-        if status in {"failed", "crashed"}:
+        if status == "failed":
             error_msg = agent_data.get("error_message", "")
             text = Text()
-            text.append(error_msg or "Agent failed", style="red")
-            text.append(" · ", style="dim")
-            text.append("Send message to resume", style="dim")
+            if error_msg:
+                text.append(error_msg, style="red")
+            else:
+                text.append("Scan failed", style="red")
             self._stop_dot_animation()
             return (text, Text(), False)
 
@@ -1561,7 +1539,6 @@ class StrixTUIApp(App):  # type: ignore[misc]
             "waiting": "⏸",
             "completed": "🟢",
             "failed": "🔴",
-            "crashed": "🔴",
             "stopped": "■",
         }
 
@@ -1607,7 +1584,6 @@ class StrixTUIApp(App):  # type: ignore[misc]
             "waiting": "⏸",
             "completed": "🟢",
             "failed": "🔴",
-            "crashed": "🔴",
             "stopped": "■",
         }
 

strix/interface/tui/live_view.py

@@ -86,17 +86,6 @@ class TuiLiveView:
             current["error_message"] = error_message
         current["updated_at"] = now
 
-    def record_agent_error(self, agent_id: str, error: str) -> None:
-        self._append_event(
-            agent_id,
-            "chat",
-            {
-                "role": "assistant",
-                "content": (f"An error occurred: {error}\nI'm now waiting for new instructions."),
-                "metadata": {"source": "agent_error"},
-            },
-        )
-
     def record_user_message(self, agent_id: str, content: str) -> None:
         self._append_event(
             agent_id,

strix/interface/tui/renderers/reporting_renderer.py

@@ -1,12 +1,11 @@
 from functools import cache
 from typing import Any, ClassVar
 
+from pygments.lexers import PythonLexer
 from pygments.styles import get_style_by_name
 from rich.text import Text
 from textual.widgets import Static
 
-from strix.report.writer import parse_fenced_code, resolve_lexer
-
 from .base_renderer import BaseToolRenderer
 from .registry import register_tool_renderer
 
@@ -62,8 +61,8 @@ class CreateVulnerabilityReportRenderer(BaseToolRenderer):
         return None
 
     @classmethod
-    def _highlight_code(cls, code: str, language: str | None) -> Text:
-        lexer = resolve_lexer(language, code)
+    def _highlight_python(cls, code: str) -> Text:
+        lexer = PythonLexer()
         text = Text()
 
         for token_type, token_value in lexer.get_tokens(code):
@@ -235,11 +234,10 @@ class CreateVulnerabilityReportRenderer(BaseToolRenderer):
             text.append(poc_description)
 
         if poc_script_code:
-            poc_language, poc_code = parse_fenced_code(poc_script_code)
             text.append("\n\n")
             text.append("PoC Code", style=FIELD_STYLE)
             text.append("\n")
-            text.append_text(cls._highlight_code(poc_code, poc_language))
+            text.append_text(cls._highlight_python(poc_script_code))
 
         if remediation_steps:
             text.append("\n\n")

strix/interface/utils.py

@@ -253,20 +253,6 @@ def _llm_usage(report_state: Any) -> dict[str, Any]:
     return usage if isinstance(usage, dict) else {}
 
 
-def _is_subscription(report_state: Any) -> bool:
-    """Whether this run uses a model subscription (no metered cost).
-
-    Prefers the run record so it's correct for hydrated/resumed runs; falls back
-    to current settings.
-    """
-    record = getattr(report_state, "run_record", None)
-    if isinstance(record, dict) and record.get("auth_mode"):
-        return record.get("auth_mode") == "subscription"
-    from strix.config import codex
-
-    return codex.auth_mode(load_settings().llm.model) == "subscription"
-
-
 def _int_stat(usage: dict[str, Any], key: str) -> int:
     try:
         return max(0, int(usage.get(key) or 0))
@@ -297,16 +283,11 @@ def _build_llm_usage_stats(
     *,
     live: bool = False,
 ) -> None:
-    subscription = _is_subscription(report_state)
     usage = _llm_usage(report_state)
     if not usage or _int_stat(usage, "requests") <= 0:
         stats_text.append("\n")
         stats_text.append("Cost ", style="dim")
-        if subscription:
-            stats_text.append("$0.00 ", style="#22c55e")
-            stats_text.append("(subscription) ", style="dim")
-        else:
-            stats_text.append("$0.0000 ", style="#fbbf24")
+        stats_text.append("$0.0000 ", style="#fbbf24")
         stats_text.append("· ", style="dim white")
         stats_text.append("Tokens ", style="dim")
         stats_text.append("0", style="white")
@@ -331,12 +312,7 @@ def _build_llm_usage_stats(
     stats_text.append("Output Tokens ", style="dim")
     stats_text.append(format_token_count(output_tokens), style="white")
 
-    if subscription:
-        stats_text.append("  ·  ", style="dim white")
-        stats_text.append("Cost ", style="dim")
-        stats_text.append("$0.00", style="#22c55e")
-        stats_text.append(" (subscription)", style="dim")
-    elif live or cost > 0:
+    if live or cost > 0:
         stats_text.append("  ·  ", style="dim white")
         stats_text.append("Cost ", style="dim")
         stats_text.append(f"${cost:.4f}", style="#fbbf24")
@@ -361,9 +337,6 @@ def build_live_stats_text(report_state: Any) -> Text:
     model = load_settings().llm.model or "unknown"
     stats_text.append("Model ", style="dim")
     stats_text.append(str(model), style="white")
-    if _is_subscription(report_state):
-        stats_text.append("  ·  ", style="dim white")
-        stats_text.append("ChatGPT subscription", style="#22c55e")
     stats_text.append("\n")
 
     vuln_count = len(report_state.vulnerability_reports)
@@ -406,10 +379,6 @@ def build_tui_stats_text(report_state: Any) -> Text:
 
     model = load_settings().llm.model or "unknown"
     stats_text.append(str(model), style="white")
-    subscription = _is_subscription(report_state)
-    if subscription:
-        stats_text.append("\n")
-        stats_text.append("ChatGPT subscription", style="#22c55e")
 
     usage = _llm_usage(report_state)
     if usage and _int_stat(usage, "total_tokens") > 0:
@@ -419,10 +388,7 @@ def build_tui_stats_text(report_state: Any) -> Text:
             style="white",
         )
         cost = _float_stat(usage, "cost")
-        if subscription:
-            stats_text.append(" · ", style="white")
-            stats_text.append("$0.00", style="white")
-        elif cost > 0:
+        if cost > 0:
             stats_text.append(" · ", style="white")
             stats_text.append(f"${cost:.2f}", style="white")
 
@@ -1181,7 +1147,9 @@ def read_target_list_file(path_str: str) -> list[str]:
             if (target := line.strip()) and not target.startswith("#")
         ]
     except UnicodeDecodeError as e:
-        raise ValueError(f"Target list file '{path_str}' must be valid UTF-8 text: {e!s}") from e
+        raise ValueError(
+            f"Target list file '{path_str}' must be valid UTF-8 text: {e!s}"
+        ) from e
     except OSError as e:
         raise ValueError(f"Failed to read target list file '{path_str}': {e!s}") from e
 

strix/report/dedupe.py

@@ -13,55 +13,20 @@ from openai.types.responses import ResponseOutputMessage
 
 from strix.config import load_settings
 from strix.config.models import (
+    DEFAULT_MODEL_RETRY,
     StrixProvider,
     configure_sdk_model_defaults,
+    request_timeout_extra_args,
 )
-from strix.core.inputs import make_model_settings
 from strix.report.state import get_global_report_state
 
 
 if TYPE_CHECKING:
     from agents.items import ModelResponse
 
-    from strix.config.settings import DedupeSettings
-
 
 logger = logging.getLogger(__name__)
 
-
-def _dedupe_extra_args(dedupe: DedupeSettings) -> dict[str, str]:
-    """Per-call credential + endpoint for the dedupe model.
-
-    Provider env vars and the global base URL are process-wide, so a
-    shared-provider dedupe key or a distinct dedupe endpoint can't be installed
-    globally without clobbering (or being clobbered by) the main model's
-    config. Passing them per call keeps the two apart. Only applies when a
-    dedicated dedupe model is configured.
-    """
-    if not dedupe.model:
-        return {}
-    extra: dict[str, str] = {}
-    if dedupe.api_key and dedupe.api_key.strip():
-        extra["api_key"] = dedupe.api_key.strip()
-    if dedupe.api_base and dedupe.api_base.strip():
-        extra["api_base"] = dedupe.api_base.strip()
-    return extra
-
-
-def _dedupe_model_settings(
-    dedupe: DedupeSettings, model_name: str, request_timeout: float | None
-) -> ModelSettings:
-    settings = make_model_settings(
-        dedupe.reasoning_effort,
-        model_name=model_name,
-        force_required_tool_choice=False,
-        request_timeout=request_timeout,
-    )
-    extra = _dedupe_extra_args(dedupe)
-    if extra:
-        settings = settings.resolve(ModelSettings(extra_args=extra))
-    return settings
-
 DEDUPE_SYSTEM_PROMPT = """You are an expert vulnerability report deduplication judge.
 Your task is to determine if a candidate vulnerability report describes the SAME vulnerability
 as any existing report.
@@ -321,14 +286,13 @@ async def check_duplicate(
 
     try:
         settings = load_settings()
-        dedupe = settings.dedupe
-        model_name = (dedupe.model or "").strip() or settings.llm.model
+        model_name = settings.llm.model
         if not model_name:
             return {
                 "is_duplicate": False,
                 "duplicate_id": "",
                 "confidence": 0.0,
-                "reason": "No LLM model configured; skipping dedupe check",
+                "reason": "STRIX_LLM not configured; skipping dedupe check",
             }
 
         candidate_cleaned = _prepare_report_for_comparison(candidate)
@@ -347,8 +311,10 @@ async def check_duplicate(
         response = await model.get_response(
             system_instructions=DEDUPE_SYSTEM_PROMPT,
             input=user_msg,
-            model_settings=_dedupe_model_settings(
-                dedupe, resolved_model, settings.llm.timeout
+            model_settings=ModelSettings(
+                retry=DEFAULT_MODEL_RETRY,
+                include_usage=True,
+                extra_args=request_timeout_extra_args(settings.llm.timeout),
             ),
             tools=[],
             output_schema=None,

strix/report/state.py

@@ -10,8 +10,6 @@ from uuid import uuid4
 
 from agents.usage import Usage
 
-from strix.config import codex
-from strix.config.loader import load_settings
 from strix.core.paths import run_dir_for
 from strix.report.sarif import write_sarif
 from strix.report.usage import LLMUsageLedger
@@ -119,15 +117,12 @@ class ReportState:
         self.scan_results: dict[str, Any] | None = None
         self.scan_config: dict[str, Any] | None = None
         self._llm_usage = LLMUsageLedger()
-        auth_mode = codex.auth_mode(load_settings().llm.model)
-        self._llm_usage.zero_cost = auth_mode == "subscription"
         self.run_record: dict[str, Any] = {
             "run_id": self.run_id,
             "run_name": self.run_name,
             "start_time": self.start_time,
             "end_time": None,
             "status": "running",
-            "auth_mode": auth_mode,
             "targets_info": [],
             "llm_usage": self._build_llm_usage_record(),
         }

strix/report/usage.py

@@ -19,9 +19,6 @@ class LLMUsageLedger:
         self._agent_usage: dict[str, Usage] = {}
         self._agent_metadata: dict[str, dict[str, str]] = {}
         self._total_cost = 0.0
-        # When True, tokens are still tracked but cost stays $0 — the run is on a
-        # model subscription, so there is no metered per-token charge to report.
-        self.zero_cost = False
 
     def record(
         self,
@@ -44,7 +41,7 @@ class LLMUsageLedger:
         if model:
             metadata["model"] = model
 
-        if not self.zero_cost and not _is_litellm_routed(model):
+        if not _is_litellm_routed(model):
             estimated = _estimate_litellm_cost(usage, model)
             if estimated:
                 self._total_cost += estimated
@@ -52,8 +49,6 @@ class LLMUsageLedger:
         return True
 
     def record_observed_cost(self, cost: float) -> None:
-        if self.zero_cost:
-            return
         if isinstance(cost, int | float) and cost > 0:
             self._total_cost += float(cost)
 

strix/report/writer.py

@@ -10,27 +10,19 @@ import re
 import tempfile
 from datetime import UTC, datetime
 from pathlib import Path
-from typing import TYPE_CHECKING, Any, cast
-
-from pygments.lexers import PythonLexer, get_lexer_by_name, guess_lexer
-from pygments.lexers.special import TextLexer
-from pygments.util import ClassNotFound
+from typing import Any
 
 from strix.core.paths import run_record_path
 
 
-if TYPE_CHECKING:
-    from pygments.lexer import Lexer
-
 logger = logging.getLogger(__name__)
 
 _SEVERITY_ORDER = {"critical": 0, "high": 1, "medium": 2, "low": 3, "info": 4}
 
-_FENCE_RE = re.compile(r"^```([^\n`]*)\r?\n(.*?)\r?\n?```$", re.DOTALL)
 _BACKTICK_RUN = re.compile(r"`+")
 
 
-def safe_fence(content: str) -> str:
+def _safe_fence(content: str) -> str:
     """Return a backtick fence that ``content`` cannot break out of.
 
     Per CommonMark a fenced code block is closed only by a run of backticks at
@@ -43,56 +35,6 @@ def safe_fence(content: str) -> str:
     return "`" * max(3, longest + 1)
 
 
-def parse_fenced_code(raw: str) -> tuple[str | None, str]:
-    """Split an optionally fenced code string into ``(language, code)``.
-
-    Agent-generated code fields (e.g. ``poc_script_code``) are stored wrapped in
-    a markdown fence carrying the language, like ``` ```python\n...\n``` ```.
-    Return the fence's language tag and the inner code, or ``(None, raw)`` when
-    the value isn't fenced.
-    """
-    match = _FENCE_RE.match(raw.strip())
-    if not match:
-        return None, raw
-    info = match.group(1).strip()
-    language = info.split()[0] if info else None
-    return (language or None), match.group(2)
-
-
-def resolve_lexer(language: str | None, code: str) -> Lexer:
-    """Pick a pygments lexer for ``code``.
-
-    Prefer the explicit fence ``language`` when it names a known lexer, otherwise
-    auto-detect from the source. Fall back to Python when detection is
-    inconclusive, since legacy (unfenced) PoC scripts are Python.
-    """
-    if language:
-        try:
-            return get_lexer_by_name(language)
-        except ClassNotFound:
-            pass
-    try:
-        lexer = guess_lexer(code)
-    except ClassNotFound:
-        return cast("Lexer", PythonLexer())
-    # ``guess_lexer`` returns the plain-text lexer when it can't detect anything.
-    if isinstance(lexer, TextLexer):
-        return cast("Lexer", PythonLexer())
-    return lexer
-
-
-def guess_language_name(code: str) -> str:
-    """Return a markdown fence tag for ``code``, defaulting to ``python`` when
-    auto-detection is inconclusive."""
-    try:
-        lexer = guess_lexer(code)
-    except ClassNotFound:
-        return "python"
-    if isinstance(lexer, TextLexer) or not lexer.aliases:
-        return "python"
-    return str(lexer.aliases[0])
-
-
 def read_run_record(run_dir: Path) -> dict[str, Any]:
     path = run_record_path(run_dir)
     if not path.exists():
@@ -245,10 +187,9 @@ def render_vulnerability_md(report: dict[str, Any]) -> str:  # noqa: PLR0912, PL
             lines.append(str(report["poc_description"]))
             lines.append("")
         if report.get("poc_script_code"):
-            language, code = parse_fenced_code(str(report["poc_script_code"]))
-            fence_lang = language or guess_language_name(code)
-            fence = safe_fence(code)
-            lines.append(f"{fence}{fence_lang}")
+            code = str(report["poc_script_code"])
+            fence = _safe_fence(code)
+            lines.append(fence)
             lines.append(code)
             lines.append(fence)
             lines.append("")
@@ -268,7 +209,7 @@ def render_vulnerability_md(report: dict[str, Any]) -> str:  # noqa: PLR0912, PL
                 lines.append(f"  {loc['label']}")
             if loc.get("snippet"):
                 snippet = str(loc["snippet"])
-                fence = safe_fence(snippet)
+                fence = _safe_fence(snippet)
                 lines.append(f"  {fence}")
                 lines.extend(f"  {ln}" for ln in snippet.splitlines())
                 lines.append(f"  {fence}")

strix/runtime/local_dir_staging.py

@@ -110,7 +110,7 @@ def stage_symlink_safe_dir(src_root: Path) -> tuple[Path, Path | None]:
     if not tree_has_symlink(root):
         return root, None
 
-    staged = Path(tempfile.mkdtemp(prefix=_STAGING_PREFIX)).resolve()
+    staged = Path(tempfile.mkdtemp(prefix=_STAGING_PREFIX))
     try:
         _stage_dir(root, staged, root, frozenset({root}))
     except OSError:

strix/telemetry/README.md

@@ -15,7 +15,7 @@ We collect only very **basic** usage data including:
 **Session Errors:** Duration and error types (not messages or stack traces)\
 **System Context:** OS type, architecture, Strix version\
 **Scan Context:** Scan mode (quick/standard/deep), scan type (whitebox/blackbox)\
-**Model Usage:** Which LLM model is being used and whether it runs via an API key or a model subscription (not prompts or responses)\
+**Model Usage:** Which LLM model is being used (not prompts or responses)\
 **Feature Usage:** Which built-in skills are loaded\
 **Aggregate Metrics:** Vulnerability counts by severity and weakness category (CWE)
 

strix/telemetry/posthog.py

@@ -58,14 +58,12 @@ def start(
     is_whitebox: bool,
     interactive: bool,
     has_instructions: bool,
-    auth_mode: str | None = None,
 ) -> None:
     _send(
         "scan_started",
         {
             **base_props(),
             "model": model or "unknown",
-            "auth_mode": auth_mode or "api_key",
             "scan_mode": scan_mode or "unknown",
             "scan_type": "whitebox" if is_whitebox else "blackbox",
             "interactive": interactive,
@@ -135,7 +133,6 @@ def end(report_state: "ReportState", exit_reason: str = "completed") -> None:
         "scan_ended",
         {
             **base_props(),
-            "auth_mode": report_state.run_record.get("auth_mode") or "api_key",
             "exit_reason": report_state.scan_ended_exit_reason,
             "duration_seconds": round(duration),
             "vulnerabilities_total": len(report_state.vulnerability_reports),

strix/telemetry/scarf.py

@@ -59,7 +59,6 @@ def start(
     is_whitebox: bool,
     interactive: bool,
     has_instructions: bool,
-    auth_mode: str | None = None,
 ) -> None:
     _send(
         "scan_started",
@@ -67,7 +66,6 @@ def start(
             **base_props(),
             "session": SESSION_ID,
             "model": model or "unknown",
-            "auth_mode": auth_mode or "api_key",
             "scan_mode": scan_mode or "unknown",
             "scan_type": "whitebox" if is_whitebox else "blackbox",
             "interactive": interactive,
@@ -142,7 +140,6 @@ def end(report_state: ReportState, exit_reason: str = "completed") -> None:
         {
             **base_props(),
             "session": SESSION_ID,
-            "auth_mode": report_state.run_record.get("auth_mode") or "api_key",
             "exit_reason": report_state.scan_ended_exit_reason,
             "duration_seconds": round(duration),
             "vulnerabilities_total": len(report_state.vulnerability_reports),

strix/tools/agents_graph/tools.py

@@ -87,7 +87,7 @@ async def view_agent_graph(ctx: RunContextWrapper) -> str:
             default=str,
         )
 
-    parent_of, statuses, names, _ = await coordinator.graph_snapshot()
+    parent_of, statuses, names = await coordinator.graph_snapshot()
 
     lines: list[str] = []
 
@@ -635,7 +635,7 @@ async def stop_agent(
             ensure_ascii=False,
             default=str,
         )
-    _, statuses, _, _ = await coordinator.graph_snapshot()
+    _, statuses, _ = await coordinator.graph_snapshot()
     if target_agent_id not in statuses:
         return json.dumps(
             {"success": False, "error": f"Unknown agent_id: {target_agent_id}"},

strix/tools/output_store.py

@@ -1,74 +0,0 @@
-"""Bound oversized tool results before they enter agent history.
-
-Keeps a head + tail slice and drops the middle, replacing it with a notice of
-how much was removed.
-"""
-
-from __future__ import annotations
-
-
-_TRUNCATION_NOTICE = "[... {lines} lines ({bytes} bytes) truncated ...]"
-
-
-def _byte_len(text: str) -> int:
-    return len(text.encode("utf-8"))
-
-
-def _take_prefix(text: str, max_bytes: int) -> str:
-    budget = 0
-    out: list[str] = []
-    for char in text:
-        size = len(char.encode("utf-8"))
-        if budget + size > max_bytes:
-            break
-        out.append(char)
-        budget += size
-    return "".join(out)
-
-
-def _take_suffix(text: str, max_bytes: int) -> str:
-    budget = 0
-    out: list[str] = []
-    for char in reversed(text):
-        size = len(char.encode("utf-8"))
-        if budget + size > max_bytes:
-            break
-        out.append(char)
-        budget += size
-    out.reverse()
-    return "".join(out)
-
-
-def bound_text(text: str, *, max_lines: int, max_bytes: int) -> str:
-    """Return ``text`` unchanged when small, else a head+tail preview.
-
-    Truncates on whichever limit is hit first (line count or UTF-8 byte size).
-    ``max_bytes`` bounds the entire joined result, notice and separators
-    included.
-    """
-    lines = text.split("\n")
-    total_bytes = _byte_len(text)
-    if len(lines) <= max_lines and total_bytes <= max_bytes:
-        return text
-
-    # Reserve notice + separator bytes up front; ``+ 4`` covers the two "\n\n".
-    notice_overhead = _byte_len(_TRUNCATION_NOTICE.format(lines=len(lines), bytes=total_bytes)) + 4
-    byte_budget = max(2, max_bytes - notice_overhead)
-
-    head_lines = max(1, max_lines // 2)
-    tail_lines = max_lines - head_lines
-    head = "\n".join(lines[:head_lines])
-    tail = "\n".join(lines[len(lines) - tail_lines :]) if tail_lines > 0 else ""
-
-    half_bytes = max(1, byte_budget // 2)
-    if _byte_len(head) > half_bytes:
-        head = _take_prefix(head, half_bytes)
-    if tail and _byte_len(tail) > half_bytes:
-        tail = _take_suffix(tail, half_bytes)
-
-    # Count from the final slices; the byte pass may have dropped whole lines.
-    kept_lines = len(head.split("\n")) + (len(tail.split("\n")) if tail else 0)
-    dropped_lines = max(0, len(lines) - kept_lines)
-    dropped_bytes = max(0, total_bytes - _byte_len(head) - _byte_len(tail))
-    notice = _TRUNCATION_NOTICE.format(lines=dropped_lines, bytes=dropped_bytes)
-    return f"{head}\n\n{notice}\n\n{tail}" if tail else f"{head}\n\n{notice}"

strix/viewer/frontend/package-lock.json

@@ -63,6 +63,7 @@
       "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@babel/code-frame": "^7.29.7",
         "@babel/generator": "^7.29.7",
@@ -1604,6 +1605,7 @@
       "resolved": "https://registry.npmjs.org/@types/react/-/react-19.2.17.tgz",
       "integrity": "sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "csstype": "^3.2.2"
       }
@@ -1614,6 +1616,7 @@
       "integrity": "sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==",
       "devOptional": true,
       "license": "MIT",
+      "peer": true,
       "peerDependencies": {
         "@types/react": "^19.2.0"
       }
@@ -1736,6 +1739,7 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "baseline-browser-mapping": "^2.10.42",
         "caniuse-lite": "^1.0.30001803",
@@ -1916,6 +1920,7 @@
       "resolved": "https://registry.npmjs.org/d3-selection/-/d3-selection-3.0.0.tgz",
       "integrity": "sha512-fmTRWbNMmsmWq6xJV8D19U/gw/bwrHfNXxrIN+HfZgnzqTHp9jOmKMhsTUjXOJnZOdZY9Q28y4yebKzqDKlxlQ==",
       "license": "ISC",
+      "peer": true,
       "engines": {
         "node": ">=12"
       }
@@ -3566,6 +3571,7 @@
       "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -3617,6 +3623,7 @@
       "resolved": "https://registry.npmjs.org/react/-/react-19.2.7.tgz",
       "integrity": "sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==",
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=0.10.0"
       }
@@ -3626,6 +3633,7 @@
       "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.2.7.tgz",
       "integrity": "sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "scheduler": "^0.27.0"
       },
@@ -4101,6 +4109,7 @@
       "integrity": "sha512-NTKlcQjlAK7MlQoyb6LgaqHc8sso/pVyUJYWMws3jg21uTJw/LddqIFPcPqP6PzpgbIcZyKI85sFE4HBrQDA8A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "esbuild": "^0.25.0",
         "fdir": "^6.4.4",

strix/viewer/frontend/src/components/RunDetails.tsx

@@ -100,7 +100,6 @@ export function RunDetails({
   const reasoning = num(rec(arr(usage.output_tokens_details)[0]).reasoning_tokens);
   const totalTokens = num(usage.total_tokens);
   const cost = num(usage.cost);
-  const subscription = str(raw.auth_mode) === "subscription";
 
   const sub = (n: number, word: string) => (
     <span className="text-[#666]"> ({formatNumber(n)} {word})</span>
@@ -176,15 +175,6 @@ export function RunDetails({
           {hasUsage ? (
             <dl className="space-y-2.5 tabular-nums">
               <Field label="Model">{models.length ? models.join(", ") : "n/a"}</Field>
-              {subscription && (
-                <Field label="Provider">
-                  <span className="inline-flex items-center gap-1.5">
-                    <span className="rounded-full border border-[#22c55e]/40 bg-[#22c55e]/10 px-2 py-0.5 text-[11px] text-[#22c55e]">
-                      ChatGPT subscription
-                    </span>
-                  </span>
-                </Field>
-              )}
               <Field label="Run time">{fmtDuration(durationSeconds)}</Field>
               {requests != null && <Field label="Requests">{formatNumber(requests)}</Field>}
               {inputTokens != null && (
@@ -200,14 +190,7 @@ export function RunDetails({
                 </Field>
               )}
               {totalTokens != null && <Field label="Total tokens">{formatNumber(totalTokens)}</Field>}
-              {subscription ? (
-                <Field label="Cost">
-                  <span className="text-[#22c55e]">$0.00</span>
-                  <span className="text-[#666]"> (subscription)</span>
-                </Field>
-              ) : (
-                cost != null && <Field label="Cost">${cost.toFixed(2)}</Field>
-              )}
+              {cost != null && <Field label="Cost">${cost.toFixed(2)}</Field>}
               {agents.length > 0 && <Field label="Agents">{formatNumber(agents.length)}</Field>}
             </dl>
           ) : (

strix/viewer/frontend/src/components/live/tool-renderers/VulnReportRenderer.tsx

@@ -3,7 +3,6 @@
 import type { ToolRendererProps } from "@/types/events";
 import { TruncatedText } from "./ToolCard";
 import { MdCodeBlock } from "@/components/vulnerability/MdCodeBlock";
-import { parseFencedCode } from "@/lib/fenced-code";
 import Markdown from "./Markdown";
 
 const SEVERITY_COLORS: Record<string, string> = {
@@ -20,7 +19,7 @@ export default function VulnReportRenderer({ args, result }: ToolRendererProps)
   const method = (args.method as string) ?? "";
   const technicalAnalysis = (args.technical_analysis as string) ?? "";
   const pocDescription = (args.poc_description as string) ?? "";
-  const { language: pocLang, code: pocCode } = parseFencedCode((args.poc_script_code as string) ?? "");
+  const pocCode = (args.poc_script_code as string) ?? "";
   const remediation = (args.remediation_steps as string) ?? "";
   const cve = (args.cve as string) ?? "";
   const cwe = (args.cwe as string) ?? "";
@@ -60,7 +59,7 @@ export default function VulnReportRenderer({ args, result }: ToolRendererProps)
         <div>
           <span className="text-emerald-400/60 text-sm font-semibold">Proof of Concept</span>
           {pocDescription && <div className="mt-1"><Markdown text={pocDescription} /></div>}
-          {pocCode && <MdCodeBlock className={pocLang ? `language-${pocLang}` : undefined}>{pocCode}</MdCodeBlock>}
+          {pocCode && <MdCodeBlock>{pocCode}</MdCodeBlock>}
         </div>
       )}
       {remediation && (

strix/viewer/frontend/src/components/vulnerability/MdCodeBlock.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useState } from "react";
-import { highlightCode } from "@/lib/hljs";
+import hljs from "@/lib/hljs";
 import "highlight.js/styles/github-dark.css";
 import { Copy, Check } from "lucide-react";
 import { copyToClipboard } from "@/lib/vulnerability-utils";
@@ -17,7 +17,7 @@ export function MdCodeBlock({
 }) {
   const [copied, setCopied] = useState(false);
   const raw = String(children).replace(/\n$/, "");
-  const match = /language-(\S+)/.exec(className || "");
+  const match = /language-(\w+)/.exec(className || "");
   const isBlock = raw.includes("\n") || match;
 
   if (!isBlock) {
@@ -35,7 +35,16 @@ export function MdCodeBlock({
       : fileName
     : null;
 
-  const highlighted = highlightCode(raw, match?.[1]);
+  let highlighted: string;
+  if (match) {
+    try {
+      highlighted = hljs.highlight(raw, { language: match[1], ignoreIllegals: true }).value;
+    } catch {
+      highlighted = hljs.highlightAuto(raw).value;
+    }
+  } else {
+    highlighted = hljs.highlightAuto(raw).value;
+  }
 
   const lines = highlighted.split("\n");
 

strix/viewer/frontend/src/components/vulnerability/PocBlock.tsx

@@ -1,13 +1,12 @@
 "use client";
 
 import { useState } from "react";
-import { highlightCode } from "@/lib/hljs";
+import hljs from "@/lib/hljs";
 import "highlight.js/styles/github-dark.css";
 import ReactMarkdown from "react-markdown";
 import remarkGfm from "remark-gfm";
 import { Copy, Check } from "lucide-react";
 import { copyToClipboard } from "@/lib/vulnerability-utils";
-import { parseFencedCode } from "@/lib/fenced-code";
 import { rehypeCodeMeta, mdComponents } from "./MdCodeBlock";
 
 interface PocBlockProps {
@@ -21,12 +20,9 @@ export function PocBlock({ description, scriptCode, onCopy }: PocBlockProps) {
 
   if (!description && !scriptCode) return null;
 
-  const { language, code } = parseFencedCode(scriptCode);
-  const highlighted = highlightCode(code, language);
-
   const copy = () => {
-    if (!code) return;
-    copyToClipboard(code);
+    if (!scriptCode) return;
+    copyToClipboard(scriptCode);
     setCopied(true);
     setTimeout(() => setCopied(false), 2000);
     onCopy?.();
@@ -47,7 +43,7 @@ export function PocBlock({ description, scriptCode, onCopy }: PocBlockProps) {
             </ReactMarkdown>
           </div>
         )}
-        {code && (
+        {scriptCode && (
           <div className="group/poc relative rounded-md border border-[#2a2a2a] overflow-hidden">
             <div className="flex items-stretch">
               <span className="relative flex items-center text-[13px] text-[#999] font-mono px-4 py-2 border-r border-[#2a2a2a]">PoC Script<span className="absolute top-0 inset-x-0 h-0.5 bg-white/60 rounded-full" /></span>
@@ -68,7 +64,7 @@ export function PocBlock({ description, scriptCode, onCopy }: PocBlockProps) {
               <pre className="font-mono text-[12px] leading-[22px] whitespace-pre [font-variant-ligatures:none]">
                 <code
                   dangerouslySetInnerHTML={{
-                    __html: highlighted,
+                    __html: hljs.highlight(scriptCode, { language: "python" }).value,
                   }}
                 />
               </pre>

strix/viewer/frontend/src/lib/fenced-code.ts

@@ -1,27 +0,0 @@
-export interface ParsedFencedCode {
-  language?: string;
-  code: string;
-}
-
-const FENCE_RE = /^```([^\n`]*)\r?\n([\s\S]*?)\r?\n?```$/;
-
-/**
- * Agent-generated `poc_script_code` is stored wrapped in a markdown code fence
- * that carries the language, e.g.
- *
- *     ```python
- *     import requests
- *     ```
- *
- * Renderers that show the value as bare code must not display the fence lines
- * literally. This extracts the inner code and the fence's language tag. Returns
- * the input unchanged (no language) when it isn't fenced.
- */
-export function parseFencedCode(raw: string | null | undefined): ParsedFencedCode {
-  if (!raw) return { code: "" };
-  const match = FENCE_RE.exec(raw.trim());
-  if (!match) return { code: raw };
-  const info = match[1].trim();
-  const language = info ? info.split(/\s+/)[0] : undefined;
-  return { language: language || undefined, code: match[2] };
-}

strix/viewer/frontend/src/lib/hljs.ts

@@ -11,22 +11,4 @@ hljs.registerLanguage("apache", apache);
 hljs.registerLanguage("dockerfile", dockerfile);
 hljs.registerLanguage("properties", properties);
 
-/**
- * Highlight code, preferring an explicit language when it's recognized,
- * otherwise auto-detecting. Falls back to Python when auto-detection is
- * inconclusive, since legacy (unfenced) PoC scripts are Python.
- */
-export function highlightCode(code: string, language?: string | null): string {
-  try {
-    if (language && hljs.getLanguage(language)) {
-      return hljs.highlight(code, { language, ignoreIllegals: true }).value;
-    }
-    const auto = hljs.highlightAuto(code);
-    if (auto.language) return auto.value;
-    return hljs.highlight(code, { language: "python", ignoreIllegals: true }).value;
-  } catch {
-    return hljs.highlight(code, { language: "python", ignoreIllegals: true }).value;
-  }
-}
-
 export default hljs;

strix/viewer/report_pdf.py

@@ -151,35 +151,19 @@ def _styles() -> dict[str, ParagraphStyle]:
         "Finding", fontName=_SANS_BOLD, fontSize=13, leading=17, textColor=_INK, spaceBefore=6
     )
     styles["field_label"] = ParagraphStyle(
-        "FieldLabel",
-        fontName=_SANS_BOLD,
-        fontSize=8.5,
-        leading=12,
-        textColor=_MUTED,
-        spaceBefore=10,
-        spaceAfter=2,
+        "FieldLabel", fontName=_SANS_BOLD, fontSize=8.5, leading=12, textColor=_MUTED,
+        spaceBefore=10, spaceAfter=2,
     )
     styles["body"] = ParagraphStyle(
         "Body", fontName=_SANS, fontSize=10, leading=15, textColor=_TEXT, spaceAfter=8
     )
     styles["md_heading"] = ParagraphStyle(
-        "MdHeading",
-        fontName=_SANS_BOLD,
-        fontSize=11,
-        leading=15,
-        textColor=_INK,
-        spaceBefore=10,
-        spaceAfter=4,
+        "MdHeading", fontName=_SANS_BOLD, fontSize=11, leading=15, textColor=_INK,
+        spaceBefore=10, spaceAfter=4,
     )
     styles["bullet"] = ParagraphStyle(
-        "Bullet",
-        fontName=_SANS,
-        fontSize=10,
-        leading=15,
-        textColor=_TEXT,
-        leftIndent=16,
-        firstLineIndent=-11,
-        spaceAfter=3,
+        "Bullet", fontName=_SANS, fontSize=10, leading=15, textColor=_TEXT,
+        leftIndent=16, firstLineIndent=-11, spaceAfter=3,
     )
     styles["meta_inline"] = ParagraphStyle(
         "MetaInline", fontName=_SANS, fontSize=9, leading=13, textColor=_MUTED, spaceBefore=4
@@ -188,44 +172,23 @@ def _styles() -> dict[str, ParagraphStyle]:
     # a bordered paragraph's top padding, so too small a gap lets the background
     # box bleed up over the field label above it.
     styles["code"] = ParagraphStyle(
-        "Code",
-        fontName=_MONO,
-        fontSize=8,
-        leading=11,
-        textColor=_TEXT,
-        backColor=_LIGHT_BG,
-        borderColor=_BORDER,
-        borderWidth=0.5,
-        borderPadding=8,
-        spaceBefore=12,
-        spaceAfter=12,
+        "Code", fontName=_MONO, fontSize=8, leading=11, textColor=_TEXT,
+        backColor=_LIGHT_BG, borderColor=_BORDER, borderWidth=0.5, borderPadding=8,
+        spaceBefore=12, spaceAfter=12,
     )
     styles["count"] = ParagraphStyle(
         "Count", fontName=_SANS_BOLD, fontSize=30, leading=32, alignment=TA_CENTER
     )
     styles["count_label"] = ParagraphStyle(
-        "CountLabel",
-        fontName=_SANS_BOLD,
-        fontSize=8,
-        leading=12,
-        textColor=_MUTED,
-        alignment=TA_CENTER,
-        spaceBefore=4,
+        "CountLabel", fontName=_SANS_BOLD, fontSize=8, leading=12, textColor=_MUTED,
+        alignment=TA_CENTER, spaceBefore=4,
     )
     styles["badge"] = ParagraphStyle(
-        "Badge",
-        fontName=_SANS_BOLD,
-        fontSize=9,
-        leading=11,
-        textColor=colors.white,
+        "Badge", fontName=_SANS_BOLD, fontSize=9, leading=11, textColor=colors.white,
         alignment=TA_CENTER,
     )
     styles["confidential"] = ParagraphStyle(
-        "Confidential",
-        fontName=_SANS_BOLD,
-        fontSize=9,
-        leading=12,
-        textColor=colors.white,
+        "Confidential", fontName=_SANS_BOLD, fontSize=9, leading=12, textColor=colors.white,
         alignment=TA_CENTER,
     )
     return styles
@@ -293,10 +256,8 @@ def _severity_grid(styles: dict[str, ParagraphStyle], counts: dict[str, int]) ->
         color = _SEVERITY_COLORS[name]
         count_style = ParagraphStyle(f"Count{name}", parent=styles["count"], textColor=color)
         cells.append(
-            [
-                Paragraph(str(counts.get(name, 0)), count_style),
-                Paragraph(name.upper(), styles["count_label"]),
-            ]
+            [Paragraph(str(counts.get(name, 0)), count_style),
+             Paragraph(name.upper(), styles["count_label"])]
         )
     col = (_PAGE_W - 40 * mm) / 4
     table = Table([cells], colWidths=[col] * 4)
@@ -359,10 +320,8 @@ def _cover(
         ("DURATION", _duration(record.get("start_time"), record.get("end_time"))),
     ]
     meta_table = Table(
-        [
-            [Paragraph(label, styles["meta_label"]), Paragraph(_esc(value), styles["meta_value"])]
-            for label, value in meta_rows
-        ],
+        [[Paragraph(label, styles["meta_label"]), Paragraph(_esc(value), styles["meta_value"])]
+         for label, value in meta_rows],
         colWidths=[38 * mm, _PAGE_W - 40 * mm - 38 * mm],
     )
     meta_table.setStyle(
@@ -503,18 +462,6 @@ def _markdown_flowables(  # noqa: PLR0915 - cohesive block parser, splitting hur
     return flow
 
 
-_FENCE_RE = re.compile(r"^```([^\n`]*)\n(.*?)\n?```$", re.DOTALL)
-
-
-def _strip_code_fence(value: Any) -> Any:
-    """Drop a wrapping markdown code fence so raw-code fields don't show the
-    ``` ```lang ``` marker lines literally in the PDF."""
-    if not isinstance(value, str):
-        return value
-    match = _FENCE_RE.match(value.strip())
-    return match.group(2) if match else value
-
-
 def _field_block(
     styles: dict[str, ParagraphStyle], label: str, value: Any, *, code: bool = False
 ) -> list[Flowable]:
@@ -556,8 +503,7 @@ def _finding_flowables(
     story.extend(_field_block(styles, "Impact", vuln.get("impact")))
     story.extend(_field_block(styles, "Technical analysis", vuln.get("technical_analysis")))
     story.extend(_field_block(styles, "Proof of concept", vuln.get("poc_description")))
-    poc_script = _strip_code_fence(vuln.get("poc_script_code"))
-    story.extend(_field_block(styles, "PoC script", poc_script, code=True))
+    story.extend(_field_block(styles, "PoC script", vuln.get("poc_script_code"), code=True))
     story.extend(_field_block(styles, "Evidence", vuln.get("evidence"), code=True))
 
     remediation = vuln.get("remediation_steps")

strix/viewer/static/index.html

@@ -6,8 +6,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <meta name="color-scheme" content="dark" />
     <title>Strix Results</title>
-    <script type="module" crossorigin src="./assets/index-Dd1cyttN.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-vV8wxCG6.css">
+    <script type="module" crossorigin src="./assets/index-BNKUksp9.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-BdiSGmzb.css">
   </head>
   <body>
     <div id="root"></div>

tests/test_agent_factory_shell.py

@@ -3,14 +3,12 @@
 from __future__ import annotations
 
 import json
-from types import SimpleNamespace
 from typing import Any, cast
 
 import pytest
-from agents.tool import CustomTool, FunctionTool
+from agents.tool import FunctionTool
 
 from strix.agents import factory
-from strix.config import load_settings
 
 
 def _capturing_exec_tool(captured: dict[str, str]) -> FunctionTool:
@@ -34,37 +32,10 @@ async def test_wrap_exec_command_defaults_shell_to_bash() -> None:
     result = await wrapped.on_invoke_tool(cast("Any", None), json.dumps({"cmd": "source /tmp/env"}))
 
     assert result == "ok"
-    parsed = json.loads(captured["raw_input"])
-    assert parsed["cmd"] == "source /tmp/env"
-    assert parsed["shell"] == "bash"
-    expected_cap = load_settings().context.tool_output_max_tokens
-    assert parsed["max_output_tokens"] == expected_cap
-
-
-@pytest.mark.asyncio
-async def test_wrap_exec_command_preserves_smaller_explicit_output_cap() -> None:
-    captured: dict[str, str] = {}
-    wrapped = factory._wrap_exec_command(_capturing_exec_tool(captured))
-
-    await wrapped.on_invoke_tool(
-        cast("Any", None), json.dumps({"cmd": "echo hi", "max_output_tokens": 42})
-    )
-
-    assert json.loads(captured["raw_input"])["max_output_tokens"] == 42
-
-
-@pytest.mark.asyncio
-async def test_wrap_exec_command_clamps_oversized_explicit_output_cap() -> None:
-    captured: dict[str, str] = {}
-    wrapped = factory._wrap_exec_command(_capturing_exec_tool(captured))
-    ceiling = load_settings().context.tool_output_max_tokens
-
-    await wrapped.on_invoke_tool(
-        cast("Any", None),
-        json.dumps({"cmd": "echo hi", "max_output_tokens": ceiling * 100}),
-    )
-
-    assert json.loads(captured["raw_input"])["max_output_tokens"] == ceiling
+    assert json.loads(captured["raw_input"]) == {
+        "cmd": "source /tmp/env",
+        "shell": "bash",
+    }
 
 
 @pytest.mark.asyncio
@@ -78,33 +49,3 @@ async def test_wrap_exec_command_preserves_explicit_shell(shell: str) -> None:
     )
 
     assert json.loads(captured["raw_input"])["shell"] == shell
-
-
-@pytest.mark.asyncio
-async def test_responses_filesystem_custom_tool_output_is_bounded() -> None:
-    async def invoke(_ctx: Any, _inp: str) -> str:
-        return "line\n" * 50_000
-
-    toolset = SimpleNamespace(
-        read_file=CustomTool(name="read_file", description="read", on_invoke_tool=invoke)
-    )
-    factory._configure_filesystem_tools(toolset, chat_completions=False)
-
-    assert isinstance(toolset.read_file, CustomTool)
-    result = await toolset.read_file.on_invoke_tool(cast("Any", None), "{}")
-
-    assert "truncated" in result
-    assert len(result) < len("line\n" * 50_000)
-
-
-@pytest.mark.asyncio
-async def test_chat_completions_filesystem_custom_tool_becomes_function_tool() -> None:
-    async def invoke(_ctx: Any, _inp: str) -> str:
-        return "ok"
-
-    toolset = SimpleNamespace(
-        read_file=CustomTool(name="read_file", description="read", on_invoke_tool=invoke)
-    )
-    factory._configure_filesystem_tools(toolset, chat_completions=True)
-
-    assert isinstance(toolset.read_file, FunctionTool)

tests/test_auth_cli.py

@@ -1,106 +0,0 @@
-"""Tests for the `strix auth` CLI: subcommand routing and provider naming."""
-
-from __future__ import annotations
-
-from typing import TYPE_CHECKING, Any
-
-import pytest
-
-from strix.config import codex
-from strix.interface import auth_cli
-
-
-if TYPE_CHECKING:
-    from pathlib import Path
-
-
-@pytest.fixture(autouse=True)
-def _tmp_store(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(codex, "AUTH_PATH", tmp_path / "home" / ".strix" / "subscription-auth.json")
-
-
-def test_login_provider_is_chatgpt() -> None:
-    assert auth_cli.LOGIN_PROVIDER == "chatgpt"
-    assert codex.PROVIDER in auth_cli._ACCEPTED_PROVIDERS
-    assert "chatgpt" in auth_cli._ACCEPTED_PROVIDERS
-
-
-def test_unknown_subcommand_returns_usage_error() -> None:
-    assert auth_cli.run_auth(["bogus"]) == 2
-
-
-def test_help_returns_zero() -> None:
-    assert auth_cli.run_auth(["--help"]) == 0
-
-
-def test_status_not_signed_in() -> None:
-    assert auth_cli.run_auth(["status"]) == 1
-
-
-def test_login_rejects_unsupported_provider(monkeypatch: pytest.MonkeyPatch) -> None:
-    def _should_not_run(*_args: Any, **_kwargs: Any) -> dict[str, Any]:
-        msg = "OAuth flow must not start for an unsupported provider"
-        raise AssertionError(msg)
-
-    monkeypatch.setattr(auth_cli, "_run_oauth_flow", _should_not_run)
-    assert auth_cli.run_auth(["login", "gemini"]) == 2
-
-
-def test_finish_requires_state_on_loopback(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(codex, "exchange_code", lambda *_: {"ok": True})
-
-    # Loopback (require_state=True): missing or mismatched state is rejected.
-    with pytest.raises(codex.CodexAuthError) as missing:
-        auth_cli._finish("code", None, "verifier", "expected", require_state=True)
-    assert missing.value.code == "state_mismatch"
-    with pytest.raises(codex.CodexAuthError) as mismatch:
-        auth_cli._finish("code", "wrong", "verifier", "expected", require_state=True)
-    assert mismatch.value.code == "state_mismatch"
-
-    # Matching state proceeds to the exchange.
-    assert auth_cli._finish("code", "expected", "verifier", "expected", require_state=True) == {
-        "ok": True
-    }
-
-
-def test_finish_manual_paste_allows_absent_state(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setattr(codex, "exchange_code", lambda *_: {"ok": True})
-    # Manual paste (require_state=False): a bare code with no state is accepted,
-    # but a present-and-wrong state is still rejected.
-    assert auth_cli._finish("code", None, "verifier", "expected", require_state=False) == {
-        "ok": True
-    }
-    with pytest.raises(codex.CodexAuthError):
-        auth_cli._finish("code", "wrong", "verifier", "expected", require_state=False)
-
-
-def test_finish_rejects_missing_code() -> None:
-    with pytest.raises(codex.CodexAuthError) as exc:
-        auth_cli._finish(None, "expected", "verifier", "expected", require_state=True)
-    assert exc.value.code == "no_code"
-
-
-def test_model_subcommand_removed() -> None:
-    assert auth_cli.run_auth(["model", "gpt-5.5"]) == 2
-
-
-@pytest.mark.parametrize("provider", ["chatgpt", "codex", "ChatGPT"])
-def test_login_accepts_provider_aliases(provider: str, monkeypatch: pytest.MonkeyPatch) -> None:
-    reached = {"flow": False}
-
-    def _fake_flow(*_args: Any, **_kwargs: Any) -> dict[str, Any]:
-        reached["flow"] = True
-        return {
-            "type": "oauth",
-            "provider": "codex",
-            "access": "a",
-            "refresh": "r",
-            "account_id": "acct",
-            "expires_at": 0,
-        }
-
-    monkeypatch.setattr(auth_cli, "_run_oauth_flow", _fake_flow)
-    monkeypatch.setattr(codex, "save_record", lambda _record: None)
-
-    assert auth_cli.run_auth(["login", provider]) == 0
-    assert reached["flow"] is True

tests/test_codex_auth.py

@@ -1,294 +0,0 @@
-"""Tests for ChatGPT (Codex) subscription auth: PKCE, token handling, store."""
-
-from __future__ import annotations
-
-import base64
-import hashlib
-import json
-import time
-from typing import TYPE_CHECKING, Any
-
-import pytest
-
-from strix.config import codex
-
-
-if TYPE_CHECKING:
-    from pathlib import Path
-
-
-def _fake_jwt(account_id: str) -> str:
-    def seg(obj: dict[str, Any]) -> str:
-        return base64.urlsafe_b64encode(json.dumps(obj).encode()).rstrip(b"=").decode()
-
-    header = seg({"alg": "none"})
-    payload = seg({"https://api.openai.com/auth": {"chatgpt_account_id": account_id}})
-    return f"{header}.{payload}.sig"
-
-
-@pytest.fixture(autouse=True)
-def _tmp_store(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
-    path = tmp_path / "home" / ".strix" / "subscription-auth.json"
-    monkeypatch.setattr(codex, "AUTH_PATH", path)
-    return path
-
-
-def test_pkce_challenge_matches_verifier_and_is_unpadded() -> None:
-    verifier, challenge = codex.generate_pkce()
-    expected = (
-        base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
-    )
-    assert challenge == expected
-    assert "=" not in verifier
-    assert "=" not in challenge
-
-
-def test_authorize_url_carries_pkce_and_client() -> None:
-    url = codex.build_authorize_url("chal", "st8")
-    assert codex.AUTHORIZE_URL in url
-    assert "code_challenge=chal" in url
-    assert "code_challenge_method=S256" in url
-    assert f"client_id={codex.CLIENT_ID}" in url
-    assert "state=st8" in url
-
-
-@pytest.mark.parametrize(
-    ("value", "expected"),
-    [
-        ("http://localhost:1455/auth/callback?code=AAA&state=BBB", ("AAA", "BBB")),
-        ("AAA#BBB", ("AAA", "BBB")),
-        ("code=AAA&state=BBB", ("AAA", "BBB")),
-        ("AAA", ("AAA", None)),
-        ("", (None, None)),
-    ],
-)
-def test_parse_redirect_input(value: str, expected: tuple[str | None, str | None]) -> None:
-    assert codex.parse_redirect_input(value) == expected
-
-
-@pytest.mark.parametrize(
-    ("model", "expected"),
-    [
-        ("chatgpt/gpt-5.4", "gpt-5.4"),
-        ("ChatGPT/GPT-5.5", "GPT-5.5"),
-        ("  chatgpt/gpt-5.4  ", "gpt-5.4"),
-        ("openai/gpt-5.4", None),  # metered API path
-        ("anthropic/claude-opus-4-8", None),
-        ("gpt-5.4", None),
-        ("chatgpt/", None),
-        ("", None),
-        (None, None),
-    ],
-)
-def test_subscription_model(model: str | None, expected: str | None) -> None:
-    assert codex.subscription_model(model) == expected
-
-
-def test_auth_mode() -> None:
-    assert codex.auth_mode("chatgpt/gpt-5.4") == "subscription"
-    assert codex.auth_mode("openai/gpt-5.4") == "api_key"
-    assert codex.auth_mode("anthropic/claude-opus-4-8") == "api_key"
-    assert codex.auth_mode(None) == "api_key"
-
-
-def test_is_content_guardrail_error() -> None:
-    # The backend's real wording (from a live gpt-5.6-sol block).
-    raw = RuntimeError(
-        "This content was flagged for possible cybersecurity risk. If this seems "
-        "wrong, try rephrasing. To get authorized, join the Trusted Access for Cyber program."
-    )
-    assert codex.is_content_guardrail_error(raw) is True
-    # The already-typed error is recognized regardless of its message wording.
-    assert codex.is_content_guardrail_error(codex.CodexContentGuardrailError("gpt-5.6-sol")) is True
-    # Unrelated errors are not misclassified.
-    assert codex.is_content_guardrail_error(RuntimeError("rate limit exceeded")) is False
-
-
-def test_content_guardrail_error_message() -> None:
-    err = codex.CodexContentGuardrailError("gpt-5.6-sol")
-    assert err.model == "gpt-5.6-sol"
-    assert "gpt-5.6-sol" in str(err)
-    assert "STRIX_LLM" in str(err)
-
-
-def test_account_id_from_jwt() -> None:
-    assert codex._account_id_from_jwt(_fake_jwt("acct-42")) == "acct-42"
-    assert codex._account_id_from_jwt("not-a-jwt") is None
-    assert codex._account_id_from_jwt("") is None
-
-
-def test_store_roundtrip_and_logout() -> None:
-    assert codex.read_record() is None
-    assert codex.is_authenticated() is False
-
-    codex.save_record(
-        {
-            "type": "oauth",
-            "provider": "codex",
-            "access": _fake_jwt("acct-42"),
-            "refresh": "r1",
-            "account_id": "acct-42",
-            "expires_at": time.time() + 3600,
-        }
-    )
-    record = codex.read_record()
-    assert record is not None
-    assert record["account_id"] == "acct-42"
-    assert codex.is_authenticated() is True
-
-    codex.logout()
-    assert codex.read_record() is None
-    codex.logout()  # no-op when already gone
-
-
-def test_read_record_rejects_incomplete_records() -> None:
-    codex.save_record({"type": "oauth", "access": "a"})  # missing refresh/account
-    assert codex.read_record() is None
-    assert codex.is_authenticated() is False
-
-
-def test_get_valid_token_returns_stored_when_fresh(monkeypatch: pytest.MonkeyPatch) -> None:
-    def _boom(_payload: dict[str, str]) -> dict[str, Any]:
-        msg = "should not refresh a fresh token"
-        raise AssertionError(msg)
-
-    monkeypatch.setattr(codex, "_post_form", _boom)
-    codex.save_record(
-        {
-            "type": "oauth",
-            "provider": "codex",
-            "access": "access-fresh",
-            "refresh": "r1",
-            "account_id": "acct-42",
-            "expires_at": time.time() + 3600,
-        }
-    )
-    assert codex.get_valid_token() == ("access-fresh", "acct-42")
-
-
-def test_get_valid_token_refreshes_and_persists_rotation(monkeypatch: pytest.MonkeyPatch) -> None:
-    calls = {"n": 0}
-
-    def _fake_post(payload: dict[str, str]) -> dict[str, Any]:
-        calls["n"] += 1
-        assert payload["grant_type"] == "refresh_token"
-        assert payload["refresh_token"] == "r1"
-        return {"access_token": _fake_jwt("acct-42"), "refresh_token": "r2", "expires_in": 3600}
-
-    monkeypatch.setattr(codex, "_post_form", _fake_post)
-    codex.save_record(
-        {
-            "type": "oauth",
-            "provider": "codex",
-            "access": "stale",
-            "refresh": "r1",
-            "account_id": "acct-42",
-            "expires_at": time.time() - 10,  # already expired
-        }
-    )
-    _access, account_id = codex.get_valid_token()
-    assert calls["n"] == 1
-    assert account_id == "acct-42"
-    # Rotated refresh token was written back to the store.
-    record = codex.read_record()
-    assert record is not None
-    assert record["refresh"] == "r2"
-
-
-def test_get_valid_token_uses_token_rotated_by_another_process(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    # Simulate a parallel Strix process rotating the token while we wait for the
-    # refresh guard: the pre-guard read sees the stale token, the in-guard read
-    # sees the winner's fresh one, so we must NOT exchange the now-dead refresh.
-    records = [
-        {
-            "type": "oauth",
-            "provider": "codex",
-            "access": "stale",
-            "refresh": "r1",
-            "account_id": "acct",
-            "expires_at": time.time() - 10,
-        },
-        {
-            "type": "oauth",
-            "provider": "codex",
-            "access": "fresh-from-other-process",
-            "refresh": "r2",
-            "account_id": "acct",
-            "expires_at": time.time() + 3600,
-        },
-    ]
-    calls = {"n": 0}
-
-    def _fake_read() -> dict[str, Any]:
-        record = records[min(calls["n"], len(records) - 1)]
-        calls["n"] += 1
-        return record
-
-    def _boom(_payload: dict[str, str]) -> dict[str, Any]:
-        msg = "must not refresh a token another process already rotated"
-        raise AssertionError(msg)
-
-    monkeypatch.setattr(codex, "read_record", _fake_read)
-    monkeypatch.setattr(codex, "_post_form", _boom)
-
-    access, account_id = codex.get_valid_token()
-    assert access == "fresh-from-other-process"
-    assert account_id == "acct"
-
-
-def _expired_record(refresh: str, access: str) -> dict[str, Any]:
-    return {
-        "type": "oauth",
-        "provider": "codex",
-        "access": access,
-        "refresh": refresh,
-        "account_id": "acct-42",
-        "expires_at": time.time() - 10,
-    }
-
-
-def test_get_valid_token_recovers_when_refresh_loses_race(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    # Lock failed open: our in-guard read still saw the stale token, so we tried to
-    # refresh and lost the race (invalid_grant). By then a peer has saved a fresh
-    # token — recover from it instead of failing the scan on the dead one.
-    codex.save_record(_expired_record("r1", "stale"))
-
-    def _fake_post(_payload: dict[str, str]) -> dict[str, Any]:
-        codex.save_record(
-            {
-                "type": "oauth",
-                "provider": "codex",
-                "access": "fresh-from-peer",
-                "refresh": "r2",
-                "account_id": "acct-42",
-                "expires_at": time.time() + 3600,
-            }
-        )
-        raise codex.CodexAuthError("token_http_error", "HTTP 400: invalid_grant")
-
-    monkeypatch.setattr(codex, "_post_form", _fake_post)
-    assert codex.get_valid_token() == ("fresh-from-peer", "acct-42")
-
-
-def test_get_valid_token_reraises_refresh_error_without_rotation(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    # Refresh fails and no peer rotated the token: surface the error, don't mask it.
-    codex.save_record(_expired_record("r1", "stale"))
-
-    def _fake_post(_payload: dict[str, str]) -> dict[str, Any]:
-        raise codex.CodexAuthError("token_http_error", "HTTP 400: invalid_grant")
-
-    monkeypatch.setattr(codex, "_post_form", _fake_post)
-    with pytest.raises(codex.CodexAuthError):
-        codex.get_valid_token()
-
-
-def test_get_valid_token_raises_when_not_signed_in() -> None:
-    with pytest.raises(codex.CodexAuthError) as exc:
-        codex.get_valid_token()
-    assert exc.value.code == "not_authenticated"

tests/test_codex_streaming.py

@@ -1,225 +0,0 @@
-"""Regression test for the ChatGPT Codex backend's streaming requirement.
-
-The backend rejects non-streamed requests with ``{"detail": "Stream must be set
-to true"}``. ``_CodexResponsesModel`` must therefore issue a streamed request
-even from the non-streaming ``get_response`` path and aggregate the events into
-a single response. A local server that mimics that behaviour proves the wrapper
-works where the stock responses model would fail.
-"""
-
-from __future__ import annotations
-
-import json
-import threading
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from typing import TYPE_CHECKING, Any
-
-import pytest
-from agents.model_settings import ModelSettings
-from agents.models.interface import ModelTracing
-from agents.models.openai_responses import OpenAIResponsesModel
-from openai import AsyncOpenAI, BadRequestError
-from openai.types.responses import ResponseOutputMessage, ResponseOutputText
-
-from strix.config import codex
-from strix.config.models import _CodexResponsesModel
-
-
-if TYPE_CHECKING:
-    from collections.abc import AsyncIterator, Iterator
-
-
-def _response_payload() -> dict[str, Any]:
-    return {
-        "id": "resp_1",
-        "object": "response",
-        "created_at": 0,
-        "status": "completed",
-        "model": "gpt-5.5",
-        "output": [
-            {
-                "type": "message",
-                "id": "m1",
-                "status": "completed",
-                "role": "assistant",
-                "content": [{"type": "output_text", "text": "OK", "annotations": []}],
-            }
-        ],
-        "usage": {
-            "input_tokens": 1,
-            "output_tokens": 1,
-            "total_tokens": 2,
-            "input_tokens_details": {"cached_tokens": 0},
-            "output_tokens_details": {"reasoning_tokens": 0},
-        },
-        "parallel_tool_calls": False,
-        "tool_choice": "auto",
-        "tools": [],
-        "metadata": {},
-        "temperature": 1.0,
-        "top_p": 1.0,
-        "error": None,
-        "incomplete_details": None,
-        "instructions": None,
-        "max_output_tokens": None,
-    }
-
-
-_CAPTURED: dict[str, Any] = {}
-
-
-class _Handler(BaseHTTPRequestHandler):
-    def log_message(self, *args: Any) -> None:
-        pass
-
-    def do_POST(self) -> None:
-        length = int(self.headers.get("Content-Length", 0))
-        body = json.loads(self.rfile.read(length) or b"{}")
-        _CAPTURED.clear()
-        _CAPTURED.update(body)
-        if not body.get("stream"):
-            payload = json.dumps({"detail": "Stream must be set to true"}).encode()
-            self.send_response(400)
-            self.send_header("Content-Type", "application/json")
-            self.send_header("Content-Length", str(len(payload)))
-            self.end_headers()
-            self.wfile.write(payload)
-            return
-        event = {
-            "type": "response.completed",
-            "sequence_number": 0,
-            "response": _response_payload(),
-        }
-        frame = f"event: response.completed\ndata: {json.dumps(event)}\n\n".encode()
-        self.send_response(200)
-        self.send_header("Content-Type", "text/event-stream")
-        self.end_headers()
-        self.wfile.write(frame)
-
-
-@pytest.fixture
-def backend_url() -> Iterator[str]:
-    server = HTTPServer(("127.0.0.1", 0), _Handler)
-    thread = threading.Thread(target=server.serve_forever, daemon=True)
-    thread.start()
-    try:
-        yield f"http://127.0.0.1:{server.server_address[1]}/backend-api/codex"
-    finally:
-        server.shutdown()
-        server.server_close()
-
-
-def _client(base_url: str) -> AsyncOpenAI:
-    return AsyncOpenAI(api_key="tok", base_url=base_url)
-
-
-def _call_kwargs() -> dict[str, Any]:
-    return {
-        "system_instructions": "s",
-        "input": "hi",
-        "model_settings": ModelSettings(
-            store=False, response_include=["reasoning.encrypted_content"]
-        ),
-        "tools": [],
-        "output_schema": None,
-        "handoffs": [],
-        "tracing": ModelTracing.DISABLED,
-        "previous_response_id": None,
-        "conversation_id": None,
-        "prompt": None,
-    }
-
-
-@pytest.mark.asyncio
-async def test_stock_model_fails_on_non_streamed_backend(backend_url: str) -> None:
-    model = OpenAIResponsesModel(model="gpt-5.5", openai_client=_client(backend_url))
-    with pytest.raises(BadRequestError, match="Stream must be set to true"):
-        await model.get_response(**_call_kwargs())
-
-
-@pytest.mark.asyncio
-async def test_codex_model_streams_and_aggregates(backend_url: str) -> None:
-    model = _CodexResponsesModel(model="gpt-5.5", openai_client=_client(backend_url))
-    response = await model.get_response(**_call_kwargs())
-    message = response.output[0]
-    assert isinstance(message, ResponseOutputMessage)
-    text = message.content[0]
-    assert isinstance(text, ResponseOutputText)
-    assert text.text == "OK"
-    assert response.usage.total_tokens == 2
-
-
-class _TrackingStream:
-    """An async iterator that yields, then raises, and records if it was closed."""
-
-    def __init__(self, events: list[Any], error: Exception | None) -> None:
-        self._events = iter(events)
-        self._error = error
-        self.closed = False
-
-    def __aiter__(self) -> _TrackingStream:
-        return self
-
-    async def __anext__(self) -> Any:
-        try:
-            return next(self._events)
-        except StopIteration:
-            if self._error is not None:
-                raise self._error from None
-            raise StopAsyncIteration from None
-
-    async def aclose(self) -> None:
-        self.closed = True
-
-
-async def _drain(gen: AsyncIterator[Any]) -> list[Any]:
-    return [event async for event in gen]
-
-
-@pytest.mark.asyncio
-async def test_guarded_converts_guardrail_error() -> None:
-    # A mid-stream backend rejection becomes a typed, model-tagged error.
-    model = _CodexResponsesModel(model="gpt-5.6-sol", openai_client=_client("http://x/backend-api"))
-    guardrail = RuntimeError("This content was flagged for possible cybersecurity risk.")
-    stream = _TrackingStream(["a", "b"], guardrail)
-    with pytest.raises(codex.CodexContentGuardrailError) as exc_info:
-        await _drain(model._guarded(stream))
-    assert exc_info.value.model == "gpt-5.6-sol"
-    assert stream.closed is True  # underlying stream is released
-
-
-@pytest.mark.asyncio
-async def test_guarded_passes_through_other_errors() -> None:
-    # A non-guardrail error propagates unchanged (still not swallowed).
-    model = _CodexResponsesModel(model="gpt-5.5", openai_client=_client("http://x/backend-api"))
-    boom = RuntimeError("some unrelated failure")
-    stream = _TrackingStream(["a"], boom)
-    with pytest.raises(RuntimeError, match="some unrelated failure"):
-        await _drain(model._guarded(stream))
-    assert stream.closed is True
-
-
-@pytest.mark.asyncio
-async def test_guarded_yields_all_events_when_clean() -> None:
-    model = _CodexResponsesModel(model="gpt-5.4", openai_client=_client("http://x/backend-api"))
-    stream = _TrackingStream(["a", "b", "c"], None)
-    assert await _drain(model._guarded(stream)) == ["a", "b", "c"]
-    assert stream.closed is True
-
-
-@pytest.mark.asyncio
-async def test_codex_model_self_enforces_backend_requirements(backend_url: str) -> None:
-    # The caller passes ordinary settings; the model must impose the backend's
-    # requirements (stream, store=false, encrypted reasoning) and the configured
-    # reasoning effort itself.
-    model = _CodexResponsesModel(
-        model="gpt-5.4", openai_client=_client(backend_url), reasoning_effort="high"
-    )
-    kwargs = _call_kwargs()
-    kwargs["model_settings"] = ModelSettings()  # nothing special from the caller
-    await model.get_response(**kwargs)
-
-    assert _CAPTURED["stream"] is True
-    assert _CAPTURED["store"] is False
-    assert _CAPTURED["include"] == ["reasoning.encrypted_content"]
-    assert _CAPTURED["reasoning"] == {"effort": "high"}

tests/test_config_loader.py

@@ -6,11 +6,10 @@ import json
 from typing import TYPE_CHECKING
 
 import pytest
-from pydantic import AliasChoices, Field, ValidationError
+from pydantic import AliasChoices, Field
 from pydantic.fields import FieldInfo
 
 from strix.config import loader
-from strix.config.settings import ContextSettings
 
 
 if TYPE_CHECKING:
@@ -121,15 +120,6 @@ def test_read_json_overrides_uses_json_when_no_alias_in_environ(tmp_path: Path)
     assert loader._read_json_overrides(path) == {"llm": {"api_key": "sk-file"}}
 
 
-def test_tool_output_max_bytes_rejects_sub_notice_values() -> None:
-    with pytest.raises(ValidationError):
-        ContextSettings(STRIX_TOOL_OUTPUT_MAX_BYTES=64)
-
-
-def test_tool_output_max_bytes_accepts_floor() -> None:
-    assert ContextSettings(STRIX_TOOL_OUTPUT_MAX_BYTES=1024).tool_output_max_bytes == 1024
-
-
 # --------------------------------------------------------------------------- #
 # _aliases_for
 # --------------------------------------------------------------------------- #

tests/test_dedupe_model.py

@@ -1,94 +0,0 @@
-"""Tests for the dedicated deduplication model configuration."""
-
-from __future__ import annotations
-
-import json
-from typing import TYPE_CHECKING
-
-from strix.config import loader
-from strix.config.settings import DedupeSettings
-from strix.report.dedupe import _dedupe_model_settings
-
-
-if TYPE_CHECKING:
-    from pathlib import Path
-
-    import pytest
-
-
-def test_dedupe_key_sent_per_call_not_via_global_env() -> None:
-    dedupe = DedupeSettings(STRIX_DEDUPE_MODEL="deepseek/cheap", DEDUPE_LLM_API_KEY="dedupe-key")
-    settings = _dedupe_model_settings(dedupe, "deepseek/cheap", 300)
-    # The key rides on the request, so a shared-provider main key can't clobber
-    # it (and vice versa) through the global provider env var.
-    assert (settings.extra_args or {})["api_key"] == "dedupe-key"
-
-
-def test_dedupe_settings_omit_api_key_when_unset() -> None:
-    dedupe = DedupeSettings(STRIX_DEDUPE_MODEL="deepseek/cheap")
-    settings = _dedupe_model_settings(dedupe, "deepseek/cheap", 300)
-    assert "api_key" not in (settings.extra_args or {})
-    assert "api_base" not in (settings.extra_args or {})
-
-
-def test_dedupe_endpoint_sent_per_call() -> None:
-    dedupe = DedupeSettings(
-        STRIX_DEDUPE_MODEL="openai/cheap",
-        DEDUPE_LLM_API_KEY="dedupe-key",
-        DEDUPE_LLM_API_BASE="https://dedupe.example/v1",
-    )
-    settings = _dedupe_model_settings(dedupe, "openai/cheap", 300)
-    # A distinct dedupe endpoint rides on the request instead of the
-    # process-wide base URL, so it can't clobber the main model's endpoint.
-    assert (settings.extra_args or {})["api_base"] == "https://dedupe.example/v1"
-    assert (settings.extra_args or {})["api_key"] == "dedupe-key"
-
-
-def test_dedupe_defaults_are_empty() -> None:
-    settings = DedupeSettings()
-    assert settings.model is None
-    assert settings.reasoning_effort is None
-    assert settings.api_key is None
-
-
-def test_dedupe_model_read_from_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_DEDUPE_MODEL", "deepseek/deepseek-v4-flash")
-    monkeypatch.setenv("STRIX_DEDUPE_REASONING_EFFORT", "low")
-
-    settings = DedupeSettings()
-
-    assert settings.model == "deepseek/deepseek-v4-flash"
-    assert settings.reasoning_effort == "low"
-
-
-def test_config_file_loads_dedupe_model(
-    tmp_path: Path,
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    for key in ("STRIX_LLM", "STRIX_DEDUPE_MODEL", "STRIX_DEDUPE_REASONING_EFFORT"):
-        monkeypatch.delenv(key, raising=False)
-    path = tmp_path / "config.json"
-    path.write_text(
-        json.dumps(
-            {
-                "env": {
-                    "STRIX_LLM": "openai/root",
-                    "STRIX_DEDUPE_MODEL": "deepseek/cheap",
-                    "STRIX_DEDUPE_REASONING_EFFORT": "minimal",
-                }
-            }
-        ),
-        encoding="utf-8",
-    )
-    loader._cached = None
-    loader._override = path
-    try:
-        settings = loader.load_settings()
-    finally:
-        loader._cached = None
-        loader._override = None
-
-    assert settings.dedupe.model == "deepseek/cheap"
-    assert settings.dedupe.reasoning_effort == "minimal"
-    # Main model stays independent of the dedupe override.
-    assert settings.llm.model == "openai/root"

tests/test_fenced_code.py

@@ -1,78 +0,0 @@
-"""Tests for stripping the markdown code fence off stored code fields."""
-
-from __future__ import annotations
-
-from pygments.lexers import BashLexer, PythonLexer
-
-from strix.report.writer import (
-    guess_language_name,
-    parse_fenced_code,
-    resolve_lexer,
-    safe_fence,
-)
-from strix.viewer.report_pdf import _strip_code_fence
-
-
-def test_parse_fenced_code_extracts_language_and_body() -> None:
-    language, code = parse_fenced_code("```python\nimport requests\nprint(1)\n```")
-    assert language == "python"
-    assert code == "import requests\nprint(1)"
-
-
-def test_parse_fenced_code_uses_first_token_of_info_string() -> None:
-    language, code = parse_fenced_code("```python title=app.py\nx = 1\n```")
-    assert language == "python"
-    assert code == "x = 1"
-
-
-def test_parse_fenced_code_handles_non_python_language() -> None:
-    language, code = parse_fenced_code("```http\nGET / HTTP/1.1\n```")
-    assert language == "http"
-    assert code == "GET / HTTP/1.1"
-
-
-def test_parse_fenced_code_passes_through_unfenced() -> None:
-    language, code = parse_fenced_code("import requests\nprint(1)")
-    assert language is None
-    assert code == "import requests\nprint(1)"
-
-
-def test_parse_fenced_code_fence_without_language() -> None:
-    language, code = parse_fenced_code("```\nplain\n```")
-    assert language is None
-    assert code == "plain"
-
-
-def test_strip_code_fence_removes_fence() -> None:
-    assert _strip_code_fence("```python\nx = 1\n```") == "x = 1"
-
-
-def test_strip_code_fence_passes_through_non_string_and_unfenced() -> None:
-    assert _strip_code_fence(None) is None
-    assert _strip_code_fence("x = 1") == "x = 1"
-
-
-def test_resolve_lexer_honors_explicit_language() -> None:
-    assert isinstance(resolve_lexer("bash", "echo hi"), BashLexer)
-
-
-def test_resolve_lexer_falls_back_to_python_when_unresolvable() -> None:
-    # Unknown language name and empty body -> nothing to auto-detect -> Python.
-    assert isinstance(resolve_lexer("not-a-language", ""), PythonLexer)
-
-
-def test_guess_language_name_defaults_to_python_when_inconclusive() -> None:
-    assert guess_language_name("") == "python"
-
-
-def test_parse_fenced_code_handles_crlf() -> None:
-    language, code = parse_fenced_code("```python\r\nx = 1\r\n```")
-    assert language == "python"
-    assert code == "x = 1"
-
-
-def test_safe_fence_widens_past_embedded_backticks() -> None:
-    # A PoC body containing a ``` run must be wrapped in a longer fence so it
-    # can't terminate the block early.
-    assert safe_fence("plain code") == "```"
-    assert safe_fence("has ```\nfence inside") == "````"

tests/test_local_dir_staging.py

@@ -106,38 +106,3 @@ def test_nested_symlinks_inside_linked_dir(tmp_path: Path) -> None:
     assert (staged / "pkg" / "shared_link" / "conf.json").read_text() == "{}\n"
     assert not (staged / "pkg" / "shared_link" / "escape").exists()
     assert not (staged / "shared" / "escape").exists()
-
-
-def test_staged_path_has_no_symlink_ancestor(tmp_path: Path, monkeypatch) -> None:  # noqa: ANN001
-    """The staging directory itself must never sit behind a symlink.
-
-    ``tempfile.mkdtemp()`` honors ``$TMPDIR``, and on macOS the default
-    ``$TMPDIR`` resolves through ``/var``, which is itself a symlink to
-    ``/private/var``. ``LocalDir`` rejects any symlink component in its
-    source path, so returning the raw ``mkdtemp()`` result breaks every
-    local-dir upload on macOS whenever the source tree contains a symlink.
-    This reproduces that shape without depending on the host OS layout.
-    """
-    repo = _make_repo(tmp_path)
-    (repo / "link.py").symlink_to(repo / "pkg" / "mod.py")
-
-    real_tmp_root = tmp_path / "real_tmp"
-    real_tmp_root.mkdir()
-    symlinked_tmp_root = tmp_path / "tmp_symlink"
-    symlinked_tmp_root.symlink_to(real_tmp_root)
-
-    def fake_mkdtemp(prefix: str = "") -> str:
-        real_dir = real_tmp_root / f"{prefix}fake"
-        real_dir.mkdir()
-        return str(symlinked_tmp_root / real_dir.name)
-
-    monkeypatch.setattr(
-        "strix.runtime.local_dir_staging.tempfile.mkdtemp", fake_mkdtemp
-    )
-
-    upload_path, staged = stage_symlink_safe_dir(repo)
-
-    assert staged is not None
-    assert upload_path == staged
-    for path in (staged, *staged.parents):
-        assert not path.is_symlink(), f"staged path has a symlink ancestor: {path}"

tests/test_model_retry.py

@@ -13,15 +13,12 @@ import asyncio
 
 from agents.retry import ModelRetryNormalizedError, RetryPolicyContext
 
-from strix.config import codex
 from strix.config.models import DEFAULT_MODEL_RETRY, _retry_statusless_provider_errors
 
 
-def _context(
-    normalized: ModelRetryNormalizedError, error: Exception | None = None
-) -> RetryPolicyContext:
+def _context(normalized: ModelRetryNormalizedError) -> RetryPolicyContext:
     return RetryPolicyContext(
-        error=error or RuntimeError("boom"),
+        error=RuntimeError("boom"),
         attempt=1,
         max_retries=5,
         stream=True,
@@ -30,11 +27,11 @@ def _context(
     )
 
 
-def _retries(normalized: ModelRetryNormalizedError, error: Exception | None = None) -> bool:
+def _retries(normalized: ModelRetryNormalizedError) -> bool:
     """Evaluate the composed DEFAULT_MODEL_RETRY policy for a normalized error."""
     policy = DEFAULT_MODEL_RETRY.policy
     assert policy is not None
-    decision = asyncio.run(policy(_context(normalized, error)))
+    decision = asyncio.run(policy(_context(normalized)))
     return bool(getattr(decision, "retry", decision))
 
 
@@ -66,16 +63,6 @@ def test_timeout_error_is_retried() -> None:
     assert _retries(ModelRetryNormalizedError(is_network_error=True)) is True
 
 
-def test_content_guardrail_error_is_not_retried() -> None:
-    # A guardrail block is status-less, so it would match the statusless policy;
-    # the guard must keep it from being retried (retrying never clears it).
-    guardrail = codex.CodexContentGuardrailError("gpt-5.6-sol")
-    assert _retries(ModelRetryNormalizedError(status_code=None), guardrail) is False
-    # A raw provider error carrying the backend's wording is excluded too.
-    raw = RuntimeError("This content was flagged for possible cybersecurity risk.")
-    assert _retries(ModelRetryNormalizedError(status_code=None), raw) is False
-
-
 def test_policy_helper_matches_statusless_only() -> None:
     assert _retry_statusless_provider_errors(_context(ModelRetryNormalizedError())) is True
     assert (

tests/test_models.py

@@ -42,11 +42,9 @@ def test_recommended_models_are_matched_case_insensitively() -> None:
     "model_name",
     [
         "gpt-5.5",
-        "chatgpt/gpt-5.4",
         "litellm/openai/gpt-5.4-pro",
         "azure_ai/gpt-5.5-pro",
         "bedrock_mantle/openai.gpt-5.5",
-        "anthropic/claude-opus-5",
         "anthropic/claude-opus-4-8",
         "anthropic.claude-opus-4-8",
         "anthropic/claude-opus-4-7",
@@ -62,10 +60,8 @@ def test_recommended_models_are_matched_case_insensitively() -> None:
         "deepseek/deepseek-reasoner",
         "dashscope/qwen3-max-2026-01-23",
         "qwen3.7-max",
-        "dashscope/qwen3.8-max",
         "moonshot/kimi-k2.6",
         "kimi-k2.7-code",
-        "moonshot/kimi-k3",
     ],
 )
 def test_frontier_model_families_are_accepted(model_name: str) -> None:

tests/test_output_store.py

@@ -1,60 +0,0 @@
-"""Tests for per-tool-output bounding."""
-
-from __future__ import annotations
-
-import re
-
-from strix.tools.output_store import bound_text
-
-
-def test_small_output_passes_through_unchanged() -> None:
-    text = "line 1\nline 2\nline 3"
-    assert bound_text(text, max_lines=100, max_bytes=10_000) == text
-
-
-def test_line_limit_keeps_head_and_tail() -> None:
-    text = "\n".join(str(i) for i in range(1000))
-    bounded = bound_text(text, max_lines=10, max_bytes=1_000_000)
-
-    assert bounded.startswith("0\n1\n2\n3\n4")
-    assert bounded.rstrip().endswith("999")
-    assert "truncated" in bounded
-    assert len(bounded.splitlines()) < 30
-
-
-def test_byte_limit_enforced_on_single_long_line() -> None:
-    text = "x" * 100_000
-    bounded = bound_text(text, max_lines=2_000, max_bytes=1_000)
-
-    assert "truncated" in bounded
-    assert len(bounded.encode("utf-8")) <= 1_000
-
-
-def test_multibyte_characters_not_split() -> None:
-    text = "😀" * 50_000
-    bounded = bound_text(text, max_lines=2_000, max_bytes=1_000)
-
-    # Must remain valid UTF-8 (no mid-character cut).
-    assert bounded == bounded.encode("utf-8").decode("utf-8")
-    assert "truncated" in bounded
-
-
-def test_notice_reports_dropped_counts() -> None:
-    text = "\n".join("y" * 10 for _ in range(500))
-    bounded = bound_text(text, max_lines=10, max_bytes=1_000_000)
-
-    assert "lines" in bounded
-    assert "bytes" in bounded
-
-
-def test_dropped_line_count_accounts_for_byte_trimming() -> None:
-    # Tight byte budget drops whole lines from head/tail; the notice must count them.
-    text = "\n".join(f"line-{i}" for i in range(200))
-    bounded = bound_text(text, max_lines=20, max_bytes=40)
-
-    match = re.search(r"\[\.\.\. (\d+) lines", bounded)
-    assert match is not None, bounded
-    dropped = int(match.group(1))
-    kept = [ln for ln in bounded.splitlines() if ln and "truncated" not in ln]
-    assert dropped == 200 - len(kept)
-    assert dropped > 200 - 20

tests/test_report_writer.py

@@ -119,11 +119,9 @@ def test_render_vulnerability_md_poc_code_cannot_break_out_of_fence() -> None:
     injected = "curl x\n```\n\n## Injected Heading\n![x](https://evil.example/beacon.png)"
     md = render_vulnerability_md(_sample_report(poc_script_code=injected))
     lines = md.split("\n")
-    opening = next(ln for ln in lines[lines.index("## Proof of Concept") + 1 :] if ln.strip())
-    ticks = opening[: len(opening) - len(opening.lstrip("`"))]
-    assert len(ticks) >= 4  # wider than the payload's 3-backtick run
-    assert "`" not in opening.removeprefix(ticks)  # backtick run + language tag only
-    assert f"\n{ticks}\n" in md  # pure-backtick closing fence of the same width
+    fence = next(ln for ln in lines[lines.index("## Proof of Concept") + 1 :] if ln.strip())
+    assert set(fence) == {"`"}
+    assert len(fence) >= 4  # wider than the payload's 3-backtick run
     assert injected in md  # the payload survives verbatim, inside the fence
 
 

tests/test_runner_root_prompt.py

@@ -46,8 +46,7 @@ def _patch_engine_scaffold(
             reasoning_effort="high",
             force_required_tool_choice=False,
             timeout=300,
-        ),
-        runtime=types.SimpleNamespace(max_context_images=3),
+        )
     )
     monkeypatch.setattr(runner, "load_settings", lambda: settings)
     monkeypatch.setattr(runner, "configure_sdk_model_defaults", lambda _settings: None)

tests/test_usage_subscription.py

@@ -1,46 +0,0 @@
-"""Subscription runs track tokens but report zero cost."""
-
-from __future__ import annotations
-
-from agents.usage import Usage
-
-from strix.report.usage import LLMUsageLedger
-
-
-def _usage() -> Usage:
-    usage = Usage()
-    usage.requests = 1
-    usage.input_tokens = 1000
-    usage.output_tokens = 200
-    usage.total_tokens = 1200
-    return usage
-
-
-def test_zero_cost_ledger_keeps_tokens_but_reports_no_cost() -> None:
-    ledger = LLMUsageLedger()
-    ledger.zero_cost = True
-    ledger.record(agent_id="a", usage=_usage(), agent_name="strix", model="gpt-5.5")
-
-    record = ledger.to_record()
-    assert record["cost"] == 0.0
-    assert record["total_tokens"] == 1200
-    assert record["input_tokens"] == 1000
-    assert record["output_tokens"] == 200
-    assert ledger.total_cost == 0.0
-
-
-def test_zero_cost_ledger_ignores_observed_cost() -> None:
-    ledger = LLMUsageLedger()
-    ledger.zero_cost = True
-    ledger.record_observed_cost(4.20)
-    assert ledger.total_cost == 0.0
-
-
-def test_normal_ledger_still_estimates_cost() -> None:
-    # Sanity check the flag is opt-in: without it, an OpenAI-native model still
-    # accrues an estimated cost (proves zeroing is what suppresses it).
-    ledger = LLMUsageLedger()
-    ledger.record(agent_id="a", usage=_usage(), agent_name="strix", model="gpt-5.5")
-    assert ledger.to_record()["total_tokens"] == 1200
-    # Cost estimation depends on litellm's cost map; it should be >= 0 and not error.
-    assert ledger.total_cost >= 0.0

uv.lock

@@ -2340,11 +2340,11 @@ wheels = [
 
 [[package]]
 name = "setuptools"
-version = "83.0.0"
+version = "82.0.1"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/34/26/f5d29e25ffdb535afef2d35cdb55b325298f96debd670da4c325e08d70f4/setuptools-83.0.0.tar.gz", hash = "sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef", size = 1154254, upload-time = "2026-07-04T15:31:22.699Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4f/db/cfac1baf10650ab4d1c111714410d2fbb77ac5a616db26775db562c8fab2/setuptools-82.0.1.tar.gz", hash = "sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9", size = 1152316, upload-time = "2026-03-09T12:47:17.221Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5d/40/e1e72872c6354b306daef1703549e8e83b4d43cfea356311bf722a043752/setuptools-83.0.0-py3-none-any.whl", hash = "sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3", size = 1008090, upload-time = "2026-07-04T15:31:20.885Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/76/f789f7a86709c6b087c5a2f52f911838cad707cc613162401badc665acfe/setuptools-82.0.1-py3-none-any.whl", hash = "sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb", size = 1006223, upload-time = "2026-03-09T12:47:15.026Z" },
 ]
 
 [[package]]