fix(update): never show update prompt/notice in non-interactive runs

An httpx.Timeout in ModelSettings.extra_args crashes
ModelSettings.to_json_dict() (PydanticSerializationError) on the Chat
Completions and LiteLLM model paths, which serialize settings for their
tracing generation span — failing every model turn on those paths. Pass
the timeout as a plain float, which httpx-based clients apply as the
read (inactivity) timeout.

containers/Dockerfile

@@ -24,6 +24,7 @@ RUN apt-get update && \
     python3 python3-pip python3-dev python3-venv python3-setuptools \
     golang-go \
     net-tools dnsutils whois \
+    file xxd \
     jq parallel ripgrep grep \
     less man-db procps htop \
     iproute2 iputils-ping netcat-traditional \
@@ -192,6 +193,8 @@ RUN mkdir -p /workspace && chown -R pentester:pentester /workspace /app
 USER pentester
 RUN python3 -m venv /app/.venv && \
     /app/.venv/bin/pip install --no-cache-dir caido-sdk-client && \
+    /app/.venv/bin/pip install --no-cache-dir \
+        requests httpx beautifulsoup4 lxml pyjwt cryptography && \
     /app/.venv/bin/pip install --no-cache-dir -r /home/pentester/tools/jwt_tool/requirements.txt && \
     printf '%s\n' \
         '#!/bin/bash' \

containers/docker-entrypoint.sh

@@ -91,10 +91,13 @@ http_proxy=http://127.0.0.1:${CAIDO_PORT}
 https_proxy=http://127.0.0.1:${CAIDO_PORT}
 EOF
 
-echo "source /etc/profile.d/proxy.sh" >> ~/.bashrc
-echo "source /etc/profile.d/proxy.sh" >> ~/.zshrc
+# Use POSIX `.` (not the bashism `source`) so these lines are safe when the rc
+# files are read by a POSIX shell (e.g. `sh -lc`), which otherwise fails with
+# "source: not found". `.` is understood by bash, zsh, and dash alike.
+echo ". /etc/profile.d/proxy.sh" >> ~/.bashrc
+echo ". /etc/profile.d/proxy.sh" >> ~/.zshrc
 
-source /etc/profile.d/proxy.sh
+. /etc/profile.d/proxy.sh
 
 echo "✅ System-wide proxy configuration complete"
 

strix/agents/prompts/system_prompt.jinja

@@ -169,8 +169,23 @@ EFFICIENCY TACTICS:
 - Run multiple scans in parallel when possible
 - Load the most relevant skill before starting a specialized testing workflow if doing so will improve accuracy, speed, or tool usage
 - Use `exec_command` for Python code: write reusable scripts to a file and
-  run them with `python3`. For one-off snippets, `python3 -c` or a
-  here-document is acceptable.
+  run them with `python3 script.py`. For one-off snippets, `python3 -c` or a
+  here-document is acceptable, but avoid deeply nested quotes/parentheses — if
+  a snippet needs complex quoting or is more than a few lines, write it to a
+  file first to prevent syntax errors.
+- Before importing a third-party Python library, make sure it is installed. The
+  sandbox's `python3` runs inside a preconfigured virtualenv that ships
+  `requests`, `httpx`, `beautifulsoup4` (bs4), `lxml`, `pyjwt`, and
+  `cryptography`; for anything else prefer the stdlib or run `pip install <pkg>`
+  (it installs into that active venv) before importing, rather than letting the
+  script fail with `ModuleNotFoundError`.
+- `exec_command` runs each command in a fresh non-interactive shell (plain
+  pipes, no TTY). To drive an interactive or long-running process with
+  `write_stdin` — REPLs, `ssh`/`nc`/`ftp`, `msfconsole`, or to send Ctrl-C —
+  you MUST start it with `exec_command(cmd="...", tty=true)` and then
+  `write_stdin(session_id=<id>, chars="...")`. Calling `write_stdin` on a
+  default (non-TTY) command or on a process that has already exited fails with
+  "stdin is not available".
 - For Caido proxy automation inside Python, explicitly import from
   `caido_api`:
   `from caido_api import list_requests, view_request, repeat_request, list_sitemap, view_sitemap_entry, scope_rules`
@@ -186,7 +201,7 @@ EFFICIENCY TACTICS:
 VALIDATION REQUIREMENTS:
 - Full validation required - no assumptions
 - Demonstrate concrete impact with evidence
-- Consider business context for severity assessment
+- Consider business context for severity assessment — check whether the target is a demo/sandbox environment or content meant to be public, and factor that in
 - Independent verification through subagent
 - Document complete attack chain
 - Keep going until you find something that matters
@@ -419,6 +434,7 @@ SPECIALIZED TOOLS:
 PROXY & INTERCEPTION:
 - Caido CLI - Modern web proxy (already running). Use the proxy tools
   directly, or import `caido_api` from sandbox Python scripts.
+- HTTPQL filters (for `list_requests`): quote string values, leave integers unquoted (`resp.code.eq:200`, not `"200"`); combine terms with `AND`/`OR` (there is no `NOT` — use the negated operator `ne`/`ncont`/`nregex`). Numeric fields (`resp.code`, `req.port`) use `eq`/`ne`/`gt`/`gte`/`lt`/`lte`; text fields (`req.host`, `req.path`, `req.method`, `req.raw`) use `cont`/`ncont`/`eq`/`regex`. Example: `resp.code.gte:200 AND resp.code.lt:300 AND req.host.cont:"api"`.
 - NOTE: If you are seeing proxy errors when sending requests, it usually means you are not sending requests to a correct url/host/port.
 - Ignore Caido proxy-generated 50x HTML error pages; these are proxy issues (might happen when requesting a wrong host or SSL/TLS issues, etc).
 

strix/config/models.py

@@ -10,6 +10,7 @@ from agents.models.multi_provider import MultiProvider
 from agents.retry import (
     ModelRetryBackoffSettings,
     ModelRetrySettings,
+    RetryPolicyContext,
     retry_policies,
 )
 
@@ -20,6 +21,21 @@ if TYPE_CHECKING:
     from strix.config.settings import Settings
 
 
+def request_timeout_extra_args(timeout_s: float | None) -> dict[str, float] | None:
+    """Per-request model timeout; a plain float so ``ModelSettings.to_json_dict()`` stays serializable."""  # noqa: E501
+    if not timeout_s or timeout_s <= 0:
+        return None
+    return {"timeout": timeout_s}
+
+
+def _retry_statusless_provider_errors(context: RetryPolicyContext) -> bool:
+    """Retry statusless provider errors (e.g. mid-stream quota/billing), but not aborts."""
+    normalized = context.normalized
+    if normalized.is_abort:
+        return False
+    return normalized.status_code is None
+
+
 class StrixProvider(MultiProvider):
     """Route any non-OpenAI prefix through LiteLLM with the prefix preserved,
     so users type ``deepseek/deepseek-chat`` rather than
@@ -56,6 +72,7 @@ DEFAULT_MODEL_RETRY = ModelRetrySettings(
         retry_policies.provider_suggested(),
         retry_policies.network_error(),
         retry_policies.http_status((429, 500, 502, 503, 504)),
+        _retry_statusless_provider_errors,
     ),
 )
 

strix/core/hooks.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import logging
+import math
 from typing import TYPE_CHECKING, Any
 
 from agents.lifecycle import RunHooks
@@ -27,8 +28,6 @@ class ReportUsageHooks(RunHooks[dict[str, Any]]):
     """Persist SDK-native usage after every model response."""
 
     def __init__(self, *, model: str, max_budget_usd: float | None = None) -> None:
-        import math
-
         if max_budget_usd is not None and (
             not math.isfinite(max_budget_usd) or max_budget_usd <= 0
         ):

strix/core/inputs.py

@@ -12,6 +12,7 @@ from strix.config.models import (
     DEFAULT_MODEL_RETRY,
     is_known_openai_bare_model,
     model_supports_reasoning,
+    request_timeout_extra_args,
 )
 from strix.core.sessions import scrub_images_from_items
 
@@ -126,11 +127,13 @@ def make_model_settings(
     *,
     model_name: str,
     force_required_tool_choice: bool = False,
+    request_timeout: float | None = None,
 ) -> ModelSettings:
     model_settings = ModelSettings(
         parallel_tool_calls=False,
         retry=DEFAULT_MODEL_RETRY,
         include_usage=True,
+        extra_args=request_timeout_extra_args(request_timeout),
     )
     if (
         reasoning_effort is not None

strix/core/runner.py

@@ -215,6 +215,7 @@ async def run_strix_scan(
             settings.llm.reasoning_effort,
             model_name=resolved_model,
             force_required_tool_choice=settings.llm.force_required_tool_choice,
+            request_timeout=settings.llm.timeout,
         )
         run_config = RunConfig(
             model=resolved_model,

strix/interface/main.py

@@ -5,6 +5,7 @@ Strix Agent Interface
 
 import argparse
 import asyncio
+import os
 import shutil
 import sys
 from datetime import UTC, datetime
@@ -32,6 +33,13 @@ from strix.config.models import (
 from strix.core.paths import run_dir_for, runtime_state_dir
 from strix.interface.cli import run_cli
 from strix.interface.tui import run_tui
+from strix.interface.update_check import (
+    is_binary_install,
+    notify_update,
+    prompt_update_if_available,
+    self_update,
+    start_background_check,
+)
 from strix.interface.utils import (
     assign_workspace_subdirs,
     build_final_stats_text,
@@ -447,6 +455,14 @@ Examples:
         version=f"strix {get_version()}",
     )
 
+    parser.add_argument(
+        "--update",
+        action="store_true",
+        help="Update strix to the latest version and exit. Self-updates the "
+        "standalone binary install; for pip/pipx/uv installs, prints the "
+        "matching upgrade command instead.",
+    )
+
     parser.add_argument(
         "-t",
         "--target",
@@ -565,6 +581,9 @@ Examples:
 
     args = parser.parse_args()
 
+    if args.update:
+        sys.exit(0 if self_update() else 1)
+
     if args.instruction and args.instruction_file:
         parser.error(
             "Cannot specify both --instruction and --instruction-file. Use one or the other."
@@ -788,6 +807,8 @@ def display_completion_message(args: argparse.Namespace, results_path: Path) ->
         "[#60a5fa]discord.gg/strix-ai[/]"
     )
     console.print()
+    if not args.non_interactive:
+        notify_update(console)
 
 
 def pull_docker_image() -> None:
@@ -851,6 +872,12 @@ def main() -> None:
     if args.config:
         apply_config_override(validate_config_file(args.config))
 
+    start_background_check()
+    if not args.non_interactive and prompt_update_if_available(Console()):
+        if is_binary_install() and sys.platform != "win32":
+            os.execv(sys.executable, sys.argv)  # noqa: S606  # nosec B606
+        sys.exit(0)
+
     check_docker_installed()
     pull_docker_image()
 

strix/interface/update_check.py

@@ -0,0 +1,389 @@
+"""Update notifications and self-update for the strix CLI.
+
+Follows the pattern used by tools like gh, uv, and pip: a background,
+rate-limited (once per 24h) check against the release source, a cached
+result in ``~/.strix``, a non-intrusive notice with the upgrade command
+for the detected install method, and a ``strix --update`` self-update
+path for the standalone binary install.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import os
+import platform
+import shutil
+import stat
+import subprocess
+import sys
+import tarfile
+import tempfile
+import threading
+import time
+import zipfile
+from pathlib import Path
+from typing import cast
+
+import requests
+from rich.console import Console
+from rich.prompt import Prompt
+
+from strix.telemetry._common import get_version
+
+
+logger = logging.getLogger(__name__)
+
+GITHUB_REPO = "usestrix/strix"
+PYPI_PACKAGE = "strix-agent"
+CHECK_INTERVAL_SECONDS = 24 * 60 * 60
+REQUEST_TIMEOUT_SECONDS = 5
+
+_CACHE_PATH = Path.home() / ".strix" / "update-check.json"
+
+_background_thread: threading.Thread | None = None
+
+
+def _is_disabled() -> bool:
+    return bool(os.environ.get("STRIX_NO_UPDATE_CHECK")) or any(
+        os.environ.get(key)
+        for key in ("CI", "GITHUB_ACTIONS", "GITLAB_CI", "JENKINS_URL", "BUILDKITE", "CIRCLECI")
+    )
+
+
+def is_binary_install() -> bool:
+    return bool(getattr(sys, "frozen", False))
+
+
+def get_install_method() -> str:
+    if is_binary_install():
+        return "binary"
+    prefix = str(Path(sys.prefix)).replace("\\", "/")
+    if "/pipx/" in prefix or prefix.endswith("/pipx"):
+        return "pipx"
+    if "/uv/tools/" in prefix:
+        return "uv"
+    return "pip"
+
+
+def get_upgrade_command(method: str | None = None) -> str:
+    method = method or get_install_method()
+    commands = {
+        "binary": "strix --update",
+        "pipx": "pipx upgrade strix-agent",
+        "uv": "uv tool upgrade strix-agent",
+        "pip": "pip install --upgrade strix-agent",
+    }
+    return commands[method]
+
+
+def _parse_version(value: str) -> tuple[int, ...] | None:
+    parts = value.strip().lstrip("v").split(".")
+    try:
+        return tuple(int(part) for part in parts)
+    except ValueError:
+        return None
+
+
+def _is_newer(latest: str, current: str) -> bool:
+    latest_parts = _parse_version(latest)
+    current_parts = _parse_version(current)
+    if latest_parts is None or current_parts is None:
+        return False
+    return latest_parts > current_parts
+
+
+def _fetch_latest_version() -> str | None:
+    try:
+        if is_binary_install():
+            response = requests.get(
+                f"https://api.github.com/repos/{GITHUB_REPO}/releases/latest",
+                timeout=REQUEST_TIMEOUT_SECONDS,
+            )
+            response.raise_for_status()
+            tag = response.json().get("tag_name", "")
+            return tag.lstrip("v") or None
+        response = requests.get(
+            f"https://pypi.org/pypi/{PYPI_PACKAGE}/json",
+            timeout=REQUEST_TIMEOUT_SECONDS,
+        )
+        response.raise_for_status()
+        version = response.json().get("info", {}).get("version")
+        return str(version) if version else None
+    except Exception:  # noqa: BLE001
+        logger.debug("update check failed", exc_info=True)
+        return None
+
+
+def _fetch_asset_digest(version: str, filename: str) -> str | None:
+    """Return the expected sha256 (hex) for a release asset, if the API provides one."""
+    try:
+        response = requests.get(
+            f"https://api.github.com/repos/{GITHUB_REPO}/releases/tags/v{version}",
+            timeout=REQUEST_TIMEOUT_SECONDS,
+        )
+        response.raise_for_status()
+        for asset in response.json().get("assets", []):
+            if asset.get("name") == filename:
+                digest = asset.get("digest") or ""
+                if digest.startswith("sha256:"):
+                    return digest.removeprefix("sha256:")
+    except Exception:  # noqa: BLE001
+        logger.debug("release asset digest lookup failed", exc_info=True)
+    return None
+
+
+def _sha256_file(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as f:
+        for chunk in iter(lambda: f.read(1 << 20), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def _read_cache() -> dict[str, object]:
+    try:
+        with _CACHE_PATH.open(encoding="utf-8") as f:
+            data = json.load(f)
+        if isinstance(data, dict):
+            return cast("dict[str, object]", data)
+    except Exception:  # noqa: BLE001, S110
+        pass  # nosec B110
+    return {}
+
+
+def _write_cache(**fields: object) -> None:
+    try:
+        cache = _read_cache()
+        cache.update(fields)
+        _CACHE_PATH.parent.mkdir(parents=True, exist_ok=True)
+        _CACHE_PATH.write_text(json.dumps(cache), encoding="utf-8")
+    except Exception:  # noqa: BLE001, S110
+        pass  # nosec B110
+
+
+def skip_version(version: str) -> None:
+    """Remember not to prompt again for this version (newer releases still notify)."""
+    _write_cache(skipped_version=version)
+
+
+def _refresh_cache() -> None:
+    latest = _fetch_latest_version()
+    if latest:
+        _write_cache(latest_version=latest, checked_at=time.time())
+
+
+def start_background_check() -> None:
+    """Refresh the cached latest-version info in a daemon thread (at most once per 24h)."""
+    global _background_thread  # noqa: PLW0603
+    if _is_disabled():
+        return
+    cache = _read_cache()
+    checked_at = cache.get("checked_at")
+    if isinstance(checked_at, int | float) and time.time() - checked_at < CHECK_INTERVAL_SECONDS:
+        return
+    _background_thread = threading.Thread(target=_refresh_cache, daemon=True)
+    _background_thread.start()
+
+
+def get_available_update(*, respect_skip: bool = True) -> str | None:
+    """Return the newer version from the cache, or None if up to date / unknown."""
+    if _is_disabled():
+        return None
+    if _background_thread is not None:
+        _background_thread.join(timeout=0.2)
+    cache = _read_cache()
+    latest = cache.get("latest_version")
+    current = get_version()
+    if not isinstance(latest, str) or current == "unknown" or not _is_newer(latest, current):
+        return None
+    if respect_skip and cache.get("skipped_version") == latest:
+        return None
+    return latest
+
+
+def notify_update(console: Console) -> None:
+    latest = get_available_update()
+    if not latest:
+        return
+    console.print(
+        f"[#eab308]A new version of strix is available:[/] "
+        f"[dim]{get_version()}[/] [dim]→[/] [bold #22c55e]{latest}[/]"
+        f"  [dim]·[/]  [#60a5fa]{get_upgrade_command()}[/]"
+    )
+    console.print()
+
+
+def run_package_upgrade(console: Console, method: str) -> bool:
+    """Upgrade a package-manager install by running its upgrade command."""
+    command = get_upgrade_command(method).split()
+    console.print(f"[dim]Running[/] [#60a5fa]{' '.join(command)}[/]")
+    try:
+        result = subprocess.run(command, check=False)  # noqa: S603
+    except OSError as e:
+        console.print(f"[bold red]Update failed:[/] {e}")
+        return False
+    if result.returncode != 0:
+        console.print(
+            f"[bold red]Update failed[/] [dim](exit code {result.returncode}).[/] "
+            f"Run it manually: [#60a5fa]{get_upgrade_command(method)}[/]"
+        )
+        return False
+    console.print("[#22c55e]✓ strix updated — restart the scan to use the new version[/]")
+    return True
+
+
+def prompt_update_if_available(console: Console) -> bool:
+    """Offer an interactive update before a scan starts.
+
+    Returns True if strix was updated (caller should re-exec / exit).
+    """
+    latest = get_available_update()
+    if not latest or not sys.stdin.isatty() or not sys.stdout.isatty():
+        return False
+    console.print()
+    console.print(
+        f"[#eab308]A new version of strix is available:[/] "
+        f"[dim]{get_version()}[/] [dim]→[/] [bold #22c55e]{latest}[/]"
+    )
+    console.print(
+        "[dim]  y — update now    n — not now (ask again next run)    s — skip this version[/]"
+    )
+    choice = Prompt.ask("Update strix?", choices=["y", "n", "s"], default="n")
+    console.print()
+    if choice == "s":
+        skip_version(latest)
+        return False
+    if choice != "y":
+        return False
+    method = get_install_method()
+    if method == "binary":
+        return self_update(console, version=latest)
+    return run_package_upgrade(console, method)
+
+
+def _release_target() -> str | None:
+    raw_os = platform.system().lower()
+    os_name = {"darwin": "macos", "linux": "linux", "windows": "windows"}.get(raw_os)
+    arch = platform.machine().lower()
+    arch = {"aarch64": "arm64", "amd64": "x86_64"}.get(arch, arch)
+    if os_name is None:
+        return None
+    target = f"{os_name}-{arch}"
+    supported = {"linux-x86_64", "macos-x86_64", "macos-arm64", "windows-x86_64"}
+    return target if target in supported else None
+
+
+def _download_and_replace(version: str, target: str, console: Console) -> bool:
+    is_windows = target.startswith("windows")
+    archive_ext = ".zip" if is_windows else ".tar.gz"
+    filename = f"strix-{version}-{target}{archive_ext}"
+    url = f"https://github.com/{GITHUB_REPO}/releases/download/v{version}/{filename}"
+    binary_name = f"strix-{version}-{target}" + (".exe" if is_windows else "")
+    current_exe = Path(sys.executable).resolve()
+
+    with tempfile.TemporaryDirectory() as tmp:
+        tmp_dir = Path(tmp)
+        archive_path = tmp_dir / filename
+        console.print(f"[dim]Downloading[/] {url}")
+        with requests.get(  # nosec B113
+            url,
+            stream=True,
+            timeout=REQUEST_TIMEOUT_SECONDS * 12,
+        ) as response:
+            response.raise_for_status()
+            with archive_path.open("wb") as f:
+                for chunk in response.iter_content(chunk_size=1 << 20):
+                    f.write(chunk)
+
+        expected_digest = _fetch_asset_digest(version, filename)
+        if expected_digest:
+            actual_digest = _sha256_file(archive_path)
+            if actual_digest != expected_digest:
+                raise RuntimeError(
+                    f"checksum mismatch for {filename}: "
+                    f"expected sha256 {expected_digest}, got {actual_digest}"
+                )
+        else:
+            console.print("[dim yellow]No published checksum available; skipping verification[/]")
+
+        if is_windows:
+            with zipfile.ZipFile(archive_path) as zf:
+                zf.extract(binary_name, tmp_dir)
+        else:
+            with tarfile.open(archive_path, "r:gz") as tf:
+                tf.extract(binary_name, tmp_dir, filter="data")
+
+        new_binary = tmp_dir / binary_name
+        new_binary.chmod(new_binary.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+
+        staged = current_exe.with_name(current_exe.name + ".new")
+        try:
+            shutil.copy2(new_binary, staged)
+            if is_windows:
+                # Windows can't replace a running executable in place; move it aside first.
+                old = current_exe.with_name(current_exe.name + ".old")
+                old.unlink(missing_ok=True)
+                current_exe.rename(old)
+                try:
+                    staged.replace(current_exe)
+                except Exception:
+                    old.rename(current_exe)
+                    raise
+            else:
+                staged.replace(current_exe)
+        except Exception:
+            staged.unlink(missing_ok=True)
+            raise
+    return True
+
+
+def self_update(console: Console | None = None, version: str | None = None) -> bool:
+    """Replace the running standalone binary with the latest release.
+
+    Returns True on success. For package-manager installs this only
+    prints the right upgrade command and returns False.
+    """
+    console = console or Console()
+
+    if not is_binary_install():
+        method = get_install_method()
+        console.print(
+            f"[#eab308]This strix was installed via {method};[/] "
+            f"upgrade it with: [#60a5fa]{get_upgrade_command(method)}[/]"
+        )
+        return False
+
+    latest = version or _fetch_latest_version()
+    if not latest:
+        console.print("[bold red]Could not determine the latest strix version.[/]")
+        return False
+
+    current = get_version()
+    if current != "unknown" and not _is_newer(latest, current):
+        console.print(f"[#22c55e]strix {current} is already the latest version.[/]")
+        return True
+
+    target = _release_target()
+    if not target:
+        console.print(
+            f"[bold red]No prebuilt binary for this platform "
+            f"({platform.system()}/{platform.machine()}).[/]"
+        )
+        return False
+
+    try:
+        _download_and_replace(latest, target, console)
+    except Exception as e:  # noqa: BLE001
+        logger.debug("self-update failed", exc_info=True)
+        console.print(f"[bold red]Update failed:[/] {e}")
+        console.print(
+            "[dim]You can reinstall manually with:[/] "
+            "[#60a5fa]curl -sSL https://strix.ai/install | bash[/]"
+        )
+        return False
+
+    _write_cache(latest_version=latest, checked_at=time.time())
+    console.print(f"[#22c55e]✓ Updated strix to {latest}[/]")
+    return True

strix/report/dedupe.py

@@ -16,6 +16,7 @@ from strix.config.models import (
     DEFAULT_MODEL_RETRY,
     StrixProvider,
     configure_sdk_model_defaults,
+    request_timeout_extra_args,
 )
 from strix.report.state import get_global_report_state
 
@@ -310,7 +311,11 @@ async def check_duplicate(
         response = await model.get_response(
             system_instructions=DEDUPE_SYSTEM_PROMPT,
             input=user_msg,
-            model_settings=ModelSettings(retry=DEFAULT_MODEL_RETRY, include_usage=True),
+            model_settings=ModelSettings(
+                retry=DEFAULT_MODEL_RETRY,
+                include_usage=True,
+                extra_args=request_timeout_extra_args(settings.llm.timeout),
+            ),
             tools=[],
             output_schema=None,
             handoffs=[],

strix/report/state.py

@@ -534,16 +534,10 @@ def litellm_cost_callback(
                 cost = value
 
     if cost is None:
-        usage: Any = getattr(completion_response, "usage", None)
-        if usage is None and isinstance(completion_response, dict):
-            usage = cast("dict[str, Any]", completion_response).get("usage")
-        usage_cost: Any
-        if isinstance(usage, dict):
-            usage_cost = cast("dict[str, Any]", usage).get("cost")
-        else:
-            usage_cost = getattr(usage, "cost", None)
-        if isinstance(usage_cost, int | float) and usage_cost > 0:
-            cost = float(usage_cost)
+        cost = _usage_reported_cost(completion_response)
+
+    if cost is None:
+        cost = _estimate_response_cost(kwargs, completion_response)
 
     if cost is None or cost <= 0:
         return
@@ -554,3 +548,101 @@ def litellm_cost_callback(
         report_state.record_observed_llm_cost(cost)
     except Exception:
         logger.exception("Failed to record observed LiteLLM cost")
+
+
+def _usage_reported_cost(completion_response: Any) -> float | None:
+    """Provider-reported cost from the ``usage`` block (e.g. OpenRouter).
+
+    Non-BYOK responses charge everything to ``usage.cost``. BYOK responses
+    charge only the OpenRouter fee to ``usage.cost`` (often 0) and report the
+    provider charge in ``usage.cost_details.upstream_inference_cost``, so the
+    true BYOK total is the sum of the two.
+    """
+    usage: Any = getattr(completion_response, "usage", None)
+    if usage is None and isinstance(completion_response, dict):
+        usage = cast("dict[str, Any]", completion_response).get("usage")
+    if usage is None:
+        return None
+
+    def _field(container: Any, name: str) -> Any:
+        if isinstance(container, dict):
+            return cast("dict[str, Any]", container).get(name)
+        return getattr(container, name, None)
+
+    total = 0.0
+    usage_cost = _field(usage, "cost")
+    if isinstance(usage_cost, int | float) and usage_cost > 0:
+        total += float(usage_cost)
+
+    if bool(_field(usage, "is_byok")):
+        upstream = _field(_field(usage, "cost_details"), "upstream_inference_cost")
+        if isinstance(upstream, int | float) and upstream > 0:
+            total += float(upstream)
+
+    return total if total > 0 else None
+
+
+def _estimate_response_cost(kwargs: Any, completion_response: Any) -> float | None:
+    """Best-effort LiteLLM cost-map estimate when no provider-reported cost exists.
+
+    LiteLLM strips provider cost fields when rebuilding streamed responses and
+    returns no ``response_cost`` for models missing from its cost map, so try
+    the provider-prefixed name, the raw name, and the bare model name.
+    """
+    from litellm import completion_cost
+
+    model = kwargs.get("model") if isinstance(kwargs, dict) else None
+    if not isinstance(model, str) or not model:
+        if isinstance(completion_response, dict):
+            model = cast("dict[str, Any]", completion_response).get("model")
+        else:
+            model = getattr(completion_response, "model", None)
+    if not isinstance(model, str) or not model:
+        return None
+
+    provider = None
+    litellm_params = kwargs.get("litellm_params") if isinstance(kwargs, dict) else None
+    if isinstance(litellm_params, dict):
+        provider = litellm_params.get("custom_llm_provider")
+
+    usage_payload = _usage_payload(completion_response)
+    if usage_payload is None:
+        return None
+
+    candidates: list[str] = []
+    if isinstance(provider, str) and provider and not model.startswith(f"{provider}/"):
+        candidates.append(f"{provider}/{model}")
+    candidates.append(model)
+    if "/" in model:
+        candidates.append(model.rsplit("/", 1)[-1])
+
+    for candidate in candidates:
+        try:
+            value = completion_cost(
+                completion_response={"model": candidate, "usage": usage_payload},
+                model=candidate,
+            )
+        except Exception:  # nosec B112  # noqa: BLE001, S112
+            continue
+        if isinstance(value, int | float) and value > 0:
+            return float(value)
+    return None
+
+
+def _usage_payload(completion_response: Any) -> dict[str, Any] | None:
+    """Token counts as a plain dict, detached from the response's provider metadata."""
+    usage: Any = getattr(completion_response, "usage", None)
+    if usage is None and isinstance(completion_response, dict):
+        usage = cast("dict[str, Any]", completion_response).get("usage")
+    if usage is None:
+        return None
+    if hasattr(usage, "model_dump"):
+        usage = usage.model_dump()
+    if not isinstance(usage, dict):
+        return None
+    payload = cast("dict[str, Any]", usage)
+    if not payload.get("total_tokens") and not (
+        payload.get("prompt_tokens") or payload.get("completion_tokens")
+    ):
+        return None
+    return payload

strix/runtime/caido_bootstrap.py

@@ -10,6 +10,7 @@ exposed-port URL for all subsequent SDK calls.
 from __future__ import annotations
 
 import asyncio
+import contextlib
 import json
 import logging
 from typing import TYPE_CHECKING
@@ -93,9 +94,16 @@ async def bootstrap_caido(
     client = Client(host_url, auth=TokenAuthOptions(token=access_token))
     await client.connect()
 
-    project = await client.project.create(
-        CreateProjectOptions(name="sandbox", temporary=True),
-    )
-    await client.project.select(project.id)
+    try:
+        project = await client.project.create(
+            CreateProjectOptions(name="sandbox", temporary=True),
+        )
+        await client.project.select(project.id)
+    except BaseException:
+        # The connected client never reaches the session bundle if project
+        # setup fails, so close it here to avoid leaking the transport.
+        with contextlib.suppress(Exception):
+            await client.aclose()
+        raise
     logger.info("Caido project selected: %s", project.id)
     return client

strix/skills/tooling/agent_browser.md

@@ -365,6 +365,23 @@ agent-browser dialog accept "text"    # accept with prompt input
 agent-browser dialog dismiss          # cancel
 ```
 
+## Readiness & recovery
+
+The first `agent-browser open` in a session launches the headless-Chrome
+daemon; later commands reuse it. Distinguish the two failure modes and react
+differently — do **not** blindly re-run the same failing command in a loop:
+
+- **Daemon / connection failure** (`Failed to connect`, `connection refused`,
+  socket missing, `browser not running`): the daemon isn't up or has died. Run
+  `agent-browser doctor` (add `--fix` if it reports repairable problems), then
+  re-open the page. Retrying the original command unchanged will keep failing.
+- **Malformed command** (`Unknown command`, `Ref not found`, bad flag): fix the
+  command itself — re-snapshot for fresh refs, or correct the syntax.
+
+Invoke `agent-browser` directly through `exec_command`; there is no need to wrap
+it in an extra `sh -c "..."` / `bash -lc "..."` layer, which only adds shell
+quoting and startup-file pitfalls.
+
 ## Diagnosing install issues
 
 If a command fails unexpectedly (`Unknown command`, `Failed to connect`,

strix/skills/tooling/python.md

@@ -92,10 +92,18 @@ For iterative exploit work, put code in a file:
 
 ## Installing extra packages
 
-The sandbox's Python lives in `/app/.venv`. To add a one-off dependency
-for an exploit script, use `uv` (already in the image and much faster
-than pip):
+The sandbox's Python lives in `/app/.venv`, and it is the active virtualenv
+(`python3` / `pip` already resolve to it). The following common libraries are
+**pre-installed** — import them directly, no install step needed:
+`requests`, `httpx`, `beautifulsoup4` (`bs4`), `lxml`, `pyjwt` (`jwt`),
+`cryptography`.
+
+To add a one-off dependency for an exploit script, use `uv` (already in the
+image and much faster than pip):
 
 ```bash
 uv pip install --python /app/.venv/bin/python <package>
 ```
+
+Plain `pip install <package>` also works because the venv is active. Install
+before you import, so scripts don't fail with `ModuleNotFoundError`.

strix/tools/proxy/caido_api.py

@@ -21,6 +21,8 @@ from caido_sdk_client.types import (
 
 
 if TYPE_CHECKING:
+    from collections.abc import Awaitable, Callable
+
     from caido_sdk_client import Client as CaidoClient
 
 
@@ -42,6 +44,7 @@ _SITEMAP_PAGE_SIZE = 30
 
 _DEFAULT_CAIDO_URL = "http://127.0.0.1:48080"
 _CLIENT_CACHE: dict[str, Client] = {}
+_CLIENT_LOCK = asyncio.Lock()
 _REQ_FIELD_MAP: dict[SortBy, tuple[str, str]] = {
     "timestamp": ("req", "created_at"),
     "host": ("req", "host"),
@@ -81,19 +84,46 @@ def _login_as_guest() -> str:
     return str(payload["data"]["loginAsGuest"]["token"]["accessToken"])
 
 
-async def get_client() -> Client:
-    if client := _CLIENT_CACHE.get("default"):
-        return client
-
+async def _new_client() -> Client:
     token = await asyncio.to_thread(_login_as_guest)
     client = Client(caido_url(), auth=TokenAuthOptions(token=token))
     await client.connect()
-    _CLIENT_CACHE["default"] = client
     return client
 
 
+async def get_client() -> Client:
+    """Return the shared Caido client, creating it under a lock if needed.
+
+    The lock prevents two concurrent callers from each building a client and
+    racing ``connect()`` on the same transport ("Transport is already
+    connected").
+    """
+    async with _CLIENT_LOCK:
+        client = _CLIENT_CACHE.get("default")
+        if client is None:
+            client = await _new_client()
+            _CLIENT_CACHE["default"] = client
+        return client
+
+
+async def call_with_client[T](fn: Callable[[Client], Awaitable[T]]) -> T:
+    """Run ``fn`` against the shared client, serialized through ``_CLIENT_LOCK``.
+
+    The Caido GraphQL transport is not safe for concurrent use: two in-flight
+    requests race and raise "Transport is already connected". Serializing every
+    proxy call through the lock prevents that.
+    """
+    async with _CLIENT_LOCK:
+        client = _CLIENT_CACHE.get("default")
+        if client is None:
+            client = await _new_client()
+            _CLIENT_CACHE["default"] = client
+        return await fn(client)
+
+
 async def close_client() -> None:
-    client = _CLIENT_CACHE.pop("default", None)
+    async with _CLIENT_LOCK:
+        client = _CLIENT_CACHE.pop("default", None)
     if client is None:
         return
     await client.aclose()
@@ -385,19 +415,23 @@ async def list_requests(
     sort_order: SortOrder = "desc",
     scope_id: str | None = None,
 ) -> Any:
-    return await list_requests_with_client(
-        await get_client(),
-        httpql_filter=httpql_filter,
-        first=first,
-        after=after,
-        sort_by=sort_by,
-        sort_order=sort_order,
-        scope_id=scope_id,
+    return await call_with_client(
+        lambda client: list_requests_with_client(
+            client,
+            httpql_filter=httpql_filter,
+            first=first,
+            after=after,
+            sort_by=sort_by,
+            sort_order=sort_order,
+            scope_id=scope_id,
+        )
     )
 
 
 async def view_request(request_id: str, *, part: RequestPart = "request") -> Any:
-    return await get_request_with_client(await get_client(), request_id, part=part)
+    return await call_with_client(
+        lambda client: get_request_with_client(client, request_id, part=part)
+    )
 
 
 async def repeat_request(
@@ -406,22 +440,26 @@ async def repeat_request(
     modifications: dict[str, Any] | None = None,
 ) -> dict[str, Any]:
     mods = modifications or {}
-    result = await get_request_with_client(await get_client(), request_id, part="request")
-    if result is None or result.request.raw is None:
-        raise ValueError(f"Request {request_id} not found")
 
-    original = result.request
-    raw_str = result.request.raw.decode("utf-8", errors="replace")
-    components = parse_raw_request(raw_str)
-    full_url = full_url_from_components(original, components, mods)
-    modified = apply_modifications(components, mods, full_url)
-    connection, raw = build_raw_request(
-        method=modified["method"],
-        url=modified["url"],
-        headers=modified["headers"],
-        body=modified["body"],
-    )
-    return await replay_send_raw(await get_client(), raw=raw, connection=connection)
+    async def _run(client: CaidoClient) -> dict[str, Any]:
+        result = await get_request_with_client(client, request_id, part="request")
+        if result is None or result.request.raw is None:
+            raise ValueError(f"Request {request_id} not found")
+
+        original = result.request
+        raw_str = result.request.raw.decode("utf-8", errors="replace")
+        components = parse_raw_request(raw_str)
+        full_url = full_url_from_components(original, components, mods)
+        modified = apply_modifications(components, mods, full_url)
+        connection, raw = build_raw_request(
+            method=modified["method"],
+            url=modified["url"],
+            headers=modified["headers"],
+            body=modified["body"],
+        )
+        return await replay_send_raw(client, raw=raw, connection=connection)
+
+    return await call_with_client(_run)
 
 
 async def scope_rules(
@@ -432,7 +470,28 @@ async def scope_rules(
     scope_id: str | None = None,
     scope_name: str | None = None,
 ) -> Any:
-    client = await get_client()
+    async def _run(client: CaidoClient) -> Any:
+        return await _scope_rules_with_client(
+            client,
+            action,
+            allowlist=allowlist,
+            denylist=denylist,
+            scope_id=scope_id,
+            scope_name=scope_name,
+        )
+
+    return await call_with_client(_run)
+
+
+async def _scope_rules_with_client(
+    client: CaidoClient,
+    action: ScopeAction,
+    *,
+    allowlist: list[str] | None = None,
+    denylist: list[str] | None = None,
+    scope_id: str | None = None,
+    scope_name: str | None = None,
+) -> Any:
     if action == "list":
         result = await scope_list(client)
     elif action == "get":
@@ -651,18 +710,20 @@ async def list_sitemap(
     page: int = 1,
     page_size: int = _SITEMAP_PAGE_SIZE,
 ) -> dict[str, Any]:
-    return await list_sitemap_with_client(
-        await get_client(),
-        scope_id=scope_id,
-        parent_id=parent_id,
-        depth=depth,
-        page=page,
-        page_size=page_size,
+    return await call_with_client(
+        lambda client: list_sitemap_with_client(
+            client,
+            scope_id=scope_id,
+            parent_id=parent_id,
+            depth=depth,
+            page=page,
+            page_size=page_size,
+        )
     )
 
 
 async def view_sitemap_entry(entry_id: str) -> dict[str, Any]:
-    return await view_sitemap_entry_with_client(await get_client(), entry_id)
+    return await call_with_client(lambda client: view_sitemap_entry_with_client(client, entry_id))
 
 
 __all__ = [

strix/tools/proxy/tools.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import asyncio
 import dataclasses
 import json
 import logging
@@ -19,6 +20,8 @@ logger = logging.getLogger(__name__)
 
 
 if TYPE_CHECKING:
+    from collections.abc import Awaitable, Callable
+
     from caido_sdk_client import Client
 
     from strix.tools.proxy.caido_api import (
@@ -38,12 +41,23 @@ else:
 
 ScopeAction = Literal["get", "list", "create", "update", "delete"]
 
+# All agents in a scan share one host-side Caido client whose GraphQL transport
+# is not concurrency-safe (parallel calls raise "Transport is already
+# connected"). Serialize every host-side proxy call through this lock.
+_CAIDO_CALL_LOCK = asyncio.Lock()
+
 
 def _ctx_client(ctx: RunContextWrapper) -> Client | None:
     inner = ctx.context if isinstance(ctx.context, dict) else {}
     return inner.get("caido_client")
 
 
+async def _call[T](client: Client, fn: Callable[[Client], Awaitable[T]]) -> T:
+    """Run ``fn`` against the shared client, serialized under ``_CAIDO_CALL_LOCK``."""
+    async with _CAIDO_CALL_LOCK:
+        return await fn(client)
+
+
 def _to_tool_json(value: Any) -> Any:
     """Recursively convert SDK dataclasses/Pydantic objects to tool JSON values."""
     if value is None or isinstance(value, str | int | float | bool):
@@ -146,14 +160,17 @@ async def list_requests(
         return _no_client()
 
     try:
-        connection = await caido_api.list_requests_with_client(
+        connection = await _call(
             client,
-            httpql_filter=httpql_filter,
-            first=first,
-            after=after,
-            sort_by=sort_by,
-            sort_order=sort_order,
-            scope_id=scope_id,
+            lambda client: caido_api.list_requests_with_client(
+                client,
+                httpql_filter=httpql_filter,
+                first=first,
+                after=after,
+                sort_by=sort_by,
+                sort_order=sort_order,
+                scope_id=scope_id,
+            ),
         )
 
         entries = []
@@ -249,7 +266,10 @@ async def view_request(
         return _no_client()
 
     try:
-        result = await caido_api.get_request_with_client(client, request_id, part=part)
+        result = await _call(
+            client,
+            lambda client: caido_api.get_request_with_client(client, request_id, part=part),
+        )
         if result is None:
             return json.dumps(
                 {"success": False, "error": f"Request {request_id} not found"},
@@ -364,15 +384,10 @@ async def repeat_request(
         return _no_client()
     mods = modifications or {}
 
-    try:
+    async def _do(client: Client) -> dict[str, Any] | None:
         result = await caido_api.get_request_with_client(client, request_id, part="request")
         if result is None or result.request.raw is None:
-            return json.dumps(
-                {"success": False, "error": f"Request {request_id} not found"},
-                ensure_ascii=False,
-                default=str,
-            )
-
+            return None
         original = result.request
         raw_str = result.request.raw.decode("utf-8", errors="replace")
         components = caido_api.parse_raw_request(raw_str)
@@ -384,7 +399,16 @@ async def repeat_request(
             headers=modified["headers"],
             body=modified["body"],
         )
-        replay = await caido_api.replay_send_raw(client, raw=raw, connection=connection)
+        return await caido_api.replay_send_raw(client, raw=raw, connection=connection)
+
+    try:
+        replay = await _call(client, _do)
+        if replay is None:
+            return json.dumps(
+                {"success": False, "error": f"Request {request_id} not found"},
+                ensure_ascii=False,
+                default=str,
+            )
         return _format_replay_tool_result(replay)
     except Exception as exc:  # noqa: BLE001
         return _err("repeat_request", exc)
@@ -441,12 +465,15 @@ async def list_sitemap(
     if client is None:
         return _no_client()
     try:
-        payload = await caido_api.list_sitemap_with_client(
+        payload = await _call(
             client,
-            scope_id=scope_id,
-            parent_id=parent_id,
-            depth=depth,
-            page=page,
+            lambda client: caido_api.list_sitemap_with_client(
+                client,
+                scope_id=scope_id,
+                parent_id=parent_id,
+                depth=depth,
+                page=page,
+            ),
         )
         return json.dumps(payload, ensure_ascii=False, default=str)
     except Exception as exc:  # noqa: BLE001
@@ -472,7 +499,10 @@ async def view_sitemap_entry(
     if client is None:
         return _no_client()
     try:
-        payload = await caido_api.view_sitemap_entry_with_client(client, entry_id)
+        payload = await _call(
+            client,
+            lambda client: caido_api.view_sitemap_entry_with_client(client, entry_id),
+        )
         return json.dumps(payload, ensure_ascii=False, default=str)
     except Exception as exc:  # noqa: BLE001
         return _err("view_sitemap_entry", exc)
@@ -530,7 +560,7 @@ async def scope_rules(
 
     try:
         if action == "list":
-            scopes = await caido_api.scope_list(client)
+            scopes = await _call(client, caido_api.scope_list)
             return json.dumps(
                 {"success": True, "scopes": [_to_tool_json(s) for s in scopes]},
                 ensure_ascii=False,
@@ -543,9 +573,11 @@ async def scope_rules(
                     ensure_ascii=False,
                     default=str,
                 )
-            scope = await caido_api.scope_get(client, scope_id)
+            scope = await _call(client, lambda client: caido_api.scope_get(client, scope_id))
             return json.dumps(
-                {"success": True, "scope": _to_tool_json(scope)}, ensure_ascii=False, default=str
+                {"success": True, "scope": _to_tool_json(scope)},
+                ensure_ascii=False,
+                default=str,
             )
         if action == "create":
             if not scope_name:
@@ -554,11 +586,16 @@ async def scope_rules(
                     ensure_ascii=False,
                     default=str,
                 )
-            scope = await caido_api.scope_create(
-                client, name=scope_name, allowlist=allowlist, denylist=denylist
+            scope = await _call(
+                client,
+                lambda client: caido_api.scope_create(
+                    client, name=scope_name, allowlist=allowlist, denylist=denylist
+                ),
             )
             return json.dumps(
-                {"success": True, "scope": _to_tool_json(scope)}, ensure_ascii=False, default=str
+                {"success": True, "scope": _to_tool_json(scope)},
+                ensure_ascii=False,
+                default=str,
             )
         if action == "update":
             if not scope_id or not scope_name:
@@ -570,11 +607,16 @@ async def scope_rules(
                     ensure_ascii=False,
                     default=str,
                 )
-            scope = await caido_api.scope_update(
-                client, scope_id, name=scope_name, allowlist=allowlist, denylist=denylist
+            scope = await _call(
+                client,
+                lambda client: caido_api.scope_update(
+                    client, scope_id, name=scope_name, allowlist=allowlist, denylist=denylist
+                ),
             )
             return json.dumps(
-                {"success": True, "scope": _to_tool_json(scope)}, ensure_ascii=False, default=str
+                {"success": True, "scope": _to_tool_json(scope)},
+                ensure_ascii=False,
+                default=str,
             )
         if not scope_id:
             return json.dumps(
@@ -582,7 +624,7 @@ async def scope_rules(
                 ensure_ascii=False,
                 default=str,
             )
-        await caido_api.scope_delete(client, scope_id)
+        await _call(client, lambda client: caido_api.scope_delete(client, scope_id))
         return json.dumps(
             {
                 "success": True,

strix/tools/shell/README.md

@@ -5,6 +5,23 @@ invocation the agent makes (nmap, ffuf, agent-browser, python3, …) goes
 through `exec_command`. `write_stdin` streams input to a still-running
 process started by an earlier `exec_command` (for interactive prompts).
 
+## `write_stdin` requires a TTY-backed process
+
+`exec_command` runs each command in a fresh **non-interactive** shell (plain
+pipes, no TTY) by default. `write_stdin` only works against a process that is
+still running **and** was started with a PTY. The canonical sequence is:
+
+```text
+exec_command(cmd="python3", tty=true)      # start a PTY-backed process
+write_stdin(session_id=<id>, chars="print(1)\n")
+```
+
+Calling `write_stdin` on a command started with the default `tty=false`, or on
+a process that has already exited, fails with
+`stdin is not available for this process. Start the command with 'tty=true' in
+'exec_command' before using 'write_stdin'.` Use `tty=true` for REPLs,
+`ssh`/`nc`/`ftp`, `msfconsole`, or to deliver a Ctrl-C to a long-running job.
+
 - **Implementation:** `agents.sandbox.capabilities.tools.shell_tool.ShellTool`
   (in the upstream `agents` SDK)
 - **Wired in:** `strix/agents/factory.py` — added per-run via the SDK

tests/test_cost_tracking.py

@@ -6,6 +6,7 @@ from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
 
 import litellm
+import pytest
 
 from strix.config.models import _configure_litellm_compatibility
 from strix.report.state import litellm_cost_callback
@@ -42,3 +43,111 @@ def test_cost_callback_reads_usage_cost_from_mapping_response() -> None:
         litellm_cost_callback({}, response)
 
     report_state.record_observed_llm_cost.assert_called_once_with(0.125)
+
+
+def test_cost_callback_reads_byok_upstream_inference_cost() -> None:
+    report_state = MagicMock()
+    response = SimpleNamespace(
+        usage=SimpleNamespace(
+            cost=0,
+            is_byok=True,
+            cost_details=SimpleNamespace(upstream_inference_cost=6.75e-06),
+        ),
+        _hidden_params={},
+    )
+
+    with patch("strix.report.state.get_global_report_state", return_value=report_state):
+        litellm_cost_callback({"response_cost": None}, response)
+
+    report_state.record_observed_llm_cost.assert_called_once_with(6.75e-06)
+
+
+def test_cost_callback_sums_usage_cost_and_upstream_inference_cost() -> None:
+    report_state = MagicMock()
+    response = {
+        "usage": {
+            "cost": 0.01,
+            "is_byok": True,
+            "cost_details": {"upstream_inference_cost": 0.2},
+        }
+    }
+
+    with patch("strix.report.state.get_global_report_state", return_value=report_state):
+        litellm_cost_callback({}, response)
+
+    report_state.record_observed_llm_cost.assert_called_once_with(pytest.approx(0.21))
+
+
+def test_cost_callback_ignores_upstream_cost_for_non_byok_responses() -> None:
+    report_state = MagicMock()
+    response = {
+        "usage": {
+            "cost": 0.05,
+            "is_byok": False,
+            "cost_details": {"upstream_inference_cost": 0.04},
+        }
+    }
+
+    with patch("strix.report.state.get_global_report_state", return_value=report_state):
+        litellm_cost_callback({}, response)
+
+    report_state.record_observed_llm_cost.assert_called_once_with(0.05)
+
+
+def test_cost_callback_estimates_cost_with_provider_prefixed_model() -> None:
+    report_state = MagicMock()
+    response = {"usage": {"prompt_tokens": 10, "completion_tokens": 5, "total_tokens": 15}}
+    kwargs = {
+        "response_cost": None,
+        "model": "anthropic/claude-sonnet-4.5",
+        "litellm_params": {"custom_llm_provider": "openrouter"},
+    }
+
+    def fake_completion_cost(**kwargs: object) -> float:
+        if kwargs["model"] == "openrouter/anthropic/claude-sonnet-4.5":
+            return 0.5
+        raise ValueError(kwargs["model"])
+
+    with (
+        patch("strix.report.state.get_global_report_state", return_value=report_state),
+        patch("litellm.completion_cost", side_effect=fake_completion_cost),
+    ):
+        litellm_cost_callback(kwargs, response)
+
+    report_state.record_observed_llm_cost.assert_called_once_with(0.5)
+
+
+def test_cost_callback_estimates_cost_with_bare_model_fallback() -> None:
+    report_state = MagicMock()
+    response = {"usage": {"prompt_tokens": 10, "completion_tokens": 5, "total_tokens": 15}}
+    kwargs = {
+        "response_cost": None,
+        "model": "openai/gpt-4o-mini",
+        "litellm_params": {"custom_llm_provider": "openrouter"},
+    }
+
+    def fake_completion_cost(**kwargs: object) -> float:
+        if kwargs["model"] == "gpt-4o-mini":
+            return 0.025
+        raise ValueError(kwargs["model"])
+
+    with (
+        patch("strix.report.state.get_global_report_state", return_value=report_state),
+        patch("litellm.completion_cost", side_effect=fake_completion_cost),
+    ):
+        litellm_cost_callback(kwargs, response)
+
+    report_state.record_observed_llm_cost.assert_called_once_with(0.025)
+
+
+def test_cost_callback_records_nothing_when_no_cost_available() -> None:
+    report_state = MagicMock()
+    response = {"usage": {"prompt_tokens": 10, "completion_tokens": 5, "total_tokens": 15}}
+
+    with (
+        patch("strix.report.state.get_global_report_state", return_value=report_state),
+        patch("litellm.completion_cost", side_effect=ValueError("unknown model")),
+    ):
+        litellm_cost_callback({"response_cost": None, "model": "x/y"}, response)
+
+    report_state.record_observed_llm_cost.assert_not_called()

tests/test_inputs.py

@@ -155,3 +155,33 @@ def test_make_model_settings_forces_required_for_anyllm_routed_openai_model() ->
     )
 
     assert settings.tool_choice == "required"
+
+
+def test_make_model_settings_sets_request_timeout() -> None:
+    settings = make_model_settings(
+        "none",
+        model_name="gpt-4o",
+        request_timeout=300.0,
+    )
+
+    assert settings.extra_args is not None
+    assert settings.extra_args["timeout"] == 300.0
+
+
+def test_make_model_settings_omits_timeout_when_unset() -> None:
+    settings = make_model_settings("none", model_name="gpt-4o")
+
+    assert settings.extra_args is None
+
+
+def test_make_model_settings_timeout_survives_reasoning_resolve() -> None:
+    # Reasoning is resolved via ModelSettings.resolve(); the timeout in extra_args
+    # must not be dropped when a reasoning override is merged in.
+    settings = make_model_settings(
+        "high",
+        model_name="openai/o3",
+        request_timeout=120.0,
+    )
+
+    assert settings.extra_args is not None
+    assert settings.extra_args["timeout"] == 120.0

tests/test_model_retry.py

@@ -0,0 +1,77 @@
+"""Tests for the model retry policy used by every agent model call.
+
+The SDK's built-in ``http_status`` policy only retries errors that carry a known
+HTTP status code. Quota/billing (and other provider-side) failures often surface
+*inside* a streamed response as a bare error with no status code, so Strix adds a
+statusless retry policy to ``DEFAULT_MODEL_RETRY`` to keep them recoverable — the
+behavior the pre-SDK engine had.
+"""
+
+from __future__ import annotations
+
+import asyncio
+
+from agents.retry import ModelRetryNormalizedError, RetryPolicyContext
+
+from strix.config.models import DEFAULT_MODEL_RETRY, _retry_statusless_provider_errors
+
+
+def _context(normalized: ModelRetryNormalizedError) -> RetryPolicyContext:
+    return RetryPolicyContext(
+        error=RuntimeError("boom"),
+        attempt=1,
+        max_retries=5,
+        stream=True,
+        normalized=normalized,
+        provider_advice=None,
+    )
+
+
+def _retries(normalized: ModelRetryNormalizedError) -> bool:
+    """Evaluate the composed DEFAULT_MODEL_RETRY policy for a normalized error."""
+    policy = DEFAULT_MODEL_RETRY.policy
+    assert policy is not None
+    decision = asyncio.run(policy(_context(normalized)))
+    return bool(getattr(decision, "retry", decision))
+
+
+def test_statusless_error_is_retried() -> None:
+    # A mid-stream quota/billing error arrives with no HTTP status code.
+    assert _retries(ModelRetryNormalizedError(status_code=None)) is True
+
+
+def test_statusless_abort_is_not_retried() -> None:
+    # A user/client cancellation must never be retried.
+    assert _retries(ModelRetryNormalizedError(status_code=None, is_abort=True)) is False
+
+
+def test_client_error_is_not_retried() -> None:
+    # A definitive 4xx client error (bad request/auth) is not recoverable.
+    assert _retries(ModelRetryNormalizedError(status_code=400)) is False
+
+
+def test_rate_limit_and_server_errors_are_retried() -> None:
+    for status in (429, 500, 502, 503, 504):
+        assert _retries(ModelRetryNormalizedError(status_code=status)) is True
+
+
+def test_timeout_error_is_retried() -> None:
+    # A stalled model stream trips the per-request read/inactivity timeout, which
+    # the SDK normalizes as a timeout. DEFAULT_MODEL_RETRY must retry it so a hung
+    # turn recovers instead of silently wedging the agent.
+    assert _retries(ModelRetryNormalizedError(is_timeout=True)) is True
+    assert _retries(ModelRetryNormalizedError(is_network_error=True)) is True
+
+
+def test_policy_helper_matches_statusless_only() -> None:
+    assert _retry_statusless_provider_errors(_context(ModelRetryNormalizedError())) is True
+    assert (
+        _retry_statusless_provider_errors(_context(ModelRetryNormalizedError(status_code=400)))
+        is False
+    )
+    assert (
+        _retry_statusless_provider_errors(
+            _context(ModelRetryNormalizedError(status_code=None, is_abort=True))
+        )
+        is False
+    )

tests/test_models.py

@@ -3,8 +3,13 @@
 from __future__ import annotations
 
 import pytest
+from agents.model_settings import ModelSettings
 
-from strix.config.models import RECOMMENDED_MODEL_NAMES, is_recommended_or_frontier_model
+from strix.config.models import (
+    RECOMMENDED_MODEL_NAMES,
+    is_recommended_or_frontier_model,
+    request_timeout_extra_args,
+)
 
 
 @pytest.mark.parametrize("model_name", RECOMMENDED_MODEL_NAMES)
@@ -12,6 +17,23 @@ def test_recommended_models_are_accepted(model_name: str) -> None:
     assert is_recommended_or_frontier_model(model_name)
 
 
+def test_request_timeout_extra_args_positive() -> None:
+    assert request_timeout_extra_args(300) == {"timeout": 300}
+    assert request_timeout_extra_args(10) == {"timeout": 10}
+
+
+def test_request_timeout_extra_args_survives_model_settings_json_dump() -> None:
+    """The Chat Completions and LiteLLM paths pydantic-serialize ModelSettings for
+    their tracing span; a non-JSON-serializable timeout fails every turn there."""
+    settings = ModelSettings(extra_args=request_timeout_extra_args(300))
+    assert settings.to_json_dict()["extra_args"] == {"timeout": 300}
+
+
+@pytest.mark.parametrize("value", [None, 0, -1])
+def test_request_timeout_extra_args_disabled(value: float | None) -> None:
+    assert request_timeout_extra_args(value) is None
+
+
 def test_recommended_models_are_matched_case_insensitively() -> None:
     assert is_recommended_or_frontier_model("Vertex_AI/Gemini-3-Pro-Preview")
 

tests/test_proxy_client.py

@@ -0,0 +1,156 @@
+"""Tests for the shared Caido client lifecycle and proxy call serialization.
+
+Covers the caching + serialization guarantees of ``caido_api.call_with_client``
+(the sandbox-imported path) and ``proxy.tools._call`` (the host-side path). The
+Caido GraphQL transport is not concurrency-safe, so both paths must run one
+call at a time against the shared client.
+"""
+
+from __future__ import annotations
+
+import asyncio
+from typing import TYPE_CHECKING, Any, cast
+
+import pytest
+
+from strix.tools.proxy import caido_api, tools
+
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+
+class _FakeClient:
+    def __init__(self, name: str) -> None:
+        self.name = name
+        self.closed = False
+
+    async def aclose(self) -> None:
+        self.closed = True
+
+
+@pytest.fixture(autouse=True)
+def _clear_cache() -> Iterator[None]:
+    caido_api._CLIENT_CACHE.clear()
+    yield
+    caido_api._CLIENT_CACHE.clear()
+
+
+async def test_call_with_client_reuses_cached_client(monkeypatch: pytest.MonkeyPatch) -> None:
+    cached = _FakeClient("cached")
+    caido_api._CLIENT_CACHE["default"] = cast("Any", cached)
+
+    async def _new() -> Any:
+        raise AssertionError("_new_client must not run when a client is cached")
+
+    monkeypatch.setattr(caido_api, "_new_client", _new)
+
+    seen: dict[str, Any] = {}
+
+    async def fn(client: Any) -> str:
+        seen["client"] = client
+        return "ok"
+
+    assert await caido_api.call_with_client(fn) == "ok"
+    assert seen["client"] is cached
+
+
+async def test_call_with_client_creates_and_caches_when_empty(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    created = _FakeClient("fresh")
+
+    async def _new() -> Any:
+        return created
+
+    monkeypatch.setattr(caido_api, "_new_client", _new)
+
+    seen: dict[str, Any] = {}
+
+    async def fn(client: Any) -> str:
+        seen["client"] = client
+        return "ok"
+
+    assert await caido_api.call_with_client(fn) == "ok"
+    assert seen["client"] is created
+    assert caido_api._CLIENT_CACHE["default"] is created
+
+
+async def test_failed_init_does_not_poison_cache(monkeypatch: pytest.MonkeyPatch) -> None:
+    async def _new() -> Any:
+        raise ConnectionRefusedError("caido not up yet")
+
+    monkeypatch.setattr(caido_api, "_new_client", _new)
+
+    async def fn(_client: Any) -> str:
+        return "unreachable"
+
+    with pytest.raises(ConnectionRefusedError):
+        await caido_api.call_with_client(fn)
+    assert "default" not in caido_api._CLIENT_CACHE
+
+
+async def test_call_with_client_propagates_errors() -> None:
+    cached = _FakeClient("cached")
+    caido_api._CLIENT_CACHE["default"] = cast("Any", cached)
+
+    async def fn(_client: Any) -> str:
+        raise ValueError("Invalid HTTPQL filter")
+
+    with pytest.raises(ValueError, match="Invalid HTTPQL"):
+        await caido_api.call_with_client(fn)
+    assert caido_api._CLIENT_CACHE["default"] is cached
+
+
+async def test_call_with_client_serializes_concurrent_calls(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    caido_api._CLIENT_CACHE["default"] = cast("Any", _FakeClient("shared"))
+
+    async def _new() -> Any:
+        raise AssertionError("no new client expected")
+
+    monkeypatch.setattr(caido_api, "_new_client", _new)
+
+    state = {"active": 0, "max": 0}
+
+    async def fn(_client: Any) -> str:
+        state["active"] += 1
+        state["max"] = max(state["max"], state["active"])
+        await asyncio.sleep(0.01)
+        state["active"] -= 1
+        return "ok"
+
+    await asyncio.gather(*(caido_api.call_with_client(fn) for _ in range(6)))
+    assert state["max"] == 1
+
+
+async def test_host_call_serializes_concurrent_calls() -> None:
+    client = _FakeClient("host")
+    state = {"active": 0, "max": 0}
+
+    async def fn(_client: Any) -> str:
+        state["active"] += 1
+        state["max"] = max(state["max"], state["active"])
+        await asyncio.sleep(0.01)
+        state["active"] -= 1
+        return "ok"
+
+    await asyncio.gather(*(tools._call(cast("Any", client), fn) for _ in range(6)))
+    assert state["max"] == 1
+
+
+class _Ctx:
+    def __init__(self, context: Any) -> None:
+        self.context = context
+
+
+def test_ctx_client_returns_client_when_present() -> None:
+    client = _FakeClient("host")
+    got = tools._ctx_client(cast("Any", _Ctx({"caido_client": client})))
+    assert got is client
+
+
+def test_ctx_client_returns_none_without_client() -> None:
+    assert tools._ctx_client(cast("Any", _Ctx({}))) is None
+    assert tools._ctx_client(cast("Any", _Ctx(None))) is None

tests/test_runner_rate_limit.py

@@ -37,6 +37,7 @@ async def test_persistent_rate_limit_stops_gracefully(
             model="openai/gpt-4o",
             reasoning_effort="high",
             force_required_tool_choice=False,
+            timeout=300,
         ),
         runtime=types.SimpleNamespace(max_context_images=3),
     )

tests/test_runner_root_prompt.py

@@ -45,6 +45,7 @@ def _patch_engine_scaffold(
             model="openai/gpt-4o",
             reasoning_effort="high",
             force_required_tool_choice=False,
+            timeout=300,
         )
     )
     monkeypatch.setattr(runner, "load_settings", lambda: settings)
@@ -124,8 +125,7 @@ async def test_root_prompt_options_flow_into_root_agent(
     assert "https://example.com" in instructions_override
     assert "CUSTOM SCAN PROMPT" in instructions_override
     assert (
-        "cannot expand, replace, or weaken authorized target constraints"
-        in instructions_override
+        "cannot expand, replace, or weaken authorized target constraints" in instructions_override
     )
     assert kwargs["system_prompt_context"] == {
         **scope_context,

tests/test_update_check.py

@@ -0,0 +1,172 @@
+import hashlib
+import io
+import json
+import platform
+import time
+from pathlib import Path
+
+import pytest
+from rich.console import Console
+
+from strix.interface import update_check
+
+
+@pytest.fixture(autouse=True)
+def _isolated_cache(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(update_check, "_CACHE_PATH", tmp_path / "update-check.json")
+    monkeypatch.setattr(update_check, "_background_thread", None)
+    monkeypatch.delenv("STRIX_NO_UPDATE_CHECK", raising=False)
+    for key in ("CI", "GITHUB_ACTIONS", "GITLAB_CI", "JENKINS_URL", "BUILDKITE", "CIRCLECI"):
+        monkeypatch.delenv(key, raising=False)
+
+
+@pytest.mark.parametrize(
+    ("latest", "current", "expected"),
+    [
+        ("1.2.0", "1.1.0", True),
+        ("1.1.0", "1.1.0", False),
+        ("1.0.9", "1.1.0", False),
+        ("2.0.0", "1.99.99", True),
+        ("1.10.0", "1.9.0", True),
+        ("v1.2.0", "1.1.0", True),
+        ("not-a-version", "1.1.0", False),
+        ("1.2.0", "unknown", False),
+    ],
+)
+def test_is_newer(latest: str, current: str, expected: bool) -> None:
+    assert update_check._is_newer(latest, current) is expected
+
+
+def test_get_available_update_from_cache(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps({"latest_version": "9.9.9", "checked_at": time.time()})
+    )
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    assert update_check.get_available_update() == "9.9.9"
+
+
+def test_get_available_update_up_to_date(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps({"latest_version": "1.0.0", "checked_at": time.time()})
+    )
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    assert update_check.get_available_update() is None
+
+
+def test_get_available_update_disabled_by_env(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps({"latest_version": "9.9.9", "checked_at": time.time()})
+    )
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    monkeypatch.setenv("STRIX_NO_UPDATE_CHECK", "1")
+    assert update_check.get_available_update() is None
+
+
+def test_get_available_update_disabled_in_ci(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps({"latest_version": "9.9.9", "checked_at": time.time()})
+    )
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    monkeypatch.setenv("CI", "true")
+    assert update_check.get_available_update() is None
+
+
+def test_get_available_update_corrupt_cache(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text("{not json")
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    assert update_check.get_available_update() is None
+
+
+def test_background_check_skipped_when_fresh(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps({"latest_version": "1.0.0", "checked_at": time.time()})
+    )
+    called = False
+
+    def fake_refresh() -> None:
+        nonlocal called
+        called = True
+
+    monkeypatch.setattr(update_check, "_refresh_cache", fake_refresh)
+    update_check.start_background_check()
+    assert update_check._background_thread is None
+    assert called is False
+
+
+def test_background_check_runs_when_stale(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps({"latest_version": "1.0.0", "checked_at": time.time() - 2 * 24 * 60 * 60})
+    )
+    monkeypatch.setattr(update_check, "_fetch_latest_version", lambda: "1.2.3")
+    update_check.start_background_check()
+    assert update_check._background_thread is not None
+    update_check._background_thread.join(timeout=5)
+    cache = json.loads(update_check._CACHE_PATH.read_text())
+    assert cache["latest_version"] == "1.2.3"
+
+
+def test_skipped_version_suppresses_update(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps({"latest_version": "9.9.9", "checked_at": time.time()})
+    )
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    update_check.skip_version("9.9.9")
+    assert update_check.get_available_update() is None
+    assert update_check.get_available_update(respect_skip=False) == "9.9.9"
+
+
+def test_newer_release_overrides_skipped_version(monkeypatch: pytest.MonkeyPatch) -> None:
+    update_check._CACHE_PATH.write_text(
+        json.dumps(
+            {"latest_version": "9.9.10", "checked_at": time.time(), "skipped_version": "9.9.9"}
+        )
+    )
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    assert update_check.get_available_update() == "9.9.10"
+
+
+def test_write_cache_preserves_existing_fields() -> None:
+    update_check.skip_version("9.9.9")
+    update_check._write_cache(latest_version="1.2.3", checked_at=123.0)
+    cache = json.loads(update_check._CACHE_PATH.read_text())
+    assert cache == {"latest_version": "1.2.3", "checked_at": 123.0, "skipped_version": "9.9.9"}
+
+
+def test_get_upgrade_command_all_methods() -> None:
+    assert update_check.get_upgrade_command("binary") == "strix --update"
+    assert update_check.get_upgrade_command("pipx") == "pipx upgrade strix-agent"
+    assert update_check.get_upgrade_command("uv") == "uv tool upgrade strix-agent"
+    assert update_check.get_upgrade_command("pip") == "pip install --upgrade strix-agent"
+
+
+def test_self_update_non_binary_prints_command(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(update_check, "is_binary_install", lambda: False)
+    buffer = io.StringIO()
+    assert update_check.self_update(Console(file=buffer)) is False
+    assert "upgrade" in buffer.getvalue()
+
+
+def test_self_update_already_latest(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(update_check, "is_binary_install", lambda: True)
+    monkeypatch.setattr(update_check, "_fetch_latest_version", lambda: "1.0.0")
+    monkeypatch.setattr(update_check, "get_version", lambda: "1.0.0")
+    assert update_check.self_update() is True
+
+
+def test_sha256_file(tmp_path: Path) -> None:
+    path = tmp_path / "blob"
+    path.write_bytes(b"strix")
+    assert update_check._sha256_file(path) == hashlib.sha256(b"strix").hexdigest()
+
+
+def test_release_target(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setattr(platform, "system", lambda: "Linux")
+    monkeypatch.setattr(platform, "machine", lambda: "x86_64")
+    assert update_check._release_target() == "linux-x86_64"
+
+    monkeypatch.setattr(platform, "system", lambda: "Darwin")
+    monkeypatch.setattr(platform, "machine", lambda: "arm64")
+    assert update_check._release_target() == "macos-arm64"
+
+    monkeypatch.setattr(platform, "machine", lambda: "riscv64")
+    assert update_check._release_target() is None