fix(llm): cap the subscription backend's responses too

containers/Dockerfile

@@ -16,8 +16,7 @@ RUN mkdir -p /out/bin && \
     go install -v github.com/projectdiscovery/katana/cmd/katana@latest && \
     go install -v github.com/projectdiscovery/cvemap/cmd/vulnx@latest && \
     go install -v github.com/jaeles-project/gospider@latest && \
-    go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest && \
-    go install -v golang.org/x/vuln/cmd/govulncheck@latest
+    go install -v github.com/projectdiscovery/interactsh/cmd/interactsh-client@latest
 
 # ---------------------------------------------------------------------------
 # Runtime stage
@@ -54,7 +53,6 @@ RUN apt-get update && \
     nmap ncat ndiff \
     sqlmap nuclei subfinder naabu ffuf \
     nodejs npm pipx \
-    golang-go \
     libcap2-bin \
     gdb \
     libnss3-tools \

pyproject.toml

@@ -238,7 +238,6 @@ ignore = [
 "tests/test_disable_streaming.py" = ["N802"]
 "tests/test_tool_call_ids.py" = ["N802"]
 "tests/test_tool_call_limits.py" = ["N802", "SLF001"]
-"tests/test_stream_idle_timeout.py" = ["N802", "SLF001"]
 "tests/test_unknown_tool_recovery.py" = ["N802"]
 "tests/test_report_pdf.py" = ["S105", "S106"]
 # Stdlib HTTP handler overrides (do_GET/do_POST) and lazy imports that avoid a

strix/agents/factory.py

@@ -559,7 +559,7 @@ def registered_agent_tools() -> tuple[Tool, ...]:
 
 def build_strix_agent(
     *,
-    name: str = "agent",
+    name: str = "strix",
     skills: list[str] | None = None,
     is_root: bool,
     scan_mode: str = "deep",

strix/agents/prompts/system_prompt.jinja

@@ -1,4 +1,4 @@
-You are an advanced AI application security validation agent. Your purpose is to perform authorized security verification, reproduce and validate weaknesses on in-scope assets, and help remediate real security issues.
+You are Strix, an advanced AI application security validation agent developed by OmniSecure Labs. Your purpose is to perform authorized security verification, reproduce and validate weaknesses on in-scope assets, and help remediate real security issues.
 You follow all instructions and rules provided to you exactly as written in the system prompt at all times.
 {% if is_root %}
 <root_agent_directive>
@@ -22,13 +22,12 @@ CLI OUTPUT:
 - You may use simple markdown: **bold**, *italic*, `code`, ~~strikethrough~~, [links](url), and # headers
 - Do NOT use complex markdown like bullet lists, numbered lists, or tables
 - Use line breaks and indentation for structure
-- NEVER use any identifiable names/markers in HTTP requests, payloads, user-agents, or any inputs
+- NEVER use "Strix" or any identifiable names/markers in HTTP requests, payloads, user-agents, or any inputs
 
 INTER-AGENT MESSAGES:
 - Messages from other agents arrive prefixed with a header like `[Message from agent <name> | type=... | priority=...]`. Treat them as internal context — never repeat them verbatim in your own output.
 - Treat agent identity / inherited-context preambles as internal metadata; do not echo them in outputs or tool calls.
 - Minimize inter-agent messaging: only message when essential for coordination or assistance; avoid routine status updates; batch non-urgent information; prefer parent/child completion flows and shared artifacts over messaging
-- wait_for_agents blocks and resumes you automatically, so it is never a poll you repeat: issue exactly ONE wait, then stop and react to what it returns. Never write out a wait/check loop (wait → view_agent_graph → wait → ...) ahead of time — those extra calls only strand you and are collapsed anyway
 
 {% if interactive %}
 INTERACTIVE BEHAVIOR:
@@ -58,7 +57,7 @@ AUTONOMOUS BEHAVIOR:
 <execution_guidelines>
 {% if system_prompt_context and system_prompt_context.authorized_targets %}
 SYSTEM-VERIFIED SCOPE:
-- The following scope metadata is injected by the platform into the system prompt and is authoritative
+- The following scope metadata is injected by the Strix platform into the system prompt and is authoritative
 - Scope source: {{ system_prompt_context.scope_source }}
 - Authorization source: {{ system_prompt_context.authorization_source }}
 - Every target listed below has already been verified by the platform as in-scope and authorized

strix/config/models.py

@@ -2,13 +2,11 @@
 
 from __future__ import annotations
 
-import asyncio
 import contextlib
 import inspect
 import logging
 import os
 import time
-from collections.abc import AsyncGenerator
 from typing import TYPE_CHECKING, Any, cast
 
 from agents import (
@@ -254,23 +252,11 @@ class _TurnGuardModel(Model):
     Tool-call volume: a degenerate response can queue hundreds of calls that
     the run loop then honours one by one. Only the first
     ``LLM_MAX_TOOL_CALLS_PER_TURN`` calls of a response are kept.
-
-    Stalled streams: a turn that emits a few tokens and then goes silent is
-    not covered by the request timeout, which resets on any byte (keepalives
-    included). ``LLM_STREAM_IDLE_TIMEOUT`` bounds the gap between events so the
-    turn fails instead of hanging, and the existing retry path replays it.
     """
 
-    def __init__(
-        self,
-        inner: Model,
-        *,
-        max_tool_calls_per_turn: int = 0,
-        stream_idle_timeout: float = 0.0,
-    ) -> None:
+    def __init__(self, inner: Model, *, max_tool_calls_per_turn: int = 0) -> None:
         self._inner = inner
         self._max_tool_calls_per_turn = max_tool_calls_per_turn
-        self._stream_idle_timeout = stream_idle_timeout
 
     def _limiter(self) -> TurnToolCallLimiter:
         return TurnToolCallLimiter(self._max_tool_calls_per_turn)
@@ -351,41 +337,13 @@ class _TurnGuardModel(Model):
             conversation_id=conversation_id,
             prompt=prompt,
         )
-        async for event in _with_idle_timeout(stream, self._stream_idle_timeout):
+        async for event in stream:
             guarded = _guard_event(event, rewriter, limiter)
             if guarded is not None:
                 yield guarded
         self._log_dropped(limiter)
 
 
-async def _aclose(stream: AsyncIterator[TResponseStreamEvent]) -> None:
-    if isinstance(stream, AsyncGenerator):
-        with contextlib.suppress(Exception):
-            await stream.aclose()
-
-
-async def _with_idle_timeout(
-    stream: AsyncIterator[TResponseStreamEvent], timeout: float
-) -> AsyncIterator[TResponseStreamEvent]:
-    if timeout <= 0:
-        async for event in stream:
-            yield event
-        return
-
-    iterator = stream.__aiter__()
-    while True:
-        try:
-            event = await asyncio.wait_for(iterator.__anext__(), timeout)
-        except StopAsyncIteration:
-            return
-        except TimeoutError:
-            await _aclose(stream)
-            message = f"model stream produced no event for {timeout:.0f}s"
-            logger.warning("%s; abandoning the turn", message)
-            raise TimeoutError(message) from None
-        yield event
-
-
 def _guard_event(
     event: TResponseStreamEvent, rewriter: TurnCallIdRewriter, limiter: TurnToolCallLimiter
 ) -> TResponseStreamEvent | None:
@@ -471,7 +429,6 @@ class StrixProvider(MultiProvider):
     def get_model(self, model_name: str | None) -> Model:
         llm = load_settings().llm
         slug = codex.subscription_model(model_name)
-        idle_timeout = float(llm.stream_idle_timeout)
         if slug:
             # The ChatGPT subscription backend is always streamed; it has no
             # non-streaming mode to fall back to, so LLM_DISABLE_STREAMING
@@ -485,15 +442,7 @@ class StrixProvider(MultiProvider):
             model = super().get_model(model_name)
             if llm.disable_streaming:
                 model = _NonStreamingModel(model)
-                # The wrapper emits its single event only once the whole request
-                # is done, so an idle gap is meaningless here; the request
-                # timeout bounds it instead.
-                idle_timeout = 0.0
-        return _TurnGuardModel(
-            model,
-            max_tool_calls_per_turn=llm.max_tool_calls_per_turn,
-            stream_idle_timeout=idle_timeout,
-        )
+        return _TurnGuardModel(model, max_tool_calls_per_turn=llm.max_tool_calls_per_turn)
 
 
 DEFAULT_MODEL_RETRY = ModelRetrySettings(

strix/config/settings.py

@@ -57,7 +57,6 @@ class LlmSettings(BaseSettings):
         alias="LLM_DISABLE_STREAMING",
     )
     timeout: int = Field(default=300, alias="LLM_TIMEOUT")
-    stream_idle_timeout: int = Field(default=300, ge=0, alias="LLM_STREAM_IDLE_TIMEOUT")
     max_tool_calls_per_turn: int = Field(
         default=32,
         ge=0,

strix/core/execution.py

@@ -838,7 +838,7 @@ async def _append_tool_required_message(
         )
     else:
         message = (
-            "Your previous response ended the autonomous run without a lifecycle tool "
+            "Your previous response ended the autonomous Strix run without a lifecycle tool "
             "call. That is invalid in non-interactive mode; plain text final answers are "
             "ignored. Continue immediately and call exactly one tool. "
             f"If your work is complete, call {finish_tool}. "

strix/core/hooks.py

@@ -20,8 +20,6 @@ if TYPE_CHECKING:
 logger = logging.getLogger(__name__)
 
 
-LLM_TURN_KEY = "llm_turn"
-
 _STAGE_LABELS: tuple[str, ...] = ("NOTICE", "URGENT", "CRITICAL")
 _TURN_WARN_BANDS: tuple[float, ...] = (0.70, 0.85, 0.95)
 _ROOT_BUDGET_WARN_BANDS: tuple[float, ...] = (0.70, 0.85, 0.95)
@@ -146,7 +144,6 @@ class ReportUsageHooks(RunHooks[dict[str, Any]]):
         system_prompt: str | None,  # noqa: ARG002
         input_items: list[TResponseInputItem],
     ) -> None:
-        context.context[LLM_TURN_KEY] = int(context.context.get(LLM_TURN_KEY, 0)) + 1
         try:
             self._maybe_warn_turns(context, input_items)
             self._maybe_warn_budget(context, input_items)

strix/core/runner.py

@@ -293,7 +293,7 @@ async def run_strix_scan(
         )
 
         root_agent = build_strix_agent(
-            name="Root Agent",
+            name="Strix",
             skills=skills,
             is_root=True,
             scan_mode=scan_mode,
@@ -307,7 +307,7 @@ async def run_strix_scan(
         if not is_resume:
             await coordinator.register(
                 root_id,
-                "Root Agent",
+                "Strix",
                 parent_id=None,
                 task=root_task,
                 skills=skills,

strix/interface/tui/internal/render/dependency.go

@@ -57,12 +57,6 @@ func renderDependencyReport(args map[string]any, result any) string {
 	section("Description", StringValue(args["description"]))
 	section("Impact", StringValue(args["impact"]))
 	section("Technical Analysis", StringValue(args["technical_analysis"]))
-	if reach := StringValue(args["reachability"]); reach != "" && reach != "unknown" {
-		b.WriteString("\n\n" + Bold(Field).Render("Usage evidence: ") + reach)
-		if ev := StringValue(args["reachability_evidence"]); ev != "" {
-			b.WriteString("\n" + ev)
-		}
-	}
 	section("Assumptions", StringValue(args["assumptions"]))
 	section("Remediation", StringValue(args["remediation_steps"]))
 	if title == "" {

strix/interface/tui/live_view.py

@@ -431,7 +431,7 @@ _INTERNAL_TURN_PREFIXES = (
     "== Inherited context from parent",
     # strix.core.execution: the no-tool-call recovery nudge, both modes.
     "Your previous message ended a turn without a tool call.",
-    "Your previous response ended the autonomous run without a lifecycle tool call.",
+    "Your previous response ended the autonomous Strix run without a lifecycle tool call.",
     # strix.core.hooks: budget warnings, the only notices injected unwrapped.
     *(
         f"[{label}] {subject}"

strix/interface/utils.py

@@ -1102,7 +1102,7 @@ def resolve_diff_scope_context(
 def _is_http_git_repo(url: str) -> bool:
     check_url = f"{url.rstrip('/')}/info/refs?service=git-upload-pack"
     try:
-        with requests.get(check_url, headers={"User-Agent": "git/2.43.0"}, timeout=10) as resp:
+        with requests.get(check_url, headers={"User-Agent": "git/strix"}, timeout=10) as resp:
             if resp.status_code >= 400:
                 return resp.status_code == 401
             return "x-git-upload-pack-advertisement" in resp.headers.get("Content-Type", "")

strix/report/dedupe.py

@@ -183,24 +183,6 @@ def _dependency_identity(report: dict[str, Any]) -> tuple[str, str, str] | None:
     return cve, ecosystem, package_name
 
 
-def _manifest_path(report: dict[str, Any]) -> str:
-    metadata = report.get("dependency_metadata")
-    if not isinstance(metadata, dict):
-        return ""
-    return str(metadata.get("manifest_path") or "").strip()
-
-
-def _distinct_manifest_paths(candidate: dict[str, Any], report: dict[str, Any]) -> bool:
-    """Same CVE/package observed in two different manifests is two findings.
-
-    Only applies when both sides carry a manifest_path; a missing path keeps
-    the legacy CVE/package/ecosystem identity.
-    """
-    candidate_path = _manifest_path(candidate)
-    report_path = _manifest_path(report)
-    return bool(candidate_path and report_path and candidate_path != report_path)
-
-
 def _report_cve(report: dict[str, Any]) -> str:
     return str(report.get("cve") or "").strip().upper()
 
@@ -246,8 +228,6 @@ def _check_dependency_duplicate(
             report_cve, report_ecosystem, report_package_name = report_identity
             if (report_cve, report_package_name) != (cve, package_name):
                 continue
-            if _distinct_manifest_paths(candidate, report):
-                continue
             if report_ecosystem == ecosystem:
                 return {
                     "is_duplicate": True,

strix/skills/custom/dependency_cve_scanning.md

@@ -28,7 +28,7 @@ Run from the repo root and store output in the shared artifact directory used by
 the source-aware pass:
 
 ```bash
-ART=/workspace/.source-aware
+ART=/workspace/.strix-source-aware
 mkdir -p "$ART"
 
 # Record the vuln DB age so a stale DB is a visible signal, not a silent clean scan.
@@ -77,10 +77,8 @@ For each entry under `.Results[].Vulnerabilities[]` in `trivy-sca.json`, collect
 - `CVSS` — the published advisory base score
 - `PrimaryURL` / references — to verify the advisory
 
-Deduplicate by `(CVE, PkgName, Target)` — the same CVE/package observed in two
-different manifests (e.g. two workspaces of a monorepo) is two findings, one
-per manifest. File one `create_dependency_report` per CVE — do not batch
-multiple CVEs into one report.
+Deduplicate by `(CVE, PkgName, InstalledVersion)`. File one
+`create_dependency_report` per CVE — do not batch multiple CVEs into one report.
 
 ### Attribute transitive CVEs to the direct dependency
 
@@ -112,76 +110,15 @@ resolution (npm `overrides` / yarn `resolutions` / pnpm `pnpm.overrides` /
 Maven `dependencyManagement` / Gradle resolution strategy / `go mod edit`),
 not just "upgrade <vulnerable pkg> to <fixed>".
 
-### Usage / reachability analysis (required for every dependency CVE)
-
-For every CVE you are about to report, run a static usage analysis and record
-the result in the structured `reachability` + `reachability_evidence` fields.
-The level is an **evidence ladder, never an exploitability verdict** — claim
-only what you proved, and cite the proof. It never changes severity (that is
-`advisory_cvss` alone); it exists so the reader can prioritize.
-
-**Go — use govulncheck (real call-graph analysis):**
-
-```bash
-# Symbol-level: reports only vulnerabilities whose vulnerable functions are
-# actually reachable from application code. Needs the Go toolchain + module
-# deps; if either is missing, fall back to the checks below rather than
-# claiming a level.
-if command -v govulncheck >/dev/null && go version >/dev/null 2>&1; then
-  govulncheck -format json ./... > "$ART/govulncheck.json" || true
-fi
-```
-
-- A finding with a call stack ⇒ `reachability=reachable_call_path`, put the
-  call-path excerpt (entrypoint → vulnerable function) in
-  `reachability_evidence`.
-- Listed as affecting a required module but with no reachable symbol ⇒ fall
-  back to the import/symbol checks below (`imported` / `not_imported`).
-
-**All other ecosystems — import check, then symbol match:**
-
-1. **Import check.** Search application code (exclude lockfiles, vendored
-   deps, `node_modules`, build output) for imports of the vulnerable package:
-   `ast-grep`/`rg` for `import`/`require`/`from X import` of the package (and
-   its ecosystem import name, which may differ from the registry name, e.g.
-   `PyYAML` → `yaml`). No hits ⇒ `not_imported`, with the search scope stated
-   in `reachability_evidence`. For a **transitive** dependency, the check is
-   whether application code imports it directly; if not, it is reachable only
-   through the direct dependency — check whether the direct dep's usage can
-   hit it (if unclear, use `imported` when the direct dep is used at all).
-2. **Symbol match.** Read the advisory (GHSA/NVD/OSV `affected[].ecosystem_specific.imports` or the
-   advisory text) for the affected functions/classes/APIs. Search application
-   code for those symbols (`ast-grep` pattern or `rg -n`). Hits ⇒
-   `vulnerable_symbol_used`, with repo-relative `file:line` of each hit (up
-   to a handful) in `reachability_evidence`. Imported but no affected-symbol
-   usage found (or the advisory names no symbols) ⇒ `imported`.
-3. If the analysis was not performed or is inconclusive (obfuscated code,
-   dynamic loading, unparsable sources) ⇒ `unknown` and say why in
-   `assumptions`.
-
-Cheap-first budgeting: the import check is one search per package — always do
-it. Do the symbol match at least for every `critical`/`high`/KEV CVE; batch
-the searches. Never let this analysis stall reporting — `unknown` with a
-reason beats an unverified claim.
-
-Anti-overclaim rules:
-
-- `not_imported` still does NOT mean safe (dynamic `import()`/reflection/
-  framework wiring evade static search) — never phrase it as "not exploitable".
-- `reachable_call_path` is reserved for call-graph tools (govulncheck); a
-  symbol grep hit is `vulnerable_symbol_used`, no matter how convinced you are.
-- The tool rejects any level other than `unknown` without
-  `reachability_evidence`.
-
 ### Reachability is a confidence modifier, not a gate
 
 Do NOT suppress or downgrade a known CVE just because you could not prove the
 vulnerable code path is reachable. Report it, set `advisory_cvss` from the
-advisory, record the usage analysis in `reachability`/`reachability_evidence`,
-and use `assumptions` for anything softer. If you *can* actually trigger the
-vulnerable path or chain it into a dynamic exploit, additionally report that
-as a normal dynamic finding with `create_vulnerability_report` (the standalone
-CVE stays in its own `create_dependency_report`).
+advisory, and use `assumptions` to note reachability (e.g. "the vulnerable
+`template()` API does not appear to be imported in application code, so practical
+exploitability is uncertain"). If you *can* show reachability or chain it into a
+dynamic exploit, do that and report it as a normal dynamic finding with
+`create_vulnerability_report` instead.
 
 ## Reporting
 
@@ -202,12 +139,6 @@ findings and rejects empty PoC fields):
   - `package_ecosystem` — normalized ecosystem from `.Results[].Type` (lowercased,
     e.g. `npm`, `pypi`, `go`, `maven`, `rubygems`, `cargo`) (required).
   - `fixed_version` — `FixedVersion` (leave empty only if no fix is published).
-  - `manifest_path` — the repo-relative `Target` lockfile/manifest path
-    (required). Strip any scan-workspace or repo checkout directory prefix so
-    the path is relative to the repository root (e.g. `package-lock.json`,
-    `services/api/pom.xml`); the tool rejects absolute paths and `..` segments.
-    This binds the finding to the exact file so remediation can target the
-    right repository.
 - Reference the repo-relative `Target` lockfile path in `description` /
   `technical_analysis` (no leading slash) so the finding is traceable.
 - Put the concrete proof in `description` / `technical_analysis`: package name,
@@ -221,8 +152,7 @@ findings and rejects empty PoC fields):
 - Set `cwe` to the most specific `CWE-NNN` when the advisory names one.
 - Do NOT cap severity at LOW just because there is no dynamic reproduction — use
   the advisory score.
-- Set `reachability` + `reachability_evidence` from the usage analysis above;
-  use `assumptions` for anything softer (confidence, caveats, analysis limits).
+- Use `assumptions` for reachability/exploitability caveats.
 
 Verify the CVE with `web_search` when available before reporting. Never guess or
 hallucinate a CVE id.
@@ -238,5 +168,3 @@ hallucinate a CVE id.
 - Do not silently drop a known CVE because it lacks a dynamic PoC — that is the
   exact failure this skill prevents.
 - Do not downgrade advisory severity for lack of dynamic reproduction.
-- Do not claim a `reachability` level the evidence does not prove — `unknown`
-  with a reason is always acceptable; an overclaimed level never is.

strix/skills/custom/source_aware_sast.md

@@ -12,7 +12,7 @@ Use this skill for source-heavy analysis where static and structural signals sho
 Run tools from repo root and store outputs in a dedicated artifact directory:
 
 ```bash
-mkdir -p /workspace/.source-aware
+mkdir -p /workspace/.strix-source-aware
 ```
 
 ## Baseline Coverage Bundle (Recommended)
@@ -20,7 +20,7 @@ mkdir -p /workspace/.source-aware
 Run this baseline once per repository before deep narrowing:
 
 ```bash
-ART=/workspace/.source-aware
+ART=/workspace/.strix-source-aware
 mkdir -p "$ART"
 
 semgrep scan --config p/default --config p/golang --config p/secrets \
@@ -30,7 +30,7 @@ python3 - <<'PY'
 import json
 from pathlib import Path
 
-art = Path("/workspace/.source-aware")
+art = Path("/workspace/.strix-source-aware")
 semgrep_json = art / "semgrep.json"
 targets_file = art / "sg-targets.txt"
 
@@ -70,10 +70,10 @@ Use Semgrep as the default static triage pass:
 ```bash
 # Preferred deterministic profile set (works with --metrics=off)
 semgrep scan --config p/default --config p/golang --config p/secrets \
-  --metrics=off --json --output /workspace/.source-aware/semgrep.json .
+  --metrics=off --json --output /workspace/.strix-source-aware/semgrep.json .
 
 # If you choose auto config, do not combine it with --metrics=off
-semgrep scan --config auto --json --output /workspace/.source-aware/semgrep-auto.json .
+semgrep scan --config auto --json --output /workspace/.strix-source-aware/semgrep-auto.json .
 ```
 
 If diff scope is active, restrict to changed files first, then expand only when needed.
@@ -85,8 +85,8 @@ Use `sg` for structure-aware code hunting:
 ```bash
 # Ruleless structural pass over deterministic target list (no sgconfig.yml required)
 xargs -r -n 200 sg run --pattern '$F($$$ARGS)' --json=stream \
-  < /workspace/.source-aware/sg-targets.txt \
-  > /workspace/.source-aware/ast-grep.json 2> /workspace/.source-aware/ast-grep.log || true
+  < /workspace/.strix-source-aware/sg-targets.txt \
+  > /workspace/.strix-source-aware/ast-grep.json 2> /workspace/.strix-source-aware/ast-grep.log || true
 ```
 
 Target high-value patterns such as:
@@ -110,15 +110,15 @@ Use outputs to improve route/symbol/sink maps for subsequent targeted scans.
 Detect hardcoded credentials:
 
 ```bash
-gitleaks detect --source . --report-format json --report-path /workspace/.source-aware/gitleaks.json
-trufflehog filesystem --json . > /workspace/.source-aware/trufflehog.json
+gitleaks detect --source . --report-format json --report-path /workspace/.strix-source-aware/gitleaks.json
+trufflehog filesystem --json . > /workspace/.strix-source-aware/trufflehog.json
 ```
 
 Run repository-wide dependency and config checks:
 
 ```bash
 trivy fs --scanners vuln,misconfig --timeout 30m --offline-scan \
-  --format json --output /workspace/.source-aware/trivy-fs.json . || true
+  --format json --output /workspace/.strix-source-aware/trivy-fs.json . || true
 ```
 
 Known-CVE dependency findings are the one exception to the "report only after
@@ -132,9 +132,9 @@ For frontends and Node services, layer these on top of the language-agnostic
 passes above:
 
 ```bash
-retire --path . --outputformat json --outputpath /workspace/.source-aware/retire.json || true
+retire --path . --outputformat json --outputpath /workspace/.strix-source-aware/retire.json || true
 eslint --no-config-lookup --rule '{"no-eval":2,"no-implied-eval":2}' \
-  -f json -o /workspace/.source-aware/eslint.json . || true
+  -f json -o /workspace/.strix-source-aware/eslint.json . || true
 ```
 
 When you hit a minified bundle, run `js-beautify <file>` for a readable

strix/skills/technologies/active_directory.md

@@ -202,7 +202,7 @@ Confirm with a version/patch check before firing — these are destructive.
 
 ## Tooling
 
-**None of the AD tools below ship in the sandbox by default** (the image is Kali-rolling but installs only web-focused tooling). Install what the task needs — the sandbox has `pipx`, `pip`, `go`, `git`, and Kali's apt repos. AD testing also requires **network reachability to the target DC/subnet**, which the default web-target sandbox usually lacks; confirm connectivity first.
+**None of the AD tools below ship in the Strix sandbox by default** (the image is Kali-rolling but installs only web-focused tooling). Install what the task needs — the sandbox has `pipx`, `pip`, `go`, `git`, and Kali's apt repos. AD testing also requires **network reachability to the target DC/subnet**, which the default web-target sandbox usually lacks; confirm connectivity first.
 
 ```
 # Python identity toolkit (impacket = GetUserSPNs/GetNPUsers/secretsdump/ntlmrelayx/getST/addcomputer/rbcd)

strix/skills/tooling/python.md

@@ -5,7 +5,7 @@ description: Run Python through exec_command in the SDK sandbox. Use the image-b
 
 # Python In The Sandbox
 
-Use `exec_command` for Python. There is no separate Python executor.
+Use `exec_command` for Python. There is no separate Strix Python executor.
 
 Prefer writing reusable scripts to a `.py` file and running them with
 `python3 <name>.py`. For short one-off transformations, `python3 -c` or a

strix/skills/vulnerabilities/prototype_pollution.md

@@ -80,7 +80,7 @@ Gadget availability depends on package versions — enumerate `node_modules` in
 1. **Identify merge points** — Search for extend/merge/defaults/deep copy on user-controlled objects
 2. **Baseline probe** — Inject benign pollution marker:
    ```json
-   {"__proto__": {"pollutionCanary": "yes"}}
+   {"__proto__": {"strixPolluted": "yes"}}
    ```
    Verify via response behavior, error messages, or follow-up request reading shared state
 3. **Shape variants** — Test `__proto__`, `constructor.prototype`, nested bracket notation
@@ -121,7 +121,7 @@ Gadget availability depends on package versions — enumerate `node_modules` in
 
 ## Pro Tips
 
-1. Always verify pollution with a unique canary key (`pollutionCanary_<random>`) before attempting RCE gadgets
+1. Always verify pollution with a unique canary key (`strixPolluted_<random>`) before attempting RCE gadgets
 2. In white-box scans, grep for `merge`, `extend`, `defaultsDeep`, `assign` with user input
 3. Check both request parsing and response template config merges (second-order)
 4. Node gadget chains are version-specific — confirm package version before claiming RCE

strix/tools/agents_graph/tools.py

@@ -14,7 +14,6 @@ from agents import RunContextWrapper, function_tool
 
 from strix.core.agents import Status, coordinator_from_context
 from strix.core.execution import notify_parent_on_terminal
-from strix.core.hooks import LLM_TURN_KEY
 from strix.skills import validate_requested_skills
 
 
@@ -225,7 +224,6 @@ _WAIT_DEFAULT_TIMEOUT_S = 300
 # ``timeout_seconds`` the model asks for. One second of headroom lets the
 # tool's own timeout fire first and return a clean result.
 _WAIT_HARD_CEILING_S = _WAIT_DEFAULT_TIMEOUT_S + 1
-_WAITED_TURN_KEY = "waited_llm_turn"
 
 
 @function_tool(timeout=_WAIT_HARD_CEILING_S)
@@ -241,11 +239,6 @@ async def wait_for_agents(  # noqa: PLR0911
     completion reports. You resume the instant any message arrives, so
     size ``timeout_seconds`` to the work you're awaiting.
 
-    **Issue exactly one wait, then stop and react to what it returns.**
-    This call blocks and resumes on its own; it is not a poll you repeat.
-    Do not write out a wait/check loop ahead of time — a second wait in
-    the same turn returns immediately without waiting.
-
     **This tool is only for waiting on other agents.** Two things it is
     NOT for:
 
@@ -297,24 +290,6 @@ async def wait_for_agents(  # noqa: PLR0911
             default=str,
         )
 
-    turn = inner.get(LLM_TURN_KEY)
-    if turn is not None and inner.get(_WAITED_TURN_KEY) == turn:
-        return json.dumps(
-            {
-                "success": True,
-                "wait_outcome": "already_waited",
-                "reason": reason,
-                "note": (
-                    "You already waited in this turn. A single wait_for_agents blocks and "
-                    "resumes on its own, so queueing more waits only strands you — issue one "
-                    "wait, then react to what it returns."
-                ),
-            },
-            ensure_ascii=False,
-            default=str,
-        )
-    inner[_WAITED_TURN_KEY] = turn
-
     async with coordinator._lock:
         stopped = coordinator.statuses.get(me) == "stopped"
     if stopped:

strix/tools/output_store.py

@@ -1,7 +1,7 @@
 """Bound oversized tool results before they enter agent history.
 
 Oversized results are spilled into the sandbox at
-``/workspace/.tool-output/<id>.txt``; the agent sees a head + tail slice
+``/workspace/.strix/tool-output/<id>.txt``; the agent sees a head + tail slice
 plus the path and reads the rest back with its own file tools. The spill writer
 is injected by the runner via :func:`configure_spill_writer`.
 """
@@ -25,7 +25,7 @@ _WORKSPACE_SPILL_NOTICE = (
     "in the sandbox; read it with exec_command (e.g. `sed -n`, `grep`, `cat`) ...]"
 )
 
-WORKSPACE_SPILL_DIR = "/workspace/.tool-output"
+WORKSPACE_SPILL_DIR = "/workspace/.strix/tool-output"
 
 # Longest possible workspace path, used only to reserve notice bytes.
 _SAMPLE_WORKSPACE_PATH = f"{WORKSPACE_SPILL_DIR}/{'0' * 32}.txt"

strix/tools/proxy/caido_api.py

@@ -189,11 +189,7 @@ def build_raw_request(
 
     final_headers = {**headers}
     final_headers.setdefault("Host", parsed.netloc)
-    final_headers.setdefault(
-        "User-Agent",
-        "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 "
-        "(KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
-    )
+    final_headers.setdefault("User-Agent", "strix")
     # Framing headers inherited from the captured request describe the ORIGINAL
     # body; once the body is modified for replay they are stale. We always send a
     # plain (non-chunked) body with an explicit Content-Length, so drop any

strix/tools/reporting/tool.py

@@ -719,36 +719,6 @@ def _dependency_severity(advisory_cvss: float | None) -> tuple[float, str]:
     return score, "none"
 
 
-_VALID_REACHABILITY = frozenset(
-    {
-        "not_imported",
-        "imported",
-        "vulnerable_symbol_used",
-        "reachable_call_path",
-        "unknown",
-    }
-)
-
-
-def _validate_manifest_path(manifest_path: str | None) -> str | None:
-    """Return an error message when manifest_path is missing or unsafe."""
-    path = (manifest_path or "").strip()
-    if not path:
-        return (
-            "manifest_path is required: pass the repo-relative path of the "
-            "lockfile/manifest where the vulnerable version was observed "
-            "(trivy's Target, e.g. 'package-lock.json' or "
-            "'services/api/pom.xml'). It binds the finding to its exact file "
-            "so remediation can target the right repository."
-        )
-    if path.startswith("/") or "\\" in path or path.split("/")[0].endswith(":"):
-        return f"manifest_path must be a relative path within the repository, got {path!r}"
-    segments = path.split("/")
-    if any(segment in ("", ".", "..") for segment in segments):
-        return f"manifest_path must not contain empty, '.', or '..' segments, got {path!r}"
-    return None
-
-
 def _build_dependency_metadata(
     *,
     package_name: str,
@@ -757,9 +727,6 @@ def _build_dependency_metadata(
     fixed_version: str | None,
     introduced_by: str | None,
     dependency_path: str | None,
-    manifest_path: str | None = None,
-    reachability: str | None = None,
-    reachability_evidence: str | None = None,
 ) -> dict[str, str]:
     metadata = {
         "package_name": package_name.strip(),
@@ -767,33 +734,15 @@ def _build_dependency_metadata(
     }
     if package_ecosystem and package_ecosystem.strip():
         metadata["package_ecosystem"] = package_ecosystem.strip()
-    if manifest_path and manifest_path.strip():
-        metadata["manifest_path"] = manifest_path.strip()
     if fixed_version and fixed_version.strip():
         metadata["fixed_version"] = fixed_version.strip()
     if introduced_by and introduced_by.strip():
         metadata["introduced_by"] = introduced_by.strip()
     if dependency_path and dependency_path.strip():
         metadata["dependency_path"] = dependency_path.strip()
-    # "unknown" is the absent case — omitting it keeps the jsonb contract clean,
-    # and evidence without a level would have nothing to qualify.
-    if reachability and reachability.strip() and reachability.strip() != "unknown":
-        metadata["reachability"] = reachability.strip()
-        if reachability_evidence and reachability_evidence.strip():
-            metadata["reachability_evidence"] = reachability_evidence.strip()
     return metadata
 
 
-_REACHABILITY_EVIDENCE_LABELS = {
-    "not_imported": "not imported by application code",
-    "imported": "imported by application code; affected API usage unconfirmed",
-    "vulnerable_symbol_used": "the advisory's affected API is used in application code",
-    "reachable_call_path": (
-        "a call path from application code to the vulnerable function was proven"
-    ),
-}
-
-
 def _build_dependency_evidence(
     *,
     cve: str,
@@ -802,8 +751,6 @@ def _build_dependency_evidence(
     fixed_version: str | None,
     introduced_by: str | None,
     dependency_path: str | None,
-    reachability: str | None = None,
-    reachability_evidence: str | None = None,
 ) -> str:
     evidence = (
         f"**Advisory evidence:** `{cve}` applies to `{package_name}` "
@@ -818,15 +765,6 @@ def _build_dependency_evidence(
         )
     if dependency_path and dependency_path.strip():
         evidence += f"\n\n**Dependency chain:** `{dependency_path.strip()}`"
-    label = _REACHABILITY_EVIDENCE_LABELS.get((reachability or "").strip().lower())
-    if label:
-        evidence += f"\n\n**Usage analysis:** {label}."
-        if reachability_evidence and reachability_evidence.strip():
-            evidence += f" {reachability_evidence.strip()}"
-        evidence += (
-            " This is a prioritization signal from static analysis, not a"
-            " proof of exploitability or of safety."
-        )
     return evidence
 
 
@@ -849,9 +787,6 @@ async def _do_create_dependency(  # noqa: PLR0912
     fix_effort: str,
     introduced_by: str | None = None,
     dependency_path: str | None = None,
-    manifest_path: str | None = None,
-    reachability: str = "unknown",
-    reachability_evidence: str | None = None,
     agent_id: str | None = None,
     agent_name: str | None = None,
 ) -> dict[str, Any]:
@@ -888,22 +823,6 @@ async def _do_create_dependency(  # noqa: PLR0912
             f"Invalid fix_effort: {fix_effort!r}. Must be one of: {sorted(_VALID_FIX_EFFORT)}"
         )
 
-    manifest_err = _validate_manifest_path(manifest_path)
-    if manifest_err:
-        errors.append(manifest_err)
-
-    reachability = (reachability or "unknown").strip().lower()
-    if reachability not in _VALID_REACHABILITY:
-        errors.append(
-            f"Invalid reachability: {reachability!r}. Must be one of: {sorted(_VALID_REACHABILITY)}"
-        )
-    elif reachability != "unknown" and not (reachability_evidence or "").strip():
-        errors.append(
-            "reachability_evidence is required when reachability is not 'unknown': "
-            "cite the concrete proof (import file:line, matched symbol usage, or "
-            "govulncheck call path). Never claim a reachability level without evidence."
-        )
-
     if advisory_cvss is None:
         errors.append(
             "advisory_cvss is required: read the published advisory base score "
@@ -924,9 +843,6 @@ async def _do_create_dependency(  # noqa: PLR0912
         fixed_version=fixed_version,
         introduced_by=introduced_by,
         dependency_path=dependency_path,
-        manifest_path=manifest_path,
-        reachability=reachability,
-        reachability_evidence=reachability_evidence,
     )
     evidence = _build_dependency_evidence(
         cve=parsed_cve,
@@ -935,8 +851,6 @@ async def _do_create_dependency(  # noqa: PLR0912
         fixed_version=fixed_version,
         introduced_by=introduced_by,
         dependency_path=dependency_path,
-        reachability=reachability,
-        reachability_evidence=reachability_evidence,
     )
 
     try:
@@ -1029,15 +943,12 @@ async def create_dependency_report(
     remediation_steps: str,
     assumptions: str,
     package_ecosystem: str,
-    manifest_path: str | None = None,
     fixed_version: str | None = None,
     cwe: str | None = None,
     technical_analysis: str | None = None,
     fix_effort: str = "low",
     introduced_by: str | None = None,
     dependency_path: str | None = None,
-    reachability: str = "unknown",
-    reachability_evidence: str | None = None,
 ) -> str:
     """File a known-CVE dependency (SCA) finding — one report per CVE x package.
 
@@ -1062,26 +973,9 @@ async def create_dependency_report(
     - Re-reporting the same CVE/package already filed.
 
     **Reachability**: do NOT silently downgrade or suppress a finding
-    because the vulnerable code path may be unreachable — report it, and
-    record what the usage analysis showed via the structured
-    ``reachability`` + ``reachability_evidence`` fields (see the
-    dependency-cve-scanning skill for the analysis procedure). The level
-    is an evidence ladder, never an exploitability verdict:
-
-    - ``not_imported`` — the package is never imported/required by
-      application code (strongest de-prioritization signal; still not
-      proof of safety — dynamic loading, reflection, or framework wiring
-      can evade static search).
-    - ``imported`` — application code imports the package, but usage of
-      the advisory's affected API was not confirmed.
-    - ``vulnerable_symbol_used`` — the advisory's affected
-      function/class/API appears in application code.
-    - ``reachable_call_path`` — a call-graph tool (e.g. ``govulncheck``)
-      proved a path from application code to the vulnerable function.
-    - ``unknown`` — usage analysis was not performed or was inconclusive.
-
-    Severity is still derived solely from ``advisory_cvss`` — the
-    reachability level never changes the rating, only prioritization.
+    because the vulnerable code path may be unreachable — instead state
+    reachability as an ``assumptions`` / confidence factor. Report the
+    finding; let the reader weigh exploitability.
 
     **Formatting**: use markdown in text fields (``**bold**``, ``inline
     code`` for package/version identifiers, fenced code blocks for
@@ -1116,21 +1010,6 @@ async def create_dependency_report(
             to the vulnerable package, joined with `` > `` (e.g.
             ``express@4.18.1 > body-parser@1.20.0 > qs@6.10.2``). Omit
             for direct dependencies.
-        manifest_path: **Required.** The repo-relative path of the
-            lockfile/manifest where the vulnerable version was observed —
-            trivy's ``Target`` (e.g. ``package-lock.json``,
-            ``services/api/pom.xml``). Strip any scan-workspace or repo
-            checkout directory prefix so the path is relative to the
-            repository root. This binds the finding to its exact file so
-            remediation can target the right repository.
-        reachability: Usage-evidence level from static analysis — one of
-            ``not_imported`` / ``imported`` / ``vulnerable_symbol_used`` /
-            ``reachable_call_path`` / ``unknown``. Claim only what the
-            evidence proves; when in doubt use ``unknown``.
-        reachability_evidence: The concrete proof for the claimed level
-            (required for any level other than ``unknown``): repo-relative
-            ``file:line`` of the import or symbol usage, the matched
-            advisory symbols, or the govulncheck call-path excerpt.
     """
     agent_id, agent_name = _caller_identity(ctx)
 
@@ -1152,9 +1031,6 @@ async def create_dependency_report(
         fix_effort=fix_effort,
         introduced_by=introduced_by,
         dependency_path=dependency_path,
-        manifest_path=manifest_path,
-        reachability=reachability,
-        reachability_evidence=reachability_evidence,
         agent_id=agent_id,
         agent_name=agent_name,
     )

tests/test_reporting_fields.py

@@ -141,7 +141,6 @@ async def test_dependency_report_sets_class_and_metadata(report_state: ReportSta
         remediation_steps="Upgrade to 4.17.21.",
         assumptions="Assumes the template sink is reachable.",
         package_ecosystem="npm",
-        manifest_path="package-lock.json",
         fixed_version="4.17.21",
         cwe="CWE-94",
         advisory_cvss=7.2,
@@ -161,7 +160,6 @@ async def test_dependency_report_sets_class_and_metadata(report_state: ReportSta
         "package_name": "lodash",
         "installed_version": "4.17.20",
         "package_ecosystem": "npm",
-        "manifest_path": "package-lock.json",
         "fixed_version": "4.17.21",
     }
 
@@ -178,7 +176,6 @@ async def test_dependency_report_records_transitive_chain(report_state: ReportSt
         remediation_steps="Upgrade express to 4.18.2, which resolves qs 6.11.0.",
         assumptions="qs parses all incoming query strings by default.",
         package_ecosystem="npm",
-        manifest_path="package-lock.json",
         fixed_version="6.10.3",
         cwe="CWE-1321",
         advisory_cvss=7.5,
@@ -216,7 +213,6 @@ async def test_dependency_report_omits_blank_chain_fields(report_state: ReportSt
         remediation_steps="Upgrade.",
         assumptions="Assumptions.",
         package_ecosystem="npm",
-        manifest_path="package-lock.json",
         fixed_version=None,
         cwe=None,
         advisory_cvss=5.0,
@@ -245,7 +241,6 @@ async def test_dependency_report_with_zero_cvss_remains_low_severity(
         remediation_steps="Upgrade to 1.0.1.",
         assumptions="Assumes the package is included in deployed builds.",
         package_ecosystem="npm",
-        manifest_path="package-lock.json",
         fixed_version="1.0.1",
         cwe=None,
         advisory_cvss=0.0,
@@ -260,124 +255,6 @@ async def test_dependency_report_with_zero_cvss_remains_low_severity(
     assert report["cvss"] == 0.0
 
 
-async def test_dependency_report_records_reachability(report_state: ReportState) -> None:
-    result = await _do_create_dependency(
-        title="CVE-2021-23337 in lodash 4.17.20",
-        description="Command injection via template.",
-        target="repo/package.json",
-        cve="CVE-2021-23337",
-        package_name="lodash",
-        installed_version="4.17.20",
-        impact="Command injection where template is used.",
-        remediation_steps="Upgrade to 4.17.21.",
-        assumptions="Assumes the template sink is reachable.",
-        package_ecosystem="npm",
-        manifest_path="package-lock.json",
-        fixed_version="4.17.21",
-        cwe=None,
-        advisory_cvss=7.2,
-        technical_analysis=None,
-        fix_effort="low",
-        reachability="vulnerable_symbol_used",
-        reachability_evidence="src/render.ts:14 calls `_.template()`.",
-    )
-
-    assert result["success"] is True
-    report = report_state.vulnerability_reports[0]
-    assert report["dependency_metadata"]["reachability"] == "vulnerable_symbol_used"
-    assert (
-        report["dependency_metadata"]["reachability_evidence"]
-        == "src/render.ts:14 calls `_.template()`."
-    )
-    assert "**Usage analysis:**" in report["evidence"]
-    assert "not a proof of exploitability or of safety" in report["evidence"]
-    # The level must never influence the rating — that stays advisory_cvss only.
-    assert report["severity"] == "high"
-
-
-async def test_dependency_report_rejects_reachability_without_evidence(
-    report_state: ReportState,
-) -> None:
-    result = await _do_create_dependency(
-        title="CVE-2024-0001 in sample 1.0.0",
-        description="Published advisory affects the pinned version.",
-        target="repo/package.json",
-        cve="CVE-2024-0001",
-        package_name="sample",
-        installed_version="1.0.0",
-        impact="Impact.",
-        remediation_steps="Upgrade.",
-        assumptions="Assumptions.",
-        package_ecosystem="npm",
-        manifest_path="package-lock.json",
-        fixed_version="1.0.1",
-        cwe=None,
-        advisory_cvss=5.0,
-        technical_analysis=None,
-        fix_effort="low",
-        reachability="not_imported",
-    )
-
-    assert result["success"] is False
-    assert any("reachability_evidence is required" in e for e in result["errors"])
-    assert not report_state.vulnerability_reports
-
-
-async def test_dependency_report_rejects_unknown_reachability_level(
-    report_state: ReportState,
-) -> None:
-    result = await _do_create_dependency(
-        title="CVE-2024-0001 in sample 1.0.0",
-        description="Published advisory affects the pinned version.",
-        target="repo/package.json",
-        cve="CVE-2024-0001",
-        package_name="sample",
-        installed_version="1.0.0",
-        impact="Impact.",
-        remediation_steps="Upgrade.",
-        assumptions="Assumptions.",
-        package_ecosystem="npm",
-        manifest_path="package-lock.json",
-        fixed_version="1.0.1",
-        cwe=None,
-        advisory_cvss=5.0,
-        technical_analysis=None,
-        fix_effort="low",
-        reachability="not_exploitable",
-        reachability_evidence="vibes",
-    )
-
-    assert result["success"] is False
-    assert any("Invalid reachability" in e for e in result["errors"])
-    assert not report_state.vulnerability_reports
-
-
-async def test_dependency_report_omits_unknown_reachability(report_state: ReportState) -> None:
-    result = await _do_create_dependency(
-        title="CVE-2024-0001 in sample 1.0.0",
-        description="Published advisory affects the pinned version.",
-        target="repo/package.json",
-        cve="CVE-2024-0001",
-        package_name="sample",
-        installed_version="1.0.0",
-        impact="Impact.",
-        remediation_steps="Upgrade.",
-        assumptions="Analysis was inconclusive.",
-        package_ecosystem="npm",
-        manifest_path="package-lock.json",
-        fixed_version="1.0.1",
-        cwe=None,
-        advisory_cvss=5.0,
-        technical_analysis=None,
-        fix_effort="low",
-    )
-
-    assert result["success"] is True
-    metadata = report_state.vulnerability_reports[0]["dependency_metadata"]
-    assert "reachability" not in metadata
-    assert "reachability_evidence" not in metadata
-
-
 async def test_dependency_report_requires_advisory_cvss(report_state: ReportState) -> None:
     result = await _do_create_dependency(
         title="CVE-2024-0001 in sample 1.0.0",
@@ -390,7 +267,6 @@ async def test_dependency_report_requires_advisory_cvss(report_state: ReportStat
         remediation_steps="Upgrade to 1.0.1.",
         assumptions="Assumes the package ships in deployed builds.",
         package_ecosystem="npm",
-        manifest_path="package-lock.json",
         fixed_version="1.0.1",
         cwe=None,
         advisory_cvss=None,
@@ -446,7 +322,6 @@ async def test_dependency_report_dedupe_candidate_includes_dependency_metadata(
         remediation_steps="Upgrade to 1.0.1.",
         assumptions="Assumes the package is included in deployed builds.",
         package_ecosystem="npm",
-        manifest_path="package-lock.json",
         fixed_version="1.0.1",
         cwe=None,
         advisory_cvss=0.0,
@@ -464,7 +339,6 @@ async def test_dependency_report_dedupe_candidate_includes_dependency_metadata(
             "package_name": "sample",
             "installed_version": "1.0.0",
             "package_ecosystem": "npm",
-            "manifest_path": "package-lock.json",
             "fixed_version": "1.0.1",
         },
         "technical_analysis": None,
@@ -483,7 +357,6 @@ async def test_dependency_report_rejects_bad_cve(report_state: ReportState) -> N
         remediation_steps="r",
         assumptions="a",
         package_ecosystem="npm",
-        manifest_path="package-lock.json",
         fixed_version=None,
         cwe=None,
         advisory_cvss=None,
@@ -506,7 +379,6 @@ async def test_dependency_report_requires_ecosystem(report_state: ReportState) -
         remediation_steps="Upgrade to 1.0.1.",
         assumptions="Assumes the package is included in deployed builds.",
         package_ecosystem="",
-        manifest_path="package-lock.json",
         fixed_version="1.0.1",
         cwe=None,
         advisory_cvss=0.0,
@@ -519,62 +391,6 @@ async def test_dependency_report_requires_ecosystem(report_state: ReportState) -
     assert not report_state.vulnerability_reports
 
 
-async def test_dependency_report_requires_manifest_path(report_state: ReportState) -> None:
-    result = await _do_create_dependency(
-        title="CVE-2024-0001 in sample 1.0.0",
-        description="Published advisory affects the pinned version.",
-        target="repo/package.json",
-        cve="CVE-2024-0001",
-        package_name="sample",
-        installed_version="1.0.0",
-        impact="Low-impact dependency advisory.",
-        remediation_steps="Upgrade to 1.0.1.",
-        assumptions="Assumes the package is included in deployed builds.",
-        package_ecosystem="npm",
-        manifest_path=None,
-        fixed_version="1.0.1",
-        cwe=None,
-        advisory_cvss=5.0,
-        technical_analysis=None,
-        fix_effort="low",
-    )
-
-    assert result["success"] is False
-    assert any("manifest_path is required" in error for error in result["errors"])
-    assert not report_state.vulnerability_reports
-
-
-@pytest.mark.parametrize(
-    "bad_path",
-    ["/etc/passwd", "..\\pom.xml", "services/../pom.xml", "./package.json", "C:/repo/pom.xml"],
-)
-async def test_dependency_report_rejects_unsafe_manifest_path(
-    report_state: ReportState, bad_path: str
-) -> None:
-    result = await _do_create_dependency(
-        title="CVE-2024-0001 in sample 1.0.0",
-        description="Published advisory affects the pinned version.",
-        target="repo/package.json",
-        cve="CVE-2024-0001",
-        package_name="sample",
-        installed_version="1.0.0",
-        impact="Low-impact dependency advisory.",
-        remediation_steps="Upgrade to 1.0.1.",
-        assumptions="Assumes the package is included in deployed builds.",
-        package_ecosystem="npm",
-        manifest_path=bad_path,
-        fixed_version="1.0.1",
-        cwe=None,
-        advisory_cvss=5.0,
-        technical_analysis=None,
-        fix_effort="low",
-    )
-
-    assert result["success"] is False
-    assert any("manifest_path" in error for error in result["errors"])
-    assert not report_state.vulnerability_reports
-
-
 def test_dedupe_comparison_preserves_cve_identity() -> None:
     cleaned = _prepare_report_for_comparison(
         {
@@ -653,72 +469,6 @@ async def test_dependency_dedupe_rejects_same_cve_package_identity() -> None:
     assert result["confidence"] == 1.0
 
 
-async def test_dependency_dedupe_keeps_findings_from_distinct_manifests() -> None:
-    existing = [
-        {
-            "id": "vuln-0001",
-            "title": "CVE-2024-0001 in sample",
-            "cve": "CVE-2024-0001",
-            "dependency_metadata": {
-                "package_name": "sample",
-                "installed_version": "1.0.0",
-                "package_ecosystem": "npm",
-                "manifest_path": "services/api/package-lock.json",
-            },
-        }
-    ]
-    candidate = {
-        "title": "CVE-2024-0001 in sample (web)",
-        "description": "Same advisory observed in a second workspace.",
-        "target": "repo/package.json",
-        "cve": "CVE-2024-0001",
-        "dependency_metadata": {
-            "package_name": "sample",
-            "installed_version": "1.0.0",
-            "package_ecosystem": "npm",
-            "manifest_path": "services/web/package-lock.json",
-        },
-    }
-
-    result = await check_duplicate(candidate, existing)
-
-    assert result["is_duplicate"] is False
-    assert result["confidence"] == 1.0
-
-
-async def test_dependency_dedupe_rejects_same_manifest_identity() -> None:
-    existing = [
-        {
-            "id": "vuln-0001",
-            "title": "CVE-2024-0001 in sample",
-            "cve": "CVE-2024-0001",
-            "dependency_metadata": {
-                "package_name": "sample",
-                "installed_version": "1.0.0",
-                "package_ecosystem": "npm",
-                "manifest_path": "services/api/package-lock.json",
-            },
-        }
-    ]
-    candidate = {
-        "title": "CVE-2024-0001 in sample re-reported",
-        "description": "Same advisory, same manifest.",
-        "target": "repo/package.json",
-        "cve": "CVE-2024-0001",
-        "dependency_metadata": {
-            "package_name": "sample",
-            "installed_version": "1.0.0",
-            "package_ecosystem": "npm",
-            "manifest_path": "services/api/package-lock.json",
-        },
-    }
-
-    result = await check_duplicate(candidate, existing)
-
-    assert result["is_duplicate"] is True
-    assert result["duplicate_id"] == "vuln-0001"
-
-
 async def test_dependency_dedupe_detects_legacy_same_cve_package() -> None:
     existing = [
         {
@@ -872,8 +622,6 @@ def test_vuln_tool_exposes_new_params() -> None:
     dep_props = create_dependency_report.params_json_schema["properties"]
     for field in ("package_name", "installed_version", "cve", "advisory_cvss"):
         assert field in dep_props
-    for field in ("reachability", "reachability_evidence", "manifest_path"):
-        assert field in dep_props
     dep_required = create_dependency_report.params_json_schema["required"]
     assert "package_ecosystem" in dep_required
     assert "advisory_cvss" in dep_required

tests/test_stream_idle_timeout.py

@@ -1,173 +0,0 @@
-"""Tests for the model-stream idle watchdog.
-
-A turn that streams a few tokens and then goes silent is not covered by the
-request timeout: the read timeout resets on every byte, keepalives included.
-The watchdog bounds the gap between events so the turn fails and can be
-retried instead of parking the agent forever.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import json
-import threading
-import time
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from typing import TYPE_CHECKING, Any
-
-import pytest
-from agents.model_settings import ModelSettings
-from agents.models.interface import Model, ModelTracing
-from agents.models.openai_chatcompletions import OpenAIChatCompletionsModel
-from openai import AsyncOpenAI
-
-from strix.config import loader
-from strix.config.loader import load_settings
-from strix.config.models import StrixProvider, _TurnGuardModel, _with_idle_timeout
-
-
-if TYPE_CHECKING:
-    from collections.abc import AsyncIterator, Iterator
-
-
-_STALL_SECONDS = 30.0
-
-
-def _chunk(text: str) -> bytes:
-    payload = {
-        "id": "chatcmpl-1",
-        "object": "chat.completion.chunk",
-        "created": 0,
-        "model": "gw-model",
-        "choices": [{"index": 0, "delta": {"content": text}, "finish_reason": None}],
-    }
-    return b"data: " + json.dumps(payload).encode() + b"\n\n"
-
-
-class _StallingHandler(BaseHTTPRequestHandler):
-    """Streams a couple of tokens, then stops producing anything."""
-
-    stop = threading.Event()
-
-    def log_message(self, *args: Any) -> None:
-        pass
-
-    def do_POST(self) -> None:
-        length = int(self.headers.get("Content-Length", 0))
-        self.rfile.read(length)
-        self.send_response(200)
-        self.send_header("Content-Type", "text/event-stream")
-        self.end_headers()
-        self.wfile.write(_chunk("Now"))
-        self.wfile.write(_chunk(" spawning"))
-        self.wfile.flush()
-        self.stop.wait(_STALL_SECONDS)
-
-
-@pytest.fixture
-def stalling_gateway() -> Iterator[str]:
-    _StallingHandler.stop.clear()
-    server = HTTPServer(("127.0.0.1", 0), _StallingHandler)
-    thread = threading.Thread(target=server.serve_forever, daemon=True)
-    thread.start()
-    try:
-        yield f"http://127.0.0.1:{server.server_address[1]}/v1"
-    finally:
-        _StallingHandler.stop.set()
-        server.shutdown()
-        server.server_close()
-
-
-def _stream(base_url: str, *, idle_timeout: float) -> AsyncIterator[Any]:
-    client = AsyncOpenAI(api_key="tok", base_url=base_url, max_retries=0, timeout=_STALL_SECONDS)
-    inner: Model = OpenAIChatCompletionsModel(model="gw-model", openai_client=client)
-    guarded = _TurnGuardModel(inner, stream_idle_timeout=idle_timeout)
-    return guarded.stream_response(
-        None,
-        "go",
-        ModelSettings(),
-        [],
-        None,
-        [],
-        ModelTracing.DISABLED,
-        previous_response_id=None,
-        conversation_id=None,
-        prompt=None,
-    )
-
-
-async def _drain(base_url: str, *, idle_timeout: float) -> list[Any]:
-    return [event async for event in _stream(base_url, idle_timeout=idle_timeout)]
-
-
-@pytest.mark.asyncio
-async def test_stalled_stream_hangs_without_the_watchdog(stalling_gateway: str) -> None:
-    # Repro: tokens arrive, then nothing. Un-watched, the turn just sits there;
-    # the request timeout is far away and would reset on any keepalive byte.
-    with pytest.raises(TimeoutError):
-        await asyncio.wait_for(_drain(stalling_gateway, idle_timeout=0), timeout=2)
-
-
-@pytest.mark.asyncio
-async def test_stalled_stream_is_abandoned_by_the_watchdog(stalling_gateway: str) -> None:
-    started = time.monotonic()
-    with pytest.raises(TimeoutError, match="produced no event"):
-        await _drain(stalling_gateway, idle_timeout=1)
-
-    assert time.monotonic() - started < _STALL_SECONDS
-
-
-@pytest.mark.asyncio
-async def test_events_keep_flowing_while_the_stream_is_alive() -> None:
-    async def _live() -> AsyncIterator[Any]:
-        for i in range(5):
-            await asyncio.sleep(0.05)
-            yield f"event-{i}"
-
-    seen: list[Any] = [event async for event in _with_idle_timeout(_live(), 1.0)]
-
-    assert seen == [f"event-{i}" for i in range(5)]
-
-
-@pytest.fixture
-def _reset_settings(monkeypatch: pytest.MonkeyPatch) -> Iterator[None]:
-    for key in ("STRIX_LLM", "LLM_DISABLE_STREAMING", "LLM_STREAM_IDLE_TIMEOUT"):
-        monkeypatch.delenv(key, raising=False)
-    monkeypatch.setattr(loader, "_cached", None)
-    monkeypatch.setattr(loader, "_override", None)
-    yield
-
-
-class _DummyModel(Model):
-    async def get_response(self, *args: Any, **kwargs: Any) -> Any:
-        raise NotImplementedError
-
-    def stream_response(self, *args: Any, **kwargs: Any) -> Any:
-        raise NotImplementedError
-
-
-def test_idle_timeout_is_configurable(
-    monkeypatch: pytest.MonkeyPatch, _reset_settings: None
-) -> None:
-    monkeypatch.setattr("strix.config.models.MultiProvider.get_model", lambda *_: _DummyModel())
-    monkeypatch.setenv("LLM_STREAM_IDLE_TIMEOUT", "45")
-    load_settings()
-
-    model = StrixProvider().get_model("openai/gpt-4o-mini")
-    assert isinstance(model, _TurnGuardModel)
-    assert model._stream_idle_timeout == 45
-
-
-def test_idle_timeout_is_off_without_streaming(
-    monkeypatch: pytest.MonkeyPatch, _reset_settings: None
-) -> None:
-    # LLM_DISABLE_STREAMING turns the whole request into one event, so an idle
-    # gap would just be the request duration — the request timeout bounds that.
-    monkeypatch.setattr("strix.config.models.MultiProvider.get_model", lambda *_: _DummyModel())
-    monkeypatch.setenv("LLM_STREAM_IDLE_TIMEOUT", "45")
-    monkeypatch.setenv("LLM_DISABLE_STREAMING", "true")
-    load_settings()
-
-    model = StrixProvider().get_model("openai/gpt-4o-mini")
-    assert isinstance(model, _TurnGuardModel)
-    assert model._stream_idle_timeout == 0

tests/test_wait_dedupe.py

@@ -1,126 +0,0 @@
-"""Tests for collapsing repeated waits queued inside one model turn.
-
-An orchestrator that writes out its whole poll loop ahead of time queues
-many ``wait_for_agents`` calls in a single response. Each one parks for its
-full timeout, so the agent stops reacting for hours while its children run
-unsupervised. Only the first wait of a turn parks; the rest return at once.
-"""
-
-from __future__ import annotations
-
-import asyncio
-import json
-import time
-from typing import TYPE_CHECKING, Any, cast
-
-import pytest
-from agents import RunContextWrapper
-from agents.tool_context import ToolContext
-
-from strix.core.agents import AgentCoordinator
-from strix.core.hooks import LLM_TURN_KEY, ReportUsageHooks
-from strix.tools.agents_graph.tools import wait_for_agents
-
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-
-_WAIT_SECONDS = 2
-
-
-@pytest.fixture
-def _fast_wait(monkeypatch: pytest.MonkeyPatch) -> Iterator[None]:
-    # The real ceiling is 300s per wait; the shape of the bug is the same.
-    monkeypatch.setattr(
-        "strix.tools.agents_graph.tools._WAIT_DEFAULT_TIMEOUT_S", _WAIT_SECONDS, raising=True
-    )
-    yield
-
-
-async def _context() -> dict[str, Any]:
-    coordinator = AgentCoordinator()
-    await coordinator.register("root", "strix", parent_id=None)
-    return {"agent_id": "root", "coordinator": coordinator}
-
-
-async def _wait(inner: dict[str, Any]) -> dict[str, Any]:
-    ctx = ToolContext(
-        context=inner,
-        tool_name="wait_for_agents",
-        tool_call_id="call-1",
-        tool_arguments="{}",
-    )
-    raw: str = await wait_for_agents.on_invoke_tool(
-        ctx, json.dumps({"reason": "waiting for wave 1", "timeout_seconds": _WAIT_SECONDS})
-    )
-    return cast("dict[str, Any]", json.loads(raw))
-
-
-@pytest.mark.asyncio
-async def test_waits_queued_in_one_turn_each_park_without_the_guard(_fast_wait: None) -> None:
-    # Repro: no turn marker in context (as before the fix) — every queued wait
-    # parks for its full timeout, so N waits cost N x timeout.
-    inner = await _context()
-
-    started = time.monotonic()
-    outcomes = [(await _wait(inner))["wait_outcome"] for _ in range(3)]
-    elapsed = time.monotonic() - started
-
-    assert outcomes == ["timeout", "timeout", "timeout"]
-    assert elapsed >= 3 * _WAIT_SECONDS
-
-
-@pytest.mark.asyncio
-async def test_repeated_waits_in_one_turn_are_collapsed(_fast_wait: None) -> None:
-    inner = await _context()
-    inner[LLM_TURN_KEY] = 1
-
-    started = time.monotonic()
-    outcomes = [(await _wait(inner))["wait_outcome"] for _ in range(3)]
-    elapsed = time.monotonic() - started
-
-    assert outcomes == ["timeout", "already_waited", "already_waited"]
-    assert elapsed < 2 * _WAIT_SECONDS
-
-
-@pytest.mark.asyncio
-async def test_a_wait_in_the_next_turn_still_parks(_fast_wait: None) -> None:
-    inner = await _context()
-    inner[LLM_TURN_KEY] = 1
-    assert (await _wait(inner))["wait_outcome"] == "timeout"
-    assert (await _wait(inner))["wait_outcome"] == "already_waited"
-
-    inner[LLM_TURN_KEY] = 2
-
-    assert (await _wait(inner))["wait_outcome"] == "timeout"
-
-
-@pytest.mark.asyncio
-async def test_each_model_turn_bumps_the_turn_marker() -> None:
-    hooks = ReportUsageHooks(model="gw-model")
-    context: RunContextWrapper[dict[str, Any]] = RunContextWrapper(context={})
-    agent = cast("Any", None)
-
-    await hooks.on_llm_start(context, agent, None, [])
-    await hooks.on_llm_start(context, agent, None, [])
-
-    assert context.context[LLM_TURN_KEY] == 2
-
-
-@pytest.mark.asyncio
-async def test_a_collapsed_wait_still_reports_arriving_messages(_fast_wait: None) -> None:
-    inner = await _context()
-    inner[LLM_TURN_KEY] = 1
-    coordinator = cast("AgentCoordinator", inner["coordinator"])
-
-    async def _send() -> None:
-        await asyncio.sleep(0.1)
-        await coordinator.send("root", {"type": "information", "content": "child done"})
-
-    task = asyncio.create_task(_send())
-    first = await _wait(inner)
-    await task
-
-    assert first["wait_outcome"] == "message_arrived"
-    assert (await _wait(inner))["wait_outcome"] == "already_waited"