settle child agents before closing sessions at wind-down

Every error path cancels the agent subtree before returning, so children unwind
while their sessions are still open. The success path did not: when root called
finish_scan with children still mid-turn, the finally closed their sessions
underneath them, the in-flight save raised "SQLiteSession is closed", and those
children were marked crashed - failing a scan whose report was already written.

Cancelling the descendants moves into the finally, ahead of the session close,
so it runs on every path - clean finish included. The per-branch cancels are
dropped since the finally now covers them; each branch keeps only its own root
status. cancel_descendants targets child tasks (root runs inline with no task),
and the finally already awaits snapshot and cleanup under cancellation, so the
added await is safe there.

Fixes #1012.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

containers/Dockerfile

@@ -58,9 +58,7 @@ RUN apt-get update && \
     libcap2-bin \
     gdb \
     libnss3-tools \
-    chromium fonts-liberation fonts-noto-core fonts-noto-color-emoji \
-    xvfb x11-utils xdotool dbus-x11 \
-    imagemagick
+    chromium fonts-liberation
 
 
 RUN setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip $(which nmap)
@@ -116,38 +114,11 @@ RUN npm install -g retire@latest && \
     ln -sf ast-grep /home/pentester/.npm-global/lib/node_modules/@ast-grep/cli/sg
 
 ENV AGENT_BROWSER_EXECUTABLE_PATH=/usr/bin/chromium
-# Must match the installed Chromium major; the build asserts it below.
-ENV AGENT_BROWSER_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36"
-# AGENT_BROWSER_ARGS is comma-separated, so no flag value may contain a comma
-# (window geometry comes from the virtual display instead).
-ENV AGENT_BROWSER_ARGS="--disable-blink-features=AutomationControlled,--no-first-run,--no-default-browser-check,--lang=en-US,--password-store=basic,--use-mock-keychain,--disable-dev-shm-usage"
+ENV AGENT_BROWSER_USER_AGENT="Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+ENV AGENT_BROWSER_ARGS="--disable-blink-features=AutomationControlled,--no-first-run,--no-default-browser-check,--lang=en-US"
 ENV AGENT_BROWSER_SCREENSHOT_DIR=/workspace/.agent-browser-screenshots
-ENV AGENT_BROWSER_IDLE_TIMEOUT_MS=180000
 RUN /home/pentester/.npm-global/bin/agent-browser doctor --offline --quick
 
-# `agent-browser --headed` exits 0 even when Chrome fails to launch, so assert
-# headed mode here. `--no-sandbox` is build-only: buildkit has no unprivileged
-# user namespaces. The stale X lock/socket must go or the runtime Xvfb refuses.
-RUN set -eu; \
-    chrome_major="$(chromium --version | grep -oE '[0-9]+' | head -1)"; \
-    printf '%s' "${AGENT_BROWSER_USER_AGENT}" | grep -q "Chrome/${chrome_major}\." || { \
-        echo "AGENT_BROWSER_USER_AGENT disagrees with installed Chromium ${chrome_major}"; exit 1; \
-    }; \
-    Xvfb :99 -screen 0 1280x800x24 -nolisten tcp >/tmp/xvfb-build.log 2>&1 & \
-    xvfb_pid=$!; \
-    for _ in $(seq 1 20); do xdpyinfo -display :99 >/dev/null 2>&1 && break; sleep 0.5; done; \
-    xdpyinfo -display :99 >/dev/null; \
-    DISPLAY=:99 agent-browser --headed --args "${AGENT_BROWSER_ARGS},--no-sandbox" \
-        open about:blank >/tmp/headed-check.log 2>&1 || true; \
-    if grep -qi 'Missing X server\|exited early' /tmp/headed-check.log; then \
-        echo "headed browser check failed:"; cat /tmp/headed-check.log; exit 1; \
-    fi; \
-    DISPLAY=:99 xwininfo -root -children | grep -qi chromium; \
-    agent-browser close >/dev/null 2>&1 || true; \
-    kill "${xvfb_pid}" 2>/dev/null || true; \
-    wait "${xvfb_pid}" 2>/dev/null || true; \
-    rm -rf /tmp/.X99-lock /tmp/.X11-unix/X99 /tmp/xvfb-build.log /tmp/headed-check.log
-
 RUN set -eux; \
     TS_PARSER_DIR="/home/pentester/.tree-sitter/parsers"; \
     mkdir -p "${TS_PARSER_DIR}"; \

containers/docker-entrypoint.sh

@@ -117,46 +117,6 @@ echo ". /etc/profile.d/proxy.sh" >> ~/.zshrc
 
 echo "✅ System-wide proxy configuration complete"
 
-# A virtual display so the agent can fall back to headed Chrome when a target
-# rejects headless; without it headed mode dies but still exits 0.
-DISPLAY_NUM="${STRIX_DISPLAY_NUM:-99}"
-DISPLAY_GEOMETRY="${STRIX_DISPLAY_GEOMETRY:-1280x800x24}"
-
-if ! xdpyinfo -display ":${DISPLAY_NUM}" >/dev/null 2>&1; then
-  # Nothing is answering, so a leftover lock/socket is stale; Xvfb refuses to
-  # start with one present.
-  rm -f "/tmp/.X${DISPLAY_NUM}-lock" "/tmp/.X11-unix/X${DISPLAY_NUM}" 2>/dev/null || true
-  Xvfb ":${DISPLAY_NUM}" -screen 0 "${DISPLAY_GEOMETRY}" -nolisten tcp \
-    > /tmp/xvfb.log 2>&1 &
-  for _ in $(seq 1 20); do
-    xdpyinfo -display ":${DISPLAY_NUM}" >/dev/null 2>&1 && break
-    sleep 0.5
-  done
-fi
-
-if xdpyinfo -display ":${DISPLAY_NUM}" >/dev/null 2>&1; then
-  echo "✅ Virtual display :${DISPLAY_NUM} ready (${DISPLAY_GEOMETRY})"
-else
-  echo "⚠️  Xvfb failed to start; headed browsing is unavailable. Xvfb log:"
-  cat /tmp/xvfb.log 2>/dev/null || echo "(no log available)"
-fi
-
-# Best-effort session bus: without it headed Chrome spews dbus errors that read
-# like fatal failures in tool output.
-if [ ! -S /run/dbus/system_bus_socket ]; then
-  sudo mkdir -p /run/dbus
-  sudo dbus-daemon --system --fork > /tmp/dbus.log 2>&1 || true
-fi
-
-cat << EOF | sudo tee /etc/profile.d/browser.sh
-export DISPLAY=:${DISPLAY_NUM}
-EOF
-
-echo ". /etc/profile.d/browser.sh" >> ~/.bashrc
-echo ". /etc/profile.d/browser.sh" >> ~/.zshrc
-
-. /etc/profile.d/browser.sh
-
 echo "Adding CA to browser trust store..."
 sudo -u pentester mkdir -p /home/pentester/.pki/nssdb
 sudo -u pentester certutil -N -d sql:/home/pentester/.pki/nssdb --empty-password

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "strix-agent"
-version = "1.5.2"
+version = "1.5.1"
 description = "Open-source AI Hackers for your apps"
 readme = "README.md"
 license = "Apache-2.0"

strix/agents/prompts/system_prompt.jinja

@@ -263,13 +263,7 @@ Remember: A single well-validated high-impact vulnerability is worth more than d
 <multi_agent_system>
 AGENT ISOLATION & SANDBOXING:
 - All agents run in the same shared Docker container for efficiency
-- Each agent has its own terminal sessions
-- Browsers are NOT per-agent by default: `agent-browser` with no `--session` is one
-  shared browser, so a concurrent agent's navigation invalidates your page and refs.
-  Pass `--session <your-agent-name>` for any browser work of your own — then it is
-  yours alone. Each session is a full Chromium (~340 MB) on this shared box, so keep
-  one, not several, and `agent-browser --session <name> close` when you're done with
-  the target; an idle browser is reclaimed automatically after 3 minutes
+- Each agent has its own: browser sessions, terminal sessions
 - All agents share the same /workspace directory and proxy history
 - Agents can see each other's files and proxy traffic for better collaboration
 

strix/core/inputs.py

@@ -201,10 +201,9 @@ def make_model_settings(
     request_timeout: float | None = None,
     prompt_cache: bool = True,
     extra_headers: dict[str, str] | None = None,
-    has_tools: bool = True,
 ) -> ModelSettings:
     model_settings = ModelSettings(
-        parallel_tool_calls=False if has_tools else None,
+        parallel_tool_calls=False,
         retry=DEFAULT_MODEL_RETRY,
         include_usage=True,
         extra_args=request_timeout_extra_args(request_timeout),

strix/interface/main.py

@@ -224,7 +224,6 @@ async def warm_up_llm(show_model_warning: bool = True) -> None:
                 request_timeout=llm.timeout,
                 prompt_cache=False,
                 extra_headers=settings.dedupe.extra_headers,
-                has_tools=False,
             )
             if deduper_extra:
                 merged = {**(deduper_settings.extra_args or {}), **deduper_extra}

strix/interface/scan_setup.py

@@ -78,7 +78,6 @@ async def preflight_model_connection(
         request_timeout=resolved_settings.llm.timeout,
         prompt_cache=False,
         extra_headers=resolved_settings.llm.extra_headers,
-        has_tools=False,
     )
     await asyncio.wait_for(
         model.get_response(

strix/llm/compaction.py

@@ -294,7 +294,6 @@ async def _summarize(model: str, prompt: str, max_tokens: int) -> str | None:
         request_timeout=llm.timeout,
         prompt_cache=False,
         extra_headers=llm.extra_headers,
-        has_tools=False,
     ).resolve(ModelSettings(max_tokens=max_tokens))
     try:
         response = (

strix/report/dedupe.py

@@ -62,7 +62,6 @@ def _dedupe_model_settings(
         # must never receive the main endpoint's credentials. A dedicated model
         # gets its own DEDUPE_LLM_EXTRA_HEADERS instead.
         extra_headers=dedupe.extra_headers if dedupe.model else llm.extra_headers,
-        has_tools=False,
     )
     extra = _dedupe_extra_args(dedupe)
     if extra:

strix/skills/tooling/agent_browser.md

@@ -58,26 +58,6 @@ agent-browser screenshot
 The browser stays running across commands so these feel like a single
 session. Use `agent-browser close` (or `close --all`) when you're done.
 
-The default session is **shared with every other agent in the sandbox** — if
-another agent navigates it, your page and your refs are gone from under you. So
-claim your own by passing `--session <your-agent-name>` on **every** command:
-
-```bash
-agent-browser --session recon-3 open https://example.com
-agent-browser --session recon-3 snapshot -i
-agent-browser --session recon-3 close        # when done with the target
-```
-
-The examples in the rest of this skill omit `--session` to keep them readable;
-keep passing yours. Each session is a separate Chromium (~340 MB) on a shared
-box, so hold one rather than several, and close it when you're finished.
-
-A browser left idle for 3 minutes is reclaimed automatically to free memory for
-the other agents; the next command relaunches it, but the page, tabs, refs and
-cookies are gone. If you're authenticated and about to go do something else for a
-while, save the state first (see
-[Persist session across runs](#persist-session-across-runs)).
-
 ## Reading a page
 
 ```bash
@@ -189,59 +169,6 @@ After any page-changing action, pick one:
 Avoid bare `wait 2000` except when debugging — it makes scripts slow and
 flaky. Timeouts default to 25 seconds.
 
-## Bot protection (read before fighting a login)
-
-Many targets sit behind a bot check (Cloudflare Turnstile, hCaptcha, Datadome).
-You will see it in a snapshot as a challenge iframe plus inputs that go
-`[disabled]` when you submit:
-
-```
-- textbox "Email address" [disabled, ref=e18]: user@example.com
-- button "Continue with email" [disabled, ref=e12]
-- Iframe "Widget containing a Cloudflare security challenge" [ref=e15]
-  - checkbox "Verify you are human" [checked=false, ref=e22]
-```
-
-`checked=false` that never flips means the challenge is refusing you, not that
-the click missed. Headless Chrome is itself one of the strongest signals these
-systems key on, so switch to a real browser window instead of retrying:
-
-```bash
-agent-browser close --all              # a running daemon makes --headed a no-op
-export AGENT_BROWSER_HEADED=1          # applies to every later command
-agent-browser open https://target.tld/login
-agent-browser get url                  # confirm it actually launched
-```
-
-The sandbox provides a virtual display and `DISPLAY` is already exported, so this
-works with no setup. Three traps:
-
-- **Set the env var, don't just pass `--headed` to `open`.** The flag is
-  per-invocation: the next bare `agent-browser snapshot` tries to start a
-  *headless* daemon and dies with `Multiple targets are not supported in headless
-  mode`. Export `AGENT_BROWSER_HEADED=1` (or pass `--headed` to every command).
-- **`--headed` is ignored when a daemon is already running** — it prints
-  `⚠ --headed ignored: daemon already running`. Always `close --all` first.
-- **A failed launch still exits 0.** Read the output text: `✗ Chrome exited
-  early` or `Missing X server` means you are not headed, whatever the exit code
-  says. Confirm with `agent-browser get url` before concluding anything.
-
-Then behave like a person rather than a script:
-
-- Drive real input events — `click`, `hover`, `keyboard type` — never `eval` with
-  `element.value = ...`. Assigning `value` directly leaves React-controlled
-  inputs internally empty, so the form submits blank or stays disabled.
-- `focus` the field, then `keyboard type "text"` when `fill` appears to work but
-  the app doesn't react.
-- Click the challenge checkbox by its ref inside the iframe, then
-  `wait --text` / `wait --url` for the *result*; don't re-click while it verifies.
-- Save the session once you're through (`state save`, or `--session-name`) so a
-  browser restart doesn't send you back to the challenge.
-
-If the challenge still refuses after a couple of honest attempts, stop. Report
-that the target is gated and hand back a bounded result — burning your whole
-window on one login costs more coverage than the login was worth.
-
 ## Common workflows
 
 ### Log in
@@ -380,16 +307,6 @@ agent-browser --session b fill @e1 "bob@test.com"
 `AGENT_BROWSER_SESSION=myapp` sets the default session for the current
 shell.
 
-Use a session named after yourself for your own work — that's what keeps a
-concurrent agent from navigating the page out from under you. Every session is a
-separate Chromium though, so hold one at a time rather than a collection, and
-close each one when its flow is finished:
-
-```bash
-agent-browser --session a close
-agent-browser --session b close
-```
-
 ### Mock network requests
 
 ```bash
@@ -450,11 +367,8 @@ agent-browser dialog dismiss          # cancel
 
 ## Readiness & recovery
 
-The first `agent-browser open` in a session launches the Chrome daemon (headless
-unless you pass `--headed`); later commands reuse it. A daemon left idle for 3
-minutes shuts itself down to free memory for the other agents, so an `open` after
-a long gap is a fresh browser rather than a resumed one — expect to re-navigate,
-and re-`state load` if you were logged in. Distinguish the failure modes and react
+The first `agent-browser open` in a session launches the headless-Chrome
+daemon; later commands reuse it. Distinguish the two failure modes and react
 differently — do **not** blindly re-run the same failing command in a loop:
 
 - **Daemon / connection failure** (`Failed to connect`, `connection refused`,
@@ -543,7 +457,7 @@ and [references/authentication.md](references/authentication.md).
 ```bash
 --session <name>        # isolated browser session
 --json                  # JSON output (for machine parsing)
---headed                # real browser window (default is headless); see "Bot protection"
+--headed                # show the window (default is headless)
 --auto-connect          # connect to an already-running Chrome
 --cdp <port>            # connect to a specific CDP port
 --profile <name|path>   # use a Chrome profile (login state survives)

tests/test_inputs.py

@@ -299,16 +299,6 @@ def test_make_model_settings_forces_required_for_anyllm_routed_openai_model() ->
     assert settings.tool_choice == "required"
 
 
-def test_make_model_settings_disables_parallel_tool_calls_by_default() -> None:
-    assert make_model_settings("none", model_name="gpt-4o").parallel_tool_calls is False
-
-
-def test_make_model_settings_omits_parallel_tool_calls_without_tools() -> None:
-    settings = make_model_settings("none", model_name="gpt-4o", has_tools=False)
-
-    assert settings.parallel_tool_calls is None
-
-
 def test_make_model_settings_sets_request_timeout() -> None:
     settings = make_model_settings(
         "none",

uv.lock

@@ -2378,7 +2378,7 @@ wheels = [
 
 [[package]]
 name = "strix-agent"
-version = "1.5.2"
+version = "1.5.1"
 source = { editable = "." }
 dependencies = [
     { name = "caido-sdk-client" },