Commit graph

628 commits

Author SHA1 Message Date
yoni
b4c7555c24 Gate session capability behind bootstrap token; sync auth status with expiry 2026-07-20 23:29:10 +00:00
yoni
e246745e4e Set session cookie whenever index.html is served 2026-07-20 23:15:23 +00:00
yoni
9ba8e0f219 Harden viewer authz: session capability, history gating, expiry 2026-07-20 23:14:27 +00:00
Jonathan Singer
68f1d19504 Show live steering messages in the agent transcript 2026-07-20 17:47:50 -04:00
Jonathan Singer
dd1dab5d95 Bring the pro live-prompt composer to the local viewer
Replace the ad-hoc steer input with a faithful port of the pro app's
ScanPromptComposer: a collapsible Guide the agent pill that opens into
the Live prompt card with an auto-resizing textarea, a target picker,
and a rounded send button. Drops the Enterprise lock and bridge states
since local steering is immediate. Used under the agent graph with a
target dropdown, and docked in the agent detail modal with a static
target.
2026-07-20 17:30:38 -04:00
Jonathan Singer
09ff9aa783 Steer each agent from its modal; drop the Pro upsell there 2026-07-20 17:20:09 -04:00
Jonathan Singer
47ded9b93c Add live agent steering from the web viewer
Let the in-TUI viewer send a steering message to a running agent during a
live scan, reusing the same delivery path the TUI uses. Standalone strix
view reports steering unavailable, so the web composer only shows when a
live scan is in process.
2026-07-20 16:54:29 -04:00
Jonathan Singer
01c02d6d97 Rebuild the viewer bundle 2026-07-20 16:48:55 -04:00
Jonathan Singer
4465617134 Polish the local viewer: inline verify, clean titles, smart default view
- Verify your email right on the Past runs page instead of being sent off
  to the Email report page; the list unlocks in place once verified.
- Show a clean target-based title (like arch.co) and a relative time
  instead of the raw run folder name everywhere runs are listed.
- Land on Agents while a scan is still live and on Overview once it is
  done, without ever overriding where you navigate yourself.
2026-07-20 16:48:52 -04:00
Jonathan Singer
8f4ca2aedc Add a collapsible sidebar to the local viewer
Toggle it to a narrow icon-only rail; the choice is remembered in
localStorage and each icon keeps a hover tooltip so labels stay findable.
2026-07-20 16:48:41 -04:00
Jonathan Singer
de1c36d7e6 Update viewer event test for the cta surface and funnel events 2026-07-20 15:15:47 -04:00
Jonathan Singer
8264eee2f5 Add surfaces to the empty-state and agents CTAs 2026-07-20 15:05:46 -04:00
Jonathan Singer
2351bf9323 Track attribution, cta surfaces, and the email funnel in the viewer 2026-07-20 15:04:29 -04:00
Jonathan Singer
10d6136352 Forward viewer email funnel events and cta surface to PostHog 2026-07-20 15:04:25 -04:00
Jonathan Singer
8b98457041 Keep report code blocks from overlapping the field labels 2026-07-20 14:51:50 -04:00
Jonathan Singer
4505ef451c Render markdown in the report PDF (bold, code, lists, headings) 2026-07-20 14:48:06 -04:00
Jonathan Singer
05e8848332 Restyle the report PDF to match the cloud pentest report 2026-07-20 14:38:17 -04:00
Jonathan Singer
f3a956f5df Reword the platform CTA and the linked-email chip 2026-07-20 14:26:03 -04:00
Jonathan Singer
ea0c107559 Start the email flow directly from the Overview CTA 2026-07-20 13:46:35 -04:00
Jonathan Singer
cfe1073650 Center the email report page in the content area 2026-07-20 13:43:35 -04:00
Jonathan Singer
2a85e27dc0 Make the email report its own page instead of a modal 2026-07-20 13:41:34 -04:00
Jonathan Singer
f91a831761 Hide the trust banner on the Pro feature pages 2026-07-20 13:36:07 -04:00
Jonathan Singer
5600650e26 Rebuild the viewer bundle 2026-07-20 13:31:19 -04:00
Jonathan Singer
9d4033d950 Pass the relay's work_email_required error through the viewer server
Classify the relay's 400 work_email_required separately from a malformed
address so the browser can show the "use your work email" message.
2026-07-20 13:31:19 -04:00
Jonathan Singer
d73f319be5 Rework the viewer nav, add in-app feature pages, and verify-only past runs
- Collapse the sidebar into one ordered list of uniform two-line rows (icon +
  label + short one-liner), no tier sections.
- Sidebar Pro/Enterprise rows now open an in-app FeatureDetail upsell page
  instead of linking out; the page's primary CTA is the sign-up link.
- Past runs "View runs" runs a verify-only flow that never sends a report.
- Ask for a work email: helper text, an instant common-domain check, and a
  friendly message when the relay rejects a personal domain.
2026-07-20 13:31:13 -04:00
Jonathan Singer
2cd953b54e Tighten the email report CTA subtext 2026-07-20 12:42:13 -04:00
Jonathan Singer
7710a970b2 Reframe the email report CTA around security, not unlocking
The subtext now leads with the zero-knowledge assurance (we cannot read the
report) and frames the email step as verifying who we send to via a one-time
code, rather than unlocking a feature.
2026-07-20 12:40:53 -04:00
Jonathan Singer
54e9c0239b Show Pro descriptions under each sidebar item and widen the rail
The hover tooltips read as too subtle, so the one-liners now sit as secondary
text under each title and the left menu is a little wider to fit them.
2026-07-20 12:36:45 -04:00
Jonathan Singer
dfc672c947 Label the top-bar CTA 'Run in the cloud' instead of a second 'Start free' 2026-07-20 12:35:14 -04:00
Jonathan Singer
e32bfcde4a Bundle Pillow so the frozen binary can build PDF reports
reportlab imports PIL lazily and it was in the PyInstaller excludes list,
so report generation crashed in the packaged binary.
2026-07-20 12:23:06 -04:00
Jonathan Singer
a12b9c634c Rebuild the viewer bundle 2026-07-20 12:02:16 -04:00
Jonathan Singer
4c337f93ba Add the email report dialog, past runs view, and run switcher 2026-07-20 12:02:13 -04:00
Jonathan Singer
8d9f785dc7 Add the persistent sidebar and shared Pro upsell tiles 2026-07-20 12:02:10 -04:00
Jonathan Singer
5dee36d30a Wire the viewer to run history, email auth, and report-send endpoints 2026-07-20 12:02:06 -04:00
Jonathan Singer
f9a966df59 Add tests for PDF reports, viewer auth, and run history gating 2026-07-20 11:52:54 -04:00
Jonathan Singer
391df1b38c Add reportlab, pypdf, and cryptography deps and packaging 2026-07-20 11:52:51 -04:00
Jonathan Singer
f7cfd0d47d Add run history list, run-scoping, and email/report endpoints to the viewer server 2026-07-20 11:52:48 -04:00
Jonathan Singer
98c2e0be4e Add viewer email auth state, relay client, and encrypted PDF reports 2026-07-20 11:52:46 -04:00
Jonathan Singer
da9c606c67 Add STRIX_APP_URL viewer setting for the relay base URL 2026-07-20 11:52:43 -04:00
Jonathan Singer
11c7eef082 Add a "View in web" link to the run summary, and make the logo clickable 2026-07-20 10:04:40 -04:00
Jonathan Singer
8bbcafcf1a Fix the viewer build command 2026-07-20 09:51:56 -04:00
Jonathan Singer
1e4db0098b Fix .gitignore skipping some viewer source files 2026-07-20 09:51:56 -04:00
Jonathan Singer
1ce37d7b12 Refresh the live view faster and follow new activity 2026-07-20 09:51:56 -04:00
Jonathan Singer
b41abc9e58 Clean up the agent transcript view 2026-07-20 09:51:56 -04:00
Jonathan Singer
9a9b5cc1c2 Tidy up the agent modal sizing 2026-07-20 09:51:56 -04:00
Jonathan Singer
db29c77b30 Open agent details in a modal 2026-07-20 09:51:56 -04:00
Jonathan Singer
46e4b16167 Add a local web viewer for runs
`strix view` opens a run in the browser, served locally from the run files
(nothing is uploaded). There's also a quick link to it from the TUI and the
end-of-run summary.
2026-07-20 09:51:56 -04:00
alex s
230324d2b8
recon asset discovery skill (#809)
* Add passive asset discovery reconnaissance skill

* Document asset discovery reconnaissance skill

* Refine asset discovery reconnaissance skill

* Add scope guidance to asset discovery skill
2026-07-19 16:47:31 -04:00
Ahmed Allam
7d5a67d234 chore(llm): shorten timeout helper docstring; update tests 2026-07-17 19:45:32 -07:00
Ahmed Allam
88ad3e4472 fix(llm): use a JSON-serializable per-turn model timeout
An httpx.Timeout in ModelSettings.extra_args crashes
ModelSettings.to_json_dict() (PydanticSerializationError) on the Chat
Completions and LiteLLM model paths, which serialize settings for their
tracing generation span — failing every model turn on those paths. Pass
the timeout as a plain float, which httpx-based clients apply as the
read (inactivity) timeout.
2026-07-17 19:45:32 -07:00