The warm-up thread imports strix.core.runner while warm_up_llm and
preflight_model_connection import agents.models.interface. Both walk the
agents SDK graph from different entry points, CPython fails one side to
break the import-lock cycle, and the orphan purge then removes agents.*
from sys.modules while the main thread is still importing it, crashing
strix -n with KeyError: 'agents.models'.
- Every payment-required error now ends with a "Next step" line: the
platform hint when one is sent, else the topup command and the billing
URL for the configured platform. JSON output gets the same text as
next_step. The platform hint is no longer repeated inside the error.
- An archive file passed to --source is rejected with guidance to pass
the directory instead, which packs and excludes deps/build output.
- An oversize archive names its largest files and points to --exclude
and --dry-run --show-files.
- uploads request help points to scans start --source for local code.
A non-interactive agent's loop returns after its terminal state, yet
send_message_to_agent kept reporting messages to it as delivered and the
parent then waited out wait_for_agents on a reply that could never come.
- AgentRuntime.resumable records whether the loop parks for wake-ups after a
terminal state; run_agent_loop / _start_child_runner set it from interactive.
- AgentCoordinator.send returns False (nothing queued) for a terminal agent
that is not resumable; send_message_to_agent surfaces target_status and
delivery_status=not_delivered with a pointer to list_reports / get_report.
- wait_for_agents returns wait_outcome=no_active_agents at once when no other
agent is running or waiting in a non-interactive run.
- agent_finish reads the reports the finishing agent filed from the report
state and puts their ids in the completion report, the parent message
(filed_report_ids) and its own return payload, so parents no longer have to
infer what was filed from prose.
Add Claude Fable 5.1, Gemini 3.7 Flash, and Z.ai GLM-5.3 / GLM-5.3-Flash
to RECOMMENDED_MODEL_NAMES, add a Z.ai GLM frontier family so GLM-5.x is
accepted through OpenRouter and Novita routes, and drop the superseded
GPT-5.4, GPT-5.3-codex, Opus 4.8, Sonnet 4.6, Gemini 3.6 Flash, and
Qwen3.7 entries. Update the README, docs provider pages, quickstart, and
CLI hint strings to the same current models, including DeepSeek V4,
Kimi K3, and GLM-5.3.
pydantic-settings takes the first alias present in the environment, even
when it is empty. persist_current() must save that same alias, so an empty
LLM_API_KEY does not let a non-empty OPENAI_API_KEY sibling land in the
file and restore a credential the run did not use.
A new STRIX_LLM, LLM_API_KEY, or LLM_API_BASE exported in the shell must not
be combined with the key, base, or model still stored in cli-config.json.
Restore the pre-refactor rule: when any linked LLM connection var differs
from the stored value, discard the whole stored connection before loading
and before persisting. Unrelated stored settings are kept.
persist_current rewrote the config file with only the env vars set in the
shell, so a run whose STRIX_LLM or LLM_API_KEY came from the file erased
them and the next launch failed with MISSING REQUIRED ENVIRONMENT
VARIABLES. Start from the stored env block, let a set env var override or
replace the aliases of its field, and let an empty env var clear it.
The interactive start screen skipped validate_environment() entirely, and
a bare prompt sent verify=false so the model preflight never ran. Both
kinds of setup launch now verify the model before leaving the start
screen, environment validation runs for every mode, and quitting setup
without a scan still shows the update notice.
* feat(cli): add strix login for managed platform sign-in (device flow)
* feat(cli): add --scopes flag to strix login
* docs: document strix login and managed billing in README, AGENTS, docs, and managed skill
* fix(cli): handle malformed login responses and credential file failures
* fix(cli): reject sign-in responses without an API token
* feat(login): interactive workspace and scope selection with presets
* fix(login): reject malformed API token values in sign-in responses
* fix(login): skip the scope prompt when stdin is not a terminal
* fix(login): tolerate malformed selection containers and remove unreadable credential files on logout
* fix(login): treat overflowing timing values as invalid
* fix(login): show the configured platform host in the sign-in banner
* fix(login): bound device flow timing values and clean up unreplaced secret temp files
* feat(cli): add the strix cloud command surface for the managed platform
* feat(cli): manage workspaces and hosted onboarding links from strix cloud
* fix(cli): report a leftover temporary secret file instead of hiding it
* feat(cli): pass a Stripe payment method to the top-up wallet client
* docs(cloud): recommend the Stripe agent wallet as the default payment path
* fix(cloud): preserve API auth during MPP payment
* fix(cloud): drop knowledge query and settings commands removed from the API
* fix(cloud): align agent commands with API contracts
* fix(cloud): send required PR review integration fields
* fix(cloud): preserve scopes when switching workspaces
* fix(cloud): make session command help non-destructive
* feat(cloud): improve human navigation and output
* feat(cli): add native shell completions
* feat(cloud): tailor human list and detail views
* feat(cloud): upload local source for managed scans
* fix(cloud): infer scan type from local targets
* Add agent-friendly managed cloud CLI
* Harden cloud CLI type boundaries
* Clarify cloud test user MFA options
* Correct cloud vulnerability status guidance
* Clarify chat file path handling
* Allow signed storage upload URLs
* Fix provider token request handling
* Improve cloud CLI human list views
* Make cloud CLI workflows actionable and safe
* Make cloud workspace switching session-safe
* Preserve CLI session metadata in JSON output
* Remove preview protection bypass plumbing from cloud CLI
* fix(report): neutralize CSV formula injection in vulnerabilities.csv
write_vulnerabilities() wrote finding titles straight into vulnerabilities.csv.
The csv module escapes CSV syntax but has no notion of spreadsheet formula
triggers, so a title beginning with =, +, -, @, tab or CR reached the cell
intact and was evaluated when a human opened the file (CWE-1236).
That input is attacker-influenced by design: Strix scans untrusted targets and
the agent quotes target content verbatim into finding titles, so a scanned page
can dictate a cell's literal contents. _validate_required_text only checks the
title is non-blank.
Add csv_safe() and apply it to every cell written. A value starting with a
formula trigger is prefixed with an apostrophe, the standard mitigation:
spreadsheets render the rest as literal text and hide the apostrophe.
This follows the module's existing safe_fence() precedent, which already guards
the markdown path against the same class of attacker-influenced content.
Adds regression tests covering the six trigger characters, that the payload
survives intact behind the guard, and that benign titles are untouched.
* report: single-line titles, exact CSV bytes, accurate csv_safe docstring
Strip control characters from finding titles at the ReportState choke point so
the guard in the CSV writer is defense-in-depth rather than the only layer, and
write artifacts with newline="" so the CSV's own \r\n terminators are not
rewritten to \r\r\n on Windows.
* report: normalize hydrated titles on resume
* report: rewrite finding markdown when resume cleans its title
---------
Co-authored-by: itzzdev09 <devved90@gmail.com>
* Treat literal 'null'/'none' strings as absent for optional tool args
Models routinely pass the literal string "null" or "none" instead of
omitting an optional argument. Taken at face value it becomes a filter
that matches nothing, so tools like list_notes / list_reports /
list_requests silently return no results.
Coerce such values to None in the central argument-coercion layer, but
only for parameters the schema allows to be null (or that are absent from
a declared "required" list), so required strings keep the literal value.
The list/filter helpers normalize the same values too, so a direct call
can't regress.
* Limit nullish coercion to query tools and keep literal tags
A literal "null"/"none" is only a mistake where the argument is a filter, so
gate the coercion on read-only query tools; a tool that writes keeps the value,
which stops update_note(content="none") from being read as "leave unchanged".
Stop dropping nullish entries from a notes tag filter too: tags are free-form,
so a literal "none" tag stays filterable and mixed tag queries keep every
branch.
* add a generic MCP client and a config for connecting MCP servers
* Add MCP docs and CLI polish: docs page, startup connect summary, --mcp-config flag, compact tool output
* Add MCP connection notes and per-run selection; clean up on cancel and dedupe names
* Show errored MCP tool calls as failed in the TUI
* Sanitize namespaced tool names so model APIs accept them
* Show MCP tool calls distinctly in the terminal and the run viewer
* Say what MCP servers are worth connecting for
* Correct the notes docstring to match how notes reach the agent
* keep the mcp tests from reading your shell's STRIX_MCP_* vars
* add extra-files plumbing so orchestrators can drop single files into the sandbox workspace
* reject extra-file paths that collide with a local source tree
* add --workspace-file so CLI users can place files in the sandbox workspace
* reject repeated and control-character workspace paths
* revalidate persisted workspace files when resuming a run
* drop the workspace-file size limit
