* feat(cli): add strix login for managed platform sign-in (device flow)
* feat(cli): add --scopes flag to strix login
* docs: document strix login and managed billing in README, AGENTS, docs, and managed skill
* fix(cli): handle malformed login responses and credential file failures
* fix(cli): reject sign-in responses without an API token
* feat(login): interactive workspace and scope selection with presets
* fix(login): reject malformed API token values in sign-in responses
* fix(login): skip the scope prompt when stdin is not a terminal
* fix(login): tolerate malformed selection containers and remove unreadable credential files on logout
* fix(login): treat overflowing timing values as invalid
* fix(login): show the configured platform host in the sign-in banner
* fix(login): bound device flow timing values and clean up unreplaced secret temp files
* feat(cli): add the strix cloud command surface for the managed platform
* feat(cli): manage workspaces and hosted onboarding links from strix cloud
* fix(cli): report a leftover temporary secret file instead of hiding it
* feat(cli): pass a Stripe payment method to the top-up wallet client
* docs(cloud): recommend the Stripe agent wallet as the default payment path
* fix(cloud): preserve API auth during MPP payment
* fix(cloud): drop knowledge query and settings commands removed from the API
* fix(cloud): align agent commands with API contracts
* fix(cloud): send required PR review integration fields
* fix(cloud): preserve scopes when switching workspaces
* fix(cloud): make session command help non-destructive
* feat(cloud): improve human navigation and output
* feat(cli): add native shell completions
* feat(cloud): tailor human list and detail views
* feat(cloud): upload local source for managed scans
* fix(cloud): infer scan type from local targets
* Add agent-friendly managed cloud CLI
* Harden cloud CLI type boundaries
* Clarify cloud test user MFA options
* Correct cloud vulnerability status guidance
* Clarify chat file path handling
* Allow signed storage upload URLs
* Fix provider token request handling
* Improve cloud CLI human list views
* Make cloud CLI workflows actionable and safe
* Make cloud workspace switching session-safe
* Preserve CLI session metadata in JSON output
* Remove preview protection bypass plumbing from cloud CLI
* fix(report): neutralize CSV formula injection in vulnerabilities.csv
write_vulnerabilities() wrote finding titles straight into vulnerabilities.csv.
The csv module escapes CSV syntax but has no notion of spreadsheet formula
triggers, so a title beginning with =, +, -, @, tab or CR reached the cell
intact and was evaluated when a human opened the file (CWE-1236).
That input is attacker-influenced by design: Strix scans untrusted targets and
the agent quotes target content verbatim into finding titles, so a scanned page
can dictate a cell's literal contents. _validate_required_text only checks the
title is non-blank.
Add csv_safe() and apply it to every cell written. A value starting with a
formula trigger is prefixed with an apostrophe, the standard mitigation:
spreadsheets render the rest as literal text and hide the apostrophe.
This follows the module's existing safe_fence() precedent, which already guards
the markdown path against the same class of attacker-influenced content.
Adds regression tests covering the six trigger characters, that the payload
survives intact behind the guard, and that benign titles are untouched.
* report: single-line titles, exact CSV bytes, accurate csv_safe docstring
Strip control characters from finding titles at the ReportState choke point so
the guard in the CSV writer is defense-in-depth rather than the only layer, and
write artifacts with newline="" so the CSV's own \r\n terminators are not
rewritten to \r\r\n on Windows.
* report: normalize hydrated titles on resume
* report: rewrite finding markdown when resume cleans its title
---------
Co-authored-by: itzzdev09 <devved90@gmail.com>
* Treat literal 'null'/'none' strings as absent for optional tool args
Models routinely pass the literal string "null" or "none" instead of
omitting an optional argument. Taken at face value it becomes a filter
that matches nothing, so tools like list_notes / list_reports /
list_requests silently return no results.
Coerce such values to None in the central argument-coercion layer, but
only for parameters the schema allows to be null (or that are absent from
a declared "required" list), so required strings keep the literal value.
The list/filter helpers normalize the same values too, so a direct call
can't regress.
* Limit nullish coercion to query tools and keep literal tags
A literal "null"/"none" is only a mistake where the argument is a filter, so
gate the coercion on read-only query tools; a tool that writes keeps the value,
which stops update_note(content="none") from being read as "leave unchanged".
Stop dropping nullish entries from a notes tag filter too: tags are free-form,
so a literal "none" tag stays filterable and mixed tag queries keep every
branch.
* add a generic MCP client and a config for connecting MCP servers
* Add MCP docs and CLI polish: docs page, startup connect summary, --mcp-config flag, compact tool output
* Add MCP connection notes and per-run selection; clean up on cancel and dedupe names
* Show errored MCP tool calls as failed in the TUI
* Sanitize namespaced tool names so model APIs accept them
* Show MCP tool calls distinctly in the terminal and the run viewer
* Say what MCP servers are worth connecting for
* Correct the notes docstring to match how notes reach the agent
* keep the mcp tests from reading your shell's STRIX_MCP_* vars
- Remove --mount from two skills: the flag does not exist in the CLI. Local
paths are mounted writable when passed with -t.
- Document --target-list, --scope-mode, --diff-base, and OpenAPI/Postman
targets, so agents stop putting spec URLs in --instruction prose.
- Add the application-security-testing skill as the entry point for
whole-product AppSec requests, routing each asset to the right workflow.
- Drop contractions and Latin abbreviations across the skill prose.
* add extra-files plumbing so orchestrators can drop single files into the sandbox workspace
* reject extra-file paths that collide with a local source tree
* add --workspace-file so CLI users can place files in the sandbox workspace
* reject repeated and control-character workspace paths
* revalidate persisted workspace files when resuming a run
* drop the workspace-file size limit
