Joel Saß 664d64a98c feat: secure credentials — LLM never receives credential values ... Adds --credentials KEY=VALUE[,...] and --credentials-file path.json CLI flags so authorization secrets (usernames, passwords, API keys) can be supplied to a scan without the LLM ever seeing the actual values. How it works: - Credential names are listed in the system prompt so the LLM knows what is available. - The LLM writes {{NAME}} placeholders in any tool input (shell commands, HTTP bodies, file writes, etc.). - Before the tool executes the framework substitutes the real value; after execution, any credential values in the output are replaced with [CREDENTIAL:NAME] before the LLM sees the result. - The LLM therefore never handles the actual secret at any point in the conversation history. Changes: - strix/interface/main.py: --credentials / --credentials-file flags with full validation (_parse_credentials helper) - strix/interface/cli.py, tui/app.py: forward credentials into scan_config - strix/core/inputs.py: add credential_names to system prompt context; skip parallel_tool_calls=False when routing via proxy to avoid a Bedrock tool_choice.type error - strix/core/runner.py: place credentials dict in runtime context so all tool wrappers can read them via ctx.context["credentials"] - strix/tools/credentials/tool.py: substitute_credentials() and scrub_credentials() pure utilities - strix/agents/factory.py: _wrap_credential_substitution() applied to _BASE_TOOLS, exec_command, write_stdin, and filesystem tools; uses dataclasses.replace for singleton FunctionTools, in-place mutation for subclasses (e.g. ViewImageTool) that override __init__ - strix/agents/prompts/system_prompt.jinja: CREDENTIALS AVAILABLE block explains {{NAME}} placeholder syntax using {% raw %} so Jinja does not evaluate the braces as template expressions - pyproject.toml: pytest dev dependency and ruff per-file ignores - tests: 31 tests covering CLI parsing, scope context, substitution, scrubbing, and wrapper integration - docs: README, cli.mdx, instructions.mdx updated to document the new flags and remove inline secret examples Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-06-09 13:24:10 +02:00
..
cli.mdx	feat: secure credentials — LLM never receives credential values	2026-06-09 13:24:10 +02:00
instructions.mdx	feat: secure credentials — LLM never receives credential values	2026-06-09 13:24:10 +02:00
scan-modes.mdx	feat: Better source-aware testing (#391)	2026-03-31 11:53:49 -07:00