strix

What's Changed

• fix(agents): stop parents waiting on finished non-interactive children by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1241
• fix(cloud): print top-up instructions on 402 and guide oversize or ar… by @bearsyankees in https://github.com/usestrix/strix/pull/1242
• fix(viewer): show stopped run status by @kusonooyasumi in https://github.com/usestrix/strix/pull/1249
• feat(web_search): add Exa as a web search provider alongside Perplexity by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1270
• fix(cli): join the import warm-up before the engine imports, drop the orphan purge by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1273
• chore(telemetry): drop per-load skill_loaded beacons, send anonymous events by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1275
• docs: update README and CLI links by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1272
• feat(telemetry): classify error beacons by phase and exception class by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1276
• chore: release v1.6.2 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1277

Full Changelog: https://github.com/usestrix/strix/compare/v1.6.1...v1.6.2

What's Changed

• skills: reference new cloud cli by @bearsyankees in https://github.com/usestrix/strix/pull/1227
• MCP call errors no longer quarantine the connection by @yoni-at-strix in https://github.com/usestrix/strix/pull/1228
• fix(tui): run environment and model checks on the no-target start screen by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1232
• fix(ci): make the pre-commit mypy hook and the test suite pass on a fresh checkout by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1234
• fix(config): merge env into cli-config.json and invalidate the linked LLM connection on change by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1236
• feat(models): add GLM-5.3, Fable 5.1, Gemini 3.7 Flash to the recommended list and make openrouter/z-ai/glm-5.3 the top pick by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1235
• docs(readme): trim the strix cloud section to the essentials by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1237
• docs: trim crammed README sections and add cloud CLI and viewer docs pages by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1238
• docs(readme): shorten the coding-agent skills paragraph by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1239
• chore: release v1.6.1 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1240

Full Changelog: https://github.com/usestrix/strix/compare/v1.6.0...v1.6.1

What's Changed

• Fix LiteLLM cost model resolution by @bearsyankees in https://github.com/usestrix/strix/pull/1069
• feat: place caller-provided files into the sandbox workspace (extra_files, --workspace-file) by @yoni-at-strix in https://github.com/usestrix/strix/pull/1085
• feat(reporting): contextual CVSS breakdown on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1091
• feat(reporting): require contextual CVSS and usage evidence on dependency reports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1092
• handle resume tokens gracefully by @bearsyankees in https://github.com/usestrix/strix/pull/1097
• Add OWASP LLM Top 10 2026 skill coverage by @bearsyankees in https://github.com/usestrix/strix/pull/1115
• Add Azure and Entra security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1119
• Add argument injection security skill by @bearsyankees in https://github.com/usestrix/strix/pull/1120
• Add ecosystem supply-chain security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1121
• Add Hurl and Hypothesis security playbooks by @bearsyankees in https://github.com/usestrix/strix/pull/1122
• Add semantic browser and Electron security skills by @bearsyankees in https://github.com/usestrix/strix/pull/1123
• Expose viewer host option by @kusonooyasumi in https://github.com/usestrix/strix/pull/1127
• Drop strict tool schemas on Claude routes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1136
• fix(tui): preserve cost when state is truncated by @kusonooyasumi in https://github.com/usestrix/strix/pull/1086
• fix(tui): use single space after ordered-list marker by @OpenPay-App in https://github.com/usestrix/strix/pull/1043
• fix(report): raise RuntimeError on non-object run.json (fixes #1109) by @vardhans07 in https://github.com/usestrix/strix/pull/1116
• better skills by @bearsyankees in https://github.com/usestrix/strix/pull/1139
• perf: take heavy imports off the startup path and pre-warm them in the background by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1141
• perf: bootstrap Caido concurrently with the scan start by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1143
• feat(agents): evidence discipline, and coverage as a first-class artifact by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/961
• Add MCP server support by @yoni-at-strix in https://github.com/usestrix/strix/pull/1137
• Treat literal 'null'/'none' strings as absent for optional tool args by @bearsyankees in https://github.com/usestrix/strix/pull/1164
• fix(update): re-exec runs the new binary after self-update (endless update-prompt loop) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1168
• fix(tui): restore base foreground after ANSI resets by @bearsyankees in https://github.com/usestrix/strix/pull/1169
• Scope threat models to the current run instead of caching them on disk by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1178
• Reach MCP tools on demand instead of registering every one by @yoni-at-strix in https://github.com/usestrix/strix/pull/1175
• Isolate MCP connections per task and surface connection status in the UIs by @yoni-at-strix in https://github.com/usestrix/strix/pull/1181
• fix(llm): only attach prompt-cache points on routes LiteLLM serves by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1186
• fix(llm): bind dedupe credentials to a provider; send reasoning=max via extra_body by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1187
• fix(report): keep strix.report import-light so it never races the warm-up thread into the agents SDK graph by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1188
• Fix user message retry lifecycle and TUI sync by @0xallam in https://github.com/usestrix/strix/pull/1193
• csv injection hardening by @bearsyankees in https://github.com/usestrix/strix/pull/1203
• fix(viewer): harden PDF report rendering by @kusonooyasumi in https://github.com/usestrix/strix/pull/1192
• fix(runtime): stage extra-file bind mounts where a remote docker daemon can see them by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1211
• Make MCP connections survive transient transport failures by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1184
• feat(cli): strix cloud — managed platform CLI (login, scans, billing, and the rest of the API) by @bearsyankees in https://github.com/usestrix/strix/pull/1177
• pentest skill cloud cli by @bearsyankees in https://github.com/usestrix/strix/pull/1220
• Forward the workspace header through cli by @bearsyankees in https://github.com/usestrix/strix/pull/1221
• report: add update_vulnerability_report so an agent can revise a filed finding by @bearsyankees in https://github.com/usestrix/strix/pull/1210
• chore: release v1.6.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1223

New Contributors

• @OpenPay-App made their first contribution in https://github.com/usestrix/strix/pull/1043
• @vardhans07 made their first contribution in https://github.com/usestrix/strix/pull/1116

Full Changelog: https://github.com/usestrix/strix/compare/v1.5.3...v1.6.0

What's Changed

• fix(llm): omit parallel_tool_calls on tool-less requests by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1029
• fix(container): reclaim abandoned browser sessions by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1034
• fix(container): keep the browser env alive where image ENV is dropped by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1035
• fix(container): write the browser profile as root by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1039
• fix(llm): send OpenRouter app attribution on the request itself by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1045
• chore: release v1.5.3 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1046

Full Changelog: https://github.com/usestrix/strix/compare/v1.5.2...v1.5.3

What's Changed

• docs(skills): clearer description by @bearsyankees in https://github.com/usestrix/strix/pull/1013
• fix(tui): make the mount prompt clickable, and skip the mount instead of abandoning the scan by @0xallam in https://github.com/usestrix/strix/pull/1015
• test(tui): correct the nudge the internal-turn test asserts by @0xallam in https://github.com/usestrix/strix/pull/1016
• fix(agents): let an agent wait on what it already said by @0xallam in https://github.com/usestrix/strix/pull/1020
• fix(todo): stop a todo plan failing on priority or duplicates by @0xallam in https://github.com/usestrix/strix/pull/1021
• fix(sessions): open a sqlite connection per operation, not per thread by @0xallam in https://github.com/usestrix/strix/pull/1022
• fix(runner): resume after a user interrupt instead of failing by @0xallam in https://github.com/usestrix/strix/pull/1023
• fix(tools): coerce an empty-string list/dict argument to an empty container by @0xallam in https://github.com/usestrix/strix/pull/1024
• fix(runner): settle child agents before closing sessions at wind-down by @0xallam in https://github.com/usestrix/strix/pull/1025
• chore: release v1.5.2 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1026

Full Changelog: https://github.com/usestrix/strix/compare/v1.5.1...v1.5.2

What's Changed

• expand firebase storage rules coverage by @bearsyankees in https://github.com/usestrix/strix/pull/1002
• fix(tui): scrollbar visibility, findings scrolling, and report navigation by @0xallam in https://github.com/usestrix/strix/pull/1006
• chore: release v1.5.1 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/1011

Full Changelog: https://github.com/usestrix/strix/compare/v1.5.0...v1.5.1

What's Changed

• fix(cli): align View label spacing in final panel by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/918
• fix viewer tool call collisions across agents by @bearsyankees in https://github.com/usestrix/strix/pull/917
• fix: recoverable guardrail blocks and decoupled crash-notify by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/919
• Scope viewer session cookie to the bound port by @yoni-at-strix in https://github.com/usestrix/strix/pull/922
• fix(cost): capture OpenRouter streamed usage.cost (fixes $0 kimi-k3 c… by @bearsyankees in https://github.com/usestrix/strix/pull/929
• fix(runtime): label docker sandbox containers with the run id for teardown by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/933
• feat(llm): custom request headers for OpenAI-compatible endpoints via LLM_EXTRA_HEADERS by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/936
• fix(llm): pass LLM_EXTRA_HEADERS through ModelSettings so they reach the agent loop by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/937
• feat(llm): opt-in LLM_DISABLE_STREAMING for non-streaming OpenAI-compatible endpoints by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/938
• fix(llm): prevent ChatGPT subscription scan freezes by @chunguscodes in https://github.com/usestrix/strix/pull/943
• fix(llm): surface structured provider refusals by @bearsyankees in https://github.com/usestrix/strix/pull/944
• fix: pre-v1-style lifecycle resilience — mailbox delivery, uniform revival, unexitable runner, waiting timeout, broader retries, crash-safe identity by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/923
• docs(prompt): teach agents to recognize Caido proxy error pages instead of chasing them by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/955
• fix(core): explicit lifecycle contract — plain text never ends a run; respond_to_user / wait_for_agents split by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/954
• docs(llm-providers): explain the structured tool_calls requirement for local endpoints (#520) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/901
• feat(config): accept STRIX_REASONING_EFFORT=max for providers that support it by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/956
• fix(tools): accept both the string and structured form of every tool argument by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/957
• perf(cli): ~10x faster startup via lazy imports by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/920
• fix(core): a child never leaves its parent waiting silently by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/959
• feat(runtime): mount local targets instead of copying them in by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/958
• fix: calibrate vulnerability severity to demonstrated impact by @bearsyankees in https://github.com/usestrix/strix/pull/962
• feat(tui): replace Textual with a Go/Bubble Tea interface by @kusonooyasumi in https://github.com/usestrix/strix/pull/941
• Create credential files with owner-only permissions by @lukiod in https://github.com/usestrix/strix/pull/945
• fix(tui): remove the shift+enter newline hint from the setup footer by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/968
• feat: support API specs and Postman collections as targets by @5h4d0wr007 in https://github.com/usestrix/strix/pull/866
• fix(tui): keep a long error inside the status row by @0xallam in https://github.com/usestrix/strix/pull/970
• feat(reporting): record transitive dependency chain on SCA findings by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/971
• fix(llm): keep tool-call ids unique so a recycled id can't erase history by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/976
• fix(llm): cap the tool calls one assistant response may queue by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/977
• fix(llm): abandon a model stream that stops producing events by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/978
• fix(agents): collapse repeated waits queued inside one model turn by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/979
• feat(reporting): structured reachability evidence ladder for dependen… by @bearsyankees in https://github.com/usestrix/strix/pull/974
• feat(reporting): require repo-relative manifest_path on dependency CVE findings by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/982
• prompt changes by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/984
• update readme by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/985
• feat: agent-ready — installable SKILL.md skills, AGENTS.md, coding-ag… by @bearsyankees in https://github.com/usestrix/strix/pull/926
• docs(skills): require per-CVE affected-symbol matching in dependency reachability analysis by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/986
• chore: release v1.5.0 + bump sandbox image to 1.3.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/987
• ci: fix Windows release build — TUI-sidecar archive check used forward-slash paths by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/990
• ci: tolerate repr-escaped backslashes in the release TUI-sidecar check by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/991
• ci: publish nested standalone archives as release assets by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/994

New Contributors

• @chunguscodes made their first contribution in https://github.com/usestrix/strix/pull/943
• @lukiod made their first contribution in https://github.com/usestrix/strix/pull/945
• @5h4d0wr007 made their first contribution in https://github.com/usestrix/strix/pull/866

Full Changelog: https://github.com/usestrix/strix/compare/v1.4.1...v1.5.0

What's Changed

• fix(tls): replace raw urllib with requests for external HTTPS calls (frozen-build cert failures) by @yoni-at-strix in https://github.com/usestrix/strix/pull/903
• chore: release v1.4.1 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/912

Full Changelog: https://github.com/usestrix/strix/compare/v1.4.0...v1.4.1

What's Changed

• feat(cli): update notifications + self-update (strix --update) by @bearsyankees in https://github.com/usestrix/strix/pull/807
• chore(deps): bump cryptography to 49.0.0 and pyasn1 to 0.6.4 by @bearsyankees in https://github.com/usestrix/strix/pull/856
• fix(deps): cap cryptography <49 to keep Intel macOS universal2 wheel by @bearsyankees in https://github.com/usestrix/strix/pull/859
• Quit after scan instead of hosting local viewer by @yoni-at-strix in https://github.com/usestrix/strix/pull/858
• Pin release-workflow actions to commit SHAs + least-privilege token by @timhaines in https://github.com/usestrix/strix/pull/862
• chore(deps): bump setuptools to 83.0.0 in uv.lock by @0xallam in https://github.com/usestrix/strix/pull/872
• Sign in with a ChatGPT subscription for inference by @yoni-at-strix in https://github.com/usestrix/strix/pull/854
• docs(cli): document exit code 1 and clarify exit 0 semantics by @dvirarad in https://github.com/usestrix/strix/pull/871
• runtime: resolve staged local-dir path to avoid symlink rejection on macOS by @utkutugrul in https://github.com/usestrix/strix/pull/857
• feat(dedupe): add dedicated deduplication model by @kusonooyasumi in https://github.com/usestrix/strix/pull/823
• Rename root agent to Strix by @0xallam in https://github.com/usestrix/strix/pull/874
• fix(reports): strip markdown code fence from poc_script_code before rendering by @0xallam in https://github.com/usestrix/strix/pull/879
• refactor: move strix/viewer under strix/interface by @0xallam in https://github.com/usestrix/strix/pull/888
• docs(skills): remove references to tools not installed in the sandbox by @0xallam in https://github.com/usestrix/strix/pull/890
• feat(reporting): add read-only list_reports + get_report tools by @0xallam in https://github.com/usestrix/strix/pull/889
• feat(context): bound per-tool output before it enters agent history by @0xallam in https://github.com/usestrix/strix/pull/880
• feat(context): model-aware conversation compaction for long scans by @0xallam in https://github.com/usestrix/strix/pull/881
• feat(context): spill oversized tool output into the sandbox workspace by @0xallam in https://github.com/usestrix/strix/pull/882
• fix(runtime): retry transient mid-stream provider errors instead of crashing the scan by @0xallam in https://github.com/usestrix/strix/pull/891
• Add Linux ARM64 standalone release support by @MBemera in https://github.com/usestrix/strix/pull/886
• feat(llm): enable Bedrock/Anthropic prompt caching for Claude models by @seanturner83 in https://github.com/usestrix/strix/pull/772
• fix(cli): don't dump raw warm-up traceback over the LLM error panel by @0xallam in https://github.com/usestrix/strix/pull/896
• feat(runtime): graduated wrap-up warnings, budget reserve, and interactive budget pause/continue by @0xallam in https://github.com/usestrix/strix/pull/893
• fix(runtime): wake parent when a child hits a terminal state (MaxTurnsExceeded) by @0xallam in https://github.com/usestrix/strix/pull/897
• chore: release v1.4.0 by @0xallam in https://github.com/usestrix/strix/pull/898

New Contributors

• @timhaines made their first contribution in https://github.com/usestrix/strix/pull/862
• @dvirarad made their first contribution in https://github.com/usestrix/strix/pull/871
• @utkutugrul made their first contribution in https://github.com/usestrix/strix/pull/857
• @kusonooyasumi made their first contribution in https://github.com/usestrix/strix/pull/823
• @MBemera made their first contribution in https://github.com/usestrix/strix/pull/886

Full Changelog: https://github.com/usestrix/strix/compare/v1.3.1...v1.4.0

What's Changed

• sandbox: bump default inner-sandbox image to 1.1.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/850
• chore: release v1.3.1 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/853

Full Changelog: https://github.com/usestrix/strix/compare/v1.3.0...v1.3.1

What's Changed

• fix(container): keep /app/.venv/bin on the login-shell PATH so python… by @bearsyankees in https://github.com/usestrix/strix/pull/839
• fix(prompt): make root agent orchestrate-only and fold fixing into reporting by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/827
• sandbox: shrink image 7.2GB → 3.8GB (cache cleanup, multi-stage Go build, drop ZAP) by @seanturner83 in https://github.com/usestrix/strix/pull/474
• Local viewer: UI polish and a Feedback & support tab by @0xallam in https://github.com/usestrix/strix/pull/847
• Local viewer: prominent scan switcher + rename to "pentest" terminology by @0xallam in https://github.com/usestrix/strix/pull/848
• chore: release v1.3.0 by @0xallam in https://github.com/usestrix/strix/pull/849

Full Changelog: https://github.com/usestrix/strix/compare/v1.2.0...v1.3.0

What's Changed

• fix(runtime): stage symlink-safe copies for LocalDir uploads by @bearsyankees in https://github.com/usestrix/strix/pull/766
• fix(runtime): retry transient sandbox startup failures by @bearsyankees in https://github.com/usestrix/strix/pull/768
• feat(runtime): resolve sandbox ports over a shared Docker network by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/775
• fix(core): bound per-agent image memory (proactive budget + inherited-context scrub) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/779
• feat(runtime): opt-in resource limits for docker sandbox containers by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/780
• Revert "fix(runtime): retry transient sandbox startup failures (#768)" by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/782
• docs(prompts,skills): bound recon output for shared-disk hygiene by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/783
• docs(tools): guide proportional wait_for_message timeouts by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/784
• docs(prompts,skills): stop hardcoding /workspace/scratch path by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/786
• fix(runtime): cap sandbox container logs to prevent host disk exhaustion by @0xallam in https://github.com/usestrix/strix/pull/785
• fix(runtime): close the docker client on session cleanup by @0xallam in https://github.com/usestrix/strix/pull/787
• fix(prompt): down-rate or skip findings on demo data / demo environments by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/793
• fix(proxy,tooling): serialize+reconnect Caido client, actionable HTTPQL errors, sandbox tool guidance by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/794
• revert(proxy): drop overfit Caido reconnect/HTTPQL band-aids, keep serialization lock by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/799
• fix(report): restore cost tracking for OpenRouter and other LiteLLM-routed models by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/801
• fix(llm): retry statusless mid-stream provider errors (quota/billing/transient) by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/790
• fix(llm): add per-turn model request timeout so stalled streams fail fast and retry by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/802
• fix(llm): use a JSON-serializable per-turn model timeout by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/803
• recon asset discovery skill by @bearsyankees in https://github.com/usestrix/strix/pull/809
• docs(skills): add grafana_prometheus observability pivot skill by @bearsyankees in https://github.com/usestrix/strix/pull/812
• fix(proxy): recompute Content-Length when replaying a modified body by @thejesh23 in https://github.com/usestrix/strix/pull/816
• strip transfer encoding by @bearsyankees in https://github.com/usestrix/strix/pull/820
• fix(report): prevent code-fence breakout in vulnerability markdown by @thejesh23 in https://github.com/usestrix/strix/pull/817
• docs(reporting): add CVSS calibration guidance to reduce severity inf… by @bearsyankees in https://github.com/usestrix/strix/pull/821
• docs(skills): add Active Directory / Kerberos domain testing skill by @bearsyankees in https://github.com/usestrix/strix/pull/825
• Local run viewer: email reports, run history, and the platform suite by @yoni-at-strix in https://github.com/usestrix/strix/pull/813
• chore: release v1.2.0 by @devin-ai-integration[bot] in https://github.com/usestrix/strix/pull/826

New Contributors

• @thejesh23 made their first contribution in https://github.com/usestrix/strix/pull/816
• @yoni-at-strix made their first contribution in https://github.com/usestrix/strix/pull/813

Full Changelog: https://github.com/usestrix/strix/compare/v1.1.0...v1.2.0

Strix v1.1.0

First release since v1.0.4. Highlights below (~56 merged PRs).

New security skills

• Weak-password detection skill (#621, #654)
• LLM prompt-injection skill (#616)
• GCP and Auth0 reconnaissance skills
• Five new skills: OAuth, AWS, prototype pollution, deserialization, Django (#617)
• Skill-directory registration (#746)

SARIF / CI integration

• SARIF 2.1.0 emitter for GitHub code-scanning / ASPM ingestion (#626)
• STRIDE tagging of SARIF rules derived from CWE (#708)
• Omit SARIF version-control provenance for multi-repo scans (#726)

Dependency / SCA reporting

• New dependency reporting fields (#751)
• Require advisory_cvss for dependency findings + SCA TUI renderer (#753)

Cost & scope controls

• Configurable token / cost usage limits, --max-budget-usd (#576)
• Bind-mount option for large target repos (#577)
• --target list-file CLI option (#711)

LLM / provider

• Use core LiteLLM dependency (#752); cap openai<2.45 + litellm[proxy] so fresh installs run (#748)
• force_required_tool_choice setting (#730) and routed OpenAI required tool choice (#732)
• Scan-agent tool registration (#733); root scan prompt options (#750)
• Attribute OpenRouter usage to the Strix app (#760)
• Warn when the configured LLM is not a recommended/frontier model (#586)
• Route ollama models through ollama_chat so tool calling works (#562)
• Report cost for streamed OpenRouter calls (#634)

Reliability / fixes

• Default sandbox exec commands to Bash so source works (#764)
• Provider import-error hints for Bedrock/Vertex, full exception-chain walk (#588)
• Env vars win over persisted JSON across all aliases (#689)
• Graceful stop with resume hint on persistent RateLimitError (#593)
• Collapse child-agent initial input into a single user message (#589)
• Atomic CSV/MD writes to prevent corruption on crash (#628, #631); csv_path indentation (#637); avoid note-ID collisions (#630)
• Swallow torn-down docker socket on sandbox delete (#721); Caido HTTPS scheme (#722) + configured UI domains (#723)
• Keep verbose openai.agents DEBUG off sandbox stdout (#704)
• Strip ANSI escapes / control bytes from terminal tool output (#554)

TUI

• Reduce scroll stutter via throttled refresh + render caching (#687)
• "More content available" hint for long views (#687)
• Restore snappy sweep/progress animation frame rate (#759)

CI / telemetry / chores

• Lower Linux release glibc baseline (#707)
• Deduplicate scan-ended telemetry (#758); minor telemetry updates (#761); drop unhandled-exception collection (#585)
• Config-loader tests (#596); report-writer artifact tests (#667); uv.lock refresh (#606); README/docs updates

Contributors

Thanks to everyone who contributed to this release:

@0xallam @AtifAssari @Ayush7614 @Hardik-369 @Rome-1 @RudraDudhat2509 @Sonai124 @Stark-SK @ViperDroid @Zizouk22 @bastitva0-blip @bearsyankees @chirag127 @dpersek @e345ee @mhspektr @ousamabenyounes @sean-kim05 @seanturner83 @singe

What's Changed

• Make TUI quit instant by SIGKILL-ing the sandbox container by @0xallam in https://github.com/usestrix/strix/pull/548
• Swallow sandbox container races in the stream consumer by @0xallam in https://github.com/usestrix/strix/pull/552
• Strip all images from session on vision-rejection, not just the latest by @0xallam in https://github.com/usestrix/strix/pull/553
• Strip ANSI escapes and control bytes from terminal tool output by @0xallam in https://github.com/usestrix/strix/pull/554
• Bump 1.0.3 -> 1.0.4 by @0xallam in https://github.com/usestrix/strix/pull/557

Full Changelog: https://github.com/usestrix/strix/compare/v1.0.3...v1.0.4

What's Changed

• fix: SDK tracing leak + orphan docker on TUI quit (closes #512) by @0xallam in https://github.com/usestrix/strix/pull/522
• fix: gate reasoning_effort by LiteLLM model registry (closes #517) by @0xallam in https://github.com/usestrix/strix/pull/523
• Simplify LLM configuration layer (closes #504) by @0xallam in https://github.com/usestrix/strix/pull/524
• Show "Send message to resume" on the left of the status bar by @0xallam in https://github.com/usestrix/strix/pull/525
• Gate Reasoning(effort=...) on registry support by @0xallam in https://github.com/usestrix/strix/pull/528
• Use observed LiteLLM cost for LiteLLM-routed calls by @0xallam in https://github.com/usestrix/strix/pull/529
• Simplify cost ledger to one bucket by @0xallam in https://github.com/usestrix/strix/pull/531
• Bump 1.0.2 -> 1.0.3 by @0xallam in https://github.com/usestrix/strix/pull/537

Full Changelog: https://github.com/usestrix/strix/compare/v1.0.2...v1.0.3

What's Changed

• fix: reasoning models reject tool_choice=required; bump to 1.0.2 (closes #503, #505) by @0xallam in https://github.com/usestrix/strix/pull/508

Full Changelog: https://github.com/usestrix/strix/compare/v1.0.1...v1.0.2

What's Changed

• fix: PyInstaller bundle is broken (missing agents SDK data + wrongly excluded gql); bump to 1.0.1 by @0xallam in https://github.com/usestrix/strix/pull/502

Full Changelog: https://github.com/usestrix/strix/compare/v1.0.0...v1.0.1