## usestrix/strix — v0.8.3…v1.0.0

_125 commits._

### Features
- **Add TUI renderers for the seven previously-unstyled tools** (d3ab3f8)
- **Add Scarf telemetry alongside PostHog** (393548c)
- **feat: add HTTP request smuggling skill (#405)** (2380cf5)
- **Add Docker sandbox host mappings (#488)** (dc39531)
- **add empty-array IDOR FP and OAST source-IP SSRF FP signals (#183)** (6942ecb)
- **Add SSTI and Header Injection vulnerability skills (#191)** (8574119)
- **feat: add Novita AI as LLM provider (#385)** (6f17c7d)
- **feat: add NoSQL injection skill (#404)** (6da7315)
- **Support xhigh reasoning effort** (88fc7be)
- **feat(cli): --resume <run_name> as the canonical resume command** (fb6fdff)
- **feat(interface): show resume hint on the existing exit panel** (b5ee0c2)
- **feat(interface): show resume hint on user-initiated exit** (1c4cb4d)
- **feat(orchestration): always-on resume across the agent graph** (d538acf)
- **feat(logging): close audit gaps — SDK records, proxy tracebacks, CLI/docker/posthog** (f821345)
- **feat(logging): per-scan ``{run_dir}/strix.log`` with scan/agent context tagging** (46ff025)
- **feat(tools): python_action — stateless Python execution with proxy helpers** (9d7f754)
- **feat(orchestration): full parity with legacy harness — 8 gaps closed via SDK natives** (f4834cd)
- **feat(run-loop): lift the interactive continuation loop — applies to all agents** (1afd176)
- **feat(entry): interactive mode keeps the root agent alive across cycles** (00f5ab3)
- **feat(runtime): pluggable sandbox backend registry** (6990fd4)
- **feat(migration): phase 5b — STRIX_USE_SDK_HARNESS dispatch flag** (4e0d0f3)
- **feat(migration): phase 5 — root agent factory + entry point** (f0e254c)
- **feat(migration): phase 4 — sandbox capability + healthcheck + session manager** (1d86e45)
- **feat(migration): phase 3 — multi-agent graph tools + Runner bridge** (1ac32df)
- **feat(migration): phase 2.5 — wrap sandbox-bound SDK tools** (044e4e8)
- **feat(migration): phase 2.4 — wrap remaining local SDK tools** (57478e5)
- **feat(migration): phase 2.1-2.3 — sandbox dispatch + thin slice tool wrappers** (6e5d96a)
- **feat(migration): phase 1 — Session + Tracer + RunConfig factory** (375389b)
- **feat(migration): phase 0 — foundation files + smoke tests for SDK migration** (d9748a4)
- **feat(skills): add Kubernetes security testing skill (#394)** (8841294)
- **feat: Add NoSQL injection vulnerability guide (#168)** (5c13348)
- **Add Strix GitHub Actions integration tip** (62e9af3)
- **feat: Migrate from Poetry to uv (#379)** (38b2700)
- **feat: Better source-aware testing (#391)** (e78c931)

### Fixes
- **Proxy tool sweep: drop send_request, fix Caido SDK gotchas** (5921fec)
- **Fix MiniMax tool calling (#456)** (6b9bd4d)
- **perf(agent): wake on state change instead of 500ms polling (#305)** (e1f38f8)
- **fix(llm): include system prompt tokens in memory compressor budget (#381)** (67050d9)
- **fix: MiniMax tool call normalization and thinking block handling (#458)** (a75ad29)
- **Fix sandbox tool error wrapper** (a61b5a0)
- **Support chat-compatible sandbox patch tool** (756457f)
- **Fix interactive lifecycle and resume history** (9f45121)
- **fix(runtime,interface): mount sources at advertised paths + surface scan failures in TUI** (53188a7)
- **fix(llm): thread LLM_API_KEY into the SDK's native OpenAIProvider** (0518599)
- **fix(runtime): preserve image ENTRYPOINT so caido-cli actually starts** (ead54ba)
- **fix(scan): respawn-skip finalizes cancelled agents as ``stopped``** (e83522c)
- **fix(persistence): snapshot resume-instruction + persist notes to disk** (671c693)
- **fix(persistence): close all 9 gaps from the resume audit** (5fd2a64)
- **fix(telemetry): capture tool args in tool_executions for TUI renderers** (5253332)
- **fix(telemetry): restore broken ``log_tool_start`` / ``log_tool_end`` interface** (494e6fa)
- **fix: address audit findings — SDK plumbing, TUI bus, dead code** (572ef2a)
- **fix(legacy): silence ruff + mypy errors surfaced by litellm 1.83 bump** (3652b44)
- **fix: --config flag now fully overrides ~/.strix/cli-config.json (#457)** (9fb1012)
- **fix: wrap acompletion in asyncio.wait_for to prevent indefinite hangs (#453)** (60abc09)
- **fix: ensure LLM stats tracking is accurate by including completed subagents (#441)** (15c9571)

### Backend
- **Strix v1.0.0 release** (63faecd)
- **Merge origin/main into harness-migration** (d50827c)
- **Bump to 1.0.0** (9c20a8f)
- **Strip narrative comments and module/helper docstrings** (8414c59)
- **Tighten tool surface consistency** (054eedf)
- **Collapse todo tools to a single list-based form** (763df86)
- **Document the SDK-provided tools as stub dirs under strix/tools/** (867a0c8)
- **Surface the previously-undocumented sandbox tools and unbreak two of them** (8ed5311)
- **Stabilize agent-browser launch and screenshot routing** (c88b2bb)
- **Drop prescriptive guidance from image-rejection placeholder** (565fd70)
- **Auto-recover when the provider rejects a view_image output** (7e117bc)
- **Restore load_skill + surface skill catalog in system prompt** (a451766)
- **Clean up SDK shell tool failure modes** (418eedc)
- **Stop web_search from leaking upstream details into tool results** (fdd8b71)
- **Agents graph sweep: status taxonomy, stop_agent safety, skill validation** (4f62adf)
- **Document HTTPQL footguns on list_requests** (136e2e6)
- **Restore sitemap tools + unify proxy I/O contract** (a51e782)
- **Align note IDs with todo IDs (6-char hex)** (940319f)
- **Tighten todo + think tool contracts** (bdc3c54)
- **Simplify Python proxy automation** (c4d76d7)
- **Record usage per SDK LLM response** (ef50c2d)
- **Track SDK LLM usage** (4791feb)
- **Enforce lifecycle completion in non-interactive runs** (e8b172b)
- **Simplify TUI SDK event rendering** (1d0da89)
- **Simplify SDK-native orchestration** (bd40884)
- **Use shared agent persistence files** (dc03f1f)
- **Simplify SDK agent orchestration** (5ec1e07)

### Docs
- **docs(finish_scan): elevate the active-agent check to a mandatory pre-flight** (6bdaa84)
- **docs(skill): document the agent-browser → view_image chain for screenshots** (ab3da5c)
- **docs: restore tool guidance into docstrings, drop prompt tool-format boilerplate** (e4be5f9)
- **docs: harness wiki + SDK migration plan + audits + playbook + testing strategy** (a35a4a2)

### Chore
- **refactor: consolidate run state layout** (af826e1)
- **chore: remove generated migration docs** (0a5be6b)
- **refactor: reorganize core report and tui modules** (629ea60)
- **refactor: remove custom llm provider layer** (c163ef8)
- **chore(image): chromium-from-apt + anti-detection flags via agent-browser env** (8bbb31e)
- **chore(image): bump sandbox tag 0.1.13 → 0.2.0** (c011c66)
- **refactor(notes): drop disk persistence + shared-wiki prose** (81703e2)
- **chore(image): bump caido-cli v0.48.0 → v0.56.0; parametrize via CAIDO_VERSION** (767dc83)
- **refactor: collapse strix/io/, strix/run_config_factory.py, strix/entry.py** (72d932f)
- **chore(orchestration): drop XML wrappers + close remaining audit gaps** (25decb0)
- **refactor: move ``run_loop`` into ``strix/orchestration/``** (5896f25)
- **refactor(agents-graph): drop redundant ``agent_finish_called`` set** (fc96716)
- **refactor(telemetry): extract scan artifact I/O into ``strix.io.scan_artifacts``** (8f1f473)
- **refactor: lift hardcoded model default + fix stale ``is_whitebox`` docstring** (9586540)
- **refactor(config): pydantic-settings revamp + drop ``is_whitebox`` plumbing** (1e641e5)
- **chore(image): drop sidecar/Playwright legacy + plug NO_PROXY hole** (346cc47)
- **refactor(dedupe): route through MultiProvider + cache wrapper + retry policy** (8a11f9d)
- **refactor: nuke ``strix_tool`` shim + dead package re-exports** (b3f7cfd)
- **refactor: rename ``strix_docker_client.py`` → ``docker_client.py``** (fe5f749)
- **refactor: collapse strix/sandbox into strix/runtime; in-sandbox Caido bootstrap** (295d43b)
- **chore: nuke post-migration dead code, deps, and broken Dockerfile fallback** (5d8436c)
- **chore: final cleanup — drop ``STRIX_SANDBOX_MODE`` / ``strix_disable_browser`` / runtime docstring** (cd1bb46)
- **refactor: SandboxAgent + SDK Shell/Filesystem; agent-browser CLI; nuke FastAPI sidecar** (2c2ab13)
- **refactor: Caido — replace ProxyManager with caido-sdk-client (host-side)** (5449af2)
- **refactor: nuke ``events.jsonl`` pipeline and the unused PII sanitizer** (9b31e9f)
- **refactor: flatten CaidoCapability into direct wiring** (df51eee)
- **refactor: lean on SDK for tracing + native session resume; nuke OTEL/Traceloop** (12baf2d)
- **chore: drop unused pydantic[email] extra** (28416c5)
- **chore: drop unused dependencies** (b65e4eb)
- **chore: nuke tests/ and the entire test toolchain** (a6d578c)
- **refactor: dedupe ``_dump`` helper, collapse retry-policy plumbing, scrub test scars** (49c38de)
- **refactor: collapse dual stat buckets, prune unused params, kill dead helpers** (d959fe2)
- **refactor: nuke gratuitous XML serialization + delete argument_parser** (f08ad2a)
- **refactor: delete orphaned dirs, dead streaming infra, unused session/compressor** (369fa56)
- **refactor: scrub migration scars, dead code, and unused helpers** (4146174)
- **chore: per-file PLC0415 ignores for inlined tool files with lazy imports** (6435e07)
- **refactor: inline non-sandbox actions, strip registry, drop schemas** (dc9b9f5)
- **refactor: remove all strix/ model alias machinery** (af42499)
- **refactor: nuke legacy harness, drop sdk_ prefixes** (d888149)

_Recap by [Repo Wrapped](https://repowrapped.com/gh/usestrix/strix?utm_source=github-action)._