refactor(runner): default replace_scan_prompt to False in _compose_root_instructions_override

containers/Dockerfile

@@ -186,84 +186,20 @@ RUN set -eux; \
         aarch64|arm64) GITLEAKS_ARCH="arm64" ;; \
         *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;; \
     esac; \
-    TAG="$(curl -fsSLI -o /dev/null -w '%{url_effective}' https://github.com/gitleaks/gitleaks/releases/latest | sed 's#.*/##')"; \
+    TAG="$(curl -fsSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r .tag_name)"; \
     curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/${TAG}/gitleaks_${TAG#v}_linux_${GITLEAKS_ARCH}.tar.gz" -o /tmp/gitleaks.tgz; \
     tar -xzf /tmp/gitleaks.tgz -C /tmp; \
     install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks; \
     rm -f /tmp/gitleaks /tmp/gitleaks.tgz
 
-ARG TRIVY_VERSION=0.76.1
-ARG TRIVY_SHA256_X86=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
-ARG TRIVY_SHA256_AARCH64=e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f
-RUN set -eux; \
-    case "$(uname -m)" in \
-        x86_64) TRIVY_ARCH="64bit"; TRIVY_SHA256="${TRIVY_SHA256_X86}" ;; \
-        aarch64|arm64) TRIVY_ARCH="ARM64"; TRIVY_SHA256="${TRIVY_SHA256_AARCH64}" ;; \
-        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
-    esac; \
-    curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TRIVY_ARCH}.tar.gz" -o /tmp/trivy.tgz; \
-    echo "${TRIVY_SHA256}  /tmp/trivy.tgz" | sha256sum -c -; \
-    tar -xzf /tmp/trivy.tgz -C /tmp trivy; \
-    install -m 0755 /tmp/trivy /usr/local/bin/trivy; \
-    rm -f /tmp/trivy /tmp/trivy.tgz; \
-    trivy --version
+RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
 
 RUN apt-get install -y wapiti
 
-# CVE-2026-111497: out-of-bounds write in the brotli decoder, fixed in brotli
-# 1.2.1 / Debian 1.2.0-4.1. kali-rolling still ships 1.2.0-4, and node, curl and
-# python3 in this image all load the shared libbrotlidec, so every HTTP client here
-# would decode a malicious `Content-Encoding: br` response with the vulnerable
-# code. Install the fixed Debian packages until Kali picks them up.
-ARG BROTLI_DEB_VERSION=1.2.0-4.1
-RUN set -eux; \
-    ARCH="$(dpkg --print-architecture)"; \
-    for pkg in libbrotli1 python3-brotli; do \
-        curl -fsSL "https://deb.debian.org/debian/pool/main/b/brotli/${pkg}_${BROTLI_DEB_VERSION}_${ARCH}.deb" -o "/tmp/${pkg}.deb"; \
-    done; \
-    dpkg -i /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
-    rm -f /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
-    test "$(dpkg-query -W -f='${Version}' libbrotli1)" = "${BROTLI_DEB_VERSION}"; \
-    node -e 'const z=require("zlib");z.brotliDecompressSync(z.brotliCompressSync(Buffer.from("ok")))'
-
-ARG OPENGREP_VERSION=1.31.0
-ARG OPENGREP_SHA256_X86=dbbe3c2058dbe600c449a8ba22ea79a1643a6660658400090d0323a8d0d31147
-ARG OPENGREP_SHA256_AARCH64=2b713a29a00237f85408b83002fc111db5b94c7fa8d263f0a93184a960655d9d
-RUN set -eux; \
-    case "$(uname -m)" in \
-        x86_64) OPENGREP_ARCH="x86"; OPENGREP_SHA256="${OPENGREP_SHA256_X86}" ;; \
-        aarch64|arm64) OPENGREP_ARCH="aarch64"; OPENGREP_SHA256="${OPENGREP_SHA256_AARCH64}" ;; \
-        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
-    esac; \
-    curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${OPENGREP_VERSION}/opengrep_manylinux_${OPENGREP_ARCH}" -o /tmp/opengrep; \
-    echo "${OPENGREP_SHA256}  /tmp/opengrep" | sha256sum -c -; \
-    install -m 0755 /tmp/opengrep /usr/local/bin/opengrep; \
-    rm -f /tmp/opengrep; \
-    opengrep --version
-
-# Opengrep ships no rule registry of its own; bake the community ruleset so
-# scans run offline. Keep only rule YAML and LICENSE; drop tests, fixtures,
-# tooling, and rules marked with a proprietary license.
-ARG OPENGREP_RULES_REF=f1d2b562b414783763fd02a6ed2736eaed622efa
-RUN set -eux; \
-    mkdir -p /opt/opengrep-rules; \
-    curl -fsSL "https://codeload.github.com/opengrep/opengrep-rules/tar.gz/${OPENGREP_RULES_REF}" \
-        | tar -xz --strip-components=1 -C /opt/opengrep-rules; \
-    cd /opt/opengrep-rules; \
-    rm -rf .github scripts stats; \
-    find . -maxdepth 1 -type f ! -name LICENSE -delete; \
-    find . -mindepth 2 -type f \( ! \( -name '*.yaml' -o -name '*.yml' \) -o -name '*.test.yaml' -o -name '*.test.yml' -o -name '.*' \) -delete; \
-    grep -rlZ 'license: proprietary' . | xargs -0 -r rm -f; \
-    find . -type d -empty -delete; \
-    chmod -R a+rX /opt/opengrep-rules
-
-# Strix-authored rules that close gaps in the community ruleset.
-COPY containers/opengrep-rules/ /opt/opengrep-rules/strix/
-RUN chmod -R a+rX /opt/opengrep-rules/strix
-
 USER pentester
 
-RUN pipx install bandit
+RUN pipx install semgrep && \
+    pipx install bandit
 
 RUN npm install -g jshint
 

containers/opengrep-rules/github-owned-action-not-pinned-to-commit-sha.yaml

@@ -1,37 +0,0 @@
-rules:
-  - id: github-owned-action-not-pinned-to-commit-sha
-    patterns:
-      - pattern-inside: "{steps: ...}"
-      - pattern: |
-          uses: "$USES"
-      - metavariable-regex:
-          metavariable: $USES
-          regex: '^(actions|github)/'
-      - metavariable-pattern:
-          metavariable: $USES
-          language: generic
-          patterns:
-            - pattern-not-regex: "@[0-9a-f]{40}$"
-    message: >-
-      GitHub-owned action `$USES` is referenced by a mutable tag or branch
-      instead of a full-length commit SHA. Tags can be moved, so a compromised
-      or force-pushed release changes what this workflow runs. Pin to the
-      commit SHA of the release you reviewed and let a bot keep it current.
-    languages:
-      - yaml
-    severity: WARNING
-    metadata:
-      cwe:
-        - "CWE-1357: Reliance on Insufficiently Trustworthy Component"
-        - "CWE-353: Missing Support for Integrity Check"
-      owasp: A06:2021 - Vulnerable and Outdated Components
-      references:
-        - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
-      category: security
-      technology:
-        - github-actions
-      subcategory:
-        - vuln
-      likelihood: LOW
-      impact: LOW
-      confidence: HIGH

docs/advanced/configuration.mdx

@@ -19,29 +19,10 @@ Configure Strix using environment variables or a config file.
   Custom API base URL. Also accepts `OPENAI_API_BASE`, `LITELLM_BASE_URL`, or `OLLAMA_API_BASE`.
 </ParamField>
 
-<ParamField path="STRIX_LLM_INPUT_COST_PER_MTOK" type="number">
-  Price per 1M input tokens in USD for `STRIX_LLM`. Use it for gateway or self-hosted model ids that LiteLLM can't price.
-</ParamField>
-
-<ParamField path="STRIX_LLM_OUTPUT_COST_PER_MTOK" type="number">
-  Price per 1M output tokens in USD for `STRIX_LLM`.
-</ParamField>
-
-<ParamField path="STRIX_LLM_CACHED_INPUT_COST_PER_MTOK" type="number">
-  Price per 1M cached input tokens in USD for `STRIX_LLM`. If unset, cached tokens use the input price.
-</ParamField>
-
-<Note>
-  Setting any of these prices replaces the provider-reported and LiteLLM cost for `STRIX_LLM` in reports and `--max-budget`. An unset input or output price counts as `0`, so set both. A separate `STRIX_DEDUPE_MODEL` keeps its LiteLLM price.
-</Note>
-
 <ParamField path="STRIX_API_TYPE" type="string">
   Select the OpenAI API path for the model: `responses` or `chat_completions`.
-  By default the model decides: Responses when LiteLLM's model catalog lists
-  `/v1/responses` for it (e.g. `gpt-5`), chat completions otherwise. A custom
-  `LLM_API_BASE` does not change this, so set `STRIX_API_TYPE=chat_completions`
-  when your gateway only serves chat completions. Applies to bare and `openai/`
-  model names. Also accepts `STRIX_FORCE_API`.
+  By default, a custom `LLM_API_BASE` uses chat completions. Set this variable
+  when your gateway requires the other API. Also accepts `STRIX_FORCE_API`.
 </ParamField>
 
 <ParamField path="LLM_EXTRA_HEADERS" type="string">
@@ -186,7 +167,7 @@ When remote vars are set, Strix dual-writes telemetry to both local JSONL and th
 
 ## Docker Configuration
 
-<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.4.0" type="string">
+<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.3.0" type="string">
   Docker image to use for the sandbox container.
 </ParamField>
 

docs/tools/sandbox.mdx

@@ -49,7 +49,7 @@ Strix runs inside a Kali Linux-based Docker container with a comprehensive set o
 
 | Tool                                                    | Description                                   |
 | ------------------------------------------------------- | --------------------------------------------- |
-| [Opengrep](https://github.com/opengrep/opengrep)        | Fast SAST and custom rule matching            |
+| [Semgrep](https://github.com/semgrep/semgrep)          | Fast SAST and custom rule matching            |
 | [ast-grep](https://ast-grep.github.io)                 | Structural AST/CST-aware code search (`sg`)   |
 | [Tree-sitter](https://tree-sitter.github.io/tree-sitter/) | Syntax tree parsing and symbol extraction (Java/JS/TS/Python/Go/Bash/JSON/YAML grammars pre-configured) |
 | [Bandit](https://bandit.readthedocs.io)                | Python security linter                        |

docs/tools/terminal.mdx

@@ -33,7 +33,7 @@ sqlmap -u "https://example.com/page?id=1"
 
 ```bash
 # Fast SAST triage
-opengrep scan --config /opt/opengrep-rules ./src
+semgrep --config auto ./src
 
 # Structural AST search
 sg scan ./src

docs/usage/scan-modes.mdx

@@ -46,7 +46,7 @@ Thorough penetration testing. Best for:
 
 **Duration**: 1-4 hours depending on target complexity
 
-**White-box behavior**: Runs broad source-aware triage (`opengrep`, AST structural search, secrets, supply-chain checks) and then systematically validates top candidates dynamically.
+**White-box behavior**: Runs broad source-aware triage (`semgrep`, AST structural search, secrets, supply-chain checks) and then systematically validates top candidates dynamically.
 
 <Note>
 Deep mode is the default. It explores edge cases, chained vulnerabilities, and complex attack paths.

scripts/install.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 
 APP=strix
 REPO="usestrix/strix"
-STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.4.0"
+STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.3.0"
 
 MUTED='\033[0;2m'
 RED='\033[0;31m'

strix/agents/prompts/system_prompt.jinja

@@ -115,11 +115,11 @@ BLACK-BOX TESTING (domain/subdomain only):
 
 WHITE-BOX TESTING (code provided):
 - MUST perform BOTH static AND dynamic analysis
-- Static: Use source-aware triage first to map risk quickly (`opengrep`, `ast-grep`, Tree-sitter tooling, `gitleaks`, `trufflehog`, `trivy fs`). Then review code for vulnerabilities
+- Static: Use source-aware triage first to map risk quickly (`semgrep`, `ast-grep`, Tree-sitter tooling, `gitleaks`, `trufflehog`, `trivy fs`). Then review code for vulnerabilities
 - Static coverage floor: execute at least one structural AST mapping pass (`sg` and/or Tree-sitter) per repository and keep artifact output
-- Static coverage target per repository: run one `opengrep` pass, one secrets pass (`gitleaks` and/or `trufflehog`), one `trivy fs` pass, and one AST-structural pass (`sg` and/or Tree-sitter)
+- Static coverage target per repository: run one `semgrep` pass, one secrets pass (`gitleaks` and/or `trufflehog`), one `trivy fs` pass, and one AST-structural pass (`sg` and/or Tree-sitter)
 - Keep AST artifacts bounded and high-signal: scope to relevant paths/hypotheses, avoid whole-repo generic function dumps
-- AST target selection rule: build `sg-targets.txt` from `opengrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`), then run `xargs ... sg run` against that file list. Only use path-heuristic fallback if opengrep scope is unavailable.
+- AST target selection rule: build `sg-targets.txt` from `semgrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`), then run `xargs ... sg run` against that file list. Only use path-heuristic fallback if semgrep scope is unavailable.
 - Dynamic: Run the application and test live to validate exploitability
 - NEVER rely solely on static code analysis when dynamic validation is possible
 - Begin with fast source triage and dynamic run preparation in parallel; use static findings to prioritize live testing.
@@ -188,7 +188,7 @@ EFFICIENCY TACTICS:
 - For Caido proxy automation inside Python, explicitly import from
   `caido_api`:
   `from caido_api import list_requests, view_request, repeat_request, list_sitemap, view_sitemap_entry, scope_rules`
-- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, nuclei, wapiti, arjun, httpx, katana, opengrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
+- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, nuclei, wapiti, arjun, httpx, katana, semgrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
 - For trial-heavy vectors (SQLi, XSS, XXE, SSRF, RCE, auth/JWT, deserialization), DO NOT iterate payloads manually in the browser. Always spray payloads via Python scripts through `exec_command` or terminal tools.
 - When using established fuzzers/scanners, use the proxy for inspection where helpful
 - Generate/adapt large payload corpora: combine encodings (URL, unicode, base64), comment styles, wrappers, time-based/differential probes. Expand with wordlists/templates
@@ -458,7 +458,7 @@ JAVASCRIPT ANALYSIS:
 - js-beautify - JS beautifier/deobfuscator
 
 CODE ANALYSIS:
-- opengrep - Static analysis/SAST (bundled rules in /opt/opengrep-rules)
+- semgrep - Static analysis/SAST
 - ast-grep (sg) - Structural AST/CST-aware code search
 - tree-sitter - Syntax-aware parsing and symbol extraction support
 - bandit - Python security linter

strix/config/models.py

@@ -713,7 +713,7 @@ def configure_sdk_model_defaults(settings: Settings) -> None:
     if codex.subscription_model(llm.model):
         return
     _configure_litellm_compatibility()
-    _configure_attribution(llm.model)
+    _configure_openrouter_attribution(llm.model)
     if llm.api_key:
         set_default_openai_key(llm.api_key, use_for_tracing=False)
         _configure_litellm_default("api_key", llm.api_key)
@@ -884,13 +884,9 @@ def _openrouter_error_type(error: object) -> object:
     return None
 
 
-APP_ATTRIBUTION_HEADERS = {
+OPENROUTER_ATTRIBUTION_HEADERS = {
     "HTTP-Referer": "https://strix.ai",
     "X-Title": "Strix",
-}
-
-OPENROUTER_ATTRIBUTION_HEADERS = {
-    **APP_ATTRIBUTION_HEADERS,
     "X-OpenRouter-Categories": "cli-agent",
 }
 
@@ -899,25 +895,20 @@ def is_openrouter_model(model_name: str | None) -> bool:
     return bool(model_name) and "openrouter/" in (model_name or "").strip().lower()
 
 
-def is_vercel_ai_gateway_model(model_name: str | None) -> bool:
-    return (model_name or "").strip().lower().startswith("vercel_ai_gateway/")
-
-
-def attribution_headers(model_name: str | None) -> dict[str, str]:
-    if is_openrouter_model(model_name):
-        return OPENROUTER_ATTRIBUTION_HEADERS
-    if is_vercel_ai_gateway_model(model_name):
-        return APP_ATTRIBUTION_HEADERS
-    return {}
-
-
-def _configure_attribution(model_name: str | None) -> None:
+def _configure_openrouter_attribution(model_name: str | None) -> None:
     import litellm
 
     current: object = litellm.headers
     existing: dict[str, str] = current if isinstance(current, dict) else {}
-    remaining = {k: v for k, v in existing.items() if k not in OPENROUTER_ATTRIBUTION_HEADERS}
-    litellm.headers = {**remaining, **attribution_headers(model_name)} or None  # type: ignore[assignment]
+    if not is_openrouter_model(model_name):
+        if any(key in existing for key in OPENROUTER_ATTRIBUTION_HEADERS):
+            remaining = {
+                k: v for k, v in existing.items() if k not in OPENROUTER_ATTRIBUTION_HEADERS
+            }
+            litellm.headers = remaining or None  # type: ignore[assignment]
+        return
+
+    litellm.headers = {**existing, **OPENROUTER_ATTRIBUTION_HEADERS}  # type: ignore[assignment]
 
 
 def _configure_extra_headers(llm: LlmSettings) -> None:

strix/config/settings.py

@@ -61,15 +61,6 @@ class LlmSettings(BaseSettings):
         repr=False,
     )
     reasoning_effort: ReasoningEffort = Field(default="high", alias="STRIX_REASONING_EFFORT")
-    input_cost_per_mtok: float | None = Field(
-        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_INPUT_COST_PER_MTOK"
-    )
-    output_cost_per_mtok: float | None = Field(
-        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_OUTPUT_COST_PER_MTOK"
-    )
-    cached_input_cost_per_mtok: float | None = Field(
-        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_CACHED_INPUT_COST_PER_MTOK"
-    )
     force_required_tool_choice: bool = Field(
         default=False,
         alias="STRIX_FORCE_REQUIRED_TOOL_CHOICE",
@@ -164,7 +155,7 @@ class RuntimeSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
     image: str = Field(
-        default="ghcr.io/usestrix/strix-sandbox:1.4.0",
+        default="ghcr.io/usestrix/strix-sandbox:1.3.0",
         alias="STRIX_IMAGE",
     )
     backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND")

strix/core/inputs.py

@@ -10,11 +10,12 @@ from openai.types.shared import Reasoning
 
 from strix.config.models import (
     DEFAULT_MODEL_RETRY,
-    attribution_headers,
+    OPENROUTER_ATTRIBUTION_HEADERS,
     bedrock_route_supports_prompt_caching,
     is_bedrock_route,
     is_claude_model,
     is_known_openai_bare_model,
+    is_openrouter_model,
     model_supports_reasoning,
     request_timeout_extra_args,
     routes_through_litellm,
@@ -286,7 +287,9 @@ def make_model_settings(
 def _request_headers(
     model_name: str, extra_headers: dict[str, str] | None
 ) -> dict[str, str] | None:
-    headers: dict[str, str] = dict(attribution_headers(model_name))
+    headers: dict[str, str] = {}
+    if is_openrouter_model(model_name):
+        headers.update(OPENROUTER_ATTRIBUTION_HEADERS)
     if extra_headers:
         headers.update(extra_headers)
     return headers or None

strix/report/dedupe.py

@@ -300,15 +300,7 @@ def _parse_dedupe_response(content: str) -> dict[str, Any]:
         raise ValueError(f"No JSON object found in dedupe response: {content[:500]}")
     parsed = json.loads(text[start : end + 1])
 
-    is_duplicate = parsed.get("is_duplicate")
-    if not isinstance(is_duplicate, bool):
-        raise TypeError("is_duplicate must be a boolean")
-    duplicate_id = parsed.get("duplicate_id") or ""
-    if is_duplicate and (not isinstance(duplicate_id, str) or not duplicate_id):
-        raise ValueError("A duplicate decision must name an existing report ID")
-    # Keep the ID verbatim: truncating or stripping it could turn an unknown ID
-    # into a different, existing one before the membership check below.
-    duplicate_id = str(duplicate_id)
+    duplicate_id = str(parsed.get("duplicate_id") or "")[:64]
     reason = str(parsed.get("reason") or "")[:500]
     try:
         confidence = float(parsed.get("confidence", 0.0))
@@ -316,22 +308,13 @@ def _parse_dedupe_response(content: str) -> dict[str, Any]:
         confidence = 0.0
 
     return {
-        "is_duplicate": is_duplicate,
+        "is_duplicate": bool(parsed.get("is_duplicate", False)),
         "duplicate_id": duplicate_id,
         "confidence": confidence,
         "reason": reason,
     }
 
 
-def _validate_duplicate_reference(
-    result: dict[str, Any], existing_reports: list[dict[str, Any]]
-) -> None:
-    if result["is_duplicate"] and not any(
-        report.get("id") == result["duplicate_id"] for report in existing_reports
-    ):
-        raise ValueError("Duplicate decision refers to an unknown report ID")
-
-
 def _extract_text(response: ModelResponse) -> str:
     parts: list[str] = []
     for item in response.output:
@@ -414,7 +397,6 @@ async def check_duplicate(
             }
 
         result = _parse_dedupe_response(content)
-        _validate_duplicate_reference(result, existing_reports)
 
         logger.info(
             "Deduplication check: is_duplicate=%s, confidence=%.2f, reason=%s",

strix/report/usage.py

@@ -8,38 +8,11 @@ from typing import Any
 from agents.usage import Usage, deserialize_usage, serialize_usage
 from pydantic import BaseModel, TypeAdapter, ValidationError
 
-from strix.config.loader import load_settings
 from strix.report.pricing import resolve_litellm_model
 
 
 logger = logging.getLogger(__name__)
 
-Prices = tuple[float | None, float | None, float | None]
-
-
-def _configured_prices() -> tuple[str | None, Prices | None]:
-    llm = load_settings().llm
-    prices = (llm.input_cost_per_mtok, llm.output_cost_per_mtok, llm.cached_input_cost_per_mtok)
-    if all(price is None for price in prices):
-        return None, None
-    return (llm.model or "").strip() or None, prices
-
-
-def _configured_usage_cost(usage: Usage, prices: Prices) -> float:
-    input_rate, output_rate, cached_rate = prices
-    input_tokens = max(0, _int_or_zero(getattr(usage, "input_tokens", 0)))
-    cached_details = getattr(usage, "input_tokens_details", None)
-    cached_tokens = max(0, _int_or_zero(getattr(cached_details, "cached_tokens", 0)))
-    cached_tokens = min(cached_tokens, input_tokens)
-    output_tokens = max(0, _int_or_zero(getattr(usage, "output_tokens", 0)))
-    billable_input = input_tokens - cached_tokens
-    cost = (
-        billable_input * (input_rate or 0)
-        + cached_tokens * (cached_rate if cached_rate is not None else input_rate or 0)
-        + output_tokens * (output_rate or 0)
-    ) / 1_000_000
-    return _round_cost(cost)
-
 
 class ProviderUsage(BaseModel):
     """Running totals for one upstream provider OpenRouter routed calls to."""
@@ -64,7 +37,6 @@ class LLMUsageLedger:
         self._total_usage = Usage()
         self._agent_usage: dict[str, Usage] = {}
         self._agent_metadata: dict[str, dict[str, str]] = {}
-        self._agent_estimated_cost: dict[str, float] = {}
         self._observed_cost = 0.0
         self._estimated_cost = 0.0
         self._has_observed_cost = False
@@ -101,9 +73,6 @@ class LLMUsageLedger:
             estimated = _estimate_litellm_cost(usage, model)
             if estimated:
                 self._estimated_cost += estimated
-                self._agent_estimated_cost[normalized_agent_id] = (
-                    self._agent_estimated_cost.get(normalized_agent_id, 0.0) + estimated
-                )
 
         return True
 
@@ -145,23 +114,11 @@ class LLMUsageLedger:
     def total_cost(self) -> float:
         if self.zero_cost:
             return 0.0
-        model, prices = _configured_prices()
-        if prices is not None:
-            return _round_cost(
-                sum(self._configured_agent_cost(aid, model, prices) for aid in self._agent_usage)
-            )
         return _round_cost(self._observed_cost if self._has_observed_cost else self._estimated_cost)
 
-    def _configured_agent_cost(self, agent_id: str, model: str | None, prices: Prices) -> float:
-        if self._agent_metadata.get(agent_id, {}).get("model") == model:
-            return _configured_usage_cost(self._agent_usage[agent_id], prices)
-        return self._agent_estimated_cost.get(agent_id, 0.0)
-
     def to_record(self) -> dict[str, Any]:
         record = serialize_usage(self._total_usage)
-        model, prices = _configured_prices()
-        total_cost = self.total_cost
-        record["cost"] = total_cost
+        record["cost"] = self.total_cost
         record["providers"] = {name: tally.model_dump() for name, tally in self._providers.items()}
         record["agents"] = []
 
@@ -171,11 +128,7 @@ class LLMUsageLedger:
             usage = self._agent_usage[agent_id]
             metadata = self._agent_metadata.get(agent_id, {})
             agent_cost = (
-                self._configured_agent_cost(agent_id, model, prices)
-                if prices is not None and not self.zero_cost
-                else total_cost * (agent_tokens[agent_id] / total_tokens)
-                if total_tokens
-                else 0.0
+                self.total_cost * (agent_tokens[agent_id] / total_tokens) if total_tokens else 0.0
             )
 
             agent_record = serialize_usage(usage)
@@ -195,7 +148,6 @@ class LLMUsageLedger:
         self._total_usage = Usage()
         self._agent_usage.clear()
         self._agent_metadata.clear()
-        self._agent_estimated_cost.clear()
         self._observed_cost = 0.0
         self._estimated_cost = 0.0
         self._has_observed_cost = False
@@ -231,7 +183,6 @@ class LLMUsageLedger:
                 logger.exception("Failed to hydrate llm_usage for agent %s", agent_id)
                 self._agent_usage[agent_id] = Usage()
 
-            self._agent_estimated_cost[agent_id] = _float_or_zero(raw_agent.get("cost"))
             metadata: dict[str, str] = {}
             agent_name = raw_agent.get("agent_name")
             model = raw_agent.get("model")

strix/skills/README.md

@@ -40,7 +40,7 @@ The skills are dynamically injected into the agent's system prompt, allowing it
 
 Notable source-aware skills:
 - `source_aware_whitebox` (coordination): white-box orchestration playbook
-- `source_aware_sast` (custom): opengrep/AST/secrets/supply-chain static triage workflow
+- `source_aware_sast` (custom): semgrep/AST/secrets/supply-chain static triage workflow
 - `dependency_cve_scanning` (custom): trivy-based SCA workflow for reporting known dependency CVEs via `create_dependency_report`
 - `npx_confusion` (custom): npx/npm exec/bunx fallback and adjacent package-runner identity confusion, with runner-specific registry and reporting gates
 - `semantic_confusion` (vulnerabilities): cross-boundary parser, normalization, and representation mismatch analysis

strix/skills/coordination/root_agent.md

@@ -58,13 +58,6 @@ Structure agents by function:
 - Business logic flaws
 - Infrastructure vulnerabilities
 
-**Sensitive Browser Confirmations**
-- For every browser workflow containing a security-sensitive or consequential user action—whether authenticated or unauthenticated—assign `browser_security` to the agent testing that workflow or create a dedicated UI-redressing agent. This includes actions that change protected state, grant authority, submit credentials, expose sensitive data, or cross a trust boundary.
-- Its task must cover both iframe and cross-window/DoubleClickjacking paths; framing protections close only iframe coverage.
-- A workflow crossing origins or ports remains eligible when every involved origin is an explicit scan target. Same-origin policy blocks DOM reads, not top-level navigation, popups, opener relationships, focus changes, or window closing; cross-origin separation alone does not close UI-redressing coverage.
-- Never expand authorization from a link alone. If a required origin is not an explicit target, leave the path `needs_follow_up` and do not claim clickjacking or the related workflow is cleared; scope expansion must come from scan configuration.
-- Before accepting `no_issue_found` or `ruled_out` for cross-window UI redressing, reject closure evidence that cites popup-as-tab behavior, ignored geometry, unavailable OS-level input, or only a manual control click; keep the exact two-click path `needs_follow_up`. A successfully executed protected consent, approval, or grant must be impact-calibrated, not dismissed because it is idempotent, pre-seeded, or issues no immediate token or data.
-
 **Exploitation and Validation**
 - Proof-of-concept development
 - Impact demonstration

strix/skills/coordination/source_aware_whitebox.md

@@ -14,22 +14,22 @@ Increase white-box coverage by combining source-aware triage with dynamic valida
 ## Recommended Workflow
 
 1. Build a quick source map before deep exploitation, including at least one AST-structural pass (`sg` or `tree-sitter`) scoped to relevant paths.
-   - For `sg` baseline, derive `sg-targets.txt` from `opengrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`) and run `xargs ... sg run` on that list.
-   - Only fall back to path heuristics when opengrep scope is unavailable.
+   - For `sg` baseline, derive `sg-targets.txt` from `semgrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`) and run `xargs ... sg run` on that list.
+   - Only fall back to path heuristics when semgrep scope is unavailable.
 2. Run first-pass static triage to rank high-risk paths.
 3. Use triage outputs to prioritize dynamic PoC validation.
 4. Keep findings evidence-driven: no report without validation.
 
 ## Source-Aware Triage Stack
 
-- `opengrep`: fast security-first triage and custom pattern scans
+- `semgrep`: fast security-first triage and custom pattern scans
 - `ast-grep` (`sg`): structural pattern hunting and targeted repo mapping
 - `tree-sitter`: syntax-aware parsing support for symbol and route extraction
 - `gitleaks` + `trufflehog`: complementary secret detection (working tree and history coverage)
 - `trivy fs`: dependency, misconfiguration, license, and secret checks
 
 Coverage target per repository:
-- one `opengrep` pass
+- one `semgrep` pass
 - one AST structural pass (`sg` and/or `tree-sitter`)
 - one secrets pass (`gitleaks` and/or `trufflehog`)
 - one `trivy fs` pass

strix/skills/custom/source_aware_sast.md

@@ -1,6 +1,6 @@
 ---
 name: source-aware-sast
-description: Practical source-aware SAST and AST playbook for opengrep, ast-grep, gitleaks, and trivy fs
+description: Practical source-aware SAST and AST playbook for semgrep, ast-grep, gitleaks, and trivy fs
 ---
 
 # Source-Aware SAST Playbook
@@ -23,19 +23,19 @@ Run this baseline once per repository before deep narrowing:
 ART=/workspace/.source-aware
 mkdir -p "$ART"
 
-opengrep scan --config /opt/opengrep-rules --taint-intrafile \
-  --json --output "$ART/opengrep.json" .
-# Build deterministic AST targets from opengrep scope (no hardcoded path guessing)
+semgrep scan --config p/default --config p/golang --config p/secrets \
+  --metrics=off --json --output "$ART/semgrep.json" .
+# Build deterministic AST targets from semgrep scope (no hardcoded path guessing)
 python3 - <<'PY'
 import json
 from pathlib import Path
 
 art = Path("/workspace/.source-aware")
-opengrep_json = art / "opengrep.json"
+semgrep_json = art / "semgrep.json"
 targets_file = art / "sg-targets.txt"
 
 try:
-    data = json.loads(opengrep_json.read_text(encoding="utf-8"))
+    data = json.loads(semgrep_json.read_text(encoding="utf-8"))
 except Exception:
     targets_file.write_text("", encoding="utf-8")
     raise
@@ -63,18 +63,17 @@ trivy fs --scanners vuln,misconfig --timeout 30m --offline-scan \
   --format json --output "$ART/trivy-fs.json" . || true
 ```
 
-## Opengrep First Pass
+## Semgrep First Pass
 
-Use Opengrep as the default static triage pass. Rules are bundled offline in `/opt/opengrep-rules` (one directory per language, plus `generic/secrets`):
+Use Semgrep as the default static triage pass:
 
 ```bash
-# Full bundled ruleset
-opengrep scan --config /opt/opengrep-rules --taint-intrafile \
-  --json --output /workspace/.source-aware/opengrep.json .
+# Preferred deterministic profile set (works with --metrics=off)
+semgrep scan --config p/default --config p/golang --config p/secrets \
+  --metrics=off --json --output /workspace/.source-aware/semgrep.json .
 
-# Narrow to the target stack when the full set is slow or noisy
-opengrep scan --config /opt/opengrep-rules/python --config /opt/opengrep-rules/generic/secrets \
-  --taint-intrafile --json --output /workspace/.source-aware/opengrep-python.json .
+# If you choose auto config, do not combine it with --metrics=off
+semgrep scan --config auto --json --output /workspace/.source-aware/semgrep-auto.json .
 ```
 
 If diff scope is active, restrict to changed files first, then expand only when needed.

strix/skills/frameworks/django.md

@@ -205,10 +205,10 @@ Jinja2 backend without autoescape: `{{7*7}}`, RCE gadgets if sandbox misconfigur
 
 ## Tooling
 
-Static analysis is the fastest way to reach the sinks above in white-box scope. The sandbox ships `python`/`pipx`, `opengrep`, `bandit`, `ast-grep`, and `ripgrep`.
+Static analysis is the fastest way to reach the sinks above in white-box scope. The sandbox ships `python`/`pipx`, `semgrep`, `bandit`, `ast-grep`, and `ripgrep`.
 
 - **bandit** (preinstalled) — Python security linter; flags `mark_safe`, `extra()`, `RawSQL`, `subprocess`, weak crypto, hardcoded secrets: `bandit -r . -ll`
-- **opengrep** (preinstalled) with the bundled Django rules — higher-signal than bandit for framework-specific bugs (`.extra()`, `RawSQL`, `|safe`, `csrf_exempt`, `ALLOWED_HOSTS=['*']`): `opengrep scan --config /opt/opengrep-rules/python/django .`
+- **semgrep** (preinstalled) with the Django ruleset — higher-signal than bandit for framework-specific bugs (`.extra()`, `RawSQL`, `|safe`, `csrf_exempt`, `ALLOWED_HOSTS=['*']`): `semgrep --config p/django .`
 - **pip-audit** (PyPA) — dependency CVE scanner for known-vuln Django/DRF/simplejwt versions: `pipx install pip-audit && pip-audit -r requirements.txt`
 - **ast-grep** (preinstalled) — quick structural grep for risky calls without a full SAST run: `ast-grep run -p 'mark_safe($X)' -l python`
 

strix/skills/scan_modes/deep.md

@@ -15,7 +15,7 @@ Thorough understanding before exploitation. Test every parameter, every endpoint
 
 **Whitebox (source available)**
 - Map every file, module, and code path in the repository
-- Start with broad source-aware triage (`opengrep`, `ast-grep`, `gitleaks`, `trufflehog`, `trivy fs`) and use outputs to drive deep review
+- Start with broad source-aware triage (`semgrep`, `ast-grep`, `gitleaks`, `trufflehog`, `trivy fs`) and use outputs to drive deep review
 - Execute at least one structural AST pass (`sg` and/or Tree-sitter) per repository and store artifacts for reuse
 - Keep AST artifacts bounded and query-driven (target relevant paths/sinks first; avoid whole-repo generic function dumps)
 - Use syntax-aware parsing (Tree-sitter tooling) to improve symbol, route, and sink extraction quality

strix/skills/scan_modes/quick.md

@@ -15,7 +15,7 @@ Optimize for fast feedback on critical security issues. Skip exhaustive enumerat
 
 **Whitebox (source available)**
 - Focus on recent changes: git diffs, new commits, modified files—these are most likely to contain fresh bugs
-- Run a fast static triage on changed files first (`opengrep`, then targeted `sg` queries)
+- Run a fast static triage on changed files first (`semgrep`, then targeted `sg` queries)
 - Run at least one lightweight AST pass (`sg` or Tree-sitter) so structural mapping is not skipped
 - Keep AST commands tightly scoped to changed or high-risk paths; avoid broad repository-wide pattern dumps
 - Run quick secret and dependency checks (`gitleaks`, `trufflehog`, `trivy fs`) scoped to changed areas when possible

strix/skills/scan_modes/standard.md

@@ -15,7 +15,7 @@ Systematic testing across the full attack surface. Understand the application be
 
 **Whitebox (source available)**
 - Map codebase structure: modules, entry points, routing
-- Run `opengrep` first-pass triage to prioritize risky flows before deep manual review
+- Run `semgrep` first-pass triage to prioritize risky flows before deep manual review
 - Run at least one AST-structural mapping pass (`sg` and/or Tree-sitter), then use outputs for route, sink, and trust-boundary mapping
 - Keep AST output bounded to relevant paths and hypotheses; avoid whole-repo generic function dumps
 - Identify architecture pattern (MVC, microservices, monolith)

strix/skills/tooling/opengrep.md

@@ -1,69 +0,0 @@
----
-name: opengrep
-description: Exact Opengrep CLI structure, bundled offline rules, scoped rule selection, taint mode, and automation-safe output patterns.
----
-
-# Opengrep CLI Playbook
-
-Official docs:
-- https://github.com/opengrep/opengrep
-- https://github.com/opengrep/opengrep-rules
-
-Canonical syntax:
-`opengrep scan [flags] [targets]`
-
-Bundled rules:
-- `/opt/opengrep-rules` holds the full ruleset, one directory per language (`python`, `javascript`, `typescript`, `go`, `java`, `php`, `ruby`, …) plus `generic/secrets`, `dockerfile`, `terraform`, `yaml`, and `strix` (Strix-authored rules, e.g. GitHub-owned actions not pinned to a commit SHA)
-- Framework rules sit under the language (`python/django`, `python/flask`, `javascript/express`, …)
-
-High-signal flags:
-- `--config <path>` rule file or directory; repeat for several
-- `--taint-intrafile` intra-file inter-procedural taint (follows data across functions in one file)
-- `--json` / `--sarif` output format
-- `--output <file>` write findings to file
-- `--severity <level>` filter by severity (`INFO`, `WARNING`, `ERROR`)
-- `--error` return non-zero exit when findings exist
-- `--quiet` suppress progress noise
-- `--jobs <n>` parallel workers
-- `--timeout <seconds>` per-rule, per-file timeout
-- `--exclude <pattern>` / `--include <pattern>` path filters
-- `--exclude-rule <rule_id>` suppress specific rule
-- `--baseline-commit <sha>` only report findings introduced after baseline
-
-Agent-safe baseline for automation:
-`opengrep scan --config /opt/opengrep-rules --taint-intrafile --json --output opengrep.json --quiet --jobs 4 --timeout 20 /workspace`
-
-Common patterns:
-- Full bundled scan:
-  `opengrep scan --config /opt/opengrep-rules --json --output opengrep.json --quiet /workspace`
-- High-severity focused pass:
-  `opengrep scan --config /opt/opengrep-rules --severity ERROR --json --output opengrep_high.json --quiet /workspace`
-- SARIF output:
-  `opengrep scan --config /opt/opengrep-rules --sarif --output opengrep.sarif --quiet /workspace`
-- Language- or framework-specific rules:
-  `opengrep scan --config /opt/opengrep-rules/python --config /opt/opengrep-rules/generic/secrets --json --output opengrep_python.json --quiet /workspace`
-- Scoped directory scan:
-  `opengrep scan --config /opt/opengrep-rules --json --output opengrep_api.json --quiet /workspace/services/api`
-- Custom rule:
-  `opengrep scan --config ./rules/my-rule.yaml --json --output opengrep_custom.json --quiet /workspace`
-
-Critical correctness rules:
-- Always provide an explicit `--config` from `/opt/opengrep-rules` or a local rule file. Registry shorthands (`p/...`, `auto`) fetch rules from the network; do not use them.
-- Opengrep has no telemetry; there is no `--metrics` flag, and passing one fails the scan.
-- Prefer `--json --output <file>` or `--sarif --output <file>` for machine-readable downstream processing. JSON keeps `paths.scanned` and `results[].path`.
-- Keep the target path explicit; use an absolute or clearly scoped workspace path instead of `.` when possible.
-
-Usage rules:
-- Start with the full `/opt/opengrep-rules` set unless the task clearly calls for a narrower language or framework directory.
-- Add `--taint-intrafile` for injection-class hunting (SQLi, command injection, SSRF, path traversal) in supported languages.
-- Use `--quiet` in automation to reduce noisy logs.
-- Use `--jobs` and `--timeout` explicitly for reproducible runtime behavior.
-- `PartialParsing` errors on templates are normal; they do not invalidate the run.
-
-Failure recovery:
-- If scans are too slow, narrow the target path and the rule directories before changing engine settings.
-- If scans time out, increase `--timeout` modestly or lower `--jobs`.
-- If output is too broad, scope `--config`, add `--severity`, or exclude known irrelevant paths.
-
-If uncertain, query web_search with:
-`site:github.com/opengrep/opengrep <flag>`

strix/skills/tooling/semgrep.md

@@ -0,0 +1,72 @@
+---
+name: semgrep
+description: Exact Semgrep CLI structure, metrics-off scanning, scoped ruleset selection, and automation-safe output patterns.
+---
+
+# Semgrep CLI Playbook
+
+Official docs:
+- https://semgrep.dev/docs/cli-reference
+- https://semgrep.dev/docs/getting-started/cli
+- https://semgrep.dev/docs/semgrep-code/semgrep-pro-engine-intro
+
+Canonical syntax:
+`semgrep scan [flags]`
+
+High-signal flags:
+- `--config <rule_or_ruleset>` ruleset, registry pack, local rule file, or directory
+- `--metrics=off` disable telemetry and metrics reporting
+- `--json` JSON output
+- `--sarif` SARIF output
+- `--output <file>` write findings to file
+- `--severity <level>` filter by severity
+- `--error` return non-zero exit when findings exist
+- `--quiet` suppress progress noise
+- `--jobs <n>` parallel workers
+- `--timeout <seconds>` per-file timeout
+- `--exclude <pattern>` exclude path pattern
+- `--include <pattern>` include path pattern
+- `--exclude-rule <rule_id>` suppress specific rule
+- `--baseline-commit <sha>` only report findings introduced after baseline
+- `--pro` enable Pro engine if available
+- `--oss-only` force OSS engine only
+
+Agent-safe baseline for automation:
+`semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet --jobs 4 --timeout 20 /workspace`
+
+Common patterns:
+- Default security scan:
+  `semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet /workspace`
+- High-severity focused pass:
+  `semgrep scan --config p/default --severity ERROR --metrics=off --json --output semgrep_high.json --quiet /workspace`
+- OWASP-oriented scan:
+  `semgrep scan --config p/owasp-top-ten --metrics=off --sarif --output semgrep.sarif --quiet /workspace`
+- Language- or framework-specific rules:
+  `semgrep scan --config p/python --config p/secrets --metrics=off --json --output semgrep_python.json --quiet /workspace`
+- Scoped directory scan:
+  `semgrep scan --config p/default --metrics=off --json --output semgrep_api.json --quiet /workspace/services/api`
+- Pro engine check or run:
+  `semgrep scan --config p/default --pro --metrics=off --json --output semgrep_pro.json --quiet /workspace`
+
+Critical correctness rules:
+- Always include `--metrics=off`; Semgrep sends telemetry by default.
+- Always provide an explicit `--config`; do not rely on vague or implied defaults.
+- Prefer `--json --output <file>` or `--sarif --output <file>` for machine-readable downstream processing.
+- Keep the target path explicit; use an absolute or clearly scoped workspace path instead of `.` when possible.
+- If Pro availability matters, check it explicitly with a bounded command before assuming cross-file analysis exists.
+
+Usage rules:
+- Start with `p/default` unless the task clearly calls for a narrower pack.
+- Add focused packs such as `p/secrets`, `p/python`, or `p/javascript` only when they match the target stack.
+- Use `--quiet` in automation to reduce noisy logs.
+- Use `--jobs` and `--timeout` explicitly for reproducible runtime behavior.
+- Do not use `-h`/`--help` for routine operation unless absolutely necessary.
+
+Failure recovery:
+- If scans are too slow, narrow the target path and reduce the active rulesets before changing engine settings.
+- If scans time out, increase `--timeout` modestly or lower `--jobs`.
+- If output is too broad, scope `--config`, add `--severity`, or exclude known irrelevant paths.
+- If Pro mode fails, rerun with `--oss-only` or without `--pro` and note the loss of cross-file coverage.
+
+If uncertain, query web_search with:
+`site:semgrep.dev semgrep <flag> cli`

strix/skills/vulnerabilities/browser_security.md

@@ -1,6 +1,6 @@
 ---
 name: browser-security
-description: Browser-internals security testing for clickjacking, UI redressing, DoubleClickjacking, browsing-context relationships, postMessage, client-side path traversal, XS-Leaks, service workers, Web Workers, navigation behavior, CSP interactions, caches, and cross-origin state machines
+description: Browser-internals security testing for browsing-context relationships, postMessage, client-side path traversal, XS-Leaks, service workers, Web Workers, navigation behavior, CSP interactions, caches, and cross-origin state machines
 ---
 
 # Browser Security
@@ -43,15 +43,6 @@ Draw the context graph. Security checks on `event.origin`, `event.source`, or a
 - Check whether a blocked intermediate frame leaves a useful browsing-context relationship intact.
 - Use random per-flow names or `_blank` with `noopener` where an opener relationship is unnecessary.
 
-### Clickjacking and UI Redressing
-
-- **UI-redressing closure gate:** Never mark clickjacking as ruled out from `X-Frame-Options` or CSP `frame-ancestors` alone. Before closure, test both frame embedding and cross-window/popup retargeting.
-- Do not treat a different origin or port as protection against UI redressing. Same-origin policy blocks DOM access, not top-level navigation, `window.open()`, opener relationships, focus changes, or window closing. Test only explicitly authorized targets; if a required origin is outside scope, keep the path `needs_follow_up` and do not claim the vulnerability class is cleared.
-- For framed cases, prove the overlay and sensitive click. For DoubleClickjacking, use two real browser clicks and trace click 1 → window/focus/navigation/positioning change → click 2 → sensitive control. Never substitute scripted `.click()` calls.
-- Reproduce in the victim state required by the workflow—authenticated when necessary—with realistic user activation and stable geometry; capture window bounds and timing.
-- **Evidence-limited closure:** Verify a repeatable sensitive server-side state change with a recording or deterministic event trace and a negative control. If the exact sequence cannot be tested, record `needs_follow_up`, not `ruled_out` or `no_issue_found`. Popup-as-tab behavior, ignored geometry, unavailable OS-level input, or a manual control click are not counterevidence. Close the path only when a named mitigation blocks it, or when geometry is honored and both physical clicks are delivered without a sensitive action.
-- **Impact floor:** Successful execution of a protected consent, approval, or grant is an integrity impact even when idempotent, pre-seeded, or followed by no immediate token or data access. Use downstream capability to calibrate severity, not erase the demonstrated protected action.
-
 ### Client-Side Path Traversal
 
 Trace the complete source-to-request pipeline:
@@ -155,7 +146,7 @@ Also inspect DevTools network initiators, service workers, storage, CSP violatio
 
 ### Source Review
 
-- Search for `postMessage`, message listeners, `window.open`, named targets, opener/parent access, frame creation, `dblclick`, `mousedown`/`mouseup`, focus/blur, move/resize, navigation handlers, and sandbox attributes.
+- Search for `postMessage`, message listeners, `window.open`, named targets, opener/parent access, frame creation, and sandbox attributes.
 - Search for router parameter APIs flowing into `fetch`, Axios, navigation, or HTML rendering.
 - Search for service-worker registration, Cache API writes, worker constructors, Blob URLs, and dynamic imports.
 - Search for raw HTML sinks and trust escape hatches in every supported frontend framework.
@@ -170,7 +161,7 @@ Also inspect DevTools network initiators, service workers, storage, CSP violatio
 5. **Prove the primitive** - Data transfer, path change, state oracle, cache modification, or context capture.
 6. **Escalate deliberately** - Chain to a privileged action, sensitive disclosure, SSRF, or executable DOM sink.
 7. **Cross-browser check** - At minimum record Chromium/Firefox/Safari applicability when the primitive is browser-specific.
-8. **State interaction requirements** - Record each physical click or drag, popup permission state, active context, focus, geometry, navigation, timing window, login state, and visual deception.
+8. **State interaction requirements** - Click, drag, popup permission, timing window, login state, and visual deception.
 
 ## Validation
 
@@ -180,7 +171,7 @@ Also inspect DevTools network initiators, service workers, storage, CSP violatio
 4. For XS-Leaks, repeat randomized success/failure trials and quantify separation and noise.
 5. For workers/caches, show which later context consumes the modified data.
 6. For client-side traversal, capture the final network request and the security-relevant response/action.
-7. For interaction-dependent chains, show both click targets, intermediate context changes, and the resulting sensitive state change in a recording or deterministic event trace.
+7. For interaction-dependent chains, provide a screen recording or deterministic event trace.
 
 ## False Positives
 

tests/test_dedupe_decisions.py

@@ -1,159 +0,0 @@
-"""Only validated model decisions may suppress a finding."""
-
-from __future__ import annotations
-
-import json
-from typing import TYPE_CHECKING, Any
-from unittest.mock import AsyncMock
-
-import pytest
-from agents.items import ModelResponse
-from agents.usage import Usage
-from openai.types.responses import ResponseOutputMessage, ResponseOutputText
-
-from strix.config import loader
-from strix.report import dedupe
-from strix.report.state import ReportState, get_global_report_state, set_global_report_state
-from strix.tools.reporting.tool import _do_create
-
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-    from pathlib import Path
-
-
-@pytest.fixture
-def report_state(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Iterator[ReportState]:
-    monkeypatch.chdir(tmp_path)
-    previous = get_global_report_state()
-    state = ReportState(run_name="dedupe-decisions")
-    set_global_report_state(state)
-    state.add_vulnerability_report(title="Existing finding", severity="low")
-    try:
-        yield state
-    finally:
-        set_global_report_state(previous)
-
-
-def _mock_judge(monkeypatch: pytest.MonkeyPatch, decision: dict[str, Any]) -> AsyncMock:
-    settings = loader.load_settings().model_copy(deep=True)
-    settings.llm.model = "openai/synthetic-model"
-    model = AsyncMock()
-    model.get_response.return_value = ModelResponse(
-        output=[
-            ResponseOutputMessage(
-                id="msg_synthetic",
-                type="message",
-                role="assistant",
-                status="completed",
-                content=[
-                    ResponseOutputText(
-                        type="output_text",
-                        annotations=[],
-                        text=json.dumps({"confidence": 0.95, "reason": "Synthetic", **decision}),
-                    )
-                ],
-            )
-        ],
-        usage=Usage(),
-        response_id="synthetic",
-    )
-    monkeypatch.setattr(dedupe, "load_settings", lambda: settings)
-    monkeypatch.setattr(dedupe, "configure_sdk_model_defaults", lambda _: None)
-    monkeypatch.setattr(dedupe, "resolve_dedupe_model", lambda *_: model)
-    return model
-
-
-async def _file_finding() -> dict[str, Any]:
-    return await _do_create(
-        title="New finding",
-        description="The endpoint reflects unencoded input.",
-        impact="The reflected script executes in a victim's browser.",
-        target="https://example.invalid",
-        technical_analysis="Input is interpolated into HTML without encoding.",
-        poc_description="Open the endpoint with the reflected parameter.",
-        poc_script_code="print('synthetic reproduction')",
-        remediation_steps="Encode output for its HTML context.",
-        evidence="The synthetic response contains the unencoded parameter.",
-        assumptions="A victim follows the crafted link.",
-        counterevidence="No encoding or content security policy is present.",
-        confidence="high",
-        severity_change_conditions="A strict content security policy would lower the impact.",
-        fix_effort="low",
-        cvss_breakdown={
-            "attack_vector": "N",
-            "attack_complexity": "L",
-            "privileges_required": "N",
-            "user_interaction": "R",
-            "scope": "U",
-            "confidentiality": "L",
-            "integrity": "L",
-            "availability": "N",
-        },
-        endpoint="/search",
-        method="GET",
-        cve=None,
-        cwe="CWE-79",
-        code_locations=None,
-    )
-
-
-@pytest.mark.parametrize("value", ["false", "true", 0, 1, None, [], {}])
-def test_dedupe_parser_requires_a_boolean(value: Any) -> None:
-    with pytest.raises(TypeError, match="is_duplicate"):
-        dedupe._parse_dedupe_response(json.dumps({"is_duplicate": value}))
-
-
-@pytest.mark.parametrize(
-    "decision",
-    [
-        {"is_duplicate": "false", "duplicate_id": "vuln-0001"},
-        {"is_duplicate": "true", "duplicate_id": "vuln-0001"},
-        {"is_duplicate": 1, "duplicate_id": "vuln-0001"},
-        {"is_duplicate": True, "duplicate_id": "vuln-9999"},
-        {"is_duplicate": True, "duplicate_id": ""},
-        {"is_duplicate": True, "duplicate_id": None},
-        {"is_duplicate": True, "duplicate_id": ["vuln-0001"]},
-        {"is_duplicate": True},
-    ],
-)
-async def test_invalid_dedupe_decision_does_not_suppress_finding(
-    report_state: ReportState, monkeypatch: pytest.MonkeyPatch, decision: dict[str, Any]
-) -> None:
-    model = _mock_judge(monkeypatch, decision)
-
-    result = await _file_finding()
-
-    assert result["success"] is True
-    model.get_response.assert_awaited_once()
-    saved = json.loads((report_state.get_run_dir() / "vulnerabilities.json").read_text())
-    assert [report["title"] for report in saved] == ["Existing finding", "New finding"]
-    assert (report_state.get_run_dir() / "vulnerabilities" / "vuln-0002.md").is_file()
-
-
-@pytest.mark.parametrize("is_duplicate", [False, True])
-async def test_valid_dedupe_decisions_keep_their_meaning(
-    report_state: ReportState, monkeypatch: pytest.MonkeyPatch, is_duplicate: bool
-) -> None:
-    # An extraneous ID must not turn a valid false decision into a duplicate.
-    _mock_judge(monkeypatch, {"is_duplicate": is_duplicate, "duplicate_id": "vuln-0001"})
-
-    result = await _file_finding()
-
-    assert result["success"] is not is_duplicate
-    saved = json.loads((report_state.get_run_dir() / "vulnerabilities.json").read_text())
-    assert len(saved) == (1 if is_duplicate else 2)
-    if is_duplicate:
-        assert result["duplicate_of"] == "vuln-0001"
-
-
-async def test_dedupe_id_is_matched_without_truncation(monkeypatch: pytest.MonkeyPatch) -> None:
-    existing_id = "x" * 64
-    _mock_judge(monkeypatch, {"is_duplicate": True, "duplicate_id": existing_id + "-unknown"})
-
-    result = await dedupe.check_duplicate(
-        {"title": "New finding"}, [{"id": existing_id, "title": "Existing finding"}]
-    )
-
-    assert result["is_duplicate"] is False
-    assert "error" in result

tests/test_hooks.py

@@ -2,14 +2,11 @@
 
 from __future__ import annotations
 
-from types import SimpleNamespace
-from typing import TYPE_CHECKING, Any
+from typing import Any
 from unittest.mock import MagicMock, patch
 
 import pytest
-from agents.usage import Usage
 
-from strix.config import loader
 from strix.core.agents import AgentCoordinator
 from strix.core.hooks import (
     BudgetExceededError,
@@ -18,11 +15,6 @@ from strix.core.hooks import (
     SubagentBudgetReservedError,
     recomputed_budget_flags,
 )
-from strix.report.usage import LLMUsageLedger
-
-
-if TYPE_CHECKING:
-    from pathlib import Path
 
 
 def _make_hooks(max_budget: float | None) -> ReportUsageHooks:
@@ -93,38 +85,6 @@ async def test_over_budget_raises() -> None:
         await hooks.on_llm_end(_make_context(), MagicMock(), MagicMock())
 
 
-@pytest.mark.asyncio
-async def test_manual_rates_make_unpriced_model_trip_budget(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    monkeypatch.setenv("STRIX_LLM", "test-model")
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "10")
-    monkeypatch.delenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", raising=False)
-    monkeypatch.delenv("STRIX_LLM_CACHED_INPUT_COST_PER_MTOK", raising=False)
-    monkeypatch.setattr(loader, "_override", tmp_path / "missing.json")
-    monkeypatch.setattr(loader, "_cached", None)
-    usage = Usage()
-    usage.requests = 1
-    usage.input_tokens = 1000
-    usage.total_tokens = 1000
-    ledger = LLMUsageLedger()
-
-    class ReportState:
-        def record_sdk_usage(self, **kwargs: Any) -> None:
-            ledger.record(**kwargs)
-
-        def get_total_llm_cost(self) -> float:
-            return ledger.total_cost
-
-    hooks = _make_hooks(0.005)
-    response: Any = SimpleNamespace(usage=usage)
-    with (
-        patch("strix.core.hooks.get_global_report_state", return_value=ReportState()),
-        pytest.raises(BudgetExceededError),
-    ):
-        await hooks.on_llm_end(_make_context(), MagicMock(), response)
-
-
 @pytest.mark.asyncio
 async def test_budget_check_uses_live_cost_accessor() -> None:
     # The check must read the live ledger, not the persisted run-record snapshot,

tests/test_inputs.py

@@ -474,11 +474,6 @@ def test_openrouter_attribution_rides_on_the_request_headers() -> None:
     }
 
 
-def test_vercel_ai_gateway_attribution_rides_on_the_request_headers() -> None:
-    headers = make_model_settings(None, model_name="vercel_ai_gateway/zai/glm-5.3").extra_headers
-    assert headers == {"HTTP-Referer": "https://strix.ai", "X-Title": "Strix"}
-
-
 def test_openrouter_attribution_absent_for_other_providers() -> None:
     assert make_model_settings(None, model_name="anthropic/claude-sonnet-4-5").extra_headers is None
 

tests/test_pricing.py

@@ -1,50 +1,14 @@
 from __future__ import annotations
 
-import json
-from typing import TYPE_CHECKING
 from unittest.mock import patch
 
 import litellm
-import pytest
 from agents.usage import Usage
-from pydantic import ValidationError
 
-from strix.config import loader
-from strix.config.settings import LlmSettings
 from strix.report.pricing import resolve_litellm_model
 from strix.report.usage import LLMUsageLedger
 
 
-if TYPE_CHECKING:
-    from pathlib import Path
-
-
-PRICE_ENV = (
-    "STRIX_LLM_INPUT_COST_PER_MTOK",
-    "STRIX_LLM_OUTPUT_COST_PER_MTOK",
-    "STRIX_LLM_CACHED_INPUT_COST_PER_MTOK",
-)
-
-
-@pytest.fixture(autouse=True)
-def _isolated_settings(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-    for name in PRICE_ENV:
-        monkeypatch.delenv(name, raising=False)
-    monkeypatch.setenv("STRIX_LLM", "gateway/unpriced-model")
-    monkeypatch.setattr(loader, "_override", tmp_path / "missing.json")
-    monkeypatch.setattr(loader, "_cached", None)
-
-
-def _usage(input_tokens: int, output_tokens: int = 0, cached_tokens: int = 0) -> Usage:
-    usage = Usage()
-    usage.requests = 1
-    usage.input_tokens = input_tokens
-    usage.output_tokens = output_tokens
-    usage.total_tokens = input_tokens + output_tokens
-    usage.input_tokens_details.cached_tokens = cached_tokens
-    return usage
-
-
 def test_resolves_common_bare_model_names() -> None:
     resolve_litellm_model.cache_clear()
     assert resolve_litellm_model("deepseek-v4-flash") == "deepseek/deepseek-v4-flash"
@@ -96,112 +60,6 @@ def test_ledger_prefers_observed_cost_over_estimate() -> None:
     assert ledger.total_cost == 0.17
 
 
-def test_unpriced_model_without_manual_rates_costs_zero() -> None:
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-
-    assert ledger.total_cost == 0.0
-
-
-def test_manual_rates_price_usage_and_override_observed_cost(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-    ledger.record_observed_cost(0.17)
-
-    assert ledger.total_cost == 0.0036
-    assert ledger.to_record()["agents"][0]["cost"] == 0.0036
-
-
-def test_manual_rates_from_config_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    path = tmp_path / "config.json"
-    path.write_text(
-        json.dumps(
-            {
-                "env": {
-                    "STRIX_LLM_INPUT_COST_PER_MTOK": "2",
-                    "STRIX_LLM_OUTPUT_COST_PER_MTOK": "8",
-                }
-            }
-        ),
-        encoding="utf-8",
-    )
-    monkeypatch.setattr(loader, "_override", path)
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-
-    assert ledger.total_cost == 0.0036
-
-
-def test_manual_rates_only_price_the_configured_model(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-    with patch("litellm.completion_cost", return_value=0.42):
-        ledger.record(agent_id="dedupe", usage=_usage(500, 50), model="deepseek/deepseek-v4-flash")
-    record = ledger.to_record()
-
-    assert ledger.total_cost == 0.4236
-    assert {agent["agent_id"]: agent["cost"] for agent in record["agents"]} == {
-        "a": 0.0036,
-        "dedupe": 0.42,
-    }
-
-
-def test_cached_tokens_fall_back_to_input_rate(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "5")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "7")
-    ledger = LLMUsageLedger()
-
-    ledger.record(
-        agent_id="a", usage=_usage(10, 1, cached_tokens=2), model="gateway/unpriced-model"
-    )
-
-    assert ledger.total_cost == 0.000057
-
-
-def test_hydrated_usage_uses_configured_rates_not_persisted_cost(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
-    original = LLMUsageLedger()
-    original.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-    persisted = original.to_record()
-    persisted["cost"] = 42.0
-    persisted["agents"][0]["cost"] = 42.0
-    hydrated = LLMUsageLedger()
-
-    hydrated.hydrate(persisted)
-
-    assert hydrated.total_cost == 0.0036
-
-
-@pytest.mark.parametrize("value", ["invalid", "-1", "nan", "inf"])
-def test_invalid_manual_rate_is_rejected(value: str, monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", value)
-    with pytest.raises(ValidationError):
-        LlmSettings()
-
-
-def test_zero_cost_overrides_manual_rates(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "10")
-    ledger = LLMUsageLedger()
-    ledger.zero_cost = True
-
-    ledger.record(agent_id="a", usage=_usage(1000), model="gateway/unpriced-model")
-
-    assert ledger.total_cost == 0.0
-
-
 def test_hydrated_estimate_continues_accumulating_new_estimates() -> None:
     usage = Usage()
     usage.requests = 1