feat(skills): add ReDoS skill with recheck-assisted detection

docs/advanced/configuration.mdx

@@ -33,18 +33,6 @@ Configure Strix using environment variables or a config file.
   the LiteLLM and native OpenAI routing paths.
 </ParamField>
 
-<ParamField path="LLM_EXTRA_BODY" type="string">
-  Extra fields merged into the JSON body of every request to the main model, as a JSON object
-  (e.g. `{"service_tier":"flex","safety_identifier":"9f86d081..."}`). Use it
-  for provider parameters Strix doesn't expose, such as OpenAI's `service_tier`
-  or `safety_identifier`. Applies to both the LiteLLM and native OpenAI routing
-  paths. Fields are not validated, so the provider or gateway must accept them;
-  unknown fields are usually rejected. Extra fields can override fields Strix
-  sends and break requests, so don't set request-shaping fields such as `model`, `messages`, `input`,
-  `tools` or `stream`, and use `STRIX_REASONING_EFFORT` rather than
-  `reasoning_effort`.
-</ParamField>
-
 <ParamField path="LLM_TIMEOUT" default="300" type="integer">
   Request timeout in seconds for LLM calls.
 </ParamField>
@@ -100,12 +88,6 @@ affecting the agents that do the actual testing.
   inherits `LLM_EXTRA_HEADERS`; set this when its endpoint needs custom headers.
 </ParamField>
 
-<ParamField path="DEDUPE_LLM_EXTRA_BODY" type="string">
-  Optional JSON object of extra request-body fields sent on every
-  deduplication-model request. A dedicated dedupe model never inherits
-  `LLM_EXTRA_BODY`; set this when its endpoint needs them too.
-</ParamField>
-
 <ParamField path="STRIX_DEDUPE_REASONING_EFFORT" type="string">
   Reasoning effort for the deduplication model. Defaults to the model's own
   baseline when unset.

docs/llm-providers/local.mdx

@@ -68,21 +68,6 @@ export LLM_API_KEY="your-bearer-token"          # sent as Authorization: Bearer
 export LLM_EXTRA_HEADERS='{"X-Feature-Key":"value","X-Tenant":"acme"}'
 ```
 
-### Extra request-body fields
-
-Some provider parameters go in the request body rather than a header, and
-Strix has no dedicated setting for them. Set them with `LLM_EXTRA_BODY` as a
-JSON object — they are merged into the body of every request to the model. For example, to
-use OpenAI's cheaper flex processing and attribute requests to a user with a
-safety identifier (a hash, never a raw email):
-
-```bash
-export LLM_EXTRA_BODY='{"service_tier":"flex","safety_identifier":"9f86d081884c7d65"}'
-```
-
-Fields aren't validated, so use only fields your provider accepts, and don't
-set fields Strix already sends, such as `model`, `messages` or `stream`.
-
 For endpoints behind a private CA, point Strix at your certificate bundle with
 the standard `SSL_CERT_FILE=/path/to/ca-bundle.pem` — never disable TLS
 verification against a real endpoint.

strix/agents/factory.py

@@ -13,13 +13,11 @@ from agents.agent import ToolsToFinalOutputResult
 from agents.sandbox import SandboxAgent
 from agents.sandbox.capabilities import Filesystem, Shell
 from agents.sandbox.errors import InvalidManifestPathError
-from agents.sandbox.session.pty_types import PTY_YIELD_TIME_MS_MAX
 from agents.tool import CustomTool, FunctionTool, Tool
 from pydantic import ValidationError
 
 from strix.agents.prompt import render_system_prompt
 from strix.config import load_settings
-from strix.config.tool_call_arguments import describe_malformed_arguments
 from strix.tools.agents_graph.tools import (
     agent_finish,
     create_agent,
@@ -269,10 +267,6 @@ def _with_coerced_arguments(tool: FunctionTool) -> FunctionTool:
     nullish = tool.name.startswith(_QUERY_TOOL_PREFIXES)
 
     async def invoke(ctx: Any, raw_input: str) -> Any:
-        malformed = describe_malformed_arguments(tool.name, raw_input)
-        if malformed is not None:
-            logger.debug("Tool %s got malformed arguments; asking the model to re-issue", tool.name)
-            return malformed
         return await invoke_tool(ctx, _coerce_arguments(raw_input, schema, nullish=nullish))
 
     tool.on_invoke_tool = invoke
@@ -442,47 +436,8 @@ def _apply_shell_output_cap(parsed: dict[str, Any]) -> None:
     )
 
 
-_EXEC_YIELD_CAP_S = PTY_YIELD_TIME_MS_MAX // 1000
-
-_EXEC_COMMAND_DESCRIPTION_NOTE = (
-    f"The wait for output is capped at {_EXEC_YIELD_CAP_S} s whatever yield_time_ms says. "
-    "A non-TTY command still running at the yield cannot be read later (write_stdin fails "
-    "on it and its output is lost): run anything longer in the background with its output "
-    "redirected to a file (`cmd > /tmp/out.log 2>&1 &`, then read the log), or start it with "
-    'tty=true and poll with write_stdin(session_id=<id>, chars="").'
-)
-
-_RUNNING_NON_TTY_NOTICE = (
-    "Note: this non-TTY process cannot be polled and its later output is lost. Rerun it in "
-    "the background (`cmd > /tmp/out.log 2>&1 &`, then read the log) or with tty=true."
-)
-
-_PROCESS_RUNNING_RE = re.compile(r"^Process running with session ID \d+$", re.MULTILINE)
-_OUTPUT_HEADER_RE = re.compile(r"^Output:\n", re.MULTILINE)
-
-
-def _annotate_running_non_tty(parsed: dict[str, Any], result: Any) -> Any:
-    if parsed.get("tty") or not isinstance(result, str):
-        return result
-    header = _OUTPUT_HEADER_RE.search(result)
-    head_end = len(result) if header is None else header.start()
-    if _PROCESS_RUNNING_RE.search(result, 0, head_end) is None:
-        return result
-    notice = _RUNNING_NON_TTY_NOTICE
-    requested = parsed.get("yield_time_ms")
-    if isinstance(requested, int | float) and requested > PTY_YIELD_TIME_MS_MAX:
-        notice = (
-            f"Note: yield_time_ms={int(requested)} was capped at {PTY_YIELD_TIME_MS_MAX} "
-            f"({_EXEC_YIELD_CAP_S} s). " + notice.removeprefix("Note: ")
-        )
-    if header is None:
-        return f"{result}\n{notice}"
-    return f"{result[: header.end()]}{notice}\n{result[header.end() :]}"
-
-
 def _wrap_exec_command(tool: FunctionTool) -> FunctionTool:
     invoke_tool = tool.on_invoke_tool
-    tool.description = f"{tool.description.rstrip()} {_EXEC_COMMAND_DESCRIPTION_NOTE}"
 
     async def invoke(ctx: Any, raw_input: str) -> Any:
         try:
@@ -495,7 +450,7 @@ def _wrap_exec_command(tool: FunctionTool) -> FunctionTool:
             _apply_shell_output_cap(parsed)
             raw_input = json.dumps(parsed)
         try:
-            result = await invoke_tool(ctx, raw_input)
+            return await invoke_tool(ctx, raw_input)
         except ValidationError as exc:
             return _format_validation_error(tool.name, exc)
         except InvalidManifestPathError as exc:
@@ -505,9 +460,6 @@ def _wrap_exec_command(tool: FunctionTool) -> FunctionTool:
                 "(or omitted to use the turn's cwd). "
                 f"Got: {rel!r}."
             )
-        if isinstance(parsed, dict):
-            return _annotate_running_non_tty(parsed, result)
-        return result
 
     tool.on_invoke_tool = invoke
     return tool

strix/agents/prompts/system_prompt.jinja

@@ -44,7 +44,7 @@ INTERACTIVE BEHAVIOR:
 - If you end a turn on plain text and the nudge arrives, your words already reached the user. Do not repeat them: call wait_for_user.
 - You can narrate while you work — plain text is shown to the user as you go. Narrating is free; wait_for_user is specifically the act of WAITING for the user, so do not call it just to give a status update.
 - Respond naturally when the user asks questions or gives instructions.
-- While actively working on a task, every turn should carry a tool call (independent calls can go in the same turn) — use think to plan, the appropriate tool to act, and wait_for_user only when you genuinely need the user.
+- While actively working on a task, every turn should carry exactly one tool call — use think to plan, the appropriate tool to act, and wait_for_user only when you genuinely need the user.
 - Never loop through think or other tools just to prepare, polish, confirm, or announce an answer. Once you know the answer, write it and call wait_for_user.
 {% else %}
 AUTONOMOUS BEHAVIOR:
@@ -55,7 +55,6 @@ AUTONOMOUS BEHAVIOR:
 - There is no user attached to this run, so there is nobody to ask and nothing to yield to. If there is nothing left to execute: do NOT send filler/repetitive text — either call wait_for_agents (only if you are genuinely expecting another agent to message you) or finish your work (subagents: agent_finish; root: finish_scan)
 - While the agent loop is running, almost every output MUST be a tool call. Do NOT send plain text messages; act via tools. If waiting on another agent, use wait_for_agents; when done, use agent_finish (subagents) or finish_scan (root)
 - A text-only turn does nothing: it neither ends the run nor yields — it just wastes a turn and forces a retry. The lifecycle tools (``finish_scan`` for root, ``agent_finish`` for subagents) are the ONLY way to terminate, and the report flows through them. If you find yourself wanting to say "Done!" or "Scan complete" without a tool call, call the lifecycle tool instead.
-- Read-only calls can go together in one turn: when several file reads or searches don't depend on each other's output, issue them as separate tool calls in the same turn rather than one per turn. Anything else — writing files, running commands that change state, sending requests, creating or messaging agents, reporting, or finishing — goes alone in its own turn.
 {% endif %}
 </communication_rules>
 

strix/config/loader.py

@@ -6,8 +6,7 @@ import json
 import logging
 import os
 from pathlib import Path
-from types import UnionType
-from typing import TYPE_CHECKING, Any, Union, get_args, get_origin
+from typing import TYPE_CHECKING, Any
 
 from pydantic import AliasChoices, BaseModel
 
@@ -127,36 +126,13 @@ def _read_json_overrides(path: Path) -> dict[str, dict[str, Any]]:
                 continue  # env wins under some alias; skip the JSON file for this field
             for alias in aliases:
                 if alias in env_block_upper:
-                    sub_data[fname] = _decode_saved_value(finfo, env_block_upper[alias])
+                    sub_data[fname] = env_block_upper[alias]
                     break
         if sub_data:
             nested[sub_name] = sub_data
     return nested
 
 
-def _decode_saved_value(finfo: FieldInfo, value: Any) -> Any:
-    """Decode a JSON string saved for a dict field, as pydantic does for env vars.
-
-    ``persist_current`` saves env values verbatim, so a dict setting such as
-    ``LLM_EXTRA_HEADERS`` lands in the file as JSON text. Values that are
-    already objects, or aren't valid JSON, are left for validation to judge.
-    """
-    if not isinstance(value, str) or not _is_dict_field(finfo):
-        return value
-    try:
-        return json.loads(value)
-    except ValueError:
-        return value
-
-
-def _is_dict_field(finfo: FieldInfo) -> bool:
-    annotation = finfo.annotation
-    candidates = (
-        get_args(annotation) if get_origin(annotation) in (Union, UnionType) else (annotation,)
-    )
-    return any(c is dict or get_origin(c) is dict for c in candidates)
-
-
 def _first_alias_value(aliases: list[str], source: Mapping[str, Any]) -> Any | None:
     return next((source[alias] for alias in aliases if alias in source), None)
 

strix/config/models.py

@@ -41,7 +41,6 @@ from openai.types.shared import Reasoning
 from strix.agents.prompt import CACHE_POINT
 from strix.config import codex
 from strix.config.loader import load_settings
-from strix.config.tool_call_arguments import repair_input
 from strix.config.tool_call_ids import TurnCallIdRewriter, dedupe_input
 from strix.config.tool_call_limits import TurnToolCallLimiter
 from strix.llm import request_log
@@ -256,12 +255,6 @@ class _TurnGuardModel(Model):
     Ids that collide with the history are rewritten before the turn is
     recorded, and already-corrupted histories are repaired on the way out.
 
-    Tool-call arguments: a turn whose ``arguments`` are not valid JSON fails
-    that one call with a parse error, but the raw string is recorded and
-    strict providers then reject every request that replays it. Such
-    arguments are rewritten to a valid JSON object on the way out (see
-    :mod:`strix.config.tool_call_arguments`).
-
     Tool-call volume: a degenerate response can queue hundreds of calls that
     the run loop then honours one by one. Only the first
     ``LLM_MAX_TOOL_CALLS_PER_TURN`` calls of a response are kept.
@@ -320,7 +313,7 @@ class _TurnGuardModel(Model):
         conversation_id: str | None,
         prompt: ResponsePromptParam | None,
     ) -> ModelResponse:
-        sanitized = _sanitize_input(input)
+        sanitized = dedupe_input(input)
         rewriter = TurnCallIdRewriter(sanitized)
         system_instructions, sanitized = _split_cached_prefix(
             system_instructions, sanitized, model_settings
@@ -356,7 +349,7 @@ class _TurnGuardModel(Model):
         conversation_id: str | None,
         prompt: ResponsePromptParam | None,
     ) -> AsyncIterator[TResponseStreamEvent]:
-        sanitized = _sanitize_input(input)
+        sanitized = dedupe_input(input)
         rewriter = TurnCallIdRewriter(sanitized)
         system_instructions, sanitized = _split_cached_prefix(
             system_instructions, sanitized, model_settings
@@ -386,10 +379,6 @@ class _TurnGuardModel(Model):
         self._log_dropped(limiter)
 
 
-def _sanitize_input(model_input: str | list[TResponseInputItem]) -> str | list[Any]:
-    return repair_input(dedupe_input(model_input))
-
-
 def _split_cached_prefix(
     system_instructions: str | None,
     model_input: str | list[Any],

strix/config/settings.py

@@ -2,7 +2,7 @@
 
 from __future__ import annotations
 
-from typing import Any, Literal
+from typing import Literal
 
 from pydantic import AliasChoices, Field, field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
@@ -55,11 +55,6 @@ class LlmSettings(BaseSettings):
         alias="LLM_EXTRA_HEADERS",
         repr=False,
     )
-    extra_body: dict[str, Any] | None = Field(
-        default=None,
-        alias="LLM_EXTRA_BODY",
-        repr=False,
-    )
     reasoning_effort: ReasoningEffort = Field(default="high", alias="STRIX_REASONING_EFFORT")
     force_required_tool_choice: bool = Field(
         default=False,
@@ -115,11 +110,6 @@ class DedupeSettings(BaseSettings):
         alias="DEDUPE_LLM_EXTRA_HEADERS",
         repr=False,
     )
-    extra_body: dict[str, Any] | None = Field(
-        default=None,
-        alias="DEDUPE_LLM_EXTRA_BODY",
-        repr=False,
-    )
 
     @field_validator("reasoning_effort", mode="before")
     @classmethod

strix/config/tool_call_arguments.py

@@ -1,100 +0,0 @@
-"""Keep replayed tool-call arguments valid JSON.
-
-A model occasionally emits a tool call whose ``arguments`` string is not a
-JSON object (truncated, unbalanced, empty). The call itself fails safely: the
-tool reports the parse error and the run continues. But the raw string is
-recorded in the session as-is, and strict OpenAI-compatible servers (vLLM,
-SGLang, ...) validate every assistant tool call in the request, so from then
-on each turn is rejected with ``Assistant tool call function.arguments must
-be valid JSON`` and the agent can never recover. Rewriting the replayed
-arguments to a JSON object that carries the original text keeps the history
-valid while the model still sees what it sent.
-"""
-
-from __future__ import annotations
-
-import json
-from typing import Any
-
-from openai.types.responses import ResponseFunctionToolCall
-
-
-MALFORMED_ARGUMENTS_KEY = "malformed_arguments"
-
-
-def _reject_constant(name: str) -> Any:
-    raise ValueError(f"non-standard JSON constant {name}")
-
-
-def _loads_strict(text: str) -> Any:
-    try:
-        return json.loads(text, parse_constant=_reject_constant)
-    except RecursionError as exc:
-        raise ValueError("arguments are nested too deeply to parse") from exc
-
-
-def describe_malformed_arguments(tool_name: str, arguments: str) -> str | None:
-    """Return a model-facing recovery message if ``arguments`` is not a JSON object.
-
-    A tool call whose arguments do not parse is almost always one the stream cut
-    off (the server flushed a prefix of the JSON, or the client closed early),
-    so instead of the SDK's generic parse-error result the model is told the
-    call never ran and must be re-issued whole.
-    """
-    if not arguments.strip():
-        return None
-    try:
-        parsed = _loads_strict(arguments)
-    except ValueError as exc:
-        detail = str(exc)
-    else:
-        if isinstance(parsed, dict):
-            return None
-        detail = f"expected a JSON object, got {type(parsed).__name__}"
-    return (
-        f"{tool_name}: the tool call was not executed because its arguments were "
-        f"truncated or otherwise not valid JSON ({detail}). The response was likely "
-        "cut off mid-call. Re-issue the call with complete, valid JSON arguments."
-    )
-
-
-def repair_arguments(arguments: object) -> str | None:
-    """Return replacement arguments a strict server accepts, or ``None`` if already valid."""
-    if not isinstance(arguments, str) or not arguments.strip():
-        return "{}"
-    try:
-        parsed = _loads_strict(arguments)
-    except ValueError:
-        parsed = None
-    if isinstance(parsed, dict):
-        return None
-    return json.dumps({MALFORMED_ARGUMENTS_KEY: arguments}, ensure_ascii=False)
-
-
-def repair_history_arguments(items: list[Any]) -> tuple[list[Any], bool]:
-    """Rewrite function calls in a conversation history whose arguments are not a JSON object."""
-    rebuilt: list[Any] = []
-    changed = False
-
-    for item in items:
-        if isinstance(item, dict):
-            if item.get("type") == "function_call":
-                repaired = repair_arguments(item.get("arguments"))
-                if repaired is not None:
-                    item = {**item, "arguments": repaired}  # noqa: PLW2901
-                    changed = True
-        elif isinstance(item, ResponseFunctionToolCall):
-            repaired = repair_arguments(item.arguments)
-            if repaired is not None:
-                item = item.model_copy(update={"arguments": repaired})  # noqa: PLW2901
-                changed = True
-        rebuilt.append(item)
-
-    return rebuilt, changed
-
-
-def repair_input(model_input: str | list[Any]) -> str | list[Any]:
-    if isinstance(model_input, str):
-        return model_input
-    rebuilt, changed = repair_history_arguments(model_input)
-    return rebuilt if changed else model_input

strix/core/agents.py

@@ -75,7 +75,6 @@ class AgentCoordinator:
         self._budget_stopped = False
         self._reserve_stopped = False
         self._budget_paused = False
-        self._operator_paused = False
         self._resume_epoch = 0
         self._budget_policy: BudgetPolicy = "stop"
         self._extend_budget: Callable[[], None] | None = None
@@ -106,10 +105,6 @@ class AgentCoordinator:
     def budget_paused(self) -> bool:
         return self._budget_paused
 
-    @property
-    def operator_paused(self) -> bool:
-        return self._operator_paused
-
     @property
     def resume_epoch(self) -> int:
         """Bumped by every ``resume_budget``; an agent parks against the value it read."""
@@ -155,7 +150,6 @@ class AgentCoordinator:
         """
         async with self._lock:
             self._budget_paused = True
-            self._operator_paused = True
         logger.info("scan paused by the operator")
         await self._maybe_snapshot()
 
@@ -171,7 +165,6 @@ class AgentCoordinator:
             self._set_budget_limit(max_budget_usd)
         async with self._lock:
             self._budget_paused = False
-            self._operator_paused = False
             self._resume_epoch += 1
             woken = [aid for aid, status in self.statuses.items() if status == "budget_paused"]
             for aid in woken:
@@ -239,7 +232,7 @@ class AgentCoordinator:
             self._budget_stopped = budget_stopped
             self._reserve_stopped = reserve_stopped
             if not budget_paused:
-                self._budget_paused = self._operator_paused
+                self._budget_paused = False
                 for aid, status in self.statuses.items():
                     if status == "budget_paused":
                         self.statuses[aid] = "waiting"
@@ -431,12 +424,7 @@ class AgentCoordinator:
         unknown, or it is terminal and its loop does not park for wake-ups.
         """
         from_user = message.get("from") == "user"
-        if (
-            from_user
-            and self._budget_paused
-            and not self._operator_paused
-            and self._budget_policy != "pause"
-        ):
+        if from_user and self._budget_paused and self._budget_policy != "pause":
             await self.resume_from_budget_pause(exclude=target_agent_id)
         async with self._lock:
             if target_agent_id not in self.statuses:
@@ -459,9 +447,7 @@ class AgentCoordinator:
                 self.recovery_counts.pop(target_agent_id, None)
                 self.idle_resume_counts.pop(target_agent_id, None)
                 self._parent_notified.discard(target_agent_id)
-                held = self._operator_paused and self.statuses[target_agent_id] == "budget_paused"
-                if not held:
-                    self.statuses[target_agent_id] = "waiting"
+                self.statuses[target_agent_id] = "waiting"
             runtime.wake.set()
             stream = runtime.stream
             interrupt_on_message = runtime.interrupt_on_message
@@ -654,7 +640,6 @@ class AgentCoordinator:
                 "budget_stopped": self._budget_stopped,
                 "reserve_stopped": self._reserve_stopped,
                 "budget_paused": self._budget_paused,
-                "operator_paused": self._operator_paused,
             }
 
     async def restore(self, snap: dict[str, Any]) -> None:
@@ -677,7 +662,6 @@ class AgentCoordinator:
             self._budget_stopped = bool(snap.get("budget_stopped", False))
             self._reserve_stopped = bool(snap.get("reserve_stopped", False))
             self._budget_paused = bool(snap.get("budget_paused", False))
-            self._operator_paused = bool(snap.get("operator_paused", False))
             for aid in self.statuses:
                 self.runtimes.setdefault(aid, AgentRuntime())
 

strix/core/execution.py

@@ -599,7 +599,7 @@ async def _run_until_lifecycle(
                     hooks=hooks,
                 )
         except BudgetPausedError as exc:
-            if coordinator.budget_policy != "pause" and not exc.operator_pause:
+            if coordinator.budget_policy != "pause":
                 raise
             # The agent parked right before an LLM call; everything up to that
             # point is already in its session. Once resumed, the same call goes
@@ -612,7 +612,6 @@ async def _run_until_lifecycle(
                 # Stopped while parked (operator stop or a parent's stop_agent).
                 await coordinator.reset_recovery(agent_id)
                 return result
-            await coordinator.consume_pending(agent_id)
             if session is not None:
                 input_data = []
             continue
@@ -832,7 +831,7 @@ async def _run_cycle(  # noqa: PLR0912, PLR0915
                 await coordinator.detach_stream(agent_id, stream)
         except BudgetPausedError as exc:
             logger.info("agent %s paused at the scan budget limit: %s", agent_id, exc)
-            if coordinator.budget_policy == "pause" or exc.operator_pause:
+            if coordinator.budget_policy == "pause":
                 await coordinator.park_for_budget(agent_id)
             else:
                 await coordinator.pause_for_budget(agent_id)
@@ -1004,7 +1003,7 @@ async def _append_tool_required_message(
         message = (
             "Your previous message ended a turn without a tool call. Plain text never ends "
             "execution and never hands control to the user: it is shown to the user, and the "
-            "run continues. Continue immediately and call a tool. "
+            "run continues. Continue immediately and call exactly one tool. "
             "If you have nothing to do until the user replies, call wait_for_user; your "
             "text already reached them, so do not repeat it. "
             "If you are blocked waiting for another agent, call wait_for_agents. "
@@ -1016,7 +1015,7 @@ async def _append_tool_required_message(
         message = (
             "Your previous response ended the autonomous run without a lifecycle tool "
             "call. That is invalid in non-interactive mode; plain text final answers are "
-            "ignored. Continue immediately and call a tool. "
+            "ignored. Continue immediately and call exactly one tool. "
             f"If your work is complete, call {finish_tool}. "
             "If you are blocked waiting for another agent, call wait_for_agents. "
             "Otherwise use the appropriate execution or planning tool. "

strix/core/hooks.py

@@ -65,12 +65,9 @@ class BudgetPausedError(RuntimeError):
     decided to park; the agent waits for a resume newer than that.
     """
 
-    def __init__(
-        self, message: str, *, resume_epoch: int = 0, operator_pause: bool = False
-    ) -> None:
+    def __init__(self, message: str, *, resume_epoch: int = 0) -> None:
         super().__init__(message)
         self.resume_epoch = resume_epoch
-        self.operator_pause = operator_pause
 
 
 def _validate_budget(max_budget_usd: float | None) -> None:
@@ -201,7 +198,6 @@ class ReportUsageHooks(RunHooks[dict[str, Any]]):
         system_prompt: str | None,  # noqa: ARG002
         input_items: list[TResponseInputItem],
     ) -> None:
-        self._pause_if_operator_paused(context)
         if self._budget_policy == "pause":
             self._pause_if_limited(context)
         context.context[LLM_TURN_KEY] = int(context.context.get(LLM_TURN_KEY, 0)) + 1
@@ -211,15 +207,6 @@ class ReportUsageHooks(RunHooks[dict[str, Any]]):
         except Exception:
             logger.exception("budget/turn warning injection failed")
 
-    def _pause_if_operator_paused(self, context: RunContextWrapper[dict[str, Any]]) -> None:
-        coordinator = coordinator_from_context(context.context)
-        if coordinator is not None and coordinator.operator_paused:
-            raise BudgetPausedError(
-                "scan paused; waiting for the operator to resume",
-                resume_epoch=coordinator.resume_epoch,
-                operator_pause=True,
-            )
-
     def _pause_if_limited(self, context: RunContextWrapper[dict[str, Any]]) -> None:
         """Park the agent before a paid call when the scan is at its limit or paused.
 

strix/core/inputs.py

@@ -250,26 +250,22 @@ def make_model_settings(
     request_timeout: float | None = None,
     prompt_cache: bool = True,
     extra_headers: dict[str, str] | None = None,
-    extra_body: dict[str, Any] | None = None,
     has_tools: bool = True,
 ) -> ModelSettings:
     headers = _request_headers(model_name, extra_headers)
     model_settings = ModelSettings(
-        parallel_tool_calls=True if has_tools else None,
+        parallel_tool_calls=False if has_tools else None,
         retry=DEFAULT_MODEL_RETRY,
         include_usage=True,
         extra_args=request_timeout_extra_args(request_timeout),
         extra_headers=headers,
-        extra_body=dict(extra_body) if extra_body else None,
     )
     if (
         reasoning_effort is not None
         and reasoning_effort != "none"
         and model_supports_reasoning(model_name)
     ):
-        model_settings = model_settings.resolve(
-            _reasoning_settings(reasoning_effort, extra_body),
-        )
+        model_settings = model_settings.resolve(_reasoning_settings(reasoning_effort))
     if force_required_tool_choice and _accepts_required_tool_choice(model_name):
         model_settings = model_settings.resolve(ModelSettings(tool_choice="required"))
 
@@ -294,9 +290,7 @@ def _request_headers(
     return headers or None
 
 
-def _reasoning_settings(
-    effort: ReasoningEffort, extra_body: dict[str, Any] | None = None
-) -> ModelSettings:
+def _reasoning_settings(effort: ReasoningEffort) -> ModelSettings:
     """``max`` is not in the OpenAI SDK's ``Reasoning.effort`` enum, so send it as
     a raw body field instead — also keeping it clear of LiteLLM's DeepSeek mapping,
     which collapses every ``reasoning_effort`` level to plain thinking-enabled.
@@ -304,13 +298,11 @@ def _reasoning_settings(
 
     It goes in ``extra_body``, the field every model implementation forwards as the
     request's ``extra_body``; the same value under ``extra_args`` collides with that
-    keyword and raises before a request is ever sent. ``resolve`` replaces
-    ``extra_body`` wholesale, so the user's ``LLM_EXTRA_BODY`` fields are carried
-    over, with ``reasoning_effort`` taking precedence.
+    keyword and raises before a request is ever sent.
     """
     if effort != "max":
         return ModelSettings(reasoning=Reasoning(effort=effort))
-    return ModelSettings(extra_body={**(extra_body or {}), "reasoning_effort": "max"})
+    return ModelSettings(extra_body={"reasoning_effort": "max"})
 
 
 def _prompt_cache_extra_args(model_name: str) -> dict[str, Any] | None:

strix/core/runner.py

@@ -401,7 +401,6 @@ async def run_strix_scan(
             request_timeout=settings.llm.timeout,
             prompt_cache=settings.llm.prompt_cache,
             extra_headers=settings.llm.extra_headers,
-            extra_body=settings.llm.extra_body,
         )
         run_config = RunConfig(
             model=resolved_model,

strix/interface/main.py

@@ -164,13 +164,12 @@ async def warm_up_llm() -> None:
             raw_model = dedupe_model
             deduper = resolve_dedupe_model(settings.dedupe, dedupe_model)
             # A dedicated dedupe model may route to another provider, which must
-            # never receive the main endpoint's headers or body fields; it has
-            # its own DEDUPE_LLM_EXTRA_HEADERS and DEDUPE_LLM_EXTRA_BODY.
+            # never receive the main endpoint's headers; it has its own
+            # DEDUPE_LLM_EXTRA_HEADERS.
             await preflight_request(
                 deduper,
                 model_name=dedupe_model,
                 extra_headers=settings.dedupe.extra_headers,
-                extra_body=settings.dedupe.extra_body,
                 timeout=llm.preflight_timeout,
                 api_base_setting="DEDUPE_LLM_API_BASE",
             )

strix/interface/scan_setup.py

@@ -116,7 +116,6 @@ async def preflight_model_connection(
         model,
         model_name=model_name,
         extra_headers=resolved_settings.llm.extra_headers,
-        extra_body=resolved_settings.llm.extra_body,
         timeout=resolved_settings.llm.preflight_timeout,
         api_base_setting="LLM_API_BASE",
     )
@@ -127,7 +126,6 @@ async def preflight_request(
     *,
     model_name: str,
     extra_headers: dict[str, str] | None,
-    extra_body: dict[str, Any] | None,
     timeout: int,
     api_base_setting: str,
 ) -> None:
@@ -146,7 +144,6 @@ async def preflight_request(
         request_timeout=timeout,
         prompt_cache=False,
         extra_headers=extra_headers,
-        extra_body=extra_body,
         has_tools=False,
     )
     try:

strix/llm/compaction.py

@@ -307,7 +307,6 @@ async def _summarize(model: str, prompt: str, max_tokens: int) -> str | None:
         request_timeout=llm.timeout,
         prompt_cache=False,
         extra_headers=llm.extra_headers,
-        extra_body=llm.extra_body,
         has_tools=False,
     ).resolve(ModelSettings(max_tokens=max_tokens))
     try:

strix/report/coverage.py

@@ -124,6 +124,7 @@ _SKILL_PHRASINGS: dict[str, tuple[str, ...]] = {
     "prototype_pollution": ("prototype pollution",),
     "race_conditions": ("race condition", "toctou"),
     "rce": ("rce", "remote code execution", "code execution", "command injection"),
+    "redos": ("redos", "regex denial", "regular expression denial", "catastrophic backtracking"),
     "semantic_confusion": (
         "semantic confusion",
         "parser differential",

strix/report/dedupe.py

@@ -39,13 +39,11 @@ def _dedupe_model_settings(
         model_name=model_name,
         force_required_tool_choice=False,
         request_timeout=request_timeout,
-        # The main model's headers and body fields apply only when dedupe falls
-        # back to the main model; a dedicated dedupe model may route to another
-        # provider, which must never receive the main endpoint's credentials or
-        # identifiers. A dedicated model gets its own DEDUPE_LLM_EXTRA_HEADERS
-        # and DEDUPE_LLM_EXTRA_BODY instead.
+        # The main model's headers apply only when dedupe falls back to the main
+        # model; a dedicated dedupe model may route to another provider, which
+        # must never receive the main endpoint's credentials. A dedicated model
+        # gets its own DEDUPE_LLM_EXTRA_HEADERS instead.
         extra_headers=dedupe.extra_headers if dedupe.model else llm.extra_headers,
-        extra_body=dedupe.extra_body if dedupe.model else llm.extra_body,
         has_tools=False,
     )
 

strix/skills/vulnerabilities/redos.md

@@ -0,0 +1,129 @@
+---
+name: redos
+description: Regular expression denial of service (ReDoS, CWE-1333) in backtracking regex engines, covering exponential and polynomial patterns, recheck-assisted detection, growth-curve confirmation, and severity calibration
+---
+
+# ReDoS (Regular Expression Denial of Service)
+
+A backtracking regex engine can take exponential or polynomial time on a crafted input that almost matches. When attacker-controlled text reaches such a pattern, one request or one document can pin a CPU core for seconds to hours. Tracked as CWE-1333 (Inefficient Regular Expression Complexity).
+
+The textbook shape, nested quantifiers like `(a+)+`, is the rarest one in real code. Most real ReDoS is polynomial: two adjacent pieces that can match the same characters, or an unanchored pattern that fails slowly at every start position. Do not rule a pattern out because it has no nested quantifier.
+
+## Engines
+
+Backtracking (vulnerable): Python `re` and `regex`, JavaScript (V8, JavaScriptCore, SpiderMonkey), Java `java.util.regex`, .NET (default mode), PCRE/PHP, Perl, Ruby before 3.2.
+
+Linear-time (not vulnerable to ReDoS): Go `regexp`, Rust `regex`, RE2 and its bindings (`google-re2`, `re2j`), .NET `RegexOptions.NonBacktracking`. Ruby 3.2+ memoizes most patterns and has `Regexp.timeout`; treat it as lower risk, not immune.
+
+PHP is special: when `pcre.backtrack_limit` is hit, `preg_match` returns `false` instead of hanging. That turns ReDoS into a logic bypass when the caller treats `false` as "no match", e.g. a validator or WAF rule that silently passes.
+
+## Vulnerable Shapes
+
+**Nested quantifiers (exponential)**: `^(a+)+$`, `^(a*)*$`, `^(\w+\s?)+$`. About 30 matching characters plus one that fails the anchor can hang.
+
+**Overlapping alternation inside a repeat (exponential)**: `^(a|a)*$`, `^(\w|\d)+$`, `^(.*,)*$`.
+
+**Adjacent overlapping quantifiers (polynomial)**: two consecutive pieces that can both match the same character, followed by something that fails. The engine tries every way to split the run between them.
+
+~~~text
+\d+\d+x          a run of digits split between two \d+, with no x after it (cubic: also retried at every start)
+^`{3,}[^\n]*\n   a run of backticks split between the fence and [^\n]*, with no newline after it
+~~~
+
+**Unanchored pattern that fails slowly at every start (polynomial)**: `<[^>]+>` on `<<<<…` with no `>`, or `\s+$` on a long run of spaces followed by one non-space character. Each start position scans to the end, and `sub`/`findall`/`search` retry at every position.
+
+**Lazy scan with an absent terminator inside a loop**: `.*?END` or `[\s\S]*?` applied repeatedly to text that never contains `END`.
+
+**Backreferences**: `^(a+)\1$` is quadratic: the engine tries every split of the run between the group and its repeat.
+
+## Where to Look
+
+- Validators: email, URL, hostname, semver, UUID, phone, password rules
+- Parsers and sanitizers: markdown, MDX, HTML stripping, template engines, log and CSV parsers, user-agent parsing
+- Routing and matching: route patterns, CORS origin checks, WAF and content-filter rules, glob-to-regex conversions
+- Patterns built from input: `re.compile(user_value)`, search filters, MongoDB `$regex`, Elasticsearch `regexp` queries (these are regex injection, the attacker supplies the pattern itself)
+- Document and RAG loaders that clean uploaded or fetched files: one large file per request is an easy delivery path
+
+Find candidate patterns in source:
+
+```bash
+rg -n --type py "re\.(compile|match|search|fullmatch|sub|subn|findall|finditer|split)\(" .
+rg -n --type js --type ts "new RegExp\(|/[^/\n]+/[dgimsuyv]*\.(test|exec)|\.(match|matchAll|replace|replaceAll|search|split)\(/" .
+```
+
+## Detect with recheck
+
+[recheck](https://github.com/makenowjust-labs/recheck) combines static analysis and fuzzing, reports the complexity class (linear, polynomial with degree, exponential), and produces an attack string. It catches polynomial cases that nested-quantifier heuristics and some tools miss. Install a pinned version at scan time:
+
+```bash
+mkdir -p /tmp/recheck && cd /tmp/recheck && npm install --silent [email protected]
+```
+
+Put the patterns in a JSON file, one `[source, flags]` pair per entry, so no shell escaping is involved:
+
+```js
+// /tmp/recheck/run.mjs   usage: node run.mjs patterns.json
+import { check } from "recheck";
+import { readFileSync } from "node:fs";
+for (const [source, flags] of JSON.parse(readFileSync(process.argv[2], "utf8"))) {
+  const r = await check(source, flags, { timeout: 30000 });
+  console.log(JSON.stringify({ source, status: r.status, complexity: r.complexity?.summary, attack: r.attack?.pattern }));
+}
+```
+
+recheck understands JavaScript syntax only. Translate other dialects first:
+
+| Python | JavaScript |
+|--------|-----------|
+| `(?P<name>…)` | `(?<name>…)` |
+| `(?P=name)` | `\k<name>` |
+| `\Z` | `$(?![\s\S])` |
+| `\A` | `^` without the `m` flag |
+| inline `(?m)`, `(?s)`, `(?i)` | `m`, `s`, `i` in the flags string |
+| `(?>…)`, `a*+` (3.11+) | no equivalent; recheck will over-report, so confirm in Python |
+
+Treat recheck's verdict as a lead and its attack string as a hint. The attack string can rely on JavaScript-only behavior and run fast in the target language: with the `m` flag, JavaScript `^` also matches after `\r`, `
`, and `
`, while Python `^` only matches after `\n`. Rebuild the attack for the real engine. If `npm install` fails (no network), reason from the shapes above and go straight to timing.
+
+## Confirm in the Target Language
+
+One timing proves nothing. Measure growth: double or 10x the input and compare times. Linear grows about 10x per 10x, quadratic about 100x, cubic about 1000x, exponential explodes after a few dozen characters.
+
+```python
+import re, time
+pattern = re.compile(r"(?ms)^(?P<fence>`{3,}|~{3,})[^\n]*\n.*?(?:^(?P=fence)[ \t]*$|\Z)")
+for n in (1_000, 10_000, 100_000):
+    payload = "`" * n   # the repeated character, with the required terminator missing
+    t = time.perf_counter(); pattern.sub("", payload); print(n, f"{time.perf_counter() - t:.3f}s")
+```
+
+Build the payload as: a prefix that reaches the vulnerable piece, then many copies of the character both quantifiers accept, then a suffix that makes the overall match fail (or no suffix, when the failing piece needs a character that never arrives). Run the confirmation against the function the attacker reaches, not just the bare regex, so input caps and preprocessing are included.
+
+## Severity Calibration
+
+Report the time at a realistic input size, not the asymptotic class alone. Ask:
+
+- Can the attacker supply the text, and how large can it be? Body size limits, field length validation, and upload caps decide whether 100 KB (seconds for quadratic) is reachable.
+- What does one slow match block? A Node.js event loop or a single-threaded worker stalls every user (higher). A per-request thread with a timeout affects one request (lower).
+- Is the work repeatable without authentication or rate limits?
+- Diff or PR review: compare against the base code. A new slow pattern next to an existing pattern with the same complexity on the same input does not add an attack; say so and calibrate down instead of reporting a new HIGH.
+
+Exponential on short unauthenticated input in a shared event loop is high. Quadratic needing megabytes behind authentication is usually low or informational.
+
+## False Positives
+
+- Linear-time engine (Go, Rust, RE2, .NET NonBacktracking)
+- Input length capped well below where the curve hurts
+- recheck flagged a construct the target dialect handles atomically (possessive quantifiers, atomic groups)
+- Only the developer controls the input (build scripts, static config)
+
+## Remediation
+
+- Make overlapping pieces unambiguous: atomic groups (`` (?>`{3,}) ``; Python 3.11+, Java, PCRE, .NET) or possessive quantifiers (`a++`; Python 3.11+, Java, PCRE), or rewrite so adjacent pieces cannot match the same character
+- Anchor patterns and bound repeats (`{1,256}`) where the format allows
+- Cap input length before matching
+- Switch to a linear-time engine (`google-re2`, Rust/Go regex) for untrusted input
+- Use engine timeouts where available: .NET `matchTimeout`, Ruby `Regexp.timeout`, Python `regex` module `timeout=`
+
+## Summary
+
+Look for adjacent pieces that can match the same character, not just nested quantifiers. Use recheck to flag candidates and get a starting attack string, then rebuild and time the attack in the target language at 1k, 10k, and 100k characters. Calibrate severity by reachable input size, what a stalled match blocks, and, in a PR, whether the base code was already as slow.

tests/test_agent_factory_shell.py

@@ -80,94 +80,6 @@ async def test_wrap_exec_command_preserves_explicit_shell(shell: str) -> None:
     assert json.loads(captured["raw_input"])["shell"] == shell
 
 
-def _running_exec_tool(result: str) -> FunctionTool:
-    async def invoke(_ctx: Any, _raw_input: str) -> str:
-        return result
-
-    return FunctionTool(
-        name="exec_command",
-        description="Runs a command.",
-        params_json_schema={"type": "object", "properties": {}},
-        on_invoke_tool=invoke,
-    )
-
-
-_RUNNING_RESULT = (
-    "Chunk ID: abc123\nWall time: 30.0012 seconds\nProcess running with session ID 7\nOutput:\n"
-)
-
-
-def test_wrap_exec_command_describes_the_yield_cap() -> None:
-    wrapped = factory._wrap_exec_command(_running_exec_tool("ok"))
-
-    assert wrapped.description.startswith("Runs a command. The wait for output is capped at 30 s")
-    assert "cannot be read later" in wrapped.description
-    assert "tty=true" in wrapped.description
-
-
-@pytest.mark.asyncio
-async def test_wrap_exec_command_flags_a_running_non_tty_process() -> None:
-    wrapped = factory._wrap_exec_command(_running_exec_tool(_RUNNING_RESULT))
-
-    result = await wrapped.on_invoke_tool(
-        cast("Any", None), json.dumps({"cmd": "sleep 60; curl x", "yield_time_ms": 90000})
-    )
-
-    assert result == (
-        "Chunk ID: abc123\nWall time: 30.0012 seconds\n"
-        "Process running with session ID 7\nOutput:\n"
-        "Note: yield_time_ms=90000 was capped at 30000 (30 s). this non-TTY process cannot be "
-        "polled and its later output is lost. Rerun it in the background "
-        "(`cmd > /tmp/out.log 2>&1 &`, then read the log) or with tty=true.\n"
-    )
-
-
-@pytest.mark.asyncio
-async def test_wrap_exec_command_flags_a_running_non_tty_process_within_the_cap() -> None:
-    wrapped = factory._wrap_exec_command(_running_exec_tool(_RUNNING_RESULT))
-
-    result = await wrapped.on_invoke_tool(cast("Any", None), json.dumps({"cmd": "sleep 60"}))
-
-    assert "Note: this non-TTY process cannot be polled" in result
-    assert "was capped" not in result
-
-
-@pytest.mark.asyncio
-async def test_wrap_exec_command_leaves_a_running_tty_process_alone() -> None:
-    wrapped = factory._wrap_exec_command(_running_exec_tool(_RUNNING_RESULT))
-
-    result = await wrapped.on_invoke_tool(
-        cast("Any", None), json.dumps({"cmd": "python3 -m http.server", "tty": True})
-    )
-
-    assert result == _RUNNING_RESULT
-
-
-@pytest.mark.asyncio
-async def test_wrap_exec_command_leaves_an_exited_process_alone() -> None:
-    exited = "Chunk ID: abc123\nWall time: 0.1 seconds\nProcess exited with code 0\nOutput:\nhi"
-    wrapped = factory._wrap_exec_command(_running_exec_tool(exited))
-
-    result = await wrapped.on_invoke_tool(cast("Any", None), json.dumps({"cmd": "echo hi"}))
-
-    assert result == exited
-
-
-@pytest.mark.asyncio
-async def test_wrap_exec_command_ignores_the_running_marker_inside_command_output() -> None:
-    exited = (
-        "Chunk ID: abc123\nWall time: 0.2 seconds\nProcess exited with code 0\nOutput:\n"
-        "Process running with session ID 7\nOutput:\n"
-    )
-    wrapped = factory._wrap_exec_command(_running_exec_tool(exited))
-
-    result = await wrapped.on_invoke_tool(
-        cast("Any", None), json.dumps({"cmd": "cat transcript.txt"})
-    )
-
-    assert result == exited
-
-
 @pytest.mark.asyncio
 async def test_responses_filesystem_custom_tool_output_is_bounded() -> None:
     async def invoke(_ctx: Any, _inp: str) -> str:

tests/test_agent_factory_tool_arguments.py

@@ -38,26 +38,11 @@ async def _roundtrip(
 
 
 _STRING = {"todos": {"type": "string"}}
-
-
-@pytest.mark.asyncio
-async def test_truncated_arguments_short_circuit_with_a_reissue_message() -> None:
-    captured: dict[str, str] = {}
-    wrapped = factory._with_coerced_arguments(_capturing_tool(captured, _STRING))
-
-    result = await wrapped.on_invoke_tool(cast("Any", None), '{"todos": "a, b')
-
-    assert "not executed" in result
-    assert "Re-issue the call" in result
-    assert "raw_input" not in captured
-
-
 _ARRAY = {"tags": {"type": "array", "items": {"type": "string"}}}
 _NULLABLE_ARRAY = {
     "tags": {"anyOf": [{"type": "array", "items": {"type": "string"}}, {"type": "null"}]}
 }
 _OBJECT = {"modifications": {"type": "object"}}
-OVER_NESTED = '{"a":' + "[" * 100_000
 
 
 @pytest.mark.asyncio
@@ -151,15 +136,12 @@ async def test_unknown_and_null_arguments_are_untouched() -> None:
 
 
 @pytest.mark.asyncio
-@pytest.mark.parametrize("arguments", ["not json", '{"n": NaN}', OVER_NESTED])
-async def test_non_object_payloads_are_reported_instead_of_invoked(arguments: str) -> None:
+async def test_non_object_payloads_pass_through_unchanged() -> None:
     captured: dict[str, str] = {}
     wrapped = factory._with_coerced_arguments(_capturing_tool(captured, _ARRAY))
 
-    result = await wrapped.on_invoke_tool(cast("Any", None), arguments)
-
-    assert result.startswith("probe: the tool call was not executed")
-    assert "raw_input" not in captured
+    assert await wrapped.on_invoke_tool(cast("Any", None), "not json") == "ok"
+    assert captured["raw_input"] == "not json"
 
 
 @pytest.mark.asyncio

tests/test_budget_pause_policy.py

@@ -21,7 +21,7 @@ from strix.core.sessions import open_agent_session
 
 
 if TYPE_CHECKING:
-    from collections.abc import AsyncIterator, Awaitable, Callable
+    from collections.abc import AsyncIterator, Callable
     from pathlib import Path
 
 
@@ -31,7 +31,6 @@ _CALL_LATENCY_S = 0.005
 
 class _FakeLedger:
     def __init__(self) -> None:
-        self.on_pause: Callable[[], Awaitable[None]] | None = None
         self.cost = 0.0
         self.calls: list[str] = []
         self.remaining: dict[str, int] = {}
@@ -81,8 +80,6 @@ class _FakeStream:
                 await self._hooks.on_llm_start(ctx_wrapper, self._agent, None, input_items)
             except BudgetPausedError as exc:
                 self.run_loop_exception = exc
-                if self._ledger.on_pause is not None:
-                    await self._ledger.on_pause()
                 return
             self._ledger.warned_inputs.append(input_items)
             if self._ledger.gate is not None:
@@ -153,16 +150,13 @@ class _Scan:
         monkeypatch: pytest.MonkeyPatch,
         *,
         max_budget_usd: float | None,
-        budget_policy: str = "pause",
     ) -> None:
         self.ledger = _FakeLedger()
         self.hooks = ReportUsageHooks(
-            model="test-model",
-            max_budget_usd=max_budget_usd,
-            budget_policy=budget_policy,  # type: ignore[arg-type]
+            model="test-model", max_budget_usd=max_budget_usd, budget_policy="pause"
         )
         self.coordinator = AgentCoordinator()
-        self.coordinator.set_budget_policy(budget_policy)  # type: ignore[arg-type]
+        self.coordinator.set_budget_policy("pause")
         self.coordinator.set_budget_limit_setter(self.hooks.set_max_budget_usd)
         monkeypatch.setattr(execution, "Runner", _fake_runner(self.ledger, self.coordinator))
         monkeypatch.setattr(execution, "_compact_session", _noop_compact)
@@ -544,140 +538,3 @@ async def test_stop_policy_is_unchanged() -> None:
 def test_budget_policy_is_validated() -> None:
     with pytest.raises(ValueError, match="budget_policy"):
         ReportUsageHooks(model="m", budget_policy="later")  # type: ignore[arg-type]
-
-
-def _pause_flags(coordinator: AgentCoordinator) -> tuple[bool, bool]:
-    return coordinator.budget_paused, coordinator.operator_paused
-
-
-@pytest.mark.asyncio
-async def test_operator_pause_holds_under_the_stop_policy(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    scan = _Scan(tmp_path, monkeypatch, max_budget_usd=None, budget_policy="stop")
-    agents = ("root", "child-a", "child-b")
-
-    with patch("strix.core.hooks.get_global_report_state", return_value=scan.ledger):
-        await scan.start_root(calls=6)
-        await scan.start_child("child-a", calls=6)
-        await scan.start_child("child-b", calls=6)
-
-        await _wait_until(lambda: scan.ledger.cost >= 3.0)
-        await scan.coordinator.pause_budget()
-        spent_at_pause = scan.ledger.cost
-        await _wait_until(lambda: _all_parked(scan.coordinator, *agents))
-        assert _pause_flags(scan.coordinator) == (True, True)
-        assert all(not task.done() for task in scan.tasks())
-
-        await scan.coordinator.send("child-a", {"from": "root", "content": "status?"})
-        await scan.coordinator.send("root", {"from": "user", "content": "keep going"})
-        await asyncio.sleep(0.05)
-        assert _pause_flags(scan.coordinator) == (True, True)
-        assert scan.ledger.cost == pytest.approx(spent_at_pause)
-        assert _all_parked(scan.coordinator, *agents)
-
-        woken = await scan.coordinator.resume_budget()
-        assert sorted(woken) == sorted(agents)
-        assert _pause_flags(scan.coordinator) == (False, False)
-        await asyncio.wait_for(asyncio.gather(*scan.tasks(), return_exceptions=True), timeout=5.0)
-        assert scan.ledger.cost == pytest.approx(18.0)
-        assert {aid: str(s) for aid, s in scan.coordinator.statuses.items()} == {
-            "root": "completed",
-            "child-a": "completed",
-            "child-b": "completed",
-        }
-        root_items = await scan.sessions[0].get_items()
-        assert any("keep going" in str(item) for item in root_items)
-
-    for session in scan.sessions:
-        session.close()
-
-
-@pytest.mark.asyncio
-async def test_a_resume_that_lands_before_the_park_still_continues(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
-) -> None:
-    scan = _Scan(tmp_path, monkeypatch, max_budget_usd=None, budget_policy="stop")
-    resumed = 0
-
-    async def resume_at_once() -> None:
-        nonlocal resumed
-        resumed += 1
-        await scan.coordinator.resume_budget()
-
-    scan.ledger.on_pause = resume_at_once
-    with patch("strix.core.hooks.get_global_report_state", return_value=scan.ledger):
-        await scan.start_root(calls=6)
-        await scan.start_child("child-a", calls=6)
-        await _wait_until(lambda: scan.ledger.cost >= 2.0)
-        await scan.coordinator.pause_budget()
-        await asyncio.wait_for(asyncio.gather(*scan.tasks(), return_exceptions=True), timeout=5.0)
-        assert resumed >= 1
-        assert _pause_flags(scan.coordinator) == (False, False)
-        assert scan.ledger.cost == pytest.approx(12.0)
-        assert {aid: str(s) for aid, s in scan.coordinator.statuses.items()} == {
-            "root": "completed",
-            "child-a": "completed",
-        }
-
-    for session in scan.sessions:
-        session.close()
-
-
-@pytest.mark.asyncio
-async def test_operator_pause_gates_the_stop_policy_hooks() -> None:
-    coordinator = AgentCoordinator()
-    hooks = ReportUsageHooks(model="m", max_budget_usd=None)
-    assert hooks.budget_policy == "stop"
-
-    await coordinator.pause_budget()
-    with pytest.raises(BudgetPausedError):
-        await hooks.on_llm_start(_ctx(coordinator), MagicMock(), None, [])
-
-    await coordinator.resume_budget()
-    await hooks.on_llm_start(_ctx(coordinator), MagicMock(), None, [])
-
-
-@pytest.mark.asyncio
-async def test_a_user_message_lifts_only_the_limit_pause(tmp_path: Path) -> None:
-    coordinator = AgentCoordinator()
-    await coordinator.register("root", "strix", parent_id=None)
-    session = open_agent_session("root", tmp_path / "agents.db")
-    await coordinator.attach_runtime("root", session=session)
-    extensions: list[int] = []
-    coordinator.set_budget_extender(lambda: extensions.append(1))
-
-    await coordinator.pause_budget()
-    await coordinator.park_for_budget("root")
-    assert coordinator.statuses["root"] == "budget_paused"
-    await coordinator.send("root", {"from": "user", "content": "keep going"})
-    assert _pause_flags(coordinator) == (True, True)
-    assert extensions == []
-    assert coordinator.pending_counts["root"] == 1
-
-    await coordinator.resume_budget()
-    await coordinator.pause_for_budget("root")
-    await coordinator.send("root", {"from": "user", "content": "keep going"})
-    assert _pause_flags(coordinator) == (False, False)
-    assert extensions == [1]
-    session.close()
-
-
-@pytest.mark.asyncio
-async def test_snapshot_and_reset_keep_an_operator_pause() -> None:
-    coordinator = AgentCoordinator()
-    await coordinator.register("root", "strix", parent_id=None)
-    await coordinator.pause_budget()
-    snap = await coordinator.snapshot()
-
-    restored = AgentCoordinator()
-    await restored.restore(snap)
-    assert _pause_flags(restored) == (True, True)
-    await restored.reset_budget_stops(budget_stopped=False, reserve_stopped=False)
-    assert _pause_flags(restored) == (True, True)
-
-    await restored.resume_budget()
-    await restored.pause_for_budget("root")
-    await restored.reset_budget_stops(budget_stopped=False, reserve_stopped=False)
-    assert _pause_flags(restored) == (False, False)
-    assert restored.statuses["root"] == "waiting"

tests/test_compaction.py

@@ -147,9 +147,7 @@ def _patch_budget(monkeypatch: pytest.MonkeyPatch, *, keep_tokens: int, window:
     context.auto_compact = True
     settings = SimpleNamespace(
         context=context,
-        llm=SimpleNamespace(
-            api_key=None, api_base=None, timeout=1, extra_headers=None, extra_body=None
-        ),
+        llm=SimpleNamespace(api_key=None, api_base=None, timeout=1, extra_headers=None),
     )
     monkeypatch.setattr(compaction, "load_settings", lambda: settings)
 
@@ -230,11 +228,7 @@ async def test_summarize_routes_through_provider_with_settings(
         "load_settings",
         lambda: SimpleNamespace(
             llm=SimpleNamespace(
-                api_key=None,
-                api_base=None,
-                timeout=1,
-                extra_headers={"X-Feature-Key": "svc"},
-                extra_body={"service_tier": "flex"},
+                api_key=None, api_base=None, timeout=1, extra_headers={"X-Feature-Key": "svc"}
             )
         ),
     )
@@ -245,7 +239,6 @@ async def test_summarize_routes_through_provider_with_settings(
     assert captured["model"] == "litellm/openai/some-model"
     settings = captured["model_settings"]
     assert settings.extra_headers == {"X-Feature-Key": "svc"}
-    assert settings.extra_body == {"service_tier": "flex"}
     assert settings.max_tokens == 64
 
 

tests/test_config_loader.py

@@ -37,12 +37,6 @@ _LLM_ENV_KEYS = [
     "STRIX_RUNTIME_BACKEND",
     # TelemetrySettings
     "STRIX_TELEMETRY",
-    # JSON-object settings
-    "LLM_EXTRA_HEADERS",
-    "LLM_EXTRA_BODY",
-    "STRIX_DEDUPE_MODEL",
-    "DEDUPE_LLM_EXTRA_HEADERS",
-    "DEDUPE_LLM_EXTRA_BODY",
 ]
 
 
@@ -412,57 +406,6 @@ def test_persist_current_replaces_corrupt_file(
     assert json.loads(target.read_text(encoding="utf-8")) == {"env": {"STRIX_LLM": "env-model"}}
 
 
-@pytest.mark.parametrize(
-    ("env_var", "section", "field"),
-    [
-        ("LLM_EXTRA_HEADERS", "llm", "extra_headers"),
-        ("LLM_EXTRA_BODY", "llm", "extra_body"),
-        ("DEDUPE_LLM_EXTRA_HEADERS", "dedupe", "extra_headers"),
-        ("DEDUPE_LLM_EXTRA_BODY", "dedupe", "extra_body"),
-    ],
-)
-def test_persisted_json_object_setting_reloads_without_env(
-    tmp_path: Path, monkeypatch: pytest.MonkeyPatch, env_var: str, section: str, field: str
-) -> None:
-    loader.apply_config_override(tmp_path / "cli-config.json")
-    monkeypatch.setenv(env_var, '{"X-Tenant": "acme"}')
-    loader.load_settings()
-    loader.persist_current()
-    monkeypatch.delenv(env_var)
-    loader.apply_config_override(tmp_path / "cli-config.json")
-
-    settings = loader.load_settings()
-
-    assert getattr(getattr(settings, section), field) == {"X-Tenant": "acme"}
-
-
-def test_json_object_setting_saved_as_object_still_loads(tmp_path: Path) -> None:
-    target = tmp_path / "cli-config.json"
-    target.write_text(
-        json.dumps({"env": {"LLM_EXTRA_BODY": {"service_tier": "flex"}}}), encoding="utf-8"
-    )
-    loader.apply_config_override(target)
-
-    assert loader.load_settings().llm.extra_body == {"service_tier": "flex"}
-
-
-def test_invalid_saved_json_object_setting_is_rejected(tmp_path: Path) -> None:
-    target = tmp_path / "cli-config.json"
-    target.write_text(json.dumps({"env": {"LLM_EXTRA_BODY": "not json"}}), encoding="utf-8")
-    loader.apply_config_override(target)
-
-    with pytest.raises(ValidationError):
-        loader.load_settings()
-
-
-def test_saved_string_setting_is_not_json_decoded(tmp_path: Path) -> None:
-    target = tmp_path / "cli-config.json"
-    target.write_text(json.dumps({"env": {"STRIX_LLM": '{"not": "decoded"}'}}), encoding="utf-8")
-    loader.apply_config_override(target)
-
-    assert loader.load_settings().llm.model == '{"not": "decoded"}'
-
-
 def test_persist_current_sets_0600_mode(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
     monkeypatch.setenv("STRIX_LLM", "persisted-model")
     target = tmp_path / "cli-config.json"

tests/test_cost_tracking.py

@@ -136,7 +136,6 @@ def test_cost_callback_estimates_cost_with_provider_prefixed_model() -> None:
 
     with (
         patch("strix.report.state.get_global_report_state", return_value=report_state),
-        patch("strix.report.state.resolve_litellm_model", side_effect=lambda model: model),
         patch("litellm.completion_cost", side_effect=fake_completion_cost),
     ):
         litellm_cost_callback(kwargs, response)

tests/test_dedupe_model.py

@@ -148,42 +148,3 @@ def test_config_file_loads_dedupe_model(
     assert settings.dedupe.reasoning_effort == "minimal"
     # Main model stays independent of the dedupe override.
     assert settings.llm.model == "openai/root"
-
-
-def test_dedicated_dedupe_model_uses_own_body_fields_not_main(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setenv("LLM_EXTRA_BODY", json.dumps({"safety_identifier": "main"}))
-    loader._cached = None
-    try:
-        dedupe = DedupeSettings(
-            STRIX_DEDUPE_MODEL="deepseek/cheap",
-            DEDUPE_LLM_EXTRA_BODY={"service_tier": "flex"},
-        )
-        settings = _dedupe_model_settings(dedupe, "deepseek/cheap", 300)
-        assert settings.extra_body == {"service_tier": "flex"}
-    finally:
-        loader._cached = None
-
-
-def test_dedicated_dedupe_model_gets_no_main_body_fields_by_default(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setenv("LLM_EXTRA_BODY", json.dumps({"safety_identifier": "main"}))
-    loader._cached = None
-    try:
-        dedupe = DedupeSettings(STRIX_DEDUPE_MODEL="deepseek/cheap")
-        settings = _dedupe_model_settings(dedupe, "deepseek/cheap", 300)
-        assert settings.extra_body is None
-    finally:
-        loader._cached = None
-
-
-def test_fallback_dedupe_inherits_main_body_fields(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("LLM_EXTRA_BODY", json.dumps({"safety_identifier": "main"}))
-    loader._cached = None
-    try:
-        settings = _dedupe_model_settings(DedupeSettings(), "openai/main-model", 300)
-        assert settings.extra_body == {"safety_identifier": "main"}
-    finally:
-        loader._cached = None

tests/test_inputs.py

@@ -310,8 +310,8 @@ def test_make_model_settings_forces_required_for_anyllm_routed_openai_model() ->
     assert settings.tool_choice == "required"
 
 
-def test_make_model_settings_enables_parallel_tool_calls_by_default() -> None:
-    assert make_model_settings("none", model_name="gpt-4o").parallel_tool_calls is True
+def test_make_model_settings_disables_parallel_tool_calls_by_default() -> None:
+    assert make_model_settings("none", model_name="gpt-4o").parallel_tool_calls is False
 
 
 def test_make_model_settings_omits_parallel_tool_calls_without_tools() -> None:
@@ -361,58 +361,6 @@ def test_make_model_settings_extra_headers_survive_reasoning_resolve() -> None:
     assert settings.extra_headers == {"X-Feature-Key": "svc"}
 
 
-def test_make_model_settings_sets_extra_body() -> None:
-    settings = make_model_settings(
-        "none",
-        model_name="openai/gpt-5",
-        extra_body={"service_tier": "flex", "safety_identifier": "user-hash"},
-    )
-
-    assert settings.extra_body == {"service_tier": "flex", "safety_identifier": "user-hash"}
-
-
-def test_make_model_settings_omits_extra_body_when_unset() -> None:
-    assert make_model_settings("none", model_name="gpt-4o").extra_body is None
-
-
-def test_make_model_settings_extra_body_survives_reasoning_resolve() -> None:
-    settings = make_model_settings(
-        "high",
-        model_name="openai/o3",
-        extra_body={"service_tier": "flex"},
-    )
-
-    assert settings.extra_body == {"service_tier": "flex"}
-
-
-def test_make_model_settings_extra_body_merges_with_max_reasoning_field() -> None:
-    settings = make_model_settings(
-        "max",
-        model_name="deepseek/deepseek-v4-flash",
-        extra_body={"safety_identifier": "user-hash"},
-    )
-
-    assert settings.extra_body == {"safety_identifier": "user-hash", "reasoning_effort": "max"}
-
-
-def test_make_model_settings_max_reasoning_overrides_extra_body_reasoning_field() -> None:
-    settings = make_model_settings(
-        "max",
-        model_name="deepseek/deepseek-v4-flash",
-        extra_body={"reasoning_effort": "low"},
-    )
-
-    assert settings.extra_body == {"reasoning_effort": "max"}
-
-
-def test_make_model_settings_does_not_mutate_caller_extra_body() -> None:
-    extra_body = {"safety_identifier": "user-hash"}
-
-    make_model_settings("max", model_name="deepseek/deepseek-v4-flash", extra_body=extra_body)
-
-    assert extra_body == {"safety_identifier": "user-hash"}
-
-
 def test_make_model_settings_timeout_survives_reasoning_resolve() -> None:
     # Reasoning is resolved via ModelSettings.resolve(); the timeout in extra_args
     # must not be dropped when a reasoning override is merged in.

tests/test_llm_extra_body.py

@@ -1,97 +0,0 @@
-"""Tests for LLM_EXTRA_BODY: extra fields merged into every LLM request body."""
-
-from __future__ import annotations
-
-import json
-from typing import TYPE_CHECKING, Any
-
-import httpx
-import litellm
-import openai
-import pytest
-from agents.extensions.models.litellm_model import LitellmModel
-from agents.models.interface import ModelTracing
-from agents.models.openai_chatcompletions import OpenAIChatCompletionsModel
-from agents.models.openai_responses import OpenAIResponsesModel
-
-from strix.config import loader
-from strix.config.loader import load_settings
-from strix.core.inputs import make_model_settings
-
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    from agents.models.interface import Model
-
-
-_EXTRA_BODY = {"service_tier": "flex", "safety_identifier": "user-hash"}
-
-
-@pytest.fixture(autouse=True)
-def _reset(monkeypatch: pytest.MonkeyPatch) -> Iterator[None]:
-    monkeypatch.delenv("LLM_EXTRA_BODY", raising=False)
-    monkeypatch.setattr(loader, "_cached", None)
-    monkeypatch.setattr(loader, "_override", None)
-    yield
-
-
-def test_extra_body_parsed_from_json_env(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("LLM_EXTRA_BODY", json.dumps({"service_tier": "flex", "n": 1}))
-
-    assert load_settings().llm.extra_body == {"service_tier": "flex", "n": 1}
-
-
-async def _send(model: Model) -> None:
-    await model.get_response(
-        system_instructions=None,
-        input="Reply with just 'OK'.",
-        model_settings=make_model_settings(None, model_name="gpt-5", extra_body=_EXTRA_BODY),
-        tools=[],
-        output_schema=None,
-        handoffs=[],
-        tracing=ModelTracing.DISABLED,
-        previous_response_id=None,
-        conversation_id=None,
-        prompt=None,
-    )
-
-
-def _capturing_client(captured: dict[str, Any]) -> openai.AsyncOpenAI:
-    def handler(request: httpx.Request) -> httpx.Response:
-        captured.update(json.loads(request.content))
-        return httpx.Response(400, json={"error": {"message": "captured"}})
-
-    return openai.AsyncOpenAI(
-        api_key="test",
-        base_url="https://gateway.example/v1",
-        max_retries=0,
-        http_client=httpx.AsyncClient(transport=httpx.MockTransport(handler)),
-    )
-
-
-@pytest.mark.asyncio
-@pytest.mark.parametrize("model_cls", [OpenAIChatCompletionsModel, OpenAIResponsesModel])
-async def test_extra_body_reaches_native_openai_request_body(model_cls: type) -> None:
-    captured: dict[str, Any] = {}
-
-    with pytest.raises(openai.BadRequestError):
-        await _send(model_cls(model="gpt-5", openai_client=_capturing_client(captured)))
-
-    assert {k: captured.get(k) for k in _EXTRA_BODY} == _EXTRA_BODY
-
-
-@pytest.mark.asyncio
-async def test_extra_body_passed_to_litellm(monkeypatch: pytest.MonkeyPatch) -> None:
-    captured: dict[str, Any] = {}
-
-    async def fake_acompletion(**kwargs: Any) -> Any:
-        captured.update(kwargs)
-        raise RuntimeError("captured")
-
-    monkeypatch.setattr(litellm, "acompletion", fake_acompletion)
-
-    with pytest.raises(RuntimeError, match="captured"):
-        await _send(LitellmModel(model="openai/gpt-5", base_url="https://gateway.example/v1"))
-
-    assert captured["extra_body"] == _EXTRA_BODY

tests/test_preflight_timeout.py

@@ -60,7 +60,6 @@ def test_preflight_request_fails_after_its_own_timeout_with_a_clear_message() ->
                 model,  # type: ignore[arg-type]
                 model_name="openai/gpt-4o",
                 extra_headers=None,
-                extra_body=None,
                 timeout=1,
                 api_base_setting="DEDUPE_LLM_API_BASE",
             )
@@ -131,52 +130,3 @@ def test_warm_up_checks_the_dedupe_model_with_its_own_headers_and_the_preflight_
         "DEDUPE_LLM_API_BASE",
     ]
     assert calls[1][0] is dedupe_model
-
-
-def test_warm_up_checks_each_model_with_its_own_body_fields(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    monkeypatch.setenv("STRIX_LLM", "openai/gpt-4o")
-    monkeypatch.setenv("LLM_API_KEY", "sk-test")
-    monkeypatch.setenv("LLM_EXTRA_BODY", '{"safety_identifier": "main"}')
-    monkeypatch.setenv("STRIX_DEDUPE_MODEL", "anthropic/claude-sonnet-4-5")
-    monkeypatch.setenv("DEDUPE_LLM_EXTRA_BODY", '{"service_tier": "flex"}')
-    _fresh_settings(monkeypatch, tmp_path)
-
-    calls: list[dict[str, Any]] = []
-
-    async def record(_model: Any, **kwargs: Any) -> None:
-        calls.append(kwargs)
-
-    monkeypatch.setattr(scan_setup, "preflight_request", record)
-    monkeypatch.setattr(cli_main, "preflight_request", record)
-    monkeypatch.setattr("strix.config.models.configure_sdk_model_defaults", lambda _settings: None)
-    monkeypatch.setattr("strix.report.dedupe.resolve_dedupe_model", lambda _dedupe, _name: object())
-
-    asyncio.run(cli_main.warm_up_llm())
-
-    assert [kwargs["extra_body"] for kwargs in calls] == [
-        {"safety_identifier": "main"},
-        {"service_tier": "flex"},
-    ]
-
-
-def test_preflight_request_sends_the_extra_body() -> None:
-    seen: list[Any] = []
-
-    class _Recorder:
-        async def get_response(self, *, model_settings: Any, **_: Any) -> None:
-            seen.append(model_settings.extra_body)
-
-    asyncio.run(
-        preflight_request(
-            _Recorder(),  # type: ignore[arg-type]
-            model_name="openai/gpt-4o",
-            extra_headers=None,
-            extra_body={"safety_identifier": "main"},
-            timeout=5,
-            api_base_setting="LLM_API_BASE",
-        )
-    )
-
-    assert seen == [{"safety_identifier": "main"}]

tests/test_resume_picker.py

@@ -263,11 +263,7 @@ def test_narrow_terminals_never_wrap_a_row() -> None:
 
 @pytest.mark.skipif(sys.platform == "win32", reason="POSIX key reader")
 def test_posix_key_reader_handles_multibyte_and_arrows() -> None:
-    tty = pytest.importorskip("tty")
     master, slave = os.openpty()
-    # Without this the pty echoes the writes into an output queue nobody reads,
-    # and read_raw_key's TCSADRAIN restore blocks forever on macOS.
-    tty.setcbreak(slave)
     try:
         with os.fdopen(slave, "r+b", buffering=0) as stream:
             os.write(master, "\u00e9".encode())

tests/test_runner_interrupt.py

@@ -28,7 +28,6 @@ def _wire_runner(monkeypatch: pytest.MonkeyPatch, tmp_path: Any) -> None:
             timeout=300,
             prompt_cache=True,
             extra_headers=None,
-            extra_body=None,
         ),
         runtime=types.SimpleNamespace(max_context_images=3),
     )

tests/test_runner_mcp.py

@@ -44,7 +44,6 @@ def _settings() -> Any:
             timeout=300,
             prompt_cache=True,
             extra_headers=None,
-            extra_body=None,
         ),
         runtime=types.SimpleNamespace(max_context_images=3),
     )

tests/test_runner_rate_limit.py

@@ -42,7 +42,6 @@ async def test_persistent_rate_limit_stops_gracefully(
             timeout=300,
             prompt_cache=True,
             extra_headers=None,
-            extra_body=None,
         ),
         runtime=types.SimpleNamespace(max_context_images=3),
     )

tests/test_runner_root_prompt.py

@@ -64,7 +64,6 @@ def _patch_engine_scaffold(
             timeout=300,
             prompt_cache=True,
             extra_headers=None,
-            extra_body=None,
         ),
         runtime=types.SimpleNamespace(max_context_images=3),
     )

tests/test_runner_teardown.py

@@ -52,7 +52,6 @@ def _settings() -> Any:
             timeout=300,
             prompt_cache=True,
             extra_headers=None,
-            extra_body=None,
         ),
         runtime=types.SimpleNamespace(max_context_images=3),
     )

tests/test_tool_call_arguments.py

@@ -1,300 +0,0 @@
-"""Tests for keeping replayed tool-call arguments valid JSON.
-
-A model that emits a tool call with malformed ``arguments`` fails that one
-call, but the raw string is recorded in the session. Strict OpenAI-compatible
-servers validate every assistant tool call in the request, so each later turn
-is rejected and the agent can never recover. A gateway that validates
-arguments the way those servers do proves both the failure and the fix.
-"""
-
-from __future__ import annotations
-
-import json
-import threading
-from http.server import BaseHTTPRequestHandler, HTTPServer
-from typing import TYPE_CHECKING, Any
-
-import pytest
-from agents import Agent, Runner, function_tool
-from agents.models.interface import Model, ModelProvider
-from agents.models.openai_chatcompletions import OpenAIChatCompletionsModel
-from agents.run import RunConfig
-from openai import AsyncOpenAI, BadRequestError
-from openai.types.responses import ResponseFunctionToolCall
-
-from strix.config.models import _NonStreamingModel, _TurnGuardModel
-from strix.config.tool_call_arguments import (
-    MALFORMED_ARGUMENTS_KEY,
-    _loads_strict,
-    describe_malformed_arguments,
-    repair_arguments,
-    repair_history_arguments,
-    repair_input,
-)
-
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-
-TRUNCATED = '{"n": 1'
-OVER_NESTED = '{"a":' + "[" * 100_000
-
-
-def _tool_call_completion(arguments: str) -> dict[str, Any]:
-    return {
-        "id": "chatcmpl-1",
-        "object": "chat.completion",
-        "created": 0,
-        "model": "gw-model",
-        "choices": [
-            {
-                "index": 0,
-                "finish_reason": "tool_calls",
-                "message": {
-                    "role": "assistant",
-                    "content": None,
-                    "tool_calls": [
-                        {
-                            "id": "call_1",
-                            "type": "function",
-                            "function": {"name": "do_thing", "arguments": arguments},
-                        }
-                    ],
-                },
-            }
-        ],
-        "usage": {"prompt_tokens": 5, "completion_tokens": 2, "total_tokens": 7},
-    }
-
-
-def _text_completion(text: str) -> dict[str, Any]:
-    return {
-        "id": "chatcmpl-2",
-        "object": "chat.completion",
-        "created": 0,
-        "model": "gw-model",
-        "choices": [
-            {"index": 0, "finish_reason": "stop", "message": {"role": "assistant", "content": text}}
-        ],
-        "usage": {"prompt_tokens": 5, "completion_tokens": 3, "total_tokens": 8},
-    }
-
-
-_REQUESTS: list[list[dict[str, Any]]] = []
-
-
-def _assistant_arguments(messages: list[dict[str, Any]]) -> list[str]:
-    return [
-        str(call["function"]["arguments"])
-        for message in messages
-        for call in message.get("tool_calls") or []
-    ]
-
-
-def _tool_results(messages: list[dict[str, Any]]) -> list[str]:
-    return [str(m.get("content")) for m in messages if m.get("role") == "tool"]
-
-
-class _StrictHandler(BaseHTTPRequestHandler):
-    """Gateway that rejects malformed assistant tool-call arguments, like vLLM/SGLang do."""
-
-    def log_message(self, *args: Any) -> None:
-        pass
-
-    def do_POST(self) -> None:
-        length = int(self.headers.get("Content-Length", 0))
-        body = json.loads(self.rfile.read(length) or b"{}")
-        messages = body.get("messages", [])
-        _REQUESTS.append(messages)
-
-        for arguments in _assistant_arguments(messages):
-            try:
-                json.loads(arguments)
-            except ValueError:
-                self._respond(
-                    400,
-                    {
-                        "object": "error",
-                        "message": "Assistant tool call function.arguments must be valid JSON.",
-                        "type": "BadRequest",
-                        "param": None,
-                        "code": 400,
-                    },
-                )
-                return
-
-        if len(_REQUESTS) == 1:
-            self._respond(200, _tool_call_completion(TRUNCATED))
-        else:
-            self._respond(200, _text_completion("all done"))
-
-    def _respond(self, status: int, payload: dict[str, Any]) -> None:
-        encoded = json.dumps(payload).encode()
-        self.send_response(status)
-        self.send_header("Content-Type", "application/json")
-        self.send_header("Content-Length", str(len(encoded)))
-        self.end_headers()
-        self.wfile.write(encoded)
-
-
-@pytest.fixture
-def strict_gateway() -> Iterator[str]:
-    _REQUESTS.clear()
-    server = HTTPServer(("127.0.0.1", 0), _StrictHandler)
-    thread = threading.Thread(target=server.serve_forever, daemon=True)
-    thread.start()
-    try:
-        yield f"http://127.0.0.1:{server.server_address[1]}/v1"
-    finally:
-        server.shutdown()
-        server.server_close()
-
-
-def _model(base_url: str) -> Model:
-    client = AsyncOpenAI(api_key="tok", base_url=base_url, max_retries=0)
-    return _NonStreamingModel(OpenAIChatCompletionsModel(model="gw-model", openai_client=client))
-
-
-async def _run_agent(base_url: str, *, wrap: bool) -> Any:
-    @function_tool
-    def do_thing(n: int) -> str:
-        return f"did {n}"
-
-    class _Provider(ModelProvider):
-        def get_model(self, model_name: str | None) -> Model:  # noqa: ARG002
-            model = _model(base_url)
-            return _TurnGuardModel(model) if wrap else model
-
-    agent = Agent(name="t", instructions="use the tool", tools=[do_thing], model="gw-model")
-    result = Runner.run_streamed(
-        agent, input="please", run_config=RunConfig(model_provider=_Provider())
-    )
-    async for _ in result.stream_events():
-        pass
-    return result
-
-
-@pytest.mark.asyncio
-async def test_malformed_arguments_poison_every_later_turn_without_the_wrapper(
-    strict_gateway: str,
-) -> None:
-    # Repro: the model truncates a tool call's arguments once. The tool fails
-    # that call gracefully, but the next request replays the raw string and
-    # the provider rejects the whole conversation from then on.
-    with pytest.raises(BadRequestError, match="must be valid JSON"):
-        await _run_agent(strict_gateway, wrap=False)
-
-    assert _assistant_arguments(_REQUESTS[-1]) == [TRUNCATED]
-
-
-@pytest.mark.asyncio
-async def test_malformed_arguments_are_replayed_as_valid_json(strict_gateway: str) -> None:
-    result = await _run_agent(strict_gateway, wrap=True)
-
-    assert result.final_output == "all done"
-    (arguments,) = _assistant_arguments(_REQUESTS[-1])
-    assert json.loads(arguments) == {MALFORMED_ARGUMENTS_KEY: TRUNCATED}
-    (tool_result,) = _tool_results(_REQUESTS[-1])
-    assert "JSON" in tool_result
-
-
-@pytest.mark.parametrize(
-    ("arguments", "expected"),
-    [
-        ('{"cmd": "ls', json.dumps({MALFORMED_ARGUMENTS_KEY: '{"cmd": "ls'})),
-        ("[1, 2]", json.dumps({MALFORMED_ARGUMENTS_KEY: "[1, 2]"})),
-        ("", "{}"),
-        ("  ", "{}"),
-        (None, "{}"),
-    ],
-)
-def test_repair_arguments_rewrites_anything_but_a_json_object(
-    arguments: str | None, expected: str
-) -> None:
-    assert repair_arguments(arguments) == expected
-
-
-@pytest.mark.parametrize(
-    "arguments", ["{}", '{"cmd": "ls -la"}', '{"nested": {"a": [1]}}', '{"n": "NaN"}']
-)
-def test_repair_arguments_leaves_json_objects_alone(arguments: str) -> None:
-    assert repair_arguments(arguments) is None
-
-
-@pytest.mark.parametrize("arguments", ['{"n": NaN}', '{"n": Infinity}', '{"n": -Infinity}'])
-def test_repair_arguments_wraps_non_standard_json_constants(arguments: str) -> None:
-    repaired = repair_arguments(arguments)
-
-    assert repaired is not None
-    assert _loads_strict(repaired) == {MALFORMED_ARGUMENTS_KEY: arguments}
-
-
-def test_repair_arguments_wraps_over_nested_json() -> None:
-    repaired = repair_arguments(OVER_NESTED)
-
-    assert repaired is not None
-    assert _loads_strict(repaired) == {MALFORMED_ARGUMENTS_KEY: OVER_NESTED}
-
-
-def test_history_repair_rewrites_only_malformed_calls() -> None:
-    items = [
-        {"role": "user", "content": "go"},
-        {"type": "function_call", "call_id": "a", "name": "x", "arguments": '{"cmd": "ls'},
-        {"type": "function_call_output", "call_id": "a", "output": "invalid JSON"},
-        {"type": "function_call", "call_id": "b", "name": "y", "arguments": '{"ok": true}'},
-        ResponseFunctionToolCall(call_id="c", name="z", arguments="", type="function_call"),
-    ]
-
-    rebuilt, changed = repair_history_arguments(items)
-
-    assert changed
-    assert rebuilt[0] is items[0]
-    assert json.loads(rebuilt[1]["arguments"]) == {MALFORMED_ARGUMENTS_KEY: '{"cmd": "ls'}
-    assert rebuilt[1]["call_id"] == "a"
-    assert rebuilt[2] is items[2]
-    assert rebuilt[3] is items[3]
-    assert isinstance(rebuilt[4], ResponseFunctionToolCall)
-    assert rebuilt[4].arguments == "{}"
-    assert isinstance(items[1], dict)
-    assert items[1]["arguments"] == '{"cmd": "ls'
-
-
-def test_repair_input_returns_same_object_when_nothing_changes() -> None:
-    items = [{"type": "function_call", "call_id": "a", "name": "x", "arguments": "{}"}]
-
-    assert repair_input(items) is items
-    assert repair_input("plain prompt") == "plain prompt"
-
-
-def test_repair_input_wraps_over_nested_function_call_arguments() -> None:
-    items = [
-        {
-            "type": "function_call",
-            "call_id": "a",
-            "name": "x",
-            "arguments": OVER_NESTED,
-        }
-    ]
-
-    repaired = repair_input(items)
-
-    assert isinstance(repaired, list)
-    assert _loads_strict(repaired[0]["arguments"]) == {MALFORMED_ARGUMENTS_KEY: OVER_NESTED}
-
-
-@pytest.mark.parametrize(
-    "arguments",
-    ['{"cmd": "ls -la', "[1, 2]", "null", "not json", '{"n": NaN}', OVER_NESTED],
-)
-def test_describe_malformed_arguments_tells_the_model_to_reissue(arguments: str) -> None:
-    message = describe_malformed_arguments("exec_command", arguments)
-
-    assert message is not None
-    assert message.startswith("exec_command: the tool call was not executed")
-    assert "Re-issue the call" in message
-
-
-@pytest.mark.parametrize("arguments", ["", "   ", "{}", '{"cmd": "ls"}'])
-def test_describe_malformed_arguments_accepts_objects_and_empty_input(arguments: str) -> None:
-    assert describe_malformed_arguments("exec_command", arguments) is None