fix(skills): strengthen DoubleClickjacking validation

* feat(sandbox): replace Semgrep with Opengrep and bundle offline rules

* fix(sandbox): keep opengrep-rules LICENSE and drop proprietary-licensed rules

* feat(sandbox): add Strix rule for GitHub-owned actions not pinned to a commit SHA

* chore: bump sandbox image to 1.4.0 (opengrep)

* fix(sandbox): resolve the gitleaks release tag without the GitHub API

* fix(sandbox): install a pinned, sha256-verified trivy release

AGENTS.md

@@ -28,7 +28,7 @@ Target-specific workflows built on the same engine:
 - **Open-source CLI (self-hosted):** free, fully local, BYO LLM key, needs Docker. Best for local dev loops, air-gapped/offline, and full control.
   ```bash
   curl -sSL https://strix.ai/install | bash        # install
-  export STRIX_LLM="openrouter/z-ai/glm-5.3"        # any LiteLLM model id
+  export STRIX_LLM="openrouter/z-ai/glm-5.3"        # any LiteLLM model id, or vercel_ai_gateway/zai/glm-5.3
   export LLM_API_KEY="<key>"
   strix -n -t ./ --scan-mode quick --max-budget 10  # headless scan; always use -n
   ```

CONTRIBUTING.md

@@ -31,7 +31,7 @@ Thank you for your interest in contributing to Strix! This guide will help you g
 
 3. **Configure your LLM provider**
    ```bash
-   export STRIX_LLM="openrouter/z-ai/glm-5.3"
+   export STRIX_LLM="openrouter/z-ai/glm-5.3"   # or vercel_ai_gateway/zai/glm-5.3
    export LLM_API_KEY="your-api-key"
    ```
 

README.md

@@ -84,7 +84,8 @@ Strix are autonomous AI penetration testing agents that act just like real hacke
 curl -sSL https://strix.ai/install | bash
 
 # Configure your AI provider
-export STRIX_LLM="openrouter/z-ai/glm-5.3"
+export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"   # Vercel AI Gateway
+# export STRIX_LLM="openrouter/z-ai/glm-5.3"       # OpenRouter
 export LLM_API_KEY="your-api-key"
 
 # Run your first security assessment
@@ -296,7 +297,8 @@ jobs:
 ### Configuration
 
 ```bash
-export STRIX_LLM="openrouter/z-ai/glm-5.3"
+export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"   # Vercel AI Gateway
+# export STRIX_LLM="openrouter/z-ai/glm-5.3"       # OpenRouter
 export LLM_API_KEY="your-api-key"
 
 # Optional
@@ -352,12 +354,14 @@ Each server's tools are namespaced by `name`, for example `github_list_issues`.
 
 **Recommended models for best results:**
 
-- [Z.ai GLM-5.3 on OpenRouter](https://openrouter.ai/z-ai/glm-5.3) - `openrouter/z-ai/glm-5.3` (the default pick)
-- [OpenAI GPT-5.4](https://openai.com/api/) - `openai/gpt-5.4`
-- [Anthropic Claude Sonnet 4.6](https://claude.com/platform/api) - `anthropic/claude-sonnet-4-6`
-- [Google Gemini 3 Pro Preview](https://cloud.google.com/vertex-ai) - `vertex_ai/gemini-3-pro-preview`
+- [Z.ai GLM-5.3 on Vercel AI Gateway](https://vercel.com/ai-gateway/models/glm-5.3) - `vercel_ai_gateway/zai/glm-5.3` (recommended)
+- [Z.ai GLM-5.3 on OpenRouter](https://openrouter.ai/z-ai/glm-5.3) - `openrouter/z-ai/glm-5.3` (recommended)
+- [DeepSeek V4.1 Flash on OpenRouter](https://openrouter.ai/deepseek/deepseek-v4.1-flash-1017) - `openrouter/deepseek/deepseek-v4.1-flash-1017`
+- [OpenAI GPT-6.1 Sol](https://openai.com/api/) - `openai/gpt-6.1-sol` (needs [Daybreak](https://openai.com/daybreak/) access)
+- [Anthropic Claude Opus 5.5](https://claude.com/platform/api) - `anthropic/claude-opus-5-5` (needs [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) access)
+- [Google Gemini 4 Argon](https://cloud.google.com/vertex-ai) - `vertex_ai/gemini-4-argon` (needs [Fairwind](https://deepmind.google/fairwind-program/) access)
 - [DeepSeek V4 Pro](https://platform.deepseek.com) - `deepseek/deepseek-v4-pro`
-- [Moonshot Kimi K3](https://platform.kimi.ai) - `moonshot/kimi-k3`
+- [Moonshot Kimi K3.1 Pro](https://platform.kimi.ai) - `moonshot/kimi-k3.1-pro`
 
 See the [LLM Providers documentation](https://docs.strix.ai/llm-providers/overview) for all supported providers including Vertex AI, Bedrock, Azure, and local models.
 

containers/Dockerfile

@@ -186,20 +186,84 @@ RUN set -eux; \
         aarch64|arm64) GITLEAKS_ARCH="arm64" ;; \
         *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;; \
     esac; \
-    TAG="$(curl -fsSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r .tag_name)"; \
+    TAG="$(curl -fsSLI -o /dev/null -w '%{url_effective}' https://github.com/gitleaks/gitleaks/releases/latest | sed 's#.*/##')"; \
     curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/${TAG}/gitleaks_${TAG#v}_linux_${GITLEAKS_ARCH}.tar.gz" -o /tmp/gitleaks.tgz; \
     tar -xzf /tmp/gitleaks.tgz -C /tmp; \
     install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks; \
     rm -f /tmp/gitleaks /tmp/gitleaks.tgz
 
-RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+ARG TRIVY_VERSION=0.76.1
+ARG TRIVY_SHA256_X86=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
+ARG TRIVY_SHA256_AARCH64=e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f
+RUN set -eux; \
+    case "$(uname -m)" in \
+        x86_64) TRIVY_ARCH="64bit"; TRIVY_SHA256="${TRIVY_SHA256_X86}" ;; \
+        aarch64|arm64) TRIVY_ARCH="ARM64"; TRIVY_SHA256="${TRIVY_SHA256_AARCH64}" ;; \
+        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TRIVY_ARCH}.tar.gz" -o /tmp/trivy.tgz; \
+    echo "${TRIVY_SHA256}  /tmp/trivy.tgz" | sha256sum -c -; \
+    tar -xzf /tmp/trivy.tgz -C /tmp trivy; \
+    install -m 0755 /tmp/trivy /usr/local/bin/trivy; \
+    rm -f /tmp/trivy /tmp/trivy.tgz; \
+    trivy --version
 
 RUN apt-get install -y wapiti
 
+# CVE-2026-111497: out-of-bounds write in the brotli decoder, fixed in brotli
+# 1.2.1 / Debian 1.2.0-4.1. kali-rolling still ships 1.2.0-4, and node, curl and
+# python3 in this image all load the shared libbrotlidec, so every HTTP client here
+# would decode a malicious `Content-Encoding: br` response with the vulnerable
+# code. Install the fixed Debian packages until Kali picks them up.
+ARG BROTLI_DEB_VERSION=1.2.0-4.1
+RUN set -eux; \
+    ARCH="$(dpkg --print-architecture)"; \
+    for pkg in libbrotli1 python3-brotli; do \
+        curl -fsSL "https://deb.debian.org/debian/pool/main/b/brotli/${pkg}_${BROTLI_DEB_VERSION}_${ARCH}.deb" -o "/tmp/${pkg}.deb"; \
+    done; \
+    dpkg -i /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
+    rm -f /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
+    test "$(dpkg-query -W -f='${Version}' libbrotli1)" = "${BROTLI_DEB_VERSION}"; \
+    node -e 'const z=require("zlib");z.brotliDecompressSync(z.brotliCompressSync(Buffer.from("ok")))'
+
+ARG OPENGREP_VERSION=1.31.0
+ARG OPENGREP_SHA256_X86=dbbe3c2058dbe600c449a8ba22ea79a1643a6660658400090d0323a8d0d31147
+ARG OPENGREP_SHA256_AARCH64=2b713a29a00237f85408b83002fc111db5b94c7fa8d263f0a93184a960655d9d
+RUN set -eux; \
+    case "$(uname -m)" in \
+        x86_64) OPENGREP_ARCH="x86"; OPENGREP_SHA256="${OPENGREP_SHA256_X86}" ;; \
+        aarch64|arm64) OPENGREP_ARCH="aarch64"; OPENGREP_SHA256="${OPENGREP_SHA256_AARCH64}" ;; \
+        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
+    esac; \
+    curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${OPENGREP_VERSION}/opengrep_manylinux_${OPENGREP_ARCH}" -o /tmp/opengrep; \
+    echo "${OPENGREP_SHA256}  /tmp/opengrep" | sha256sum -c -; \
+    install -m 0755 /tmp/opengrep /usr/local/bin/opengrep; \
+    rm -f /tmp/opengrep; \
+    opengrep --version
+
+# Opengrep ships no rule registry of its own; bake the community ruleset so
+# scans run offline. Keep only rule YAML and LICENSE; drop tests, fixtures,
+# tooling, and rules marked with a proprietary license.
+ARG OPENGREP_RULES_REF=f1d2b562b414783763fd02a6ed2736eaed622efa
+RUN set -eux; \
+    mkdir -p /opt/opengrep-rules; \
+    curl -fsSL "https://codeload.github.com/opengrep/opengrep-rules/tar.gz/${OPENGREP_RULES_REF}" \
+        | tar -xz --strip-components=1 -C /opt/opengrep-rules; \
+    cd /opt/opengrep-rules; \
+    rm -rf .github scripts stats; \
+    find . -maxdepth 1 -type f ! -name LICENSE -delete; \
+    find . -mindepth 2 -type f \( ! \( -name '*.yaml' -o -name '*.yml' \) -o -name '*.test.yaml' -o -name '*.test.yml' -o -name '.*' \) -delete; \
+    grep -rlZ 'license: proprietary' . | xargs -0 -r rm -f; \
+    find . -type d -empty -delete; \
+    chmod -R a+rX /opt/opengrep-rules
+
+# Strix-authored rules that close gaps in the community ruleset.
+COPY containers/opengrep-rules/ /opt/opengrep-rules/strix/
+RUN chmod -R a+rX /opt/opengrep-rules/strix
+
 USER pentester
 
-RUN pipx install semgrep && \
-    pipx install bandit
+RUN pipx install bandit
 
 RUN npm install -g jshint
 

containers/opengrep-rules/github-owned-action-not-pinned-to-commit-sha.yaml

@@ -0,0 +1,37 @@
+rules:
+  - id: github-owned-action-not-pinned-to-commit-sha
+    patterns:
+      - pattern-inside: "{steps: ...}"
+      - pattern: |
+          uses: "$USES"
+      - metavariable-regex:
+          metavariable: $USES
+          regex: '^(actions|github)/'
+      - metavariable-pattern:
+          metavariable: $USES
+          language: generic
+          patterns:
+            - pattern-not-regex: "@[0-9a-f]{40}$"
+    message: >-
+      GitHub-owned action `$USES` is referenced by a mutable tag or branch
+      instead of a full-length commit SHA. Tags can be moved, so a compromised
+      or force-pushed release changes what this workflow runs. Pin to the
+      commit SHA of the release you reviewed and let a bot keep it current.
+    languages:
+      - yaml
+    severity: WARNING
+    metadata:
+      cwe:
+        - "CWE-1357: Reliance on Insufficiently Trustworthy Component"
+        - "CWE-353: Missing Support for Integrity Check"
+      owasp: A06:2021 - Vulnerable and Outdated Components
+      references:
+        - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
+      category: security
+      technology:
+        - github-actions
+      subcategory:
+        - vuln
+      likelihood: LOW
+      impact: LOW
+      confidence: HIGH

docs/advanced/configuration.mdx

@@ -8,7 +8,7 @@ Configure Strix using environment variables or a config file.
 ## LLM Configuration
 
 <ParamField path="STRIX_LLM" type="string" required>
-  Model name in LiteLLM format (e.g., `openrouter/z-ai/glm-5.3`, `openai/gpt-5.4`).
+  Model name in LiteLLM format (e.g., `openrouter/z-ai/glm-5.3`, `openai/gpt-6.1-sol`).
 </ParamField>
 
 <ParamField path="LLM_API_KEY" type="string">
@@ -19,10 +19,29 @@ Configure Strix using environment variables or a config file.
   Custom API base URL. Also accepts `OPENAI_API_BASE`, `LITELLM_BASE_URL`, or `OLLAMA_API_BASE`.
 </ParamField>
 
+<ParamField path="STRIX_LLM_INPUT_COST_PER_MTOK" type="number">
+  Price per 1M input tokens in USD for `STRIX_LLM`. Use it for gateway or self-hosted model ids that LiteLLM can't price.
+</ParamField>
+
+<ParamField path="STRIX_LLM_OUTPUT_COST_PER_MTOK" type="number">
+  Price per 1M output tokens in USD for `STRIX_LLM`.
+</ParamField>
+
+<ParamField path="STRIX_LLM_CACHED_INPUT_COST_PER_MTOK" type="number">
+  Price per 1M cached input tokens in USD for `STRIX_LLM`. If unset, cached tokens use the input price.
+</ParamField>
+
+<Note>
+  Setting any of these prices replaces the provider-reported and LiteLLM cost for `STRIX_LLM` in reports and `--max-budget`. An unset input or output price counts as `0`, so set both. A separate `STRIX_DEDUPE_MODEL` keeps its LiteLLM price.
+</Note>
+
 <ParamField path="STRIX_API_TYPE" type="string">
   Select the OpenAI API path for the model: `responses` or `chat_completions`.
-  By default, a custom `LLM_API_BASE` uses chat completions. Set this variable
-  when your gateway requires the other API. Also accepts `STRIX_FORCE_API`.
+  By default the model decides: Responses when LiteLLM's model catalog lists
+  `/v1/responses` for it (e.g. `gpt-5`), chat completions otherwise. A custom
+  `LLM_API_BASE` does not change this, so set `STRIX_API_TYPE=chat_completions`
+  when your gateway only serves chat completions. Applies to bare and `openai/`
+  model names. Also accepts `STRIX_FORCE_API`.
 </ParamField>
 
 <ParamField path="LLM_EXTRA_HEADERS" type="string">
@@ -167,7 +186,7 @@ When remote vars are set, Strix dual-writes telemetry to both local JSONL and th
 
 ## Docker Configuration
 
-<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.3.0" type="string">
+<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.4.0" type="string">
   Docker image to use for the sandbox container.
 </ParamField>
 

docs/docs.json

@@ -35,8 +35,8 @@
               "llm-providers/overview",
               "llm-providers/openai",
               "llm-providers/anthropic",
-              "llm-providers/openrouter",
               "llm-providers/vercel-ai-gateway",
+              "llm-providers/openrouter",
               "llm-providers/vertex",
               "llm-providers/bedrock",
               "llm-providers/azure",

docs/index.mdx

@@ -73,7 +73,20 @@ Strix uses a graph of specialized agents for comprehensive security testing:
 
 ## Quick Example
 
-```bash
+<CodeGroup>
+```bash Vercel AI Gateway
+# Install
+curl -sSL https://strix.ai/install | bash
+
+# Configure
+export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
+export LLM_API_KEY="your-api-key"
+
+# Scan
+strix --target ./your-app
+```
+
+```bash OpenRouter
 # Install
 curl -sSL https://strix.ai/install | bash
 
@@ -84,6 +97,7 @@ export LLM_API_KEY="your-api-key"
 # Scan
 strix --target ./your-app
 ```
+</CodeGroup>
 
 ## Community
 

docs/llm-providers/anthropic.mdx

@@ -6,7 +6,7 @@ description: "Configure Strix with Claude models"
 ## Setup
 
 ```bash
-export STRIX_LLM="anthropic/claude-sonnet-4-6"
+export STRIX_LLM="anthropic/claude-sonnet-5-5"
 export LLM_API_KEY="sk-ant-..."
 ```
 
@@ -14,8 +14,12 @@ export LLM_API_KEY="sk-ant-..."
 
 | Model | Description |
 |-------|-------------|
-| `anthropic/claude-sonnet-4-6` | Best balance of intelligence and speed |
-| `anthropic/claude-opus-4-6` | Maximum capability for deep analysis |
+| `anthropic/claude-sonnet-5-5` | Best balance of intelligence and speed |
+| `anthropic/claude-opus-5-5` | Maximum capability for deep analysis |
+
+<Note>
+Security testing with Claude needs the [Cyber Verification Program](https://support.claude.com/en/articles/14604842-cyber-verification-program) (CVP). Without it the safety classifiers block most offensive tasks. Red Team Access covers authorized penetration testing.
+</Note>
 
 ## Get API Key
 

docs/llm-providers/azure.mdx

@@ -6,7 +6,7 @@ description: "Configure Strix with OpenAI models via Azure"
 ## Setup
 
 ```bash
-export STRIX_LLM="azure/your-gpt5-deployment"
+export STRIX_LLM="azure/your-gpt6-deployment"
 export AZURE_API_KEY="your-azure-api-key"
 export AZURE_API_BASE="https://your-resource.openai.azure.com"
 export AZURE_API_VERSION="2025-11-01-preview"
@@ -24,7 +24,7 @@ export AZURE_API_VERSION="2025-11-01-preview"
 ## Example
 
 ```bash
-export STRIX_LLM="azure/gpt-5.4-deployment"
+export STRIX_LLM="azure/gpt-6.1-sol-deployment"
 export AZURE_API_KEY="abc123..."
 export AZURE_API_BASE="https://mycompany.openai.azure.com"
 export AZURE_API_VERSION="2025-11-01-preview"
@@ -33,5 +33,9 @@ export AZURE_API_VERSION="2025-11-01-preview"
 ## Prerequisites
 
 1. Create an Azure OpenAI resource
-2. Deploy a model (e.g., GPT-5.4)
+2. Deploy a model such as GPT-6.1 Sol
 3. Get the endpoint URL and API key from the Azure portal
+
+<Note>
+Security testing with OpenAI models needs [Daybreak](https://openai.com/daybreak/) access, also on Azure.
+</Note>

docs/llm-providers/bedrock.mdx

@@ -6,7 +6,7 @@ description: "Configure Strix with models via AWS Bedrock"
 ## Setup
 
 ```bash
-export STRIX_LLM="bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0"
+export STRIX_LLM="bedrock/us.anthropic.claude-sonnet-5-5"
 ```
 
 No API key required—uses AWS credentials from environment.
@@ -36,10 +36,13 @@ Automatically uses instance role credentials.
 
 | Model | Description |
 |-------|-------------|
-| `bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0` | Claude 4.5 Sonnet |
-| `bedrock/anthropic.claude-4-5-opus-20251022-v1:0` | Claude 4.5 Opus |
-| `bedrock/anthropic.claude-4-5-haiku-20251022-v1:0` | Claude 4.5 Haiku |
-| `bedrock/amazon.titan-text-premier-v2:0` | Amazon Titan Premier v2 |
+| `bedrock/us.anthropic.claude-sonnet-5-5` | Claude Sonnet 5.5 |
+| `bedrock/us.anthropic.claude-opus-5-5` | Claude Opus 5.5 |
+| `bedrock/us.anthropic.claude-haiku-5-5` | Claude Haiku 5.5 |
+
+<Note>
+Security testing with Claude needs the [Cyber Verification Program](https://support.claude.com/en/articles/14604842-cyber-verification-program) (CVP), also on Bedrock.
+</Note>
 
 ## Prerequisites
 

docs/llm-providers/novita.mdx

@@ -8,7 +8,7 @@ description: "Configure Strix with Novita AI models"
 ## Setup
 
 ```bash
-export STRIX_LLM="openai/moonshotai/kimi-k2.5"
+export STRIX_LLM="openai/zai-org/glm-5.3"
 export LLM_API_KEY="your-novita-api-key"
 export LLM_API_BASE="https://api.novita.ai/openai"
 ```
@@ -18,11 +18,12 @@ export LLM_API_BASE="https://api.novita.ai/openai"
 | Model | Configuration |
 |-------|---------------|
 | GLM-5.3 | `openai/zai-org/glm-5.3` |
+| Kimi K3.1 Pro | `openai/moonshotai/kimi-k3.1-pro` |
 | Kimi K3 | `openai/moonshotai/kimi-k3` |
+| DeepSeek V4.1 Flash | `openai/deepseek/deepseek-v4.1-flash-1017` |
 | DeepSeek V4 Pro | `openai/deepseek/deepseek-v4-pro` |
-| Kimi K2.5 | `openai/moonshotai/kimi-k2.5` |
-| GLM-5 | `openai/zai-org/glm-5` |
-| MiniMax M2.5 | `openai/minimax/minimax-m2.5` |
+| MiniMax M3.1 Flash | `openai/minimax/minimax-m3.1-flash` |
+| GLM-5.3 Flash | `openai/zai-org/glm-5.3-flash` |
 
 ## Get API Key
 

docs/llm-providers/openai.mdx

@@ -6,13 +6,23 @@ description: "Configure Strix with OpenAI models"
 ## Setup
 
 ```bash
-export STRIX_LLM="openai/gpt-5.4"
+export STRIX_LLM="openai/gpt-6.1-sol"
 export LLM_API_KEY="sk-..."
 ```
 
 ## Available Models
 
-See [OpenAI Models Documentation](https://platform.openai.com/docs/models) for the full list of available models.
+| Model | Description |
+|-------|-------------|
+| `openai/gpt-6.1-sol` | Best balance of capability and cost for agentic security work |
+| `openai/gpt-6-astra` | Flagship, maximum capability |
+| `openai/gpt-6-luna` | Fast and cheap |
+
+See [OpenAI Models Documentation](https://platform.openai.com/docs/models) for the full list.
+
+<Note>
+Security testing with OpenAI models needs [Daybreak](https://openai.com/daybreak/) (Trusted Access for Cyber). Without it the models refuse most offensive tasks. [Request access](https://openai.com/form/enterprise-trusted-access-for-cyber/).
+</Note>
 
 ## Get API Key
 
@@ -25,7 +35,7 @@ See [OpenAI Models Documentation](https://platform.openai.com/docs/models) for t
 For OpenAI-compatible APIs:
 
 ```bash
-export STRIX_LLM="openai/gpt-5.4"
+export STRIX_LLM="openai/gpt-6.1-sol"
 export LLM_API_KEY="your-key"
 export LLM_API_BASE="https://your-proxy.com/v1"
 ```

docs/llm-providers/openrouter.mdx

@@ -18,13 +18,19 @@ Access any model on OpenRouter using the format `openrouter/<provider>/<model>`:
 
 | Model | Configuration |
 |-------|---------------|
-| GLM-5.3 (default) | `openrouter/z-ai/glm-5.3` |
-| GPT-5.4 | `openrouter/openai/gpt-5.4` |
-| Claude Sonnet 4.6 | `openrouter/anthropic/claude-sonnet-4.6` |
-| Gemini 3 Pro | `openrouter/google/gemini-3-pro-preview` |
+| GLM-5.3 (recommended) | `openrouter/z-ai/glm-5.3` |
+| GPT-6.1 Sol | `openrouter/openai/gpt-6.1-sol` |
+| GPT-6 Astra | `openrouter/openai/gpt-6-astra` |
+| Claude Opus 5.5 | `openrouter/anthropic/claude-opus-5.5` |
+| Claude Sonnet 5.5 | `openrouter/anthropic/claude-sonnet-5.5` |
+| Gemini 4 Argon | `openrouter/google/gemini-4-argon` |
+| Gemini 3.8 Flash | `openrouter/google/gemini-3.8-flash` |
+| DeepSeek V4.1 Flash | `openrouter/deepseek/deepseek-v4.1-flash-1017` |
 | DeepSeek V4 Pro | `openrouter/deepseek/deepseek-v4-pro` |
-| Kimi K3 | `openrouter/moonshotai/kimi-k3` |
-| GLM-4.7 | `openrouter/z-ai/glm-4.7` |
+| Kimi K3.1 Pro | `openrouter/moonshotai/kimi-k3.1-pro` |
+| GLM-5.3 Flash | `openrouter/z-ai/glm-5.3-flash` |
+
+OpenAI, Anthropic and Gemini models keep their provider safeguards on OpenRouter. Security testing with them needs [Daybreak](https://openai.com/daybreak/), [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) or [Fairwind](https://deepmind.google/fairwind-program/) access.
 
 ## Get API Key
 

docs/llm-providers/overview.mdx

@@ -9,19 +9,33 @@ Strix uses [LiteLLM](https://docs.litellm.ai/docs/providers) for model compatibi
 
 Set your model and API key:
 
-| Model                | Provider          | Configuration                    |
-| -------------------- | ----------------- | -------------------------------- |
-| GLM-5.3 (default)    | Z.ai (OpenRouter) | `openrouter/z-ai/glm-5.3`        |
-| GPT-5.4              | OpenAI            | `openai/gpt-5.4`                 |
-| Claude Sonnet 4.6    | Anthropic         | `anthropic/claude-sonnet-4-6`    |
-| Gemini 3 Pro         | Google Vertex     | `vertex_ai/gemini-3-pro-preview` |
-| DeepSeek V4 Pro      | DeepSeek          | `deepseek/deepseek-v4-pro`       |
-| Kimi K3              | Moonshot          | `moonshot/kimi-k3`               |
+| Model                 | Provider                  | Configuration                    |
+| --------------------- | ------------------------- | -------------------------------- |
+| GLM-5.3 (recommended) | Vercel AI Gateway         | `vercel_ai_gateway/zai/glm-5.3`  |
+| GLM-5.3 (recommended) | OpenRouter                | `openrouter/z-ai/glm-5.3`        |
+| GPT-6.1 Sol           | OpenAI                    | `openai/gpt-6.1-sol`             |
+| Claude Opus 5.5       | Anthropic                 | `anthropic/claude-opus-5-5`      |
+| Claude Sonnet 5.5     | Anthropic                 | `anthropic/claude-sonnet-5-5`    |
+| Gemini 4 Argon        | Google Vertex             | `vertex_ai/gemini-4-argon`       |
+| DeepSeek V4.1 Flash   | DeepSeek                  | `deepseek/deepseek-flash`        |
+| DeepSeek V4 Pro       | DeepSeek                  | `deepseek/deepseek-v4-pro`       |
+| Kimi K3.1 Pro         | Moonshot                  | `moonshot/kimi-k3.1-pro`         |
 
-```bash
+<Note>
+Frontier OpenAI, Anthropic and Gemini models need a cyber access program for security testing: [Daybreak](https://openai.com/daybreak/) for OpenAI, the [Cyber Verification Program](https://support.claude.com/en/articles/14604842-cyber-verification-program) for Anthropic, and the [Fairwind Program](https://deepmind.google/fairwind-program/) for Gemini.
+</Note>
+
+<CodeGroup>
+```bash Vercel AI Gateway
+export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
+export LLM_API_KEY="your-api-key"
+```
+
+```bash OpenRouter
 export STRIX_LLM="openrouter/z-ai/glm-5.3"
 export LLM_API_KEY="your-api-key"
 ```
+</CodeGroup>
 
 ## Local Models
 
@@ -47,7 +61,7 @@ See the [Local Models guide](/llm-providers/local) for setup instructions and re
     Access 100+ models through a single API.
   </Card>
   <Card title="Vercel AI Gateway" href="/llm-providers/vercel-ai-gateway">
-    Access models from multiple providers through one endpoint.
+    Access 100+ models through one OpenAI-compatible endpoint.
   </Card>
   <Card title="Google Vertex AI" href="/llm-providers/vertex">
     Gemini 3 models via Google Cloud.
@@ -69,9 +83,9 @@ Use LiteLLM's `provider/model-name` format:
 
 ```
 openrouter/z-ai/glm-5.3
-openai/gpt-5.4
-anthropic/claude-sonnet-4-6
-vertex_ai/gemini-3-pro-preview
-bedrock/anthropic.claude-4-5-sonnet-20251022-v1:0
+openai/gpt-6.1-sol
+anthropic/claude-sonnet-5-5
+vertex_ai/gemini-4-argon
+bedrock/us.anthropic.claude-sonnet-5-5
 ollama/llama4
 ```

docs/llm-providers/vercel-ai-gateway.mdx

@@ -1,32 +1,47 @@
 ---
 title: "Vercel AI Gateway"
-description: "Configure Strix with models via Vercel AI Gateway"
+description: "Configure Strix with models through Vercel AI Gateway"
 ---
 
-[Vercel AI Gateway](https://vercel.com/docs/ai-gateway) provides an OpenAI-compatible API for models from multiple providers.
+[Vercel AI Gateway](https://vercel.com/docs/ai-gateway) provides access to 100+ models from multiple providers through one OpenAI-compatible API.
 
 ## Setup
 
 Create an [AI Gateway API key](https://vercel.com/docs/ai-gateway/authentication-and-byok), then configure Strix:
 
 ```bash
-export STRIX_LLM="openai/anthropic/claude-opus-5"
+export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
 export LLM_API_KEY="your-ai-gateway-api-key"
-export LLM_API_BASE="https://ai-gateway.vercel.sh/v1"
 ```
 
-The first `openai/` segment tells Strix to use its OpenAI-compatible client. The remaining value is the [AI Gateway model ID](https://vercel.com/docs/ai-gateway/models-and-providers).
+The `vercel_ai_gateway/` prefix selects the Gateway. The remaining value is the [AI Gateway model ID](https://vercel.com/docs/ai-gateway/models-and-providers).
 
 ## Available Models
 
-Use any language model returned by the AI Gateway models endpoint:
+Access any model on the Gateway using the format `vercel_ai_gateway/<provider>/<model>`:
+
+| Model | Configuration |
+|-------|---------------|
+| GLM-5.3 (recommended) | `vercel_ai_gateway/zai/glm-5.3` |
+| GPT-6.1 Sol | `vercel_ai_gateway/openai/gpt-6.1-sol` |
+| GPT-6 Astra | `vercel_ai_gateway/openai/gpt-6-astra` |
+| Claude Opus 5.5 | `vercel_ai_gateway/anthropic/claude-opus-5.5` |
+| Claude Sonnet 5.5 | `vercel_ai_gateway/anthropic/claude-sonnet-5.5` |
+| Gemini 4 Argon | `vercel_ai_gateway/google/gemini-4-argon` |
+| Gemini 3.8 Flash | `vercel_ai_gateway/google/gemini-3.8-flash` |
+| DeepSeek V4.1 Flash | `vercel_ai_gateway/deepseek/deepseek-v4.1-flash-1017` |
+| DeepSeek V4 Pro | `vercel_ai_gateway/deepseek/deepseek-v4-pro` |
+| Kimi K3.1 Pro | `vercel_ai_gateway/moonshotai/kimi-k3.1-pro` |
+| GLM-5.3 Flash | `vercel_ai_gateway/zai/glm-5.3-flash` |
+
+OpenAI, Anthropic and Gemini models keep their provider safeguards on the Gateway. Security testing with them needs [Daybreak](https://openai.com/daybreak/), [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) or [Fairwind](https://deepmind.google/fairwind-program/) access.
+
+The full list is at the [AI Gateway models page](https://vercel.com/ai-gateway/models) or the models endpoint:
 
 ```text
 https://ai-gateway.vercel.sh/v1/models
 ```
 
-Prefix its model ID with `openai/` when setting `STRIX_LLM`. For example, the Gateway model ID `anthropic/claude-opus-5` becomes `openai/anthropic/claude-opus-5` in Strix.
-
 ## Get API Key
 
 1. Open the [AI Gateway API key settings](https://vercel.com/docs/ai-gateway/authentication-and-byok)
@@ -35,5 +50,6 @@ Prefix its model ID with `openai/` when setting `STRIX_LLM`. For example, the Ga
 
 ## Benefits
 
-- Access models from multiple providers through one endpoint
-- Track Gateway usage and cost in Vercel
+- **Single API** — Access models from OpenAI, Anthropic, Google, Z.ai, and more
+- **Bring your own keys** — Route through your own provider accounts when you want
+- **Cost tracking** — Monitor Gateway usage and cost in Vercel

docs/llm-providers/vertex.mdx

@@ -6,7 +6,7 @@ description: "Configure Strix with Gemini models via Google Cloud"
 ## Setup
 
 ```bash
-export STRIX_LLM="vertex_ai/gemini-3-pro-preview"
+export STRIX_LLM="vertex_ai/gemini-4-argon"
 ```
 
 No API key required—uses Google Cloud Application Default Credentials.
@@ -29,8 +29,12 @@ export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"
 
 | Model | Description |
 |-------|-------------|
-| `vertex_ai/gemini-3-pro-preview` | Best overall performance for security testing |
-| `vertex_ai/gemini-3-flash-preview` | Faster and cheaper |
+| `vertex_ai/gemini-4-argon` | Best overall performance for security testing |
+| `vertex_ai/gemini-3.8-flash` | Faster and cheaper |
+
+<Note>
+Security testing with Gemini needs the [Fairwind Program](https://deepmind.google/fairwind-program/). Without it the cyber guardrails block most offensive tasks.
+</Note>
 
 ## Project Configuration
 

docs/quickstart.mdx

@@ -25,15 +25,22 @@ description: "Install Strix and run your first security scan"
 
 ## Configuration
 
-Set your LLM provider:
+Set your LLM provider. We recommend GLM-5.3 through [Vercel AI Gateway](/llm-providers/vercel-ai-gateway) or [OpenRouter](/llm-providers/openrouter):
 
-```bash
-export STRIX_LLM="openrouter/z-ai/glm-5.3"
+<CodeGroup>
+```bash Vercel AI Gateway
+export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
 export LLM_API_KEY="your-api-key"
 ```
 
+```bash OpenRouter
+export STRIX_LLM="openrouter/z-ai/glm-5.3"
+export LLM_API_KEY="your-api-key"
+```
+</CodeGroup>
+
 <Tip>
-For best results, use `openrouter/z-ai/glm-5.3` (the default pick), `openai/gpt-5.4`, `anthropic/claude-opus-4-6`, or `openai/gpt-5.2`.
+For best results, use `zai/glm-5.3`, `deepseek/deepseek-v4.1-flash-1017`, `anthropic/claude-opus-5-5` (needs [CVP](https://support.claude.com/en/articles/14604842-cyber-verification-program) access), or `openai/gpt-6.1-sol` (needs [Daybreak](https://openai.com/daybreak/) access).
 </Tip>
 
 ## Run Your First Scan

docs/tools/sandbox.mdx

@@ -49,7 +49,7 @@ Strix runs inside a Kali Linux-based Docker container with a comprehensive set o
 
 | Tool                                                    | Description                                   |
 | ------------------------------------------------------- | --------------------------------------------- |
-| [Semgrep](https://github.com/semgrep/semgrep)          | Fast SAST and custom rule matching            |
+| [Opengrep](https://github.com/opengrep/opengrep)        | Fast SAST and custom rule matching            |
 | [ast-grep](https://ast-grep.github.io)                 | Structural AST/CST-aware code search (`sg`)   |
 | [Tree-sitter](https://tree-sitter.github.io/tree-sitter/) | Syntax tree parsing and symbol extraction (Java/JS/TS/Python/Go/Bash/JSON/YAML grammars pre-configured) |
 | [Bandit](https://bandit.readthedocs.io)                | Python security linter                        |

docs/tools/terminal.mdx

@@ -33,7 +33,7 @@ sqlmap -u "https://example.com/page?id=1"
 
 ```bash
 # Fast SAST triage
-semgrep --config auto ./src
+opengrep scan --config /opt/opengrep-rules ./src
 
 # Structural AST search
 sg scan ./src

docs/usage/scan-modes.mdx

@@ -46,7 +46,7 @@ Thorough penetration testing. Best for:
 
 **Duration**: 1-4 hours depending on target complexity
 
-**White-box behavior**: Runs broad source-aware triage (`semgrep`, AST structural search, secrets, supply-chain checks) and then systematically validates top candidates dynamically.
+**White-box behavior**: Runs broad source-aware triage (`opengrep`, AST structural search, secrets, supply-chain checks) and then systematically validates top candidates dynamically.
 
 <Note>
 Deep mode is the default. It explores edge cases, chained vulnerabilities, and complex attack paths.

scripts/install.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 
 APP=strix
 REPO="usestrix/strix"
-STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.3.0"
+STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.4.0"
 
 MUTED='\033[0;2m'
 RED='\033[0;31m'

skills/ci-security-scanning-with-strix/SKILL.md

@@ -63,7 +63,7 @@ jobs:
           fi
 ```
 
-Then tell the user to add two repository secrets: `STRIX_LLM` (model id, for example `openai/gpt-5.4`) and `LLM_API_KEY` (the provider key). Do not create these values yourself.
+Then tell the user to add two repository secrets: `STRIX_LLM` (model id, for example `openrouter/z-ai/glm-5.3`) and `LLM_API_KEY` (the provider key). Do not create these values yourself.
 
 Notes:
 - In CI/headless runs Strix automatically scopes to the PR's changed files (`--scope-mode auto`). If diff resolution fails, keep `fetch-depth: 0` or set `--diff-base` to the PR's actual base branch — use `origin/${{ github.base_ref }}` in GitHub Actions rather than a hard-coded `origin/main`, since repos use different default branches.

skills/penetration-testing-with-strix/SKILL.md

@@ -47,7 +47,7 @@ If unsure and the user has (or will create) an app.strix.ai account, prefer **Cl
    ```
 3. **LLM configured** — two environment variables:
    ```bash
-   export STRIX_LLM="openai/gpt-5.4"      # any LiteLLM model id (openai/..., anthropic/..., openrouter/...)
+   export STRIX_LLM="openrouter/z-ai/glm-5.3"      # any LiteLLM model id (openai/..., anthropic/..., openrouter/...)
    export LLM_API_KEY="<provider api key>"
    ```
    Ask the user for these if unset. Never hardcode or commit keys.

strix/agents/prompts/system_prompt.jinja

@@ -115,11 +115,11 @@ BLACK-BOX TESTING (domain/subdomain only):
 
 WHITE-BOX TESTING (code provided):
 - MUST perform BOTH static AND dynamic analysis
-- Static: Use source-aware triage first to map risk quickly (`semgrep`, `ast-grep`, Tree-sitter tooling, `gitleaks`, `trufflehog`, `trivy fs`). Then review code for vulnerabilities
+- Static: Use source-aware triage first to map risk quickly (`opengrep`, `ast-grep`, Tree-sitter tooling, `gitleaks`, `trufflehog`, `trivy fs`). Then review code for vulnerabilities
 - Static coverage floor: execute at least one structural AST mapping pass (`sg` and/or Tree-sitter) per repository and keep artifact output
-- Static coverage target per repository: run one `semgrep` pass, one secrets pass (`gitleaks` and/or `trufflehog`), one `trivy fs` pass, and one AST-structural pass (`sg` and/or Tree-sitter)
+- Static coverage target per repository: run one `opengrep` pass, one secrets pass (`gitleaks` and/or `trufflehog`), one `trivy fs` pass, and one AST-structural pass (`sg` and/or Tree-sitter)
 - Keep AST artifacts bounded and high-signal: scope to relevant paths/hypotheses, avoid whole-repo generic function dumps
-- AST target selection rule: build `sg-targets.txt` from `semgrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`), then run `xargs ... sg run` against that file list. Only use path-heuristic fallback if semgrep scope is unavailable.
+- AST target selection rule: build `sg-targets.txt` from `opengrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`), then run `xargs ... sg run` against that file list. Only use path-heuristic fallback if opengrep scope is unavailable.
 - Dynamic: Run the application and test live to validate exploitability
 - NEVER rely solely on static code analysis when dynamic validation is possible
 - Begin with fast source triage and dynamic run preparation in parallel; use static findings to prioritize live testing.
@@ -188,7 +188,7 @@ EFFICIENCY TACTICS:
 - For Caido proxy automation inside Python, explicitly import from
   `caido_api`:
   `from caido_api import list_requests, view_request, repeat_request, list_sitemap, view_sitemap_entry, scope_rules`
-- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, nuclei, wapiti, arjun, httpx, katana, semgrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
+- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, nuclei, wapiti, arjun, httpx, katana, opengrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
 - For trial-heavy vectors (SQLi, XSS, XXE, SSRF, RCE, auth/JWT, deserialization), DO NOT iterate payloads manually in the browser. Always spray payloads via Python scripts through `exec_command` or terminal tools.
 - When using established fuzzers/scanners, use the proxy for inspection where helpful
 - Generate/adapt large payload corpora: combine encodings (URL, unicode, base64), comment styles, wrappers, time-based/differential probes. Expand with wordlists/templates
@@ -458,7 +458,7 @@ JAVASCRIPT ANALYSIS:
 - js-beautify - JS beautifier/deobfuscator
 
 CODE ANALYSIS:
-- semgrep - Static analysis/SAST
+- opengrep - Static analysis/SAST (bundled rules in /opt/opengrep-rules)
 - ast-grep (sg) - Structural AST/CST-aware code search
 - tree-sitter - Syntax-aware parsing and symbol extraction support
 - bandit - Python security linter

strix/config/models.py

@@ -713,7 +713,7 @@ def configure_sdk_model_defaults(settings: Settings) -> None:
     if codex.subscription_model(llm.model):
         return
     _configure_litellm_compatibility()
-    _configure_openrouter_attribution(llm.model)
+    _configure_attribution(llm.model)
     if llm.api_key:
         set_default_openai_key(llm.api_key, use_for_tracing=False)
         _configure_litellm_default("api_key", llm.api_key)
@@ -884,9 +884,13 @@ def _openrouter_error_type(error: object) -> object:
     return None
 
 
-OPENROUTER_ATTRIBUTION_HEADERS = {
+APP_ATTRIBUTION_HEADERS = {
     "HTTP-Referer": "https://strix.ai",
     "X-Title": "Strix",
+}
+
+OPENROUTER_ATTRIBUTION_HEADERS = {
+    **APP_ATTRIBUTION_HEADERS,
     "X-OpenRouter-Categories": "cli-agent",
 }
 
@@ -895,20 +899,25 @@ def is_openrouter_model(model_name: str | None) -> bool:
     return bool(model_name) and "openrouter/" in (model_name or "").strip().lower()
 
 
-def _configure_openrouter_attribution(model_name: str | None) -> None:
+def is_vercel_ai_gateway_model(model_name: str | None) -> bool:
+    return (model_name or "").strip().lower().startswith("vercel_ai_gateway/")
+
+
+def attribution_headers(model_name: str | None) -> dict[str, str]:
+    if is_openrouter_model(model_name):
+        return OPENROUTER_ATTRIBUTION_HEADERS
+    if is_vercel_ai_gateway_model(model_name):
+        return APP_ATTRIBUTION_HEADERS
+    return {}
+
+
+def _configure_attribution(model_name: str | None) -> None:
     import litellm
 
     current: object = litellm.headers
     existing: dict[str, str] = current if isinstance(current, dict) else {}
-    if not is_openrouter_model(model_name):
-        if any(key in existing for key in OPENROUTER_ATTRIBUTION_HEADERS):
-            remaining = {
-                k: v for k, v in existing.items() if k not in OPENROUTER_ATTRIBUTION_HEADERS
-            }
-            litellm.headers = remaining or None  # type: ignore[assignment]
-        return
-
-    litellm.headers = {**existing, **OPENROUTER_ATTRIBUTION_HEADERS}  # type: ignore[assignment]
+    remaining = {k: v for k, v in existing.items() if k not in OPENROUTER_ATTRIBUTION_HEADERS}
+    litellm.headers = {**remaining, **attribution_headers(model_name)} or None  # type: ignore[assignment]
 
 
 def _configure_extra_headers(llm: LlmSettings) -> None:

strix/config/settings.py

@@ -61,6 +61,15 @@ class LlmSettings(BaseSettings):
         repr=False,
     )
     reasoning_effort: ReasoningEffort = Field(default="high", alias="STRIX_REASONING_EFFORT")
+    input_cost_per_mtok: float | None = Field(
+        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_INPUT_COST_PER_MTOK"
+    )
+    output_cost_per_mtok: float | None = Field(
+        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_OUTPUT_COST_PER_MTOK"
+    )
+    cached_input_cost_per_mtok: float | None = Field(
+        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_CACHED_INPUT_COST_PER_MTOK"
+    )
     force_required_tool_choice: bool = Field(
         default=False,
         alias="STRIX_FORCE_REQUIRED_TOOL_CHOICE",
@@ -155,7 +164,7 @@ class RuntimeSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
     image: str = Field(
-        default="ghcr.io/usestrix/strix-sandbox:1.3.0",
+        default="ghcr.io/usestrix/strix-sandbox:1.4.0",
         alias="STRIX_IMAGE",
     )
     backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND")

strix/core/inputs.py

@@ -10,12 +10,11 @@ from openai.types.shared import Reasoning
 
 from strix.config.models import (
     DEFAULT_MODEL_RETRY,
-    OPENROUTER_ATTRIBUTION_HEADERS,
+    attribution_headers,
     bedrock_route_supports_prompt_caching,
     is_bedrock_route,
     is_claude_model,
     is_known_openai_bare_model,
-    is_openrouter_model,
     model_supports_reasoning,
     request_timeout_extra_args,
     routes_through_litellm,
@@ -287,9 +286,7 @@ def make_model_settings(
 def _request_headers(
     model_name: str, extra_headers: dict[str, str] | None
 ) -> dict[str, str] | None:
-    headers: dict[str, str] = {}
-    if is_openrouter_model(model_name):
-        headers.update(OPENROUTER_ATTRIBUTION_HEADERS)
+    headers: dict[str, str] = dict(attribution_headers(model_name))
     if extra_headers:
         headers.update(extra_headers)
     return headers or None

strix/core/runner.py

@@ -181,7 +181,7 @@ def _compose_root_instructions_override(
     supports_images: bool,
     report_tool: str,
     coverage_tools: bool,
-    replace_scan_prompt: bool,
+    replace_scan_prompt: bool = False,
 ) -> str | None:
     if root_instructions_override is None:
         return None

strix/report/dedupe.py

@@ -300,7 +300,15 @@ def _parse_dedupe_response(content: str) -> dict[str, Any]:
         raise ValueError(f"No JSON object found in dedupe response: {content[:500]}")
     parsed = json.loads(text[start : end + 1])
 
-    duplicate_id = str(parsed.get("duplicate_id") or "")[:64]
+    is_duplicate = parsed.get("is_duplicate")
+    if not isinstance(is_duplicate, bool):
+        raise TypeError("is_duplicate must be a boolean")
+    duplicate_id = parsed.get("duplicate_id") or ""
+    if is_duplicate and (not isinstance(duplicate_id, str) or not duplicate_id):
+        raise ValueError("A duplicate decision must name an existing report ID")
+    # Keep the ID verbatim: truncating or stripping it could turn an unknown ID
+    # into a different, existing one before the membership check below.
+    duplicate_id = str(duplicate_id)
     reason = str(parsed.get("reason") or "")[:500]
     try:
         confidence = float(parsed.get("confidence", 0.0))
@@ -308,13 +316,22 @@ def _parse_dedupe_response(content: str) -> dict[str, Any]:
         confidence = 0.0
 
     return {
-        "is_duplicate": bool(parsed.get("is_duplicate", False)),
+        "is_duplicate": is_duplicate,
         "duplicate_id": duplicate_id,
         "confidence": confidence,
         "reason": reason,
     }
 
 
+def _validate_duplicate_reference(
+    result: dict[str, Any], existing_reports: list[dict[str, Any]]
+) -> None:
+    if result["is_duplicate"] and not any(
+        report.get("id") == result["duplicate_id"] for report in existing_reports
+    ):
+        raise ValueError("Duplicate decision refers to an unknown report ID")
+
+
 def _extract_text(response: ModelResponse) -> str:
     parts: list[str] = []
     for item in response.output:
@@ -397,6 +414,7 @@ async def check_duplicate(
             }
 
         result = _parse_dedupe_response(content)
+        _validate_duplicate_reference(result, existing_reports)
 
         logger.info(
             "Deduplication check: is_duplicate=%s, confidence=%.2f, reason=%s",

strix/report/usage.py

@@ -8,11 +8,38 @@ from typing import Any
 from agents.usage import Usage, deserialize_usage, serialize_usage
 from pydantic import BaseModel, TypeAdapter, ValidationError
 
+from strix.config.loader import load_settings
 from strix.report.pricing import resolve_litellm_model
 
 
 logger = logging.getLogger(__name__)
 
+Prices = tuple[float | None, float | None, float | None]
+
+
+def _configured_prices() -> tuple[str | None, Prices | None]:
+    llm = load_settings().llm
+    prices = (llm.input_cost_per_mtok, llm.output_cost_per_mtok, llm.cached_input_cost_per_mtok)
+    if all(price is None for price in prices):
+        return None, None
+    return (llm.model or "").strip() or None, prices
+
+
+def _configured_usage_cost(usage: Usage, prices: Prices) -> float:
+    input_rate, output_rate, cached_rate = prices
+    input_tokens = max(0, _int_or_zero(getattr(usage, "input_tokens", 0)))
+    cached_details = getattr(usage, "input_tokens_details", None)
+    cached_tokens = max(0, _int_or_zero(getattr(cached_details, "cached_tokens", 0)))
+    cached_tokens = min(cached_tokens, input_tokens)
+    output_tokens = max(0, _int_or_zero(getattr(usage, "output_tokens", 0)))
+    billable_input = input_tokens - cached_tokens
+    cost = (
+        billable_input * (input_rate or 0)
+        + cached_tokens * (cached_rate if cached_rate is not None else input_rate or 0)
+        + output_tokens * (output_rate or 0)
+    ) / 1_000_000
+    return _round_cost(cost)
+
 
 class ProviderUsage(BaseModel):
     """Running totals for one upstream provider OpenRouter routed calls to."""
@@ -37,6 +64,7 @@ class LLMUsageLedger:
         self._total_usage = Usage()
         self._agent_usage: dict[str, Usage] = {}
         self._agent_metadata: dict[str, dict[str, str]] = {}
+        self._agent_estimated_cost: dict[str, float] = {}
         self._observed_cost = 0.0
         self._estimated_cost = 0.0
         self._has_observed_cost = False
@@ -73,6 +101,9 @@ class LLMUsageLedger:
             estimated = _estimate_litellm_cost(usage, model)
             if estimated:
                 self._estimated_cost += estimated
+                self._agent_estimated_cost[normalized_agent_id] = (
+                    self._agent_estimated_cost.get(normalized_agent_id, 0.0) + estimated
+                )
 
         return True
 
@@ -114,11 +145,23 @@ class LLMUsageLedger:
     def total_cost(self) -> float:
         if self.zero_cost:
             return 0.0
+        model, prices = _configured_prices()
+        if prices is not None:
+            return _round_cost(
+                sum(self._configured_agent_cost(aid, model, prices) for aid in self._agent_usage)
+            )
         return _round_cost(self._observed_cost if self._has_observed_cost else self._estimated_cost)
 
+    def _configured_agent_cost(self, agent_id: str, model: str | None, prices: Prices) -> float:
+        if self._agent_metadata.get(agent_id, {}).get("model") == model:
+            return _configured_usage_cost(self._agent_usage[agent_id], prices)
+        return self._agent_estimated_cost.get(agent_id, 0.0)
+
     def to_record(self) -> dict[str, Any]:
         record = serialize_usage(self._total_usage)
-        record["cost"] = self.total_cost
+        model, prices = _configured_prices()
+        total_cost = self.total_cost
+        record["cost"] = total_cost
         record["providers"] = {name: tally.model_dump() for name, tally in self._providers.items()}
         record["agents"] = []
 
@@ -128,7 +171,11 @@ class LLMUsageLedger:
             usage = self._agent_usage[agent_id]
             metadata = self._agent_metadata.get(agent_id, {})
             agent_cost = (
-                self.total_cost * (agent_tokens[agent_id] / total_tokens) if total_tokens else 0.0
+                self._configured_agent_cost(agent_id, model, prices)
+                if prices is not None and not self.zero_cost
+                else total_cost * (agent_tokens[agent_id] / total_tokens)
+                if total_tokens
+                else 0.0
             )
 
             agent_record = serialize_usage(usage)
@@ -148,6 +195,7 @@ class LLMUsageLedger:
         self._total_usage = Usage()
         self._agent_usage.clear()
         self._agent_metadata.clear()
+        self._agent_estimated_cost.clear()
         self._observed_cost = 0.0
         self._estimated_cost = 0.0
         self._has_observed_cost = False
@@ -183,6 +231,7 @@ class LLMUsageLedger:
                 logger.exception("Failed to hydrate llm_usage for agent %s", agent_id)
                 self._agent_usage[agent_id] = Usage()
 
+            self._agent_estimated_cost[agent_id] = _float_or_zero(raw_agent.get("cost"))
             metadata: dict[str, str] = {}
             agent_name = raw_agent.get("agent_name")
             model = raw_agent.get("model")

strix/skills/README.md

@@ -40,7 +40,7 @@ The skills are dynamically injected into the agent's system prompt, allowing it
 
 Notable source-aware skills:
 - `source_aware_whitebox` (coordination): white-box orchestration playbook
-- `source_aware_sast` (custom): semgrep/AST/secrets/supply-chain static triage workflow
+- `source_aware_sast` (custom): opengrep/AST/secrets/supply-chain static triage workflow
 - `dependency_cve_scanning` (custom): trivy-based SCA workflow for reporting known dependency CVEs via `create_dependency_report`
 - `npx_confusion` (custom): npx/npm exec/bunx fallback and adjacent package-runner identity confusion, with runner-specific registry and reporting gates
 - `semantic_confusion` (vulnerabilities): cross-boundary parser, normalization, and representation mismatch analysis

strix/skills/coordination/root_agent.md

@@ -58,6 +58,13 @@ Structure agents by function:
 - Business logic flaws
 - Infrastructure vulnerabilities
 
+**Sensitive Browser Confirmations**
+- For every browser workflow containing a security-sensitive or consequential user action—whether authenticated or unauthenticated—assign `browser_security` to the agent testing that workflow or create a dedicated UI-redressing agent. This includes actions that change protected state, grant authority, submit credentials, expose sensitive data, or cross a trust boundary.
+- Its task must cover both iframe and cross-window/DoubleClickjacking paths; framing protections close only iframe coverage.
+- A workflow crossing origins or ports remains eligible when every involved origin is an explicit scan target. Same-origin policy blocks DOM reads, not top-level navigation, popups, opener relationships, focus changes, or window closing; cross-origin separation alone does not close UI-redressing coverage.
+- Never expand authorization from a link alone. If a required origin is not an explicit target, leave the path `needs_follow_up` and do not claim clickjacking or the related workflow is cleared; scope expansion must come from scan configuration.
+- Before accepting `no_issue_found` or `ruled_out` for cross-window UI redressing, reject closure evidence that cites popup-as-tab behavior, ignored geometry, unavailable OS-level input, or only a manual control click; keep the exact two-click path `needs_follow_up`. A successfully executed protected consent, approval, or grant must be impact-calibrated, not dismissed because it is idempotent, pre-seeded, or issues no immediate token or data.
+
 **Exploitation and Validation**
 - Proof-of-concept development
 - Impact demonstration

strix/skills/coordination/source_aware_whitebox.md

@@ -14,22 +14,22 @@ Increase white-box coverage by combining source-aware triage with dynamic valida
 ## Recommended Workflow
 
 1. Build a quick source map before deep exploitation, including at least one AST-structural pass (`sg` or `tree-sitter`) scoped to relevant paths.
-   - For `sg` baseline, derive `sg-targets.txt` from `semgrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`) and run `xargs ... sg run` on that list.
-   - Only fall back to path heuristics when semgrep scope is unavailable.
+   - For `sg` baseline, derive `sg-targets.txt` from `opengrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`) and run `xargs ... sg run` on that list.
+   - Only fall back to path heuristics when opengrep scope is unavailable.
 2. Run first-pass static triage to rank high-risk paths.
 3. Use triage outputs to prioritize dynamic PoC validation.
 4. Keep findings evidence-driven: no report without validation.
 
 ## Source-Aware Triage Stack
 
-- `semgrep`: fast security-first triage and custom pattern scans
+- `opengrep`: fast security-first triage and custom pattern scans
 - `ast-grep` (`sg`): structural pattern hunting and targeted repo mapping
 - `tree-sitter`: syntax-aware parsing support for symbol and route extraction
 - `gitleaks` + `trufflehog`: complementary secret detection (working tree and history coverage)
 - `trivy fs`: dependency, misconfiguration, license, and secret checks
 
 Coverage target per repository:
-- one `semgrep` pass
+- one `opengrep` pass
 - one AST structural pass (`sg` and/or `tree-sitter`)
 - one secrets pass (`gitleaks` and/or `trufflehog`)
 - one `trivy fs` pass

strix/skills/custom/source_aware_sast.md

@@ -1,6 +1,6 @@
 ---
 name: source-aware-sast
-description: Practical source-aware SAST and AST playbook for semgrep, ast-grep, gitleaks, and trivy fs
+description: Practical source-aware SAST and AST playbook for opengrep, ast-grep, gitleaks, and trivy fs
 ---
 
 # Source-Aware SAST Playbook
@@ -23,19 +23,19 @@ Run this baseline once per repository before deep narrowing:
 ART=/workspace/.source-aware
 mkdir -p "$ART"
 
-semgrep scan --config p/default --config p/golang --config p/secrets \
-  --metrics=off --json --output "$ART/semgrep.json" .
-# Build deterministic AST targets from semgrep scope (no hardcoded path guessing)
+opengrep scan --config /opt/opengrep-rules --taint-intrafile \
+  --json --output "$ART/opengrep.json" .
+# Build deterministic AST targets from opengrep scope (no hardcoded path guessing)
 python3 - <<'PY'
 import json
 from pathlib import Path
 
 art = Path("/workspace/.source-aware")
-semgrep_json = art / "semgrep.json"
+opengrep_json = art / "opengrep.json"
 targets_file = art / "sg-targets.txt"
 
 try:
-    data = json.loads(semgrep_json.read_text(encoding="utf-8"))
+    data = json.loads(opengrep_json.read_text(encoding="utf-8"))
 except Exception:
     targets_file.write_text("", encoding="utf-8")
     raise
@@ -63,17 +63,18 @@ trivy fs --scanners vuln,misconfig --timeout 30m --offline-scan \
   --format json --output "$ART/trivy-fs.json" . || true
 ```
 
-## Semgrep First Pass
+## Opengrep First Pass
 
-Use Semgrep as the default static triage pass:
+Use Opengrep as the default static triage pass. Rules are bundled offline in `/opt/opengrep-rules` (one directory per language, plus `generic/secrets`):
 
 ```bash
-# Preferred deterministic profile set (works with --metrics=off)
-semgrep scan --config p/default --config p/golang --config p/secrets \
-  --metrics=off --json --output /workspace/.source-aware/semgrep.json .
+# Full bundled ruleset
+opengrep scan --config /opt/opengrep-rules --taint-intrafile \
+  --json --output /workspace/.source-aware/opengrep.json .
 
-# If you choose auto config, do not combine it with --metrics=off
-semgrep scan --config auto --json --output /workspace/.source-aware/semgrep-auto.json .
+# Narrow to the target stack when the full set is slow or noisy
+opengrep scan --config /opt/opengrep-rules/python --config /opt/opengrep-rules/generic/secrets \
+  --taint-intrafile --json --output /workspace/.source-aware/opengrep-python.json .
 ```
 
 If diff scope is active, restrict to changed files first, then expand only when needed.

strix/skills/frameworks/django.md

@@ -205,10 +205,10 @@ Jinja2 backend without autoescape: `{{7*7}}`, RCE gadgets if sandbox misconfigur
 
 ## Tooling
 
-Static analysis is the fastest way to reach the sinks above in white-box scope. The sandbox ships `python`/`pipx`, `semgrep`, `bandit`, `ast-grep`, and `ripgrep`.
+Static analysis is the fastest way to reach the sinks above in white-box scope. The sandbox ships `python`/`pipx`, `opengrep`, `bandit`, `ast-grep`, and `ripgrep`.
 
 - **bandit** (preinstalled) — Python security linter; flags `mark_safe`, `extra()`, `RawSQL`, `subprocess`, weak crypto, hardcoded secrets: `bandit -r . -ll`
-- **semgrep** (preinstalled) with the Django ruleset — higher-signal than bandit for framework-specific bugs (`.extra()`, `RawSQL`, `|safe`, `csrf_exempt`, `ALLOWED_HOSTS=['*']`): `semgrep --config p/django .`
+- **opengrep** (preinstalled) with the bundled Django rules — higher-signal than bandit for framework-specific bugs (`.extra()`, `RawSQL`, `|safe`, `csrf_exempt`, `ALLOWED_HOSTS=['*']`): `opengrep scan --config /opt/opengrep-rules/python/django .`
 - **pip-audit** (PyPA) — dependency CVE scanner for known-vuln Django/DRF/simplejwt versions: `pipx install pip-audit && pip-audit -r requirements.txt`
 - **ast-grep** (preinstalled) — quick structural grep for risky calls without a full SAST run: `ast-grep run -p 'mark_safe($X)' -l python`
 

strix/skills/scan_modes/deep.md

@@ -15,7 +15,7 @@ Thorough understanding before exploitation. Test every parameter, every endpoint
 
 **Whitebox (source available)**
 - Map every file, module, and code path in the repository
-- Start with broad source-aware triage (`semgrep`, `ast-grep`, `gitleaks`, `trufflehog`, `trivy fs`) and use outputs to drive deep review
+- Start with broad source-aware triage (`opengrep`, `ast-grep`, `gitleaks`, `trufflehog`, `trivy fs`) and use outputs to drive deep review
 - Execute at least one structural AST pass (`sg` and/or Tree-sitter) per repository and store artifacts for reuse
 - Keep AST artifacts bounded and query-driven (target relevant paths/sinks first; avoid whole-repo generic function dumps)
 - Use syntax-aware parsing (Tree-sitter tooling) to improve symbol, route, and sink extraction quality

strix/skills/scan_modes/quick.md

@@ -15,7 +15,7 @@ Optimize for fast feedback on critical security issues. Skip exhaustive enumerat
 
 **Whitebox (source available)**
 - Focus on recent changes: git diffs, new commits, modified files—these are most likely to contain fresh bugs
-- Run a fast static triage on changed files first (`semgrep`, then targeted `sg` queries)
+- Run a fast static triage on changed files first (`opengrep`, then targeted `sg` queries)
 - Run at least one lightweight AST pass (`sg` or Tree-sitter) so structural mapping is not skipped
 - Keep AST commands tightly scoped to changed or high-risk paths; avoid broad repository-wide pattern dumps
 - Run quick secret and dependency checks (`gitleaks`, `trufflehog`, `trivy fs`) scoped to changed areas when possible

strix/skills/scan_modes/standard.md

@@ -15,7 +15,7 @@ Systematic testing across the full attack surface. Understand the application be
 
 **Whitebox (source available)**
 - Map codebase structure: modules, entry points, routing
-- Run `semgrep` first-pass triage to prioritize risky flows before deep manual review
+- Run `opengrep` first-pass triage to prioritize risky flows before deep manual review
 - Run at least one AST-structural mapping pass (`sg` and/or Tree-sitter), then use outputs for route, sink, and trust-boundary mapping
 - Keep AST output bounded to relevant paths and hypotheses; avoid whole-repo generic function dumps
 - Identify architecture pattern (MVC, microservices, monolith)

strix/skills/tooling/opengrep.md

@@ -0,0 +1,69 @@
+---
+name: opengrep
+description: Exact Opengrep CLI structure, bundled offline rules, scoped rule selection, taint mode, and automation-safe output patterns.
+---
+
+# Opengrep CLI Playbook
+
+Official docs:
+- https://github.com/opengrep/opengrep
+- https://github.com/opengrep/opengrep-rules
+
+Canonical syntax:
+`opengrep scan [flags] [targets]`
+
+Bundled rules:
+- `/opt/opengrep-rules` holds the full ruleset, one directory per language (`python`, `javascript`, `typescript`, `go`, `java`, `php`, `ruby`, …) plus `generic/secrets`, `dockerfile`, `terraform`, `yaml`, and `strix` (Strix-authored rules, e.g. GitHub-owned actions not pinned to a commit SHA)
+- Framework rules sit under the language (`python/django`, `python/flask`, `javascript/express`, …)
+
+High-signal flags:
+- `--config <path>` rule file or directory; repeat for several
+- `--taint-intrafile` intra-file inter-procedural taint (follows data across functions in one file)
+- `--json` / `--sarif` output format
+- `--output <file>` write findings to file
+- `--severity <level>` filter by severity (`INFO`, `WARNING`, `ERROR`)
+- `--error` return non-zero exit when findings exist
+- `--quiet` suppress progress noise
+- `--jobs <n>` parallel workers
+- `--timeout <seconds>` per-rule, per-file timeout
+- `--exclude <pattern>` / `--include <pattern>` path filters
+- `--exclude-rule <rule_id>` suppress specific rule
+- `--baseline-commit <sha>` only report findings introduced after baseline
+
+Agent-safe baseline for automation:
+`opengrep scan --config /opt/opengrep-rules --taint-intrafile --json --output opengrep.json --quiet --jobs 4 --timeout 20 /workspace`
+
+Common patterns:
+- Full bundled scan:
+  `opengrep scan --config /opt/opengrep-rules --json --output opengrep.json --quiet /workspace`
+- High-severity focused pass:
+  `opengrep scan --config /opt/opengrep-rules --severity ERROR --json --output opengrep_high.json --quiet /workspace`
+- SARIF output:
+  `opengrep scan --config /opt/opengrep-rules --sarif --output opengrep.sarif --quiet /workspace`
+- Language- or framework-specific rules:
+  `opengrep scan --config /opt/opengrep-rules/python --config /opt/opengrep-rules/generic/secrets --json --output opengrep_python.json --quiet /workspace`
+- Scoped directory scan:
+  `opengrep scan --config /opt/opengrep-rules --json --output opengrep_api.json --quiet /workspace/services/api`
+- Custom rule:
+  `opengrep scan --config ./rules/my-rule.yaml --json --output opengrep_custom.json --quiet /workspace`
+
+Critical correctness rules:
+- Always provide an explicit `--config` from `/opt/opengrep-rules` or a local rule file. Registry shorthands (`p/...`, `auto`) fetch rules from the network; do not use them.
+- Opengrep has no telemetry; there is no `--metrics` flag, and passing one fails the scan.
+- Prefer `--json --output <file>` or `--sarif --output <file>` for machine-readable downstream processing. JSON keeps `paths.scanned` and `results[].path`.
+- Keep the target path explicit; use an absolute or clearly scoped workspace path instead of `.` when possible.
+
+Usage rules:
+- Start with the full `/opt/opengrep-rules` set unless the task clearly calls for a narrower language or framework directory.
+- Add `--taint-intrafile` for injection-class hunting (SQLi, command injection, SSRF, path traversal) in supported languages.
+- Use `--quiet` in automation to reduce noisy logs.
+- Use `--jobs` and `--timeout` explicitly for reproducible runtime behavior.
+- `PartialParsing` errors on templates are normal; they do not invalidate the run.
+
+Failure recovery:
+- If scans are too slow, narrow the target path and the rule directories before changing engine settings.
+- If scans time out, increase `--timeout` modestly or lower `--jobs`.
+- If output is too broad, scope `--config`, add `--severity`, or exclude known irrelevant paths.
+
+If uncertain, query web_search with:
+`site:github.com/opengrep/opengrep <flag>`

strix/skills/tooling/semgrep.md

@@ -1,72 +0,0 @@
----
-name: semgrep
-description: Exact Semgrep CLI structure, metrics-off scanning, scoped ruleset selection, and automation-safe output patterns.
----
-
-# Semgrep CLI Playbook
-
-Official docs:
-- https://semgrep.dev/docs/cli-reference
-- https://semgrep.dev/docs/getting-started/cli
-- https://semgrep.dev/docs/semgrep-code/semgrep-pro-engine-intro
-
-Canonical syntax:
-`semgrep scan [flags]`
-
-High-signal flags:
-- `--config <rule_or_ruleset>` ruleset, registry pack, local rule file, or directory
-- `--metrics=off` disable telemetry and metrics reporting
-- `--json` JSON output
-- `--sarif` SARIF output
-- `--output <file>` write findings to file
-- `--severity <level>` filter by severity
-- `--error` return non-zero exit when findings exist
-- `--quiet` suppress progress noise
-- `--jobs <n>` parallel workers
-- `--timeout <seconds>` per-file timeout
-- `--exclude <pattern>` exclude path pattern
-- `--include <pattern>` include path pattern
-- `--exclude-rule <rule_id>` suppress specific rule
-- `--baseline-commit <sha>` only report findings introduced after baseline
-- `--pro` enable Pro engine if available
-- `--oss-only` force OSS engine only
-
-Agent-safe baseline for automation:
-`semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet --jobs 4 --timeout 20 /workspace`
-
-Common patterns:
-- Default security scan:
-  `semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet /workspace`
-- High-severity focused pass:
-  `semgrep scan --config p/default --severity ERROR --metrics=off --json --output semgrep_high.json --quiet /workspace`
-- OWASP-oriented scan:
-  `semgrep scan --config p/owasp-top-ten --metrics=off --sarif --output semgrep.sarif --quiet /workspace`
-- Language- or framework-specific rules:
-  `semgrep scan --config p/python --config p/secrets --metrics=off --json --output semgrep_python.json --quiet /workspace`
-- Scoped directory scan:
-  `semgrep scan --config p/default --metrics=off --json --output semgrep_api.json --quiet /workspace/services/api`
-- Pro engine check or run:
-  `semgrep scan --config p/default --pro --metrics=off --json --output semgrep_pro.json --quiet /workspace`
-
-Critical correctness rules:
-- Always include `--metrics=off`; Semgrep sends telemetry by default.
-- Always provide an explicit `--config`; do not rely on vague or implied defaults.
-- Prefer `--json --output <file>` or `--sarif --output <file>` for machine-readable downstream processing.
-- Keep the target path explicit; use an absolute or clearly scoped workspace path instead of `.` when possible.
-- If Pro availability matters, check it explicitly with a bounded command before assuming cross-file analysis exists.
-
-Usage rules:
-- Start with `p/default` unless the task clearly calls for a narrower pack.
-- Add focused packs such as `p/secrets`, `p/python`, or `p/javascript` only when they match the target stack.
-- Use `--quiet` in automation to reduce noisy logs.
-- Use `--jobs` and `--timeout` explicitly for reproducible runtime behavior.
-- Do not use `-h`/`--help` for routine operation unless absolutely necessary.
-
-Failure recovery:
-- If scans are too slow, narrow the target path and reduce the active rulesets before changing engine settings.
-- If scans time out, increase `--timeout` modestly or lower `--jobs`.
-- If output is too broad, scope `--config`, add `--severity`, or exclude known irrelevant paths.
-- If Pro mode fails, rerun with `--oss-only` or without `--pro` and note the loss of cross-file coverage.
-
-If uncertain, query web_search with:
-`site:semgrep.dev semgrep <flag> cli`

strix/skills/vulnerabilities/browser_security.md

@@ -1,6 +1,6 @@
 ---
 name: browser-security
-description: Browser-internals security testing for browsing-context relationships, postMessage, client-side path traversal, XS-Leaks, service workers, Web Workers, navigation behavior, CSP interactions, caches, and cross-origin state machines
+description: Browser-internals security testing for clickjacking, UI redressing, DoubleClickjacking, browsing-context relationships, postMessage, client-side path traversal, XS-Leaks, service workers, Web Workers, navigation behavior, CSP interactions, caches, and cross-origin state machines
 ---
 
 # Browser Security
@@ -43,6 +43,15 @@ Draw the context graph. Security checks on `event.origin`, `event.source`, or a
 - Check whether a blocked intermediate frame leaves a useful browsing-context relationship intact.
 - Use random per-flow names or `_blank` with `noopener` where an opener relationship is unnecessary.
 
+### Clickjacking and UI Redressing
+
+- **UI-redressing closure gate:** Never mark clickjacking as ruled out from `X-Frame-Options` or CSP `frame-ancestors` alone. Before closure, test both frame embedding and cross-window/popup retargeting.
+- Do not treat a different origin or port as protection against UI redressing. Same-origin policy blocks DOM access, not top-level navigation, `window.open()`, opener relationships, focus changes, or window closing. Test only explicitly authorized targets; if a required origin is outside scope, keep the path `needs_follow_up` and do not claim the vulnerability class is cleared.
+- For framed cases, prove the overlay and sensitive click. For DoubleClickjacking, use two real browser clicks and trace click 1 → window/focus/navigation/positioning change → click 2 → sensitive control. Never substitute scripted `.click()` calls.
+- Reproduce in the victim state required by the workflow—authenticated when necessary—with realistic user activation and stable geometry; capture window bounds and timing.
+- **Evidence-limited closure:** Verify a repeatable sensitive server-side state change with a recording or deterministic event trace and a negative control. If the exact sequence cannot be tested, record `needs_follow_up`, not `ruled_out` or `no_issue_found`. Popup-as-tab behavior, ignored geometry, unavailable OS-level input, or a manual control click are not counterevidence. Close the path only when a named mitigation blocks it, or when geometry is honored and both physical clicks are delivered without a sensitive action.
+- **Impact floor:** Successful execution of a protected consent, approval, or grant is an integrity impact even when idempotent, pre-seeded, or followed by no immediate token or data access. Use downstream capability to calibrate severity, not erase the demonstrated protected action.
+
 ### Client-Side Path Traversal
 
 Trace the complete source-to-request pipeline:
@@ -146,7 +155,7 @@ Also inspect DevTools network initiators, service workers, storage, CSP violatio
 
 ### Source Review
 
-- Search for `postMessage`, message listeners, `window.open`, named targets, opener/parent access, frame creation, and sandbox attributes.
+- Search for `postMessage`, message listeners, `window.open`, named targets, opener/parent access, frame creation, `dblclick`, `mousedown`/`mouseup`, focus/blur, move/resize, navigation handlers, and sandbox attributes.
 - Search for router parameter APIs flowing into `fetch`, Axios, navigation, or HTML rendering.
 - Search for service-worker registration, Cache API writes, worker constructors, Blob URLs, and dynamic imports.
 - Search for raw HTML sinks and trust escape hatches in every supported frontend framework.
@@ -161,7 +170,7 @@ Also inspect DevTools network initiators, service workers, storage, CSP violatio
 5. **Prove the primitive** - Data transfer, path change, state oracle, cache modification, or context capture.
 6. **Escalate deliberately** - Chain to a privileged action, sensitive disclosure, SSRF, or executable DOM sink.
 7. **Cross-browser check** - At minimum record Chromium/Firefox/Safari applicability when the primitive is browser-specific.
-8. **State interaction requirements** - Click, drag, popup permission, timing window, login state, and visual deception.
+8. **State interaction requirements** - Record each physical click or drag, popup permission state, active context, focus, geometry, navigation, timing window, login state, and visual deception.
 
 ## Validation
 
@@ -171,7 +180,7 @@ Also inspect DevTools network initiators, service workers, storage, CSP violatio
 4. For XS-Leaks, repeat randomized success/failure trials and quantify separation and noise.
 5. For workers/caches, show which later context consumes the modified data.
 6. For client-side traversal, capture the final network request and the security-relevant response/action.
-7. For interaction-dependent chains, provide a screen recording or deterministic event trace.
+7. For interaction-dependent chains, show both click targets, intermediate context changes, and the resulting sensitive state change in a recording or deterministic event trace.
 
 ## False Positives
 

tests/test_dedupe_decisions.py

@@ -0,0 +1,159 @@
+"""Only validated model decisions may suppress a finding."""
+
+from __future__ import annotations
+
+import json
+from typing import TYPE_CHECKING, Any
+from unittest.mock import AsyncMock
+
+import pytest
+from agents.items import ModelResponse
+from agents.usage import Usage
+from openai.types.responses import ResponseOutputMessage, ResponseOutputText
+
+from strix.config import loader
+from strix.report import dedupe
+from strix.report.state import ReportState, get_global_report_state, set_global_report_state
+from strix.tools.reporting.tool import _do_create
+
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+
+@pytest.fixture
+def report_state(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Iterator[ReportState]:
+    monkeypatch.chdir(tmp_path)
+    previous = get_global_report_state()
+    state = ReportState(run_name="dedupe-decisions")
+    set_global_report_state(state)
+    state.add_vulnerability_report(title="Existing finding", severity="low")
+    try:
+        yield state
+    finally:
+        set_global_report_state(previous)
+
+
+def _mock_judge(monkeypatch: pytest.MonkeyPatch, decision: dict[str, Any]) -> AsyncMock:
+    settings = loader.load_settings().model_copy(deep=True)
+    settings.llm.model = "openai/synthetic-model"
+    model = AsyncMock()
+    model.get_response.return_value = ModelResponse(
+        output=[
+            ResponseOutputMessage(
+                id="msg_synthetic",
+                type="message",
+                role="assistant",
+                status="completed",
+                content=[
+                    ResponseOutputText(
+                        type="output_text",
+                        annotations=[],
+                        text=json.dumps({"confidence": 0.95, "reason": "Synthetic", **decision}),
+                    )
+                ],
+            )
+        ],
+        usage=Usage(),
+        response_id="synthetic",
+    )
+    monkeypatch.setattr(dedupe, "load_settings", lambda: settings)
+    monkeypatch.setattr(dedupe, "configure_sdk_model_defaults", lambda _: None)
+    monkeypatch.setattr(dedupe, "resolve_dedupe_model", lambda *_: model)
+    return model
+
+
+async def _file_finding() -> dict[str, Any]:
+    return await _do_create(
+        title="New finding",
+        description="The endpoint reflects unencoded input.",
+        impact="The reflected script executes in a victim's browser.",
+        target="https://example.invalid",
+        technical_analysis="Input is interpolated into HTML without encoding.",
+        poc_description="Open the endpoint with the reflected parameter.",
+        poc_script_code="print('synthetic reproduction')",
+        remediation_steps="Encode output for its HTML context.",
+        evidence="The synthetic response contains the unencoded parameter.",
+        assumptions="A victim follows the crafted link.",
+        counterevidence="No encoding or content security policy is present.",
+        confidence="high",
+        severity_change_conditions="A strict content security policy would lower the impact.",
+        fix_effort="low",
+        cvss_breakdown={
+            "attack_vector": "N",
+            "attack_complexity": "L",
+            "privileges_required": "N",
+            "user_interaction": "R",
+            "scope": "U",
+            "confidentiality": "L",
+            "integrity": "L",
+            "availability": "N",
+        },
+        endpoint="/search",
+        method="GET",
+        cve=None,
+        cwe="CWE-79",
+        code_locations=None,
+    )
+
+
+@pytest.mark.parametrize("value", ["false", "true", 0, 1, None, [], {}])
+def test_dedupe_parser_requires_a_boolean(value: Any) -> None:
+    with pytest.raises(TypeError, match="is_duplicate"):
+        dedupe._parse_dedupe_response(json.dumps({"is_duplicate": value}))
+
+
+@pytest.mark.parametrize(
+    "decision",
+    [
+        {"is_duplicate": "false", "duplicate_id": "vuln-0001"},
+        {"is_duplicate": "true", "duplicate_id": "vuln-0001"},
+        {"is_duplicate": 1, "duplicate_id": "vuln-0001"},
+        {"is_duplicate": True, "duplicate_id": "vuln-9999"},
+        {"is_duplicate": True, "duplicate_id": ""},
+        {"is_duplicate": True, "duplicate_id": None},
+        {"is_duplicate": True, "duplicate_id": ["vuln-0001"]},
+        {"is_duplicate": True},
+    ],
+)
+async def test_invalid_dedupe_decision_does_not_suppress_finding(
+    report_state: ReportState, monkeypatch: pytest.MonkeyPatch, decision: dict[str, Any]
+) -> None:
+    model = _mock_judge(monkeypatch, decision)
+
+    result = await _file_finding()
+
+    assert result["success"] is True
+    model.get_response.assert_awaited_once()
+    saved = json.loads((report_state.get_run_dir() / "vulnerabilities.json").read_text())
+    assert [report["title"] for report in saved] == ["Existing finding", "New finding"]
+    assert (report_state.get_run_dir() / "vulnerabilities" / "vuln-0002.md").is_file()
+
+
+@pytest.mark.parametrize("is_duplicate", [False, True])
+async def test_valid_dedupe_decisions_keep_their_meaning(
+    report_state: ReportState, monkeypatch: pytest.MonkeyPatch, is_duplicate: bool
+) -> None:
+    # An extraneous ID must not turn a valid false decision into a duplicate.
+    _mock_judge(monkeypatch, {"is_duplicate": is_duplicate, "duplicate_id": "vuln-0001"})
+
+    result = await _file_finding()
+
+    assert result["success"] is not is_duplicate
+    saved = json.loads((report_state.get_run_dir() / "vulnerabilities.json").read_text())
+    assert len(saved) == (1 if is_duplicate else 2)
+    if is_duplicate:
+        assert result["duplicate_of"] == "vuln-0001"
+
+
+async def test_dedupe_id_is_matched_without_truncation(monkeypatch: pytest.MonkeyPatch) -> None:
+    existing_id = "x" * 64
+    _mock_judge(monkeypatch, {"is_duplicate": True, "duplicate_id": existing_id + "-unknown"})
+
+    result = await dedupe.check_duplicate(
+        {"title": "New finding"}, [{"id": existing_id, "title": "Existing finding"}]
+    )
+
+    assert result["is_duplicate"] is False
+    assert "error" in result

tests/test_hooks.py

@@ -2,11 +2,14 @@
 
 from __future__ import annotations
 
-from typing import Any
+from types import SimpleNamespace
+from typing import TYPE_CHECKING, Any
 from unittest.mock import MagicMock, patch
 
 import pytest
+from agents.usage import Usage
 
+from strix.config import loader
 from strix.core.agents import AgentCoordinator
 from strix.core.hooks import (
     BudgetExceededError,
@@ -15,6 +18,11 @@ from strix.core.hooks import (
     SubagentBudgetReservedError,
     recomputed_budget_flags,
 )
+from strix.report.usage import LLMUsageLedger
+
+
+if TYPE_CHECKING:
+    from pathlib import Path
 
 
 def _make_hooks(max_budget: float | None) -> ReportUsageHooks:
@@ -85,6 +93,38 @@ async def test_over_budget_raises() -> None:
         await hooks.on_llm_end(_make_context(), MagicMock(), MagicMock())
 
 
+@pytest.mark.asyncio
+async def test_manual_rates_make_unpriced_model_trip_budget(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setenv("STRIX_LLM", "test-model")
+    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "10")
+    monkeypatch.delenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", raising=False)
+    monkeypatch.delenv("STRIX_LLM_CACHED_INPUT_COST_PER_MTOK", raising=False)
+    monkeypatch.setattr(loader, "_override", tmp_path / "missing.json")
+    monkeypatch.setattr(loader, "_cached", None)
+    usage = Usage()
+    usage.requests = 1
+    usage.input_tokens = 1000
+    usage.total_tokens = 1000
+    ledger = LLMUsageLedger()
+
+    class ReportState:
+        def record_sdk_usage(self, **kwargs: Any) -> None:
+            ledger.record(**kwargs)
+
+        def get_total_llm_cost(self) -> float:
+            return ledger.total_cost
+
+    hooks = _make_hooks(0.005)
+    response: Any = SimpleNamespace(usage=usage)
+    with (
+        patch("strix.core.hooks.get_global_report_state", return_value=ReportState()),
+        pytest.raises(BudgetExceededError),
+    ):
+        await hooks.on_llm_end(_make_context(), MagicMock(), response)
+
+
 @pytest.mark.asyncio
 async def test_budget_check_uses_live_cost_accessor() -> None:
     # The check must read the live ledger, not the persisted run-record snapshot,

tests/test_inputs.py

@@ -474,6 +474,11 @@ def test_openrouter_attribution_rides_on_the_request_headers() -> None:
     }
 
 
+def test_vercel_ai_gateway_attribution_rides_on_the_request_headers() -> None:
+    headers = make_model_settings(None, model_name="vercel_ai_gateway/zai/glm-5.3").extra_headers
+    assert headers == {"HTTP-Referer": "https://strix.ai", "X-Title": "Strix"}
+
+
 def test_openrouter_attribution_absent_for_other_providers() -> None:
     assert make_model_settings(None, model_name="anthropic/claude-sonnet-4-5").extra_headers is None
 

tests/test_pricing.py

@@ -1,14 +1,50 @@
 from __future__ import annotations
 
+import json
+from typing import TYPE_CHECKING
 from unittest.mock import patch
 
 import litellm
+import pytest
 from agents.usage import Usage
+from pydantic import ValidationError
 
+from strix.config import loader
+from strix.config.settings import LlmSettings
 from strix.report.pricing import resolve_litellm_model
 from strix.report.usage import LLMUsageLedger
 
 
+if TYPE_CHECKING:
+    from pathlib import Path
+
+
+PRICE_ENV = (
+    "STRIX_LLM_INPUT_COST_PER_MTOK",
+    "STRIX_LLM_OUTPUT_COST_PER_MTOK",
+    "STRIX_LLM_CACHED_INPUT_COST_PER_MTOK",
+)
+
+
+@pytest.fixture(autouse=True)
+def _isolated_settings(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    for name in PRICE_ENV:
+        monkeypatch.delenv(name, raising=False)
+    monkeypatch.setenv("STRIX_LLM", "gateway/unpriced-model")
+    monkeypatch.setattr(loader, "_override", tmp_path / "missing.json")
+    monkeypatch.setattr(loader, "_cached", None)
+
+
+def _usage(input_tokens: int, output_tokens: int = 0, cached_tokens: int = 0) -> Usage:
+    usage = Usage()
+    usage.requests = 1
+    usage.input_tokens = input_tokens
+    usage.output_tokens = output_tokens
+    usage.total_tokens = input_tokens + output_tokens
+    usage.input_tokens_details.cached_tokens = cached_tokens
+    return usage
+
+
 def test_resolves_common_bare_model_names() -> None:
     resolve_litellm_model.cache_clear()
     assert resolve_litellm_model("deepseek-v4-flash") == "deepseek/deepseek-v4-flash"
@@ -60,6 +96,112 @@ def test_ledger_prefers_observed_cost_over_estimate() -> None:
     assert ledger.total_cost == 0.17
 
 
+def test_unpriced_model_without_manual_rates_costs_zero() -> None:
+    ledger = LLMUsageLedger()
+
+    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
+
+    assert ledger.total_cost == 0.0
+
+
+def test_manual_rates_price_usage_and_override_observed_cost(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
+    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
+    ledger = LLMUsageLedger()
+
+    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
+    ledger.record_observed_cost(0.17)
+
+    assert ledger.total_cost == 0.0036
+    assert ledger.to_record()["agents"][0]["cost"] == 0.0036
+
+
+def test_manual_rates_from_config_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    path = tmp_path / "config.json"
+    path.write_text(
+        json.dumps(
+            {
+                "env": {
+                    "STRIX_LLM_INPUT_COST_PER_MTOK": "2",
+                    "STRIX_LLM_OUTPUT_COST_PER_MTOK": "8",
+                }
+            }
+        ),
+        encoding="utf-8",
+    )
+    monkeypatch.setattr(loader, "_override", path)
+    ledger = LLMUsageLedger()
+
+    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
+
+    assert ledger.total_cost == 0.0036
+
+
+def test_manual_rates_only_price_the_configured_model(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
+    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
+    ledger = LLMUsageLedger()
+
+    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
+    with patch("litellm.completion_cost", return_value=0.42):
+        ledger.record(agent_id="dedupe", usage=_usage(500, 50), model="deepseek/deepseek-v4-flash")
+    record = ledger.to_record()
+
+    assert ledger.total_cost == 0.4236
+    assert {agent["agent_id"]: agent["cost"] for agent in record["agents"]} == {
+        "a": 0.0036,
+        "dedupe": 0.42,
+    }
+
+
+def test_cached_tokens_fall_back_to_input_rate(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "5")
+    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "7")
+    ledger = LLMUsageLedger()
+
+    ledger.record(
+        agent_id="a", usage=_usage(10, 1, cached_tokens=2), model="gateway/unpriced-model"
+    )
+
+    assert ledger.total_cost == 0.000057
+
+
+def test_hydrated_usage_uses_configured_rates_not_persisted_cost(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
+    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
+    original = LLMUsageLedger()
+    original.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
+    persisted = original.to_record()
+    persisted["cost"] = 42.0
+    persisted["agents"][0]["cost"] = 42.0
+    hydrated = LLMUsageLedger()
+
+    hydrated.hydrate(persisted)
+
+    assert hydrated.total_cost == 0.0036
+
+
+@pytest.mark.parametrize("value", ["invalid", "-1", "nan", "inf"])
+def test_invalid_manual_rate_is_rejected(value: str, monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", value)
+    with pytest.raises(ValidationError):
+        LlmSettings()
+
+
+def test_zero_cost_overrides_manual_rates(monkeypatch: pytest.MonkeyPatch) -> None:
+    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "10")
+    ledger = LLMUsageLedger()
+    ledger.zero_cost = True
+
+    ledger.record(agent_id="a", usage=_usage(1000), model="gateway/unpriced-model")
+
+    assert ledger.total_cost == 0.0
+
+
 def test_hydrated_estimate_continues_accumulating_new_estimates() -> None:
     usage = Usage()
     usage.requests = 1