refactor(runner): default replace_scan_prompt to False in _compose_root_instructions_override

.github/workflows/build-release.yml

@@ -32,7 +32,6 @@ jobs:
             wheel-platform: win_amd64
 
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 45
 
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
@@ -111,7 +110,6 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     needs: build
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     permissions:
       contents: write
 

.github/workflows/ci-package.yml

@@ -1,39 +1,48 @@
-name: Binary
+name: Package
 
 on:
-  pull_request:
-    paths:
-      - pyproject.toml
-      - uv.lock
-      - strix.spec
-      - scripts/**
-      - strix/interface/tui/**
-      - .github/actions/**
-      - .github/workflows/binary.yml
-  push:
-    branches:
-      - main
-    paths:
-      - pyproject.toml
-      - uv.lock
-      - strix.spec
-      - scripts/**
-      - strix/interface/tui/**
-      - .github/actions/**
-      - .github/workflows/binary.yml
-  workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
+  wheel:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
+        with:
+          go-version-file: strix/interface/tui/go.mod
+          cache-dependency-path: strix/interface/tui/go.sum
+      - uses: ./.github/actions/setup-python-env
+      - run: uv build --wheel
+      - name: Wheel ships the TUI sidecar and the viewer bundle
+        run: |
+          uv run --frozen python - <<'PY'
+          import glob, zipfile
+          (wheel,) = glob.glob("dist/*.whl")
+          names = zipfile.ZipFile(wheel).namelist()
+          assert "strix/bin/strix-tui" in names, names
+          assert "strix/interface/viewer/static/index.html" in names, names
+          assert not any(name.startswith("strix/interface/viewer/frontend/") for name in names)
+          assert not any(name.startswith("strix/interface/tui/cmd/") for name in names)
+          PY
+      - name: Install into a clean environment and run the CLI
+        env:
+          UV_EXCLUDE_NEWER: 5 days
+        run: |
+          uv venv --python 3.12 /tmp/strix-smoke
+          uv pip install --python /tmp/strix-smoke/bin/python dist/*.whl
+          /tmp/strix-smoke/bin/strix --version
+          /tmp/strix-smoke/bin/strix --help >/dev/null
+      - name: Vertex AI and Bedrock dependencies install with the wheel
+        run: /tmp/strix-smoke/bin/python -c "import google.auth.transport.requests, boto3"
+
   binary:
     runs-on: ubuntu-latest
-    timeout-minutes: 20
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
         with:

.github/workflows/ci-python.yml

@@ -0,0 +1,61 @@
+name: Python
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  lock:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86  # v5.4.2
+      - run: uv lock --check
+
+  ruff:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-python-env
+      - run: uv run --frozen ruff check .
+      - run: uv run --frozen ruff format --check .
+
+  mypy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-python-env
+      - run: uv run --frozen mypy strix/
+
+  bandit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-python-env
+      - run: uv run --frozen bandit -r strix/ -c pyproject.toml
+
+  pytest:
+    name: pytest (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ['3.12', '3.13', '3.14']
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/setup-python-env
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: uv run --frozen pytest -q

.github/workflows/ci-tui.yml

@@ -0,0 +1,26 @@
+name: TUI
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  go:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: strix/interface/tui
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
+        with:
+          go-version-file: strix/interface/tui/go.mod
+          cache-dependency-path: strix/interface/tui/go.sum
+      - run: test -z "$(gofmt -l .)"
+      - run: go vet ./...
+      - run: CGO_ENABLED=0 go build -trimpath -o /dev/null ./cmd/strix-tui
+      - run: go test -race ./...

.github/workflows/ci-viewer.yml

@@ -0,0 +1,27 @@
+name: Viewer
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: strix/interface/viewer/frontend
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        with:
+          node-version: '24'
+          cache: npm
+          cache-dependency-path: strix/interface/viewer/frontend/package-lock.json
+      - run: npm ci --no-audit --no-fund
+      - run: npm run build
+      - name: Committed viewer bundle matches the build
+        run: git -C "$GITHUB_WORKSPACE" diff --exit-code --stat -- strix/interface/viewer/static && test -z "$(git -C "$GITHUB_WORKSPACE" status --porcelain -- strix/interface/viewer/static)"

.github/workflows/ci-workflows.yml

@@ -1,27 +1,14 @@
 name: Workflows
 
 on:
-  pull_request:
-    paths:
-      - .github/**
-  push:
-    branches:
-      - main
-    paths:
-      - .github/**
-  workflow_dispatch:
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   actionlint:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     env:
       ACTIONLINT_VERSION: 1.7.12
       ACTIONLINT_SCRIPT_REF: 914e7df21a07ef503a81201c76d2b11c789d3fca  # v1.7.12
@@ -40,7 +27,6 @@ jobs:
 
   zizmor:
     runs-on: ubuntu-latest
-    timeout-minutes: 10
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
         with:

.github/workflows/ci.yml

@@ -15,107 +15,38 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  lint:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/setup-python-env
-      - run: uv lock --check
-      - run: uv run --frozen ruff check .
-      - run: uv run --frozen ruff format --check .
-      - run: uv run --frozen mypy strix/
-      - run: uv run --frozen bandit -r strix/ -c pyproject.toml
-
-  pytest:
-    name: pytest (${{ matrix.python-version }})
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version: ['3.12', '3.14']
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/setup-python-env
-        with:
-          python-version: ${{ matrix.python-version }}
-      - run: uv run --frozen pytest -q
+  python:
+    uses: ./.github/workflows/ci-python.yml
 
   tui:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: strix/interface/tui
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
-        with:
-          go-version-file: strix/interface/tui/go.mod
-          cache-dependency-path: strix/interface/tui/go.sum
-      - run: test -z "$(gofmt -l .)"
-      - run: go vet ./...
-      - run: CGO_ENABLED=0 go build -trimpath -o /dev/null ./cmd/strix-tui
-      - run: go test -race ./...
+    uses: ./.github/workflows/ci-tui.yml
 
   viewer:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    defaults:
-      run:
-        working-directory: strix/interface/viewer/frontend
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
-        with:
-          node-version: '24'
-          cache: npm
-          cache-dependency-path: strix/interface/viewer/frontend/package-lock.json
-      - run: npm ci --no-audit --no-fund
-      - run: npm run build
-      - name: Committed viewer bundle matches the build
-        run: git -C "$GITHUB_WORKSPACE" diff --exit-code --stat -- strix/interface/viewer/static && test -z "$(git -C "$GITHUB_WORKSPACE" status --porcelain -- strix/interface/viewer/static)"
+    uses: ./.github/workflows/ci-viewer.yml
 
-  wheel:
+  package:
+    uses: ./.github/workflows/ci-package.yml
+
+  workflows:
+    uses: ./.github/workflows/ci-workflows.yml
+
+  ci-passed:
+    name: ci-passed
+    if: always()
+    needs:
+      - python
+      - tui
+      - viewer
+      - package
+      - workflows
     runs-on: ubuntu-latest
-    timeout-minutes: 15
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00  # v6.0.0
-        with:
-          go-version-file: strix/interface/tui/go.mod
-          cache-dependency-path: strix/interface/tui/go.sum
-      - uses: ./.github/actions/setup-python-env
-      - run: uv build --wheel
-      - name: Wheel ships the TUI sidecar and the viewer bundle
-        run: |
-          uv run --frozen python - <<'PY'
-          import glob, zipfile
-          (wheel,) = glob.glob("dist/*.whl")
-          names = zipfile.ZipFile(wheel).namelist()
-          assert "strix/bin/strix-tui" in names, names
-          assert "strix/interface/viewer/static/index.html" in names, names
-          assert not any(name.startswith("strix/interface/viewer/frontend/") for name in names)
-          assert not any(name.startswith("strix/interface/tui/cmd/") for name in names)
-          PY
-      - name: Install into a clean environment and run the CLI
+      - name: Every job succeeded
         env:
-          UV_EXCLUDE_NEWER: 5 days
+          NEEDS: ${{ toJSON(needs) }}
         run: |
-          uv venv --python 3.12 /tmp/strix-smoke
-          uv pip install --python /tmp/strix-smoke/bin/python dist/*.whl
-          /tmp/strix-smoke/bin/strix --version
-          /tmp/strix-smoke/bin/strix --help >/dev/null
-      - name: Vertex AI and Bedrock dependencies install with the wheel
-        run: /tmp/strix-smoke/bin/python -c "import google.auth.transport.requests, boto3"
+          failing=$(jq -r 'to_entries[] | select(.value.result != "success") | "\(.key): \(.value.result)"' <<< "$NEEDS")
+          if [ -n "$failing" ]; then
+            echo "$failing"
+            exit 1
+          fi

.pre-commit-config.yaml

@@ -45,3 +45,23 @@ repos:
     hooks:
       - id: bandit
         args: [-c, pyproject.toml]
+
+  # Additional Python code quality checks
+  - repo: https://github.com/asottile/pyupgrade
+    rev: v3.21.2
+    hooks:
+      - id: pyupgrade
+        args: [--py312-plus]
+
+ci:
+  autofix_commit_msg: |
+    [pre-commit.ci] auto fixes from pre-commit.com hooks
+
+    for more information, see https://pre-commit.ci
+  autofix_prs: true
+  autoupdate_branch: ""
+  autoupdate_commit_msg: "[pre-commit.ci] pre-commit autoupdate"
+  autoupdate_schedule: weekly
+  # pre-commit.ci cannot run `language: system` hooks; mypy runs via `make check-all`.
+  skip: [mypy]
+  submodules: false

containers/Dockerfile

@@ -186,84 +186,20 @@ RUN set -eux; \
         aarch64|arm64) GITLEAKS_ARCH="arm64" ;; \
         *) echo "Unsupported architecture: $ARCH" >&2; exit 1 ;; \
     esac; \
-    TAG="$(curl -fsSLI -o /dev/null -w '%{url_effective}' https://github.com/gitleaks/gitleaks/releases/latest | sed 's#.*/##')"; \
+    TAG="$(curl -fsSL https://api.github.com/repos/gitleaks/gitleaks/releases/latest | jq -r .tag_name)"; \
     curl -fsSL "https://github.com/gitleaks/gitleaks/releases/download/${TAG}/gitleaks_${TAG#v}_linux_${GITLEAKS_ARCH}.tar.gz" -o /tmp/gitleaks.tgz; \
     tar -xzf /tmp/gitleaks.tgz -C /tmp; \
     install -m 0755 /tmp/gitleaks /usr/local/bin/gitleaks; \
     rm -f /tmp/gitleaks /tmp/gitleaks.tgz
 
-ARG TRIVY_VERSION=0.76.1
-ARG TRIVY_SHA256_X86=c7cbe3137fb8a48a17574bede3dd6beb16742d1e9772929940fc90082c39d9c0
-ARG TRIVY_SHA256_AARCH64=e174dff2a6dba5e3ae41f8d0537a6324405bd08132497340304c6b20e0f16a1f
-RUN set -eux; \
-    case "$(uname -m)" in \
-        x86_64) TRIVY_ARCH="64bit"; TRIVY_SHA256="${TRIVY_SHA256_X86}" ;; \
-        aarch64|arm64) TRIVY_ARCH="ARM64"; TRIVY_SHA256="${TRIVY_SHA256_AARCH64}" ;; \
-        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
-    esac; \
-    curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-${TRIVY_ARCH}.tar.gz" -o /tmp/trivy.tgz; \
-    echo "${TRIVY_SHA256}  /tmp/trivy.tgz" | sha256sum -c -; \
-    tar -xzf /tmp/trivy.tgz -C /tmp trivy; \
-    install -m 0755 /tmp/trivy /usr/local/bin/trivy; \
-    rm -f /tmp/trivy /tmp/trivy.tgz; \
-    trivy --version
+RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
 
 RUN apt-get install -y wapiti
 
-# CVE-2026-111497: out-of-bounds write in the brotli decoder, fixed in brotli
-# 1.2.1 / Debian 1.2.0-4.1. kali-rolling still ships 1.2.0-4, and node, curl and
-# python3 in this image all load the shared libbrotlidec, so every HTTP client here
-# would decode a malicious `Content-Encoding: br` response with the vulnerable
-# code. Install the fixed Debian packages until Kali picks them up.
-ARG BROTLI_DEB_VERSION=1.2.0-4.1
-RUN set -eux; \
-    ARCH="$(dpkg --print-architecture)"; \
-    for pkg in libbrotli1 python3-brotli; do \
-        curl -fsSL "https://deb.debian.org/debian/pool/main/b/brotli/${pkg}_${BROTLI_DEB_VERSION}_${ARCH}.deb" -o "/tmp/${pkg}.deb"; \
-    done; \
-    dpkg -i /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
-    rm -f /tmp/libbrotli1.deb /tmp/python3-brotli.deb; \
-    test "$(dpkg-query -W -f='${Version}' libbrotli1)" = "${BROTLI_DEB_VERSION}"; \
-    node -e 'const z=require("zlib");z.brotliDecompressSync(z.brotliCompressSync(Buffer.from("ok")))'
-
-ARG OPENGREP_VERSION=1.31.0
-ARG OPENGREP_SHA256_X86=dbbe3c2058dbe600c449a8ba22ea79a1643a6660658400090d0323a8d0d31147
-ARG OPENGREP_SHA256_AARCH64=2b713a29a00237f85408b83002fc111db5b94c7fa8d263f0a93184a960655d9d
-RUN set -eux; \
-    case "$(uname -m)" in \
-        x86_64) OPENGREP_ARCH="x86"; OPENGREP_SHA256="${OPENGREP_SHA256_X86}" ;; \
-        aarch64|arm64) OPENGREP_ARCH="aarch64"; OPENGREP_SHA256="${OPENGREP_SHA256_AARCH64}" ;; \
-        *) echo "Unsupported architecture: $(uname -m)" >&2; exit 1 ;; \
-    esac; \
-    curl -fsSL "https://github.com/opengrep/opengrep/releases/download/v${OPENGREP_VERSION}/opengrep_manylinux_${OPENGREP_ARCH}" -o /tmp/opengrep; \
-    echo "${OPENGREP_SHA256}  /tmp/opengrep" | sha256sum -c -; \
-    install -m 0755 /tmp/opengrep /usr/local/bin/opengrep; \
-    rm -f /tmp/opengrep; \
-    opengrep --version
-
-# Opengrep ships no rule registry of its own; bake the community ruleset so
-# scans run offline. Keep only rule YAML and LICENSE; drop tests, fixtures,
-# tooling, and rules marked with a proprietary license.
-ARG OPENGREP_RULES_REF=f1d2b562b414783763fd02a6ed2736eaed622efa
-RUN set -eux; \
-    mkdir -p /opt/opengrep-rules; \
-    curl -fsSL "https://codeload.github.com/opengrep/opengrep-rules/tar.gz/${OPENGREP_RULES_REF}" \
-        | tar -xz --strip-components=1 -C /opt/opengrep-rules; \
-    cd /opt/opengrep-rules; \
-    rm -rf .github scripts stats; \
-    find . -maxdepth 1 -type f ! -name LICENSE -delete; \
-    find . -mindepth 2 -type f \( ! \( -name '*.yaml' -o -name '*.yml' \) -o -name '*.test.yaml' -o -name '*.test.yml' -o -name '.*' \) -delete; \
-    grep -rlZ 'license: proprietary' . | xargs -0 -r rm -f; \
-    find . -type d -empty -delete; \
-    chmod -R a+rX /opt/opengrep-rules
-
-# Strix-authored rules that close gaps in the community ruleset.
-COPY containers/opengrep-rules/ /opt/opengrep-rules/strix/
-RUN chmod -R a+rX /opt/opengrep-rules/strix
-
 USER pentester
 
-RUN pipx install bandit
+RUN pipx install semgrep && \
+    pipx install bandit
 
 RUN npm install -g jshint
 

containers/opengrep-rules/github-owned-action-not-pinned-to-commit-sha.yaml

@@ -1,37 +0,0 @@
-rules:
-  - id: github-owned-action-not-pinned-to-commit-sha
-    patterns:
-      - pattern-inside: "{steps: ...}"
-      - pattern: |
-          uses: "$USES"
-      - metavariable-regex:
-          metavariable: $USES
-          regex: '^(actions|github)/'
-      - metavariable-pattern:
-          metavariable: $USES
-          language: generic
-          patterns:
-            - pattern-not-regex: "@[0-9a-f]{40}$"
-    message: >-
-      GitHub-owned action `$USES` is referenced by a mutable tag or branch
-      instead of a full-length commit SHA. Tags can be moved, so a compromised
-      or force-pushed release changes what this workflow runs. Pin to the
-      commit SHA of the release you reviewed and let a bot keep it current.
-    languages:
-      - yaml
-    severity: WARNING
-    metadata:
-      cwe:
-        - "CWE-1357: Reliance on Insufficiently Trustworthy Component"
-        - "CWE-353: Missing Support for Integrity Check"
-      owasp: A06:2021 - Vulnerable and Outdated Components
-      references:
-        - https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
-      category: security
-      technology:
-        - github-actions
-      subcategory:
-        - vuln
-      likelihood: LOW
-      impact: LOW
-      confidence: HIGH

docs/advanced/configuration.mdx

@@ -19,29 +19,10 @@ Configure Strix using environment variables or a config file.
   Custom API base URL. Also accepts `OPENAI_API_BASE`, `LITELLM_BASE_URL`, or `OLLAMA_API_BASE`.
 </ParamField>
 
-<ParamField path="STRIX_LLM_INPUT_COST_PER_MTOK" type="number">
-  Price per 1M input tokens in USD for `STRIX_LLM`. Use it for gateway or self-hosted model ids that LiteLLM can't price.
-</ParamField>
-
-<ParamField path="STRIX_LLM_OUTPUT_COST_PER_MTOK" type="number">
-  Price per 1M output tokens in USD for `STRIX_LLM`.
-</ParamField>
-
-<ParamField path="STRIX_LLM_CACHED_INPUT_COST_PER_MTOK" type="number">
-  Price per 1M cached input tokens in USD for `STRIX_LLM`. If unset, cached tokens use the input price.
-</ParamField>
-
-<Note>
-  Setting any of these prices replaces the provider-reported and LiteLLM cost for `STRIX_LLM` in reports and `--max-budget`. An unset input or output price counts as `0`, so set both. A separate `STRIX_DEDUPE_MODEL` keeps its LiteLLM price.
-</Note>
-
 <ParamField path="STRIX_API_TYPE" type="string">
   Select the OpenAI API path for the model: `responses` or `chat_completions`.
-  By default the model decides: Responses when LiteLLM's model catalog lists
-  `/v1/responses` for it (e.g. `gpt-5`), chat completions otherwise. A custom
-  `LLM_API_BASE` does not change this, so set `STRIX_API_TYPE=chat_completions`
-  when your gateway only serves chat completions. Applies to bare and `openai/`
-  model names. Also accepts `STRIX_FORCE_API`.
+  By default, a custom `LLM_API_BASE` uses chat completions. Set this variable
+  when your gateway requires the other API. Also accepts `STRIX_FORCE_API`.
 </ParamField>
 
 <ParamField path="LLM_EXTRA_HEADERS" type="string">
@@ -186,7 +167,7 @@ When remote vars are set, Strix dual-writes telemetry to both local JSONL and th
 
 ## Docker Configuration
 
-<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.4.0" type="string">
+<ParamField path="STRIX_IMAGE" default="ghcr.io/usestrix/strix-sandbox:1.3.0" type="string">
   Docker image to use for the sandbox container.
 </ParamField>
 

docs/tools/sandbox.mdx

@@ -49,7 +49,7 @@ Strix runs inside a Kali Linux-based Docker container with a comprehensive set o
 
 | Tool                                                    | Description                                   |
 | ------------------------------------------------------- | --------------------------------------------- |
-| [Opengrep](https://github.com/opengrep/opengrep)        | Fast SAST and custom rule matching            |
+| [Semgrep](https://github.com/semgrep/semgrep)          | Fast SAST and custom rule matching            |
 | [ast-grep](https://ast-grep.github.io)                 | Structural AST/CST-aware code search (`sg`)   |
 | [Tree-sitter](https://tree-sitter.github.io/tree-sitter/) | Syntax tree parsing and symbol extraction (Java/JS/TS/Python/Go/Bash/JSON/YAML grammars pre-configured) |
 | [Bandit](https://bandit.readthedocs.io)                | Python security linter                        |

docs/tools/terminal.mdx

@@ -33,7 +33,7 @@ sqlmap -u "https://example.com/page?id=1"
 
 ```bash
 # Fast SAST triage
-opengrep scan --config /opt/opengrep-rules ./src
+semgrep --config auto ./src
 
 # Structural AST search
 sg scan ./src

docs/usage/scan-modes.mdx

@@ -46,7 +46,7 @@ Thorough penetration testing. Best for:
 
 **Duration**: 1-4 hours depending on target complexity
 
-**White-box behavior**: Runs broad source-aware triage (`opengrep`, AST structural search, secrets, supply-chain checks) and then systematically validates top candidates dynamically.
+**White-box behavior**: Runs broad source-aware triage (`semgrep`, AST structural search, secrets, supply-chain checks) and then systematically validates top candidates dynamically.
 
 <Note>
 Deep mode is the default. It explores edge cases, chained vulnerabilities, and complex attack paths.

scripts/install.sh

@@ -4,7 +4,7 @@ set -euo pipefail
 
 APP=strix
 REPO="usestrix/strix"
-STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.4.0"
+STRIX_IMAGE="ghcr.io/usestrix/strix-sandbox:1.3.0"
 
 MUTED='\033[0;2m'
 RED='\033[0;31m'

strix/agents/prompts/system_prompt.jinja

@@ -115,11 +115,11 @@ BLACK-BOX TESTING (domain/subdomain only):
 
 WHITE-BOX TESTING (code provided):
 - MUST perform BOTH static AND dynamic analysis
-- Static: Use source-aware triage first to map risk quickly (`opengrep`, `ast-grep`, Tree-sitter tooling, `gitleaks`, `trufflehog`, `trivy fs`). Then review code for vulnerabilities
+- Static: Use source-aware triage first to map risk quickly (`semgrep`, `ast-grep`, Tree-sitter tooling, `gitleaks`, `trufflehog`, `trivy fs`). Then review code for vulnerabilities
 - Static coverage floor: execute at least one structural AST mapping pass (`sg` and/or Tree-sitter) per repository and keep artifact output
-- Static coverage target per repository: run one `opengrep` pass, one secrets pass (`gitleaks` and/or `trufflehog`), one `trivy fs` pass, and one AST-structural pass (`sg` and/or Tree-sitter)
+- Static coverage target per repository: run one `semgrep` pass, one secrets pass (`gitleaks` and/or `trufflehog`), one `trivy fs` pass, and one AST-structural pass (`sg` and/or Tree-sitter)
 - Keep AST artifacts bounded and high-signal: scope to relevant paths/hypotheses, avoid whole-repo generic function dumps
-- AST target selection rule: build `sg-targets.txt` from `opengrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`), then run `xargs ... sg run` against that file list. Only use path-heuristic fallback if opengrep scope is unavailable.
+- AST target selection rule: build `sg-targets.txt` from `semgrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`), then run `xargs ... sg run` against that file list. Only use path-heuristic fallback if semgrep scope is unavailable.
 - Dynamic: Run the application and test live to validate exploitability
 - NEVER rely solely on static code analysis when dynamic validation is possible
 - Begin with fast source triage and dynamic run preparation in parallel; use static findings to prioritize live testing.
@@ -188,7 +188,7 @@ EFFICIENCY TACTICS:
 - For Caido proxy automation inside Python, explicitly import from
   `caido_api`:
   `from caido_api import list_requests, view_request, repeat_request, list_sitemap, view_sitemap_entry, scope_rules`
-- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, nuclei, wapiti, arjun, httpx, katana, opengrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
+- Prefer established fuzzers/scanners where applicable: ffuf, sqlmap, nuclei, wapiti, arjun, httpx, katana, semgrep, bandit, trufflehog, nmap. Use scripts mainly to coordinate or validate around them, not to replace them without reason
 - For trial-heavy vectors (SQLi, XSS, XXE, SSRF, RCE, auth/JWT, deserialization), DO NOT iterate payloads manually in the browser. Always spray payloads via Python scripts through `exec_command` or terminal tools.
 - When using established fuzzers/scanners, use the proxy for inspection where helpful
 - Generate/adapt large payload corpora: combine encodings (URL, unicode, base64), comment styles, wrappers, time-based/differential probes. Expand with wordlists/templates
@@ -458,7 +458,7 @@ JAVASCRIPT ANALYSIS:
 - js-beautify - JS beautifier/deobfuscator
 
 CODE ANALYSIS:
-- opengrep - Static analysis/SAST (bundled rules in /opt/opengrep-rules)
+- semgrep - Static analysis/SAST
 - ast-grep (sg) - Structural AST/CST-aware code search
 - tree-sitter - Syntax-aware parsing and symbol extraction support
 - bandit - Python security linter

strix/config/models.py

@@ -713,7 +713,7 @@ def configure_sdk_model_defaults(settings: Settings) -> None:
     if codex.subscription_model(llm.model):
         return
     _configure_litellm_compatibility()
-    _configure_attribution(llm.model)
+    _configure_openrouter_attribution(llm.model)
     if llm.api_key:
         set_default_openai_key(llm.api_key, use_for_tracing=False)
         _configure_litellm_default("api_key", llm.api_key)
@@ -884,13 +884,9 @@ def _openrouter_error_type(error: object) -> object:
     return None
 
 
-APP_ATTRIBUTION_HEADERS = {
+OPENROUTER_ATTRIBUTION_HEADERS = {
     "HTTP-Referer": "https://strix.ai",
     "X-Title": "Strix",
-}
-
-OPENROUTER_ATTRIBUTION_HEADERS = {
-    **APP_ATTRIBUTION_HEADERS,
     "X-OpenRouter-Categories": "cli-agent",
 }
 
@@ -899,25 +895,20 @@ def is_openrouter_model(model_name: str | None) -> bool:
     return bool(model_name) and "openrouter/" in (model_name or "").strip().lower()
 
 
-def is_vercel_ai_gateway_model(model_name: str | None) -> bool:
-    return (model_name or "").strip().lower().startswith("vercel_ai_gateway/")
-
-
-def attribution_headers(model_name: str | None) -> dict[str, str]:
-    if is_openrouter_model(model_name):
-        return OPENROUTER_ATTRIBUTION_HEADERS
-    if is_vercel_ai_gateway_model(model_name):
-        return APP_ATTRIBUTION_HEADERS
-    return {}
-
-
-def _configure_attribution(model_name: str | None) -> None:
+def _configure_openrouter_attribution(model_name: str | None) -> None:
     import litellm
 
     current: object = litellm.headers
     existing: dict[str, str] = current if isinstance(current, dict) else {}
-    remaining = {k: v for k, v in existing.items() if k not in OPENROUTER_ATTRIBUTION_HEADERS}
-    litellm.headers = {**remaining, **attribution_headers(model_name)} or None  # type: ignore[assignment]
+    if not is_openrouter_model(model_name):
+        if any(key in existing for key in OPENROUTER_ATTRIBUTION_HEADERS):
+            remaining = {
+                k: v for k, v in existing.items() if k not in OPENROUTER_ATTRIBUTION_HEADERS
+            }
+            litellm.headers = remaining or None  # type: ignore[assignment]
+        return
+
+    litellm.headers = {**existing, **OPENROUTER_ATTRIBUTION_HEADERS}  # type: ignore[assignment]
 
 
 def _configure_extra_headers(llm: LlmSettings) -> None:

strix/config/settings.py

@@ -61,15 +61,6 @@ class LlmSettings(BaseSettings):
         repr=False,
     )
     reasoning_effort: ReasoningEffort = Field(default="high", alias="STRIX_REASONING_EFFORT")
-    input_cost_per_mtok: float | None = Field(
-        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_INPUT_COST_PER_MTOK"
-    )
-    output_cost_per_mtok: float | None = Field(
-        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_OUTPUT_COST_PER_MTOK"
-    )
-    cached_input_cost_per_mtok: float | None = Field(
-        default=None, ge=0, allow_inf_nan=False, alias="STRIX_LLM_CACHED_INPUT_COST_PER_MTOK"
-    )
     force_required_tool_choice: bool = Field(
         default=False,
         alias="STRIX_FORCE_REQUIRED_TOOL_CHOICE",
@@ -164,7 +155,7 @@ class RuntimeSettings(BaseSettings):
     model_config = _BASE_CONFIG
 
     image: str = Field(
-        default="ghcr.io/usestrix/strix-sandbox:1.4.0",
+        default="ghcr.io/usestrix/strix-sandbox:1.3.0",
         alias="STRIX_IMAGE",
     )
     backend: str = Field(default="docker", alias="STRIX_RUNTIME_BACKEND")

strix/core/inputs.py

@@ -10,11 +10,12 @@ from openai.types.shared import Reasoning
 
 from strix.config.models import (
     DEFAULT_MODEL_RETRY,
-    attribution_headers,
+    OPENROUTER_ATTRIBUTION_HEADERS,
     bedrock_route_supports_prompt_caching,
     is_bedrock_route,
     is_claude_model,
     is_known_openai_bare_model,
+    is_openrouter_model,
     model_supports_reasoning,
     request_timeout_extra_args,
     routes_through_litellm,
@@ -286,7 +287,9 @@ def make_model_settings(
 def _request_headers(
     model_name: str, extra_headers: dict[str, str] | None
 ) -> dict[str, str] | None:
-    headers: dict[str, str] = dict(attribution_headers(model_name))
+    headers: dict[str, str] = {}
+    if is_openrouter_model(model_name):
+        headers.update(OPENROUTER_ATTRIBUTION_HEADERS)
     if extra_headers:
         headers.update(extra_headers)
     return headers or None

strix/report/dedupe.py

@@ -300,15 +300,7 @@ def _parse_dedupe_response(content: str) -> dict[str, Any]:
         raise ValueError(f"No JSON object found in dedupe response: {content[:500]}")
     parsed = json.loads(text[start : end + 1])
 
-    is_duplicate = parsed.get("is_duplicate")
-    if not isinstance(is_duplicate, bool):
-        raise TypeError("is_duplicate must be a boolean")
-    duplicate_id = parsed.get("duplicate_id") or ""
-    if is_duplicate and (not isinstance(duplicate_id, str) or not duplicate_id):
-        raise ValueError("A duplicate decision must name an existing report ID")
-    # Keep the ID verbatim: truncating or stripping it could turn an unknown ID
-    # into a different, existing one before the membership check below.
-    duplicate_id = str(duplicate_id)
+    duplicate_id = str(parsed.get("duplicate_id") or "")[:64]
     reason = str(parsed.get("reason") or "")[:500]
     try:
         confidence = float(parsed.get("confidence", 0.0))
@@ -316,22 +308,13 @@ def _parse_dedupe_response(content: str) -> dict[str, Any]:
         confidence = 0.0
 
     return {
-        "is_duplicate": is_duplicate,
+        "is_duplicate": bool(parsed.get("is_duplicate", False)),
         "duplicate_id": duplicate_id,
         "confidence": confidence,
         "reason": reason,
     }
 
 
-def _validate_duplicate_reference(
-    result: dict[str, Any], existing_reports: list[dict[str, Any]]
-) -> None:
-    if result["is_duplicate"] and not any(
-        report.get("id") == result["duplicate_id"] for report in existing_reports
-    ):
-        raise ValueError("Duplicate decision refers to an unknown report ID")
-
-
 def _extract_text(response: ModelResponse) -> str:
     parts: list[str] = []
     for item in response.output:
@@ -414,7 +397,6 @@ async def check_duplicate(
             }
 
         result = _parse_dedupe_response(content)
-        _validate_duplicate_reference(result, existing_reports)
 
         logger.info(
             "Deduplication check: is_duplicate=%s, confidence=%.2f, reason=%s",

strix/report/usage.py

@@ -8,38 +8,11 @@ from typing import Any
 from agents.usage import Usage, deserialize_usage, serialize_usage
 from pydantic import BaseModel, TypeAdapter, ValidationError
 
-from strix.config.loader import load_settings
 from strix.report.pricing import resolve_litellm_model
 
 
 logger = logging.getLogger(__name__)
 
-Prices = tuple[float | None, float | None, float | None]
-
-
-def _configured_prices() -> tuple[str | None, Prices | None]:
-    llm = load_settings().llm
-    prices = (llm.input_cost_per_mtok, llm.output_cost_per_mtok, llm.cached_input_cost_per_mtok)
-    if all(price is None for price in prices):
-        return None, None
-    return (llm.model or "").strip() or None, prices
-
-
-def _configured_usage_cost(usage: Usage, prices: Prices) -> float:
-    input_rate, output_rate, cached_rate = prices
-    input_tokens = max(0, _int_or_zero(getattr(usage, "input_tokens", 0)))
-    cached_details = getattr(usage, "input_tokens_details", None)
-    cached_tokens = max(0, _int_or_zero(getattr(cached_details, "cached_tokens", 0)))
-    cached_tokens = min(cached_tokens, input_tokens)
-    output_tokens = max(0, _int_or_zero(getattr(usage, "output_tokens", 0)))
-    billable_input = input_tokens - cached_tokens
-    cost = (
-        billable_input * (input_rate or 0)
-        + cached_tokens * (cached_rate if cached_rate is not None else input_rate or 0)
-        + output_tokens * (output_rate or 0)
-    ) / 1_000_000
-    return _round_cost(cost)
-
 
 class ProviderUsage(BaseModel):
     """Running totals for one upstream provider OpenRouter routed calls to."""
@@ -64,7 +37,6 @@ class LLMUsageLedger:
         self._total_usage = Usage()
         self._agent_usage: dict[str, Usage] = {}
         self._agent_metadata: dict[str, dict[str, str]] = {}
-        self._agent_estimated_cost: dict[str, float] = {}
         self._observed_cost = 0.0
         self._estimated_cost = 0.0
         self._has_observed_cost = False
@@ -101,9 +73,6 @@ class LLMUsageLedger:
             estimated = _estimate_litellm_cost(usage, model)
             if estimated:
                 self._estimated_cost += estimated
-                self._agent_estimated_cost[normalized_agent_id] = (
-                    self._agent_estimated_cost.get(normalized_agent_id, 0.0) + estimated
-                )
 
         return True
 
@@ -145,23 +114,11 @@ class LLMUsageLedger:
     def total_cost(self) -> float:
         if self.zero_cost:
             return 0.0
-        model, prices = _configured_prices()
-        if prices is not None:
-            return _round_cost(
-                sum(self._configured_agent_cost(aid, model, prices) for aid in self._agent_usage)
-            )
         return _round_cost(self._observed_cost if self._has_observed_cost else self._estimated_cost)
 
-    def _configured_agent_cost(self, agent_id: str, model: str | None, prices: Prices) -> float:
-        if self._agent_metadata.get(agent_id, {}).get("model") == model:
-            return _configured_usage_cost(self._agent_usage[agent_id], prices)
-        return self._agent_estimated_cost.get(agent_id, 0.0)
-
     def to_record(self) -> dict[str, Any]:
         record = serialize_usage(self._total_usage)
-        model, prices = _configured_prices()
-        total_cost = self.total_cost
-        record["cost"] = total_cost
+        record["cost"] = self.total_cost
         record["providers"] = {name: tally.model_dump() for name, tally in self._providers.items()}
         record["agents"] = []
 
@@ -171,11 +128,7 @@ class LLMUsageLedger:
             usage = self._agent_usage[agent_id]
             metadata = self._agent_metadata.get(agent_id, {})
             agent_cost = (
-                self._configured_agent_cost(agent_id, model, prices)
-                if prices is not None and not self.zero_cost
-                else total_cost * (agent_tokens[agent_id] / total_tokens)
-                if total_tokens
-                else 0.0
+                self.total_cost * (agent_tokens[agent_id] / total_tokens) if total_tokens else 0.0
             )
 
             agent_record = serialize_usage(usage)
@@ -195,7 +148,6 @@ class LLMUsageLedger:
         self._total_usage = Usage()
         self._agent_usage.clear()
         self._agent_metadata.clear()
-        self._agent_estimated_cost.clear()
         self._observed_cost = 0.0
         self._estimated_cost = 0.0
         self._has_observed_cost = False
@@ -231,7 +183,6 @@ class LLMUsageLedger:
                 logger.exception("Failed to hydrate llm_usage for agent %s", agent_id)
                 self._agent_usage[agent_id] = Usage()
 
-            self._agent_estimated_cost[agent_id] = _float_or_zero(raw_agent.get("cost"))
             metadata: dict[str, str] = {}
             agent_name = raw_agent.get("agent_name")
             model = raw_agent.get("model")

strix/skills/README.md

@@ -40,7 +40,7 @@ The skills are dynamically injected into the agent's system prompt, allowing it
 
 Notable source-aware skills:
 - `source_aware_whitebox` (coordination): white-box orchestration playbook
-- `source_aware_sast` (custom): opengrep/AST/secrets/supply-chain static triage workflow
+- `source_aware_sast` (custom): semgrep/AST/secrets/supply-chain static triage workflow
 - `dependency_cve_scanning` (custom): trivy-based SCA workflow for reporting known dependency CVEs via `create_dependency_report`
 - `npx_confusion` (custom): npx/npm exec/bunx fallback and adjacent package-runner identity confusion, with runner-specific registry and reporting gates
 - `semantic_confusion` (vulnerabilities): cross-boundary parser, normalization, and representation mismatch analysis

strix/skills/coordination/source_aware_whitebox.md

@@ -14,22 +14,22 @@ Increase white-box coverage by combining source-aware triage with dynamic valida
 ## Recommended Workflow
 
 1. Build a quick source map before deep exploitation, including at least one AST-structural pass (`sg` or `tree-sitter`) scoped to relevant paths.
-   - For `sg` baseline, derive `sg-targets.txt` from `opengrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`) and run `xargs ... sg run` on that list.
-   - Only fall back to path heuristics when opengrep scope is unavailable.
+   - For `sg` baseline, derive `sg-targets.txt` from `semgrep.json` scope first (`paths.scanned`, fallback to unique `results[].path`) and run `xargs ... sg run` on that list.
+   - Only fall back to path heuristics when semgrep scope is unavailable.
 2. Run first-pass static triage to rank high-risk paths.
 3. Use triage outputs to prioritize dynamic PoC validation.
 4. Keep findings evidence-driven: no report without validation.
 
 ## Source-Aware Triage Stack
 
-- `opengrep`: fast security-first triage and custom pattern scans
+- `semgrep`: fast security-first triage and custom pattern scans
 - `ast-grep` (`sg`): structural pattern hunting and targeted repo mapping
 - `tree-sitter`: syntax-aware parsing support for symbol and route extraction
 - `gitleaks` + `trufflehog`: complementary secret detection (working tree and history coverage)
 - `trivy fs`: dependency, misconfiguration, license, and secret checks
 
 Coverage target per repository:
-- one `opengrep` pass
+- one `semgrep` pass
 - one AST structural pass (`sg` and/or `tree-sitter`)
 - one secrets pass (`gitleaks` and/or `trufflehog`)
 - one `trivy fs` pass

strix/skills/custom/source_aware_sast.md

@@ -1,6 +1,6 @@
 ---
 name: source-aware-sast
-description: Practical source-aware SAST and AST playbook for opengrep, ast-grep, gitleaks, and trivy fs
+description: Practical source-aware SAST and AST playbook for semgrep, ast-grep, gitleaks, and trivy fs
 ---
 
 # Source-Aware SAST Playbook
@@ -23,19 +23,19 @@ Run this baseline once per repository before deep narrowing:
 ART=/workspace/.source-aware
 mkdir -p "$ART"
 
-opengrep scan --config /opt/opengrep-rules --taint-intrafile \
-  --json --output "$ART/opengrep.json" .
-# Build deterministic AST targets from opengrep scope (no hardcoded path guessing)
+semgrep scan --config p/default --config p/golang --config p/secrets \
+  --metrics=off --json --output "$ART/semgrep.json" .
+# Build deterministic AST targets from semgrep scope (no hardcoded path guessing)
 python3 - <<'PY'
 import json
 from pathlib import Path
 
 art = Path("/workspace/.source-aware")
-opengrep_json = art / "opengrep.json"
+semgrep_json = art / "semgrep.json"
 targets_file = art / "sg-targets.txt"
 
 try:
-    data = json.loads(opengrep_json.read_text(encoding="utf-8"))
+    data = json.loads(semgrep_json.read_text(encoding="utf-8"))
 except Exception:
     targets_file.write_text("", encoding="utf-8")
     raise
@@ -63,18 +63,17 @@ trivy fs --scanners vuln,misconfig --timeout 30m --offline-scan \
   --format json --output "$ART/trivy-fs.json" . || true
 ```
 
-## Opengrep First Pass
+## Semgrep First Pass
 
-Use Opengrep as the default static triage pass. Rules are bundled offline in `/opt/opengrep-rules` (one directory per language, plus `generic/secrets`):
+Use Semgrep as the default static triage pass:
 
 ```bash
-# Full bundled ruleset
-opengrep scan --config /opt/opengrep-rules --taint-intrafile \
-  --json --output /workspace/.source-aware/opengrep.json .
+# Preferred deterministic profile set (works with --metrics=off)
+semgrep scan --config p/default --config p/golang --config p/secrets \
+  --metrics=off --json --output /workspace/.source-aware/semgrep.json .
 
-# Narrow to the target stack when the full set is slow or noisy
-opengrep scan --config /opt/opengrep-rules/python --config /opt/opengrep-rules/generic/secrets \
-  --taint-intrafile --json --output /workspace/.source-aware/opengrep-python.json .
+# If you choose auto config, do not combine it with --metrics=off
+semgrep scan --config auto --json --output /workspace/.source-aware/semgrep-auto.json .
 ```
 
 If diff scope is active, restrict to changed files first, then expand only when needed.

strix/skills/frameworks/django.md

@@ -205,10 +205,10 @@ Jinja2 backend without autoescape: `{{7*7}}`, RCE gadgets if sandbox misconfigur
 
 ## Tooling
 
-Static analysis is the fastest way to reach the sinks above in white-box scope. The sandbox ships `python`/`pipx`, `opengrep`, `bandit`, `ast-grep`, and `ripgrep`.
+Static analysis is the fastest way to reach the sinks above in white-box scope. The sandbox ships `python`/`pipx`, `semgrep`, `bandit`, `ast-grep`, and `ripgrep`.
 
 - **bandit** (preinstalled) — Python security linter; flags `mark_safe`, `extra()`, `RawSQL`, `subprocess`, weak crypto, hardcoded secrets: `bandit -r . -ll`
-- **opengrep** (preinstalled) with the bundled Django rules — higher-signal than bandit for framework-specific bugs (`.extra()`, `RawSQL`, `|safe`, `csrf_exempt`, `ALLOWED_HOSTS=['*']`): `opengrep scan --config /opt/opengrep-rules/python/django .`
+- **semgrep** (preinstalled) with the Django ruleset — higher-signal than bandit for framework-specific bugs (`.extra()`, `RawSQL`, `|safe`, `csrf_exempt`, `ALLOWED_HOSTS=['*']`): `semgrep --config p/django .`
 - **pip-audit** (PyPA) — dependency CVE scanner for known-vuln Django/DRF/simplejwt versions: `pipx install pip-audit && pip-audit -r requirements.txt`
 - **ast-grep** (preinstalled) — quick structural grep for risky calls without a full SAST run: `ast-grep run -p 'mark_safe($X)' -l python`
 

strix/skills/scan_modes/deep.md

@@ -15,7 +15,7 @@ Thorough understanding before exploitation. Test every parameter, every endpoint
 
 **Whitebox (source available)**
 - Map every file, module, and code path in the repository
-- Start with broad source-aware triage (`opengrep`, `ast-grep`, `gitleaks`, `trufflehog`, `trivy fs`) and use outputs to drive deep review
+- Start with broad source-aware triage (`semgrep`, `ast-grep`, `gitleaks`, `trufflehog`, `trivy fs`) and use outputs to drive deep review
 - Execute at least one structural AST pass (`sg` and/or Tree-sitter) per repository and store artifacts for reuse
 - Keep AST artifacts bounded and query-driven (target relevant paths/sinks first; avoid whole-repo generic function dumps)
 - Use syntax-aware parsing (Tree-sitter tooling) to improve symbol, route, and sink extraction quality

strix/skills/scan_modes/quick.md

@@ -15,7 +15,7 @@ Optimize for fast feedback on critical security issues. Skip exhaustive enumerat
 
 **Whitebox (source available)**
 - Focus on recent changes: git diffs, new commits, modified files—these are most likely to contain fresh bugs
-- Run a fast static triage on changed files first (`opengrep`, then targeted `sg` queries)
+- Run a fast static triage on changed files first (`semgrep`, then targeted `sg` queries)
 - Run at least one lightweight AST pass (`sg` or Tree-sitter) so structural mapping is not skipped
 - Keep AST commands tightly scoped to changed or high-risk paths; avoid broad repository-wide pattern dumps
 - Run quick secret and dependency checks (`gitleaks`, `trufflehog`, `trivy fs`) scoped to changed areas when possible

strix/skills/scan_modes/standard.md

@@ -15,7 +15,7 @@ Systematic testing across the full attack surface. Understand the application be
 
 **Whitebox (source available)**
 - Map codebase structure: modules, entry points, routing
-- Run `opengrep` first-pass triage to prioritize risky flows before deep manual review
+- Run `semgrep` first-pass triage to prioritize risky flows before deep manual review
 - Run at least one AST-structural mapping pass (`sg` and/or Tree-sitter), then use outputs for route, sink, and trust-boundary mapping
 - Keep AST output bounded to relevant paths and hypotheses; avoid whole-repo generic function dumps
 - Identify architecture pattern (MVC, microservices, monolith)

strix/skills/tooling/agent_browser.md

@@ -207,7 +207,7 @@ agent-browser snapshot -i
 ```
 
 Credentials in shell history are a leak. For anything sensitive, use the
-auth vault (see `references/authentication.md`):
+auth vault (see [references/authentication.md](references/authentication.md)):
 
 ```bash
 agent-browser auth save my-app --url https://app.example.com/login \
@@ -367,7 +367,7 @@ agent-browser click @e3
 agent-browser record stop
 ```
 
-See `references/video-recording.md` for
+See [references/video-recording.md](references/video-recording.md) for
 codec options, GIF export, and more.
 
 ### Iframes
@@ -491,8 +491,8 @@ snapshot — fall back to `eval` in the iframe's origin or use the
 
 **Authentication expires mid-workflow**
 Use `--session-name <name>` or `state save`/`state load` so your session
-survives browser restarts. See `references/session-management.md`
-and `references/authentication.md`.
+survives browser restarts. See [references/session-management.md](references/session-management.md)
+and [references/authentication.md](references/authentication.md).
 
 ## Global flags worth knowing
 

strix/skills/tooling/opengrep.md

@@ -1,69 +0,0 @@
----
-name: opengrep
-description: Exact Opengrep CLI structure, bundled offline rules, scoped rule selection, taint mode, and automation-safe output patterns.
----
-
-# Opengrep CLI Playbook
-
-Official docs:
-- https://github.com/opengrep/opengrep
-- https://github.com/opengrep/opengrep-rules
-
-Canonical syntax:
-`opengrep scan [flags] [targets]`
-
-Bundled rules:
-- `/opt/opengrep-rules` holds the full ruleset, one directory per language (`python`, `javascript`, `typescript`, `go`, `java`, `php`, `ruby`, …) plus `generic/secrets`, `dockerfile`, `terraform`, `yaml`, and `strix` (Strix-authored rules, e.g. GitHub-owned actions not pinned to a commit SHA)
-- Framework rules sit under the language (`python/django`, `python/flask`, `javascript/express`, …)
-
-High-signal flags:
-- `--config <path>` rule file or directory; repeat for several
-- `--taint-intrafile` intra-file inter-procedural taint (follows data across functions in one file)
-- `--json` / `--sarif` output format
-- `--output <file>` write findings to file
-- `--severity <level>` filter by severity (`INFO`, `WARNING`, `ERROR`)
-- `--error` return non-zero exit when findings exist
-- `--quiet` suppress progress noise
-- `--jobs <n>` parallel workers
-- `--timeout <seconds>` per-rule, per-file timeout
-- `--exclude <pattern>` / `--include <pattern>` path filters
-- `--exclude-rule <rule_id>` suppress specific rule
-- `--baseline-commit <sha>` only report findings introduced after baseline
-
-Agent-safe baseline for automation:
-`opengrep scan --config /opt/opengrep-rules --taint-intrafile --json --output opengrep.json --quiet --jobs 4 --timeout 20 /workspace`
-
-Common patterns:
-- Full bundled scan:
-  `opengrep scan --config /opt/opengrep-rules --json --output opengrep.json --quiet /workspace`
-- High-severity focused pass:
-  `opengrep scan --config /opt/opengrep-rules --severity ERROR --json --output opengrep_high.json --quiet /workspace`
-- SARIF output:
-  `opengrep scan --config /opt/opengrep-rules --sarif --output opengrep.sarif --quiet /workspace`
-- Language- or framework-specific rules:
-  `opengrep scan --config /opt/opengrep-rules/python --config /opt/opengrep-rules/generic/secrets --json --output opengrep_python.json --quiet /workspace`
-- Scoped directory scan:
-  `opengrep scan --config /opt/opengrep-rules --json --output opengrep_api.json --quiet /workspace/services/api`
-- Custom rule:
-  `opengrep scan --config ./rules/my-rule.yaml --json --output opengrep_custom.json --quiet /workspace`
-
-Critical correctness rules:
-- Always provide an explicit `--config` from `/opt/opengrep-rules` or a local rule file. Registry shorthands (`p/...`, `auto`) fetch rules from the network; do not use them.
-- Opengrep has no telemetry; there is no `--metrics` flag, and passing one fails the scan.
-- Prefer `--json --output <file>` or `--sarif --output <file>` for machine-readable downstream processing. JSON keeps `paths.scanned` and `results[].path`.
-- Keep the target path explicit; use an absolute or clearly scoped workspace path instead of `.` when possible.
-
-Usage rules:
-- Start with the full `/opt/opengrep-rules` set unless the task clearly calls for a narrower language or framework directory.
-- Add `--taint-intrafile` for injection-class hunting (SQLi, command injection, SSRF, path traversal) in supported languages.
-- Use `--quiet` in automation to reduce noisy logs.
-- Use `--jobs` and `--timeout` explicitly for reproducible runtime behavior.
-- `PartialParsing` errors on templates are normal; they do not invalidate the run.
-
-Failure recovery:
-- If scans are too slow, narrow the target path and the rule directories before changing engine settings.
-- If scans time out, increase `--timeout` modestly or lower `--jobs`.
-- If output is too broad, scope `--config`, add `--severity`, or exclude known irrelevant paths.
-
-If uncertain, query web_search with:
-`site:github.com/opengrep/opengrep <flag>`

strix/skills/tooling/semgrep.md

@@ -0,0 +1,72 @@
+---
+name: semgrep
+description: Exact Semgrep CLI structure, metrics-off scanning, scoped ruleset selection, and automation-safe output patterns.
+---
+
+# Semgrep CLI Playbook
+
+Official docs:
+- https://semgrep.dev/docs/cli-reference
+- https://semgrep.dev/docs/getting-started/cli
+- https://semgrep.dev/docs/semgrep-code/semgrep-pro-engine-intro
+
+Canonical syntax:
+`semgrep scan [flags]`
+
+High-signal flags:
+- `--config <rule_or_ruleset>` ruleset, registry pack, local rule file, or directory
+- `--metrics=off` disable telemetry and metrics reporting
+- `--json` JSON output
+- `--sarif` SARIF output
+- `--output <file>` write findings to file
+- `--severity <level>` filter by severity
+- `--error` return non-zero exit when findings exist
+- `--quiet` suppress progress noise
+- `--jobs <n>` parallel workers
+- `--timeout <seconds>` per-file timeout
+- `--exclude <pattern>` exclude path pattern
+- `--include <pattern>` include path pattern
+- `--exclude-rule <rule_id>` suppress specific rule
+- `--baseline-commit <sha>` only report findings introduced after baseline
+- `--pro` enable Pro engine if available
+- `--oss-only` force OSS engine only
+
+Agent-safe baseline for automation:
+`semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet --jobs 4 --timeout 20 /workspace`
+
+Common patterns:
+- Default security scan:
+  `semgrep scan --config p/default --metrics=off --json --output semgrep.json --quiet /workspace`
+- High-severity focused pass:
+  `semgrep scan --config p/default --severity ERROR --metrics=off --json --output semgrep_high.json --quiet /workspace`
+- OWASP-oriented scan:
+  `semgrep scan --config p/owasp-top-ten --metrics=off --sarif --output semgrep.sarif --quiet /workspace`
+- Language- or framework-specific rules:
+  `semgrep scan --config p/python --config p/secrets --metrics=off --json --output semgrep_python.json --quiet /workspace`
+- Scoped directory scan:
+  `semgrep scan --config p/default --metrics=off --json --output semgrep_api.json --quiet /workspace/services/api`
+- Pro engine check or run:
+  `semgrep scan --config p/default --pro --metrics=off --json --output semgrep_pro.json --quiet /workspace`
+
+Critical correctness rules:
+- Always include `--metrics=off`; Semgrep sends telemetry by default.
+- Always provide an explicit `--config`; do not rely on vague or implied defaults.
+- Prefer `--json --output <file>` or `--sarif --output <file>` for machine-readable downstream processing.
+- Keep the target path explicit; use an absolute or clearly scoped workspace path instead of `.` when possible.
+- If Pro availability matters, check it explicitly with a bounded command before assuming cross-file analysis exists.
+
+Usage rules:
+- Start with `p/default` unless the task clearly calls for a narrower pack.
+- Add focused packs such as `p/secrets`, `p/python`, or `p/javascript` only when they match the target stack.
+- Use `--quiet` in automation to reduce noisy logs.
+- Use `--jobs` and `--timeout` explicitly for reproducible runtime behavior.
+- Do not use `-h`/`--help` for routine operation unless absolutely necessary.
+
+Failure recovery:
+- If scans are too slow, narrow the target path and reduce the active rulesets before changing engine settings.
+- If scans time out, increase `--timeout` modestly or lower `--jobs`.
+- If output is too broad, scope `--config`, add `--severity`, or exclude known irrelevant paths.
+- If Pro mode fails, rerun with `--oss-only` or without `--pro` and note the loss of cross-file coverage.
+
+If uncertain, query web_search with:
+`site:semgrep.dev semgrep <flag> cli`

strix/skills/vulnerabilities/semantic_confusion.md

@@ -1,6 +1,6 @@
 ---
 name: semantic-confusion
-description: Cross-component semantic confusion testing for parser differentials, normalization mismatches, email and IDNA identity drift, overloaded fields, lifecycle state drift, internal redirects, protocol translation, and validator-to-sink inconsistencies
+description: Cross-component semantic confusion testing for parser differentials, normalization mismatches, overloaded fields, lifecycle state drift, internal redirects, protocol translation, and validator-to-sink inconsistencies
 ---
 
 # Semantic Confusion
@@ -59,27 +59,6 @@ The highest-signal condition is `security_check(value_A)` followed by `sink(tran
 - Test malformed Unicode and replacement behavior; a rejected code point may become an allowed delimiter or wildcard later.
 - Test path, query, and fragment separately. Browsers and routers commonly transform each source differently.
 
-### Email and Account Identity Drift
-
-Treat an email address as both a principal selector and a delivery destination. Trace the complete boundary before testing:
-
-```text
-submitted or identity-provider address
-  -> application normalization / IDNA
-  -> database comparison and collation
-  -> selected local principal
-  -> token, session, invitation, or link binding
-  -> recipient or linked identity consumed by the final service
-```
-
-- Cover recovery, magic links, invitations, registration uniqueness, email changes, and OAuth/OIDC account linking. Test case/accent-insensitive collations, Unicode normalization, IDNA U-label/A-label conversion, trailing dots, and provider canonicalization only when the observed stack supports them.
-- In black-box testing, report the observed equivalence and routing behavior. Do not name a specific collation, normalizer, or provider algorithm without source, configuration, or version evidence.
-- Determine whether two non-identical addresses can select the same protected principal while SMTP or an identity provider routes them to different owners. The address that receives authority must identify the same principal selected by the security check.
-- In recovery flows, compare the submitted address with the selected account's stored canonical address. A fuzzy lookup followed by delivery to the submitted value is high risk; an exact lookup plus delivery to the stored value is the primary negative control.
-- Use only an explicitly authorized attacker-controlled mailbox or test domain. Derive a bounded variant set from the deployed collation and canonicalizers rather than spraying external domains or the Unicode range.
-
-For a recovery, magic-link, or invitation finding, a generic success response is not proof. Demonstrate that the variant selects the protected principal, the issued authority reaches the controlled mailbox or identity, and redemption yields the protected principal's access. If delivery or redemption cannot be observed, keep the path `needs_follow_up`.
-
 ### Field and Type Overloading
 
 - Identify shared fields reused for different concepts: path vs URL, content type vs handler, display name vs executable name, route vs filesystem location.
@@ -191,8 +170,6 @@ A valid confusion finding should include:
 - Different error messages with identical final authorization and sink behavior
 - A parser accepts odd syntax but downstream consumers preserve the same safe meaning
 - A normalization difference visible only in logs, with no security decision between representations
-- A Unicode or Punycode lookalike that neither selects another principal nor receives authority intended for that principal
-- A permissive database comparison where recovery delivery still uses the selected account's stored canonical address
 - WAF bypass where the application itself rejects the request identically
 - Version-specific behavior claimed as universal without testing the relevant deployment
 - A search-path candidate that is attacker-named but cannot be created, claimed, loaded, or executed

tests/test_dedupe_decisions.py

@@ -1,159 +0,0 @@
-"""Only validated model decisions may suppress a finding."""
-
-from __future__ import annotations
-
-import json
-from typing import TYPE_CHECKING, Any
-from unittest.mock import AsyncMock
-
-import pytest
-from agents.items import ModelResponse
-from agents.usage import Usage
-from openai.types.responses import ResponseOutputMessage, ResponseOutputText
-
-from strix.config import loader
-from strix.report import dedupe
-from strix.report.state import ReportState, get_global_report_state, set_global_report_state
-from strix.tools.reporting.tool import _do_create
-
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-    from pathlib import Path
-
-
-@pytest.fixture
-def report_state(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Iterator[ReportState]:
-    monkeypatch.chdir(tmp_path)
-    previous = get_global_report_state()
-    state = ReportState(run_name="dedupe-decisions")
-    set_global_report_state(state)
-    state.add_vulnerability_report(title="Existing finding", severity="low")
-    try:
-        yield state
-    finally:
-        set_global_report_state(previous)
-
-
-def _mock_judge(monkeypatch: pytest.MonkeyPatch, decision: dict[str, Any]) -> AsyncMock:
-    settings = loader.load_settings().model_copy(deep=True)
-    settings.llm.model = "openai/synthetic-model"
-    model = AsyncMock()
-    model.get_response.return_value = ModelResponse(
-        output=[
-            ResponseOutputMessage(
-                id="msg_synthetic",
-                type="message",
-                role="assistant",
-                status="completed",
-                content=[
-                    ResponseOutputText(
-                        type="output_text",
-                        annotations=[],
-                        text=json.dumps({"confidence": 0.95, "reason": "Synthetic", **decision}),
-                    )
-                ],
-            )
-        ],
-        usage=Usage(),
-        response_id="synthetic",
-    )
-    monkeypatch.setattr(dedupe, "load_settings", lambda: settings)
-    monkeypatch.setattr(dedupe, "configure_sdk_model_defaults", lambda _: None)
-    monkeypatch.setattr(dedupe, "resolve_dedupe_model", lambda *_: model)
-    return model
-
-
-async def _file_finding() -> dict[str, Any]:
-    return await _do_create(
-        title="New finding",
-        description="The endpoint reflects unencoded input.",
-        impact="The reflected script executes in a victim's browser.",
-        target="https://example.invalid",
-        technical_analysis="Input is interpolated into HTML without encoding.",
-        poc_description="Open the endpoint with the reflected parameter.",
-        poc_script_code="print('synthetic reproduction')",
-        remediation_steps="Encode output for its HTML context.",
-        evidence="The synthetic response contains the unencoded parameter.",
-        assumptions="A victim follows the crafted link.",
-        counterevidence="No encoding or content security policy is present.",
-        confidence="high",
-        severity_change_conditions="A strict content security policy would lower the impact.",
-        fix_effort="low",
-        cvss_breakdown={
-            "attack_vector": "N",
-            "attack_complexity": "L",
-            "privileges_required": "N",
-            "user_interaction": "R",
-            "scope": "U",
-            "confidentiality": "L",
-            "integrity": "L",
-            "availability": "N",
-        },
-        endpoint="/search",
-        method="GET",
-        cve=None,
-        cwe="CWE-79",
-        code_locations=None,
-    )
-
-
-@pytest.mark.parametrize("value", ["false", "true", 0, 1, None, [], {}])
-def test_dedupe_parser_requires_a_boolean(value: Any) -> None:
-    with pytest.raises(TypeError, match="is_duplicate"):
-        dedupe._parse_dedupe_response(json.dumps({"is_duplicate": value}))
-
-
-@pytest.mark.parametrize(
-    "decision",
-    [
-        {"is_duplicate": "false", "duplicate_id": "vuln-0001"},
-        {"is_duplicate": "true", "duplicate_id": "vuln-0001"},
-        {"is_duplicate": 1, "duplicate_id": "vuln-0001"},
-        {"is_duplicate": True, "duplicate_id": "vuln-9999"},
-        {"is_duplicate": True, "duplicate_id": ""},
-        {"is_duplicate": True, "duplicate_id": None},
-        {"is_duplicate": True, "duplicate_id": ["vuln-0001"]},
-        {"is_duplicate": True},
-    ],
-)
-async def test_invalid_dedupe_decision_does_not_suppress_finding(
-    report_state: ReportState, monkeypatch: pytest.MonkeyPatch, decision: dict[str, Any]
-) -> None:
-    model = _mock_judge(monkeypatch, decision)
-
-    result = await _file_finding()
-
-    assert result["success"] is True
-    model.get_response.assert_awaited_once()
-    saved = json.loads((report_state.get_run_dir() / "vulnerabilities.json").read_text())
-    assert [report["title"] for report in saved] == ["Existing finding", "New finding"]
-    assert (report_state.get_run_dir() / "vulnerabilities" / "vuln-0002.md").is_file()
-
-
-@pytest.mark.parametrize("is_duplicate", [False, True])
-async def test_valid_dedupe_decisions_keep_their_meaning(
-    report_state: ReportState, monkeypatch: pytest.MonkeyPatch, is_duplicate: bool
-) -> None:
-    # An extraneous ID must not turn a valid false decision into a duplicate.
-    _mock_judge(monkeypatch, {"is_duplicate": is_duplicate, "duplicate_id": "vuln-0001"})
-
-    result = await _file_finding()
-
-    assert result["success"] is not is_duplicate
-    saved = json.loads((report_state.get_run_dir() / "vulnerabilities.json").read_text())
-    assert len(saved) == (1 if is_duplicate else 2)
-    if is_duplicate:
-        assert result["duplicate_of"] == "vuln-0001"
-
-
-async def test_dedupe_id_is_matched_without_truncation(monkeypatch: pytest.MonkeyPatch) -> None:
-    existing_id = "x" * 64
-    _mock_judge(monkeypatch, {"is_duplicate": True, "duplicate_id": existing_id + "-unknown"})
-
-    result = await dedupe.check_duplicate(
-        {"title": "New finding"}, [{"id": existing_id, "title": "Existing finding"}]
-    )
-
-    assert result["is_duplicate"] is False
-    assert "error" in result

tests/test_hooks.py

@@ -2,14 +2,11 @@
 
 from __future__ import annotations
 
-from types import SimpleNamespace
-from typing import TYPE_CHECKING, Any
+from typing import Any
 from unittest.mock import MagicMock, patch
 
 import pytest
-from agents.usage import Usage
 
-from strix.config import loader
 from strix.core.agents import AgentCoordinator
 from strix.core.hooks import (
     BudgetExceededError,
@@ -18,11 +15,6 @@ from strix.core.hooks import (
     SubagentBudgetReservedError,
     recomputed_budget_flags,
 )
-from strix.report.usage import LLMUsageLedger
-
-
-if TYPE_CHECKING:
-    from pathlib import Path
 
 
 def _make_hooks(max_budget: float | None) -> ReportUsageHooks:
@@ -93,38 +85,6 @@ async def test_over_budget_raises() -> None:
         await hooks.on_llm_end(_make_context(), MagicMock(), MagicMock())
 
 
-@pytest.mark.asyncio
-async def test_manual_rates_make_unpriced_model_trip_budget(
-    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
-) -> None:
-    monkeypatch.setenv("STRIX_LLM", "test-model")
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "10")
-    monkeypatch.delenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", raising=False)
-    monkeypatch.delenv("STRIX_LLM_CACHED_INPUT_COST_PER_MTOK", raising=False)
-    monkeypatch.setattr(loader, "_override", tmp_path / "missing.json")
-    monkeypatch.setattr(loader, "_cached", None)
-    usage = Usage()
-    usage.requests = 1
-    usage.input_tokens = 1000
-    usage.total_tokens = 1000
-    ledger = LLMUsageLedger()
-
-    class ReportState:
-        def record_sdk_usage(self, **kwargs: Any) -> None:
-            ledger.record(**kwargs)
-
-        def get_total_llm_cost(self) -> float:
-            return ledger.total_cost
-
-    hooks = _make_hooks(0.005)
-    response: Any = SimpleNamespace(usage=usage)
-    with (
-        patch("strix.core.hooks.get_global_report_state", return_value=ReportState()),
-        pytest.raises(BudgetExceededError),
-    ):
-        await hooks.on_llm_end(_make_context(), MagicMock(), response)
-
-
 @pytest.mark.asyncio
 async def test_budget_check_uses_live_cost_accessor() -> None:
     # The check must read the live ledger, not the persisted run-record snapshot,

tests/test_inputs.py

@@ -474,11 +474,6 @@ def test_openrouter_attribution_rides_on_the_request_headers() -> None:
     }
 
 
-def test_vercel_ai_gateway_attribution_rides_on_the_request_headers() -> None:
-    headers = make_model_settings(None, model_name="vercel_ai_gateway/zai/glm-5.3").extra_headers
-    assert headers == {"HTTP-Referer": "https://strix.ai", "X-Title": "Strix"}
-
-
 def test_openrouter_attribution_absent_for_other_providers() -> None:
     assert make_model_settings(None, model_name="anthropic/claude-sonnet-4-5").extra_headers is None
 

tests/test_pricing.py

@@ -1,50 +1,14 @@
 from __future__ import annotations
 
-import json
-from typing import TYPE_CHECKING
 from unittest.mock import patch
 
 import litellm
-import pytest
 from agents.usage import Usage
-from pydantic import ValidationError
 
-from strix.config import loader
-from strix.config.settings import LlmSettings
 from strix.report.pricing import resolve_litellm_model
 from strix.report.usage import LLMUsageLedger
 
 
-if TYPE_CHECKING:
-    from pathlib import Path
-
-
-PRICE_ENV = (
-    "STRIX_LLM_INPUT_COST_PER_MTOK",
-    "STRIX_LLM_OUTPUT_COST_PER_MTOK",
-    "STRIX_LLM_CACHED_INPUT_COST_PER_MTOK",
-)
-
-
-@pytest.fixture(autouse=True)
-def _isolated_settings(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
-    for name in PRICE_ENV:
-        monkeypatch.delenv(name, raising=False)
-    monkeypatch.setenv("STRIX_LLM", "gateway/unpriced-model")
-    monkeypatch.setattr(loader, "_override", tmp_path / "missing.json")
-    monkeypatch.setattr(loader, "_cached", None)
-
-
-def _usage(input_tokens: int, output_tokens: int = 0, cached_tokens: int = 0) -> Usage:
-    usage = Usage()
-    usage.requests = 1
-    usage.input_tokens = input_tokens
-    usage.output_tokens = output_tokens
-    usage.total_tokens = input_tokens + output_tokens
-    usage.input_tokens_details.cached_tokens = cached_tokens
-    return usage
-
-
 def test_resolves_common_bare_model_names() -> None:
     resolve_litellm_model.cache_clear()
     assert resolve_litellm_model("deepseek-v4-flash") == "deepseek/deepseek-v4-flash"
@@ -96,112 +60,6 @@ def test_ledger_prefers_observed_cost_over_estimate() -> None:
     assert ledger.total_cost == 0.17
 
 
-def test_unpriced_model_without_manual_rates_costs_zero() -> None:
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-
-    assert ledger.total_cost == 0.0
-
-
-def test_manual_rates_price_usage_and_override_observed_cost(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-    ledger.record_observed_cost(0.17)
-
-    assert ledger.total_cost == 0.0036
-    assert ledger.to_record()["agents"][0]["cost"] == 0.0036
-
-
-def test_manual_rates_from_config_file(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
-    path = tmp_path / "config.json"
-    path.write_text(
-        json.dumps(
-            {
-                "env": {
-                    "STRIX_LLM_INPUT_COST_PER_MTOK": "2",
-                    "STRIX_LLM_OUTPUT_COST_PER_MTOK": "8",
-                }
-            }
-        ),
-        encoding="utf-8",
-    )
-    monkeypatch.setattr(loader, "_override", path)
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-
-    assert ledger.total_cost == 0.0036
-
-
-def test_manual_rates_only_price_the_configured_model(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
-    ledger = LLMUsageLedger()
-
-    ledger.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-    with patch("litellm.completion_cost", return_value=0.42):
-        ledger.record(agent_id="dedupe", usage=_usage(500, 50), model="deepseek/deepseek-v4-flash")
-    record = ledger.to_record()
-
-    assert ledger.total_cost == 0.4236
-    assert {agent["agent_id"]: agent["cost"] for agent in record["agents"]} == {
-        "a": 0.0036,
-        "dedupe": 0.42,
-    }
-
-
-def test_cached_tokens_fall_back_to_input_rate(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "5")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "7")
-    ledger = LLMUsageLedger()
-
-    ledger.record(
-        agent_id="a", usage=_usage(10, 1, cached_tokens=2), model="gateway/unpriced-model"
-    )
-
-    assert ledger.total_cost == 0.000057
-
-
-def test_hydrated_usage_uses_configured_rates_not_persisted_cost(
-    monkeypatch: pytest.MonkeyPatch,
-) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "2")
-    monkeypatch.setenv("STRIX_LLM_OUTPUT_COST_PER_MTOK", "8")
-    original = LLMUsageLedger()
-    original.record(agent_id="a", usage=_usage(1000, 200), model="gateway/unpriced-model")
-    persisted = original.to_record()
-    persisted["cost"] = 42.0
-    persisted["agents"][0]["cost"] = 42.0
-    hydrated = LLMUsageLedger()
-
-    hydrated.hydrate(persisted)
-
-    assert hydrated.total_cost == 0.0036
-
-
-@pytest.mark.parametrize("value", ["invalid", "-1", "nan", "inf"])
-def test_invalid_manual_rate_is_rejected(value: str, monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", value)
-    with pytest.raises(ValidationError):
-        LlmSettings()
-
-
-def test_zero_cost_overrides_manual_rates(monkeypatch: pytest.MonkeyPatch) -> None:
-    monkeypatch.setenv("STRIX_LLM_INPUT_COST_PER_MTOK", "10")
-    ledger = LLMUsageLedger()
-    ledger.zero_cost = True
-
-    ledger.record(agent_id="a", usage=_usage(1000), model="gateway/unpriced-model")
-
-    assert ledger.total_cost == 0.0
-
-
 def test_hydrated_estimate_continues_accumulating_new_estimates() -> None:
     usage = Usage()
     usage.requests = 1