Skip to content

Conversation

@laikhtman
Copy link

📝 PR Description

This Pull Request delivers a comprehensive upgrade across multiple layers of the Strix platform, including the core agent framework, documentation, structured vulnerability exports, Telegram bot integration, and several new security tools.

The scope is intentionally broad, completing major portions of the roadmap and unifying recent improvements into a cohesive, documented release.

Key Improvements

1. Documentation Overhaul

  • Added extensive architecture, agent-loop, telemetry, and operator-facing documentation.
  • Updated README with .env configuration examples, clarified setup steps, and removed outdated acknowledgements.

2. Telegram Bot + Control API

  • Implemented end-to-end Telegram bot integration.
  • Added control APIs for triggering runs, browsing outputs, and interacting with agents.
  • Included example .env, systemd service file, and a bot load-testing script.

3. Structured Vulnerability Exports

  • Added JSONL vulnerability export pipeline.
  • Introduced SARIF 2.1.0 report generation with normalized metadata and improved runName serialization.
  • Updated related docs and validated tracer output behavior.

4. Core Agent Enhancements (A01–A03)

  • A01: Pluggable agent graph builder with validation and YAML support.
  • A02: Adaptive iteration policy based on target complexity and LLM latency, integrated across CLI/TUI/bot.
  • A03: Persistent, resumable agent state with automated run snapshots and supporting tests.

5. New Tooling & Coverage Enhancements (T01–T05)

  • Integrated SAST/dep scan tooling.
  • Added API probing and auth-flows playbooks.
  • Reporting enrichment including CVSS estimates, CWE/OWASP references, and fix-by snippets.

Testing

  • Added new unit tests for graph builder, state persistence, API probing, and more.
  • Note: Full pytest suite not executed locally (pytest not installed).

Docs Updated

  • README.md
  • architecture.md
  • agent-loop.md
  • telemetry-and-observability.md
  • todo_roadmap.md
  • Additional supporting files

Introduces initial documentation covering architecture, agent loop internals, development workflow, interface usage, LLM configuration, prompts, runtime/sandbox, security, setup, telemetry, testing, glossary, release/versioning, troubleshooting, and detailed Telegram bot integration. These docs provide deep references and extension guides for developers and operators.
Added instructions for configuring STRIX_LLM and LLM_API_KEY via a .env file. Removed the acknowledgements section listing related open-source projects.
Introduces a new strix/bot package with Telegram bot service, configuration, control APIs, file system API, and state management. Adds main entrypoint and service logic for bot operation, including command handling, rate limiting, and file/report access. Updates llm.py to support .env-based configuration loading for API keys and endpoints.
Introduces a .env.example file for environment configuration, a systemd unit file for Strix Telegram Bot deployment, and a Python script for load testing the bot's formatting and batching logic. These additions improve deployment, configuration, and reliability testing.
Implemented JSONL and SARIF 2.1.0 vulnerability exports in tracer.py for CI integration. Updated documentation to reflect new structured outputs and marked roadmap item T06 as complete. SARIF driver metadata was refined for accurate serialization and runName handling.
…ence

Introduces pluggable agent graph builder with validation (supports JSON/YAML), adaptive iteration limits based on target complexity and LLM latency, and agent state persistence with save/load helpers. Updates CLI, TUI, and bot to use iteration policy, and documents new features. Adds corresponding tests for graph builder, iteration policy, and state persistence.
Introduces new SAST and dependency scanning tools (strix/tools/sast/*), API probing utilities for OpenAPI/Swagger (strix/tools/api_probe/*), and an OIDC/SAML/SSO authentication playbook prompt (strix/prompts/auth/oidc_saml_sso.jinja). Enhances browser automation with network event logging and screenshot diff actions. Reporting now supports CVSS scores, CWE IDs, references, and fix recommendations. Updates documentation and adds tests for new modules and features.
Implements concurrent run manager, multiplexing LLM router with fallback, tool server pool with health tracking, and benchmark suite. Adds a caching tool for storing/retrieving tool outputs, updates tool registry, and provides corresponding tests for new modules. Updates roadmap to mark related tasks as completed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant