What's Changed
- Stop the run after finish_pr_review by @ian-at-strix in #1451
- Stop false "ended without calling finish_scan" error on PR reviews by @ian-at-strix in #1449
- feat(cli): add -r and a title column to the resume picker by @ian-at-strix in #1450
- feat(tui): set the terminal title to the scan target by @ian-at-strix in #1479
- fix(logging): suppress Agents SDK PTY warning that interferes with TUI by @ian-at-strix in #1392
- feat(llm): detect whether a model accepts image input by @ian-at-strix in #1460
- feat(llm): keep images away from text-only models by @ian-at-strix in #1465
- feat(llm): scrub images from every request to a text-only model by @ian-at-strix in #1466
- fix(execution): only strip images on image-rejection errors by @ian-at-strix in #1461
- feat(llm): log the upstream provider behind OpenRouter by @ian-at-strix in #1459
- feat(llm): retry 4xx model errors by @ian-at-strix in #1486
- feat(llm): bound the first stream event and the whole stream by @ian-at-strix in #1487
- fix(mcp): load catalogs before agents discover connections by @bearsyankees in #1492
- Let callers choose the top-level agent's finish tool by @ian-at-strix in #1496
- docs(readme): add update instructions by @yoni-at-strix in #1501
- feat(reporting): accept code_locations on dependency reports by @yoni-at-strix in #1366
- feat(tui): show the run's targets in a sidebar box by @ian-at-strix in #1500
- fix(proxy): log Caido SDK errors as warnings by @ian-at-strix in #1517
- feat(runtime): add defer=True to create_or_reuse so the agent loop does not wait for the sandbox bring-up by @devin-ai-integration[bot] in #1518
- feat(runtime): accept an awaitable extra_files in create_or_reuse so the sandbox create does not wait for it by @devin-ai-integration[bot] in #1521
- fix(reporting): drop the static-analysis disclaimer from dependency evidence by @yoni-at-strix in #1520
- test(resume-picker): put the pty in cbreak so the key-reader test can't hang on macOS by @ian-at-strix in #1527
- fix(models): replay malformed tool-call arguments as valid JSON by @bearsyankees in #1327
- feat(llm): extra request-body fields via LLM_EXTRA_BODY by @SzymonNastaly in #1495
- fix(agents): exec_command states the 30 s yield cap and that a running non-TTY process cannot be polled by @devin-ai-integration[bot] in #1535
- fix(core): an operator pause holds under every budget policy and only resume_budget lifts it by @devin-ai-integration[bot] in #1536
- feat(run): STRIX_RUN_RECORD_TIMINGS records every LLM request's and tool call's timing in run.json by @ian-at-strix in #1539
- feat(agents): let callers choose the report tool by @ian-at-strix in #1550
- fix(reporting): keep HTTP exchange evidence when the proxy is slow to… by @bearsyankees in #1551
- build(deps): enforce a 5-day release cooldown for uv and npm resolution by @bearsyankees in #1556
- feat(skills): expand XSS coverage for HTML injection and normalization by @theo-at-strix in #1559
- Bump aiohttp, graphql-core, vite and trufflehog by @bearsyankees in #1569
- Make the root agent follow up open coverage rows before finishing by @bearsyankees in #1573
- feat(agents): soft per-skill turn limits for sub-agents by @ian-at-strix in #1553
- feat(core): opt-in parallel tool calls via STRIX_PARALLEL_TOOL_CALLS by @ian-at-strix in #1555
- feat(agents): let callers turn off the coverage ledger tools by @ian-at-strix in #1584
- feat(runtime): pass host devices from STRIX_DOCKER_SANDBOX_DEVICES through to the sandbox container by @devin-ai-integration[bot] in #1587
- docs: add Vercel AI Gateway as recommended provider by @devin-ai-integration[bot] in #1591
- docs: use the vercel_ai_gateway provider for the Vercel AI Gateway setup by @devin-ai-integration[bot] in #1593
- docs: show Vercel AI Gateway and OpenRouter in the README setup by @devin-ai-integration[bot] in #1594
- feat(runner): let root_instructions_override replace the root's scan prompt by @ian-at-strix in #1592
- refactor(runner): default replace_scan_prompt to False by @ian-at-strix in #1598
- docs(config): describe the current STRIX_API_TYPE default by @Thibaultjaigu in #1602
- feat(llm): send app attribution headers to Vercel AI Gateway by @devin-ai-integration[bot] in #1603
- fix(image): patch brotli decoder (CVE-2026-111497) in sandbox, bump t… by @bearsyankees in #1617
- fix(STR-1654): price LLM usage from model config by @bearsyankees in #1616
- Feat/str 1646 opengrep by @bearsyankees in #1625
- fix(report): validate deduplication decisions before suppressing findings by @samirhvbr in #1634
- feat(skills): cover email identity canonicalization drift by @theo-at-strix in #1661
- ci: one lean CI workflow with job timeouts; path-gate binary build and workflow lint by @devin-ai-integration[bot] in #1662
- docs(skills): stop linking reference files that are not in this repo by @lxcxjxhx in #1690
- Fix/str 2014 mcp refresh bearer on 401 by @bearsyankees in #1717
- Feat/reachability three states by @yoni-at-strix in #1701
- Fix/str 2195 sandbox updates by @bearsyankees in #1729
- feat(skills): detect query-language and JSON parser differentials by @theo-at-strix in #1720
- chore: release v1.7.1 by @devin-ai-integration[bot] in #1730
New Contributors
- @SzymonNastaly made their first contribution in #1495
- @theo-at-strix made their first contribution in #1559
- @Thibaultjaigu made their first contribution in #1602
- @samirhvbr made their first contribution in #1634
- @lxcxjxhx made their first contribution in #1690
Full Changelog: v1.7.0...v1.7.1