fix: inherit proxy config in sub-agent terminal sessions

[nedalaltiti]

Fixes #430

Problem

When the Root Agent creates sub-agents via create_agent, each sub-agent gets a new tmux terminal session. These sessions don't inherit the Caido proxy environment variables (HTTP_PROXY, HTTPS_PROXY, REQUESTS_CA_BUNDLE) set by docker-entrypoint.sh in /etc/profile.d/proxy.sh.

This causes sub-agent commands (curl, httpx, sqlmap) to fail when testing external HTTPS targets.

Fix

Source /etc/profile.d/proxy.sh and ~/.bashrc in TerminalSession.initialize() before setting the custom PS1 prompt.

Testing

• Ran Strix in deep mode against OWASP Juice Shop
• Sub-agents (SQLi Discovery, XSS Discovery, SSRF Discovery) were able to make HTTP requests after the fix
• Confirmed SQLi, tested XSS, and ran 118 SSRF tool calls successfully

[greptile-apps]

Greptile Summary

This PR fixes proxy inheritance for sub-agent tmux sessions by sourcing /etc/profile.d/proxy.sh and ~/.bashrc inside TerminalSession.initialize(), ensuring that HTTP_PROXY, HTTPS_PROXY, and REQUESTS_CA_BUNDLE are available when tools like curl, httpx, and sqlmap run.

Key concerns:

• Broad ~/.bashrc sourcing — .bashrc is an interactive non-login shell script and can contain arbitrary logic (conda init, pyenv, nvm, cd, PROMPT_COMMAND overrides, or even unset HTTP_PROXY lines). Sourcing it broadly risks silently undoing the proxy settings that were just loaded, producing unexpected terminal output, or interfering with the custom PS1 setup that follows immediately after. The safer fix is to source only /etc/profile.d/proxy.sh and then export HTTP_PROXY HTTPS_PROXY REQUESTS_CA_BUNDLE.
• Hardcoded 0.3 s sleep — There is no confirmation that both files have finished being sourced before the next send_keys call is dispatched. Heavy init scripts can exceed this window, leading to a race between still-running source output and the PS1 setup command. A polling approach (waiting for the PS1 marker) would be more robust and consistent with how the rest of the class handles command completion.

Confidence Score: 3/5

The fix addresses a real gap but introduces side-effects risk via ~/.bashrc sourcing and relies on a fragile fixed sleep for synchronization.

The core intent is correct and the 2>/dev/null guards prevent hard failures, but sourcing .bashrc is overly broad and could silently break proxy inheritance or PS1 behavior in certain environments. The hardcoded 0.3 s sleep is a pre-existing pattern in the codebase but is still unreliable when applied to potentially slow scripts. These are not showstoppers but warrant addressing before merging to avoid subtle, environment-dependent failures.

strix/tools/terminal/terminal_session.py — specifically lines 81-82 where the proxy sourcing and sleep are introduced.

Important Files Changed

Filename	Overview
strix/tools/terminal/terminal_session.py	Adds proxy/CA-cert sourcing at session init; sourcing ~/.bashrc introduces broad side-effects risk and the hardcoded 0.3 s sleep may be insufficient on slower systems.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: strix/tools/terminal/terminal_session.py
Line: 81-82

Comment:
**Sourcing `~/.bashrc` can override or undo proxy settings**

`~/.bashrc` is designed for interactive non-login shells and can contain arbitrary shell logic — `PROMPT_COMMAND` overrides, `PS1` redefinitions, `conda init`, `pyenv init`, `nvm` setup, `cd` calls, and sometimes even explicit `unset HTTP_PROXY` lines. Sourcing it here introduces several risks:

1. If the user's `.bashrc` unsets or overwrites `HTTP_PROXY`/`HTTPS_PROXY`/`REQUESTS_CA_BUNDLE`, it will immediately undo the proxy config that was just loaded from `/etc/profile.d/proxy.sh`.
2. It can silently modify `PROMPT_COMMAND` or `PS1` in ways that interfere with the custom PS1 set on line 83 (the override on line 83 wins, but any `PROMPT_COMMAND` set by `.bashrc` will re-evaluate on every prompt and may fight it).
3. Interactive init scripts (conda, nvm, etc.) can produce output or take non-trivial time to execute, making the 0.3 s sleep unreliable.

A safer approach is to source only the known proxy file and explicitly re-export the three variables that are actually needed:

```python
self.pane.send_keys(
    'source /etc/profile.d/proxy.sh 2>/dev/null; '
    'export HTTP_PROXY HTTPS_PROXY REQUESTS_CA_BUNDLE; true'
)
```

This avoids the broad side-effects of `.bashrc` while still propagating the proxy environment into the session.

How can I resolve this? If you propose a fix, please make it concise.

---

This is a comment left during a code review.
Path: strix/tools/terminal/terminal_session.py
Line: 81-82

Comment:
**Hardcoded sleep may be too short for slow startup scripts**

The 0.3 s sleep assumes that sourcing both files completes within that window. On systems with `conda init`, `pyenv`, `nvm`, or NFS-mounted home directories in `.bashrc`, this assumption can fail silently — the subsequent `send_keys` for the PS1 setup will be interleaved with still-running sourcing output, and the shell may not have fully applied the proxy variables before the first command is dispatched.

The existing `_execute_new_command` polling loop (which waits for the PS1 marker to appear) is the right pattern for reliable sequencing. A small wrapper that runs the source commands and then waits for the PS1 prompt to reappear would make initialization deterministic without requiring a magic sleep constant.

Alternatively, if the sleep is intentional, at minimum adding a comment explaining why 0.3 s was chosen (and that it may need tuning in slower environments) would help future maintainers.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix: inherit proxy config in sub-agent t..." | Re-trigger Greptile}