feat: add fail-closed mount-free transport for local-code Docker scans

[manideep-malyala]

Summary

Implements #1080 — adds a require_mount_free configuration flag (env: STRIX_REQUIRE_MOUNT_FREE) that enforces mount-free (bind-mount-free) transport for local-code Docker scans.

When enabled, Strix guarantees that no host directories are bind-mounted into the scanning container. Local sources are transferred via the Manifest upload path, keeping the container fully isolated from the host filesystem. A symlink-safe tree walker ensures projects containing symlinks (e.g. node_modules, venv, tool wrappers) are transferred without aborting sandbox startup.

Changes

• strix/config/settings.py: Added require_mount_free boolean field to RuntimeSettings (env: STRIX_REQUIRE_MOUNT_FREE, default False).
• strix/runtime/backends.py: Added _MOUNT_FREE_BACKENDS registry and backend_supports_mount_free() helper. Extended register_backend() with supports_mount_free kwarg (default True).
• strix/runtime/session_manager.py: Fail-closed enforcement in create_or_reuse — raises RuntimeError if the backend does not support mount-free transport. Added _symlink_safe_dir_entry() which walks the source tree, resolving symlinks into File/Dir entries so the SDK LocalDir symlink rejection is bypassed entirely. Dangling symlinks are skipped with a warning rather than aborting.
• strix/core/inputs.py: Agent system prompt dynamically adapts — describes sources as a "bounded snapshot, isolated from the live host system" when mount-free is active.
• strix/report/state.py: Records a transport field ("bind-mount" or "mount-free") in run.json for downstream security auditing.
• tests/test_mount_free.py: New test validating the fail-closed guarantee when a backend without mount-free support is used with the flag enabled.

Testing

uv run --all-extras pytest
931 passed, 2 warnings in 151.66s

[greptile-apps]

Greptile Summary

This PR adds an opt-in mount-free transport policy for local-code Docker scans, backend capability registration, transport-aware prompts and run metadata, and per-model LiteLLM endpoint configuration.

• Adds STRIX_REQUIRE_MOUNT_FREE and rejects incompatible backends.
• Routes local sources through manifest upload when bind mounts are forbidden.
• Records and describes the selected transport in run artifacts and agent instructions.
• Adds a refusal-path test for backends without mount-free support.

Confidence Score: 4/5

The mount-free feature should not merge until symlink-containing local projects can be transferred without aborting sandbox startup.

Requiring mount-free transport sends unmodified source trees through the SDK LocalDir materializer, which rejects symlinks and prevents common local-code scans from starting.

Files Needing Attention: strix/runtime/session_manager.py, tests/test_mount_free.py

Important Files Changed

Filename	Overview
strix/runtime/session_manager.py	Enforces the mount-free policy and selects manifest upload, but raw LocalDir uploads make symlink-containing local projects fail during session startup.
strix/runtime/backends.py	Adds mount-free capability tracking and registration metadata with fail-closed support checks.
strix/config/settings.py	Adds the boolean STRIX_REQUIRE_MOUNT_FREE runtime setting with a safe default.
strix/core/inputs.py	Adjusts local-source descriptions according to the configured backend and mount-free policy.
strix/report/state.py	Persists the selected transport label in run.json for auditing.
strix/config/models.py	Moves LiteLLM key and base URL configuration from module globals to resolved model instances.
tests/test_mount_free.py	Covers incompatible-backend refusal but not successful mount-free transfer of realistic source trees such as projects containing symlinks.

Comments Outside Diff (1)

1. strix/runtime/session_manager.py, line 305 (link)

   Mount-free uploads reject symlinks

   When STRIX_REQUIRE_MOUNT_FREE is enabled for a local-code target or workspace containing a symlink, this path passes the unmodified tree to the SDK's LocalDir materializer, which raises LocalDirReadError(reason="symlink_not_supported") and aborts sandbox startup before the scan can run.

   Knowledge Base Used: Runtime and Docker Sandbox

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: strix/runtime/session_manager.py
   Line: 305
   
   Comment:
   **Mount-free uploads reject symlinks**
   
   When `STRIX_REQUIRE_MOUNT_FREE` is enabled for a local-code target or workspace containing a symlink, this path passes the unmodified tree to the SDK's `LocalDir` materializer, which raises `LocalDirReadError(reason="symlink_not_supported")` and aborts sandbox startup before the scan can run.
   
   **Knowledge Base Used:** [Runtime and Docker Sandbox](https://app.greptile.com/strix-org-3/-/custom-context/knowledge-base/usestrix/strix/-/docs/runtime-and-docker.md)
   
   ---
   
   For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Prompt To Fix All With AI

### Issue 1
strix/runtime/session_manager.py:305
**Mount-free uploads reject symlinks**

When `STRIX_REQUIRE_MOUNT_FREE` is enabled for a local-code target or workspace containing a symlink, this path passes the unmodified tree to the SDK's `LocalDir` materializer, which raises `LocalDirReadError(reason="symlink_not_supported")` and aborts sandbox startup before the scan can run.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat: add fail-closed mount-free transpo..." | Re-trigger Greptile}