deep mode: non-lifecycle final output loop causes MaxTurnsExceeded, 29 findings lost

[elysiayunchen]

Bug Description

Running strix --target <URL> -m deep -n leads to one or more agents entering an infinite non-lifecycle final output loop (empty output retries). The stuck agent eventually hits the 500-turn MaxTurnsExceeded limit, causing the coordinator to fail with status: failed — even though 6 other agents successfully completed and reported findings back.

Steps to Reproduce

1. strix --target https://elysia-cloudnyx-blog.top/ -m deep -n
2. Let it run for ~3 hours
3. Observe agent bbee01c8 stuck in NFE loop, other 6 agents finish normally

Environment

• Strix version: v1.1.0 (Windows x86_64 binary, PyInstaller-packaged)
• OS: Windows 11, Docker Desktop v29.2.1
• LLM: openai/gpt-5.6-sol via custom base URL (OpenAI-compatible proxy)
• Sandbox: ghcr.io/usestrix/strix-sandbox:1.0.0

Actual Behavior

1. 6 agents completed with findings (total: 29):

   • Content Discovery Mapper: 6 findings
   • External Recon Lead: 7 findings
   • 1664cf65: 4 findings
   • 1dbdeb7d: 3 findings
   • 1cd0995d: 4 findings
   • 72f20f76: 5 findings

2. Agent bbee01c8 entered a loop producing empty non-lifecycle final output — strix forced tool continuation 500 times (all with <empty> output, zero LLM tokens consumed).

3. After 500 retries, MaxTurnsExceeded was raised, causing the root coordinator to terminate without aggregating the 6 completed agents' findings.

4. Final run.json: status: failed, findings: [], end_time: 2026-07-17T06:16:59Z

5. findings.sarif: empty (0 results, 0 rules)

Warning Pattern in Logs

Repeated ~500 times:

WARNING - strix.core.execution: agent bbee01c8 produced non-lifecycle 
final output in non-interactive mode; forcing tool continuation (N/500): <empty>

Final failure:

agents.exceptions.MaxTurnsExceeded: Agent exhausted non-interactive 
recovery attempts without calling finish_scan or agent_finish.

Expected Behavior

• Strix should detect an agent stuck in NFE loops (e.g., after N consecutive empty outputs) and either terminate that specific agent gracefully or skip it to let the coordinator finalize.
• Alternatively, the coordinator should aggregate completed agent findings regardless of whether all agents finished.
• At minimum, findings from agent_finish calls (which were logged) should be persisted to SARIF before the scan terminates.

Impact

• 3 hours of scan time lost
• ~40.7M tokens consumed (456 API requests)
• 29 confirmed findings (from completed agents) not serialized to report
• User has no actionable vulnerability report

Suggested Fix

1. Add a detection for NFE loops: if an agent produces empty output >N times consecutively, mark it as failed/unresponsive and remove it from the agent graph.
2. Ensure the coordinator can finalize even with partial agent completion (graceful degradation).
3. Flush findings to SARIF incrementally when each agent finishes, rather than waiting for coordinator shutdown.

Attachments

Full run.json (272KB), strix.log (2.4MB), and scan-deep.log available on request.