[samirhvbr]

postman://collection?env=environment currently uses environment values to authorize base URLs, then stages the unmodified collection. For example, scope includes https://one.test while the agent receives the collection default https://default.test, with {{tenant}} and {{token}} still lacking their environment values.

Fixes #1633 by carrying enabled, referenced environment values in the staged collection's standard variable block. Environment values override collection defaults; request templates, auth configuration and existing variable metadata remain intact. Dependencies of used variables are included with a cycle guard; unrelated environment values and the host's Postman API key are excluded.

Each fetch gets a separate snapshot directory, so targeting the same collection with two environments cannot overwrite the first target before staging. Snapshots use the existing private-file writer; copy2 retains the file permissions when staging. Download snapshots are removed only after all staging copies succeed, and pending downloads are cleaned up at normal process exit. The per-run copy remains available for resume; failed staging can be retried.

Validation on main 6b7ae2ebe4d47037a927aade23265ff4e4f27e84, Python 3.12.14 and frozen dependencies, with isolated HOME and dotenv loading disabled:

• Five regressions fail on the unchanged base; the no-environment control passes. All six pass with this patch. Two additional cleanup regressions fail on the initial PR head and pass after the lifecycle fix.
• 114 focused tests pass across Postman handoff, spec parsing/staging, private files, root-task inputs and target lists.
• Ruff formatting/lint, Mypy and Bandit pass. make check-all still stops at the existing Pyright baseline: 941 errors, with no added or removed normalized diagnostics.
• A real Python subprocess confirms cleanup of an unstaged download on normal process exit.
• Mocked Postman HTTP responses exercise the real environment enabled-value filter. No live Postman account, LLM, Docker scan or full-suite run was used for this patch.

The CLI documentation states the boundary: this carries {{name}} template dependencies; variables accessed only through script APIs such as pm.environment.get(...) are not inferred. It does not execute Postman scripts or inline-substitute request contents.

Related active work: #1158 validates Postman resource IDs and changes the same writer to use write_secret_text. This PR leaves its ID-validation scope to that work; its small writer overlap should be reconciled whichever merges first. The private writer here is needed because the staged snapshot now includes environment credentials.

[mintlify]

Preview approval required

This pull request comes from a fork, so Mintlify won't build a preview until someone with write access approves commit 5f65feb.

Approve preview

[greptile-apps]

Confidence Score: 4/5

[Critical impact] Referenced Postman environment secrets now reach the scan agent's API-spec input.

The PR appears safe to merge, with snapshot cleanup as a non-blocking follow-up.

Findings

1.  Old snapshots keep accumulating ▶

Fix with agent prompt

### Issue 1
strix/interface/utils.py:1515-1517
`write_fetched_collection` now creates a fresh directory on every fetch, but nothing removes these snapshots after staging or when a scan ends. Repeated scans of the same collection keep every old copy, including environment credentials, instead of replacing one cached file. Add cleanup tied to the scan's lifetime, while preserving files still needed for staging or resume.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

The PR carries referenced Postman environment values into the collection given to the agent.

• Postman collections carry the environment values their templates use.
• Each Postman fetch gets its own private collection snapshot.

_{Reviews (1) · Last reviewed commit: "fix(api-spec): preserve referenced Postm..." · Reviewed by Greptile}

[greptile-apps]

Old snapshots keep accumulating

write_fetched_collection now creates a fresh directory on every fetch, but nothing removes these snapshots after staging or when a scan ends. Repeated scans of the same collection keep every old copy, including environment credentials, instead of replacing one cached file. Add cleanup tied to the scan's lifetime, while preserving files still needed for staging or resume.

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/interface/utils.py
Line: 1515-1517

Comment:
**Old snapshots keep accumulating**

`write_fetched_collection` now creates a fresh directory on every fetch, but nothing removes these snapshots after staging or when a scan ends. Repeated scans of the same collection keep every old copy, including environment credentials, instead of replacing one cached file. Add cleanup tied to the scan's lifetime, while preserving files still needed for staging or resume.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.