v0.23.0

Install: npm i -g @stroq/cli@0.23.0, or npx @stroq/cli@latest init. Every change, with the reasons, is in the changelog.

What is new

• stroq init on a terminal shows what it will read and write, asks first, installs, and starts the hook it wrote with a harmless action and with curl … | sh, to see that it answers.
• stroq sent --card writes a summary of what an agent already saw that holds no value, name, path or hash, and stroq replay --html writes one self-contained page of a replay.
• stroq doctor says when the host last called the hook and how many rules can fire. stroq bench --actions measures what Stroq does to ordinary work (75 scenarios, 4 asked).
• The Claude Code plugin starts a pinned copy of Stroq instead of npx on every hook.
• Rules on tool_response and tool_description now receive those fields: 450 of the 621 active rules can fire (304 of 640 before).

The classifier reads shell text the way the shell does

Every program a shell is handed (pipes, here-strings and here-documents, process substitutions, -c, eval, trap, files, ssh host sh) is decoded and read, or the command is asked about. Nested commands, functions, aliases and variables that name a command are read, and so is the same command spelt another way. A script no longer carries a session past a taint-gated deny. curl … | python3 -c '…' is judged by what the program does, and is no longer denied for the interpreter alone.

Fixed

• Antigravity on Windows refused every tool call. Its hook line had quotes in it, and Antigravity hands the line to cmd.exe with each quote escaped, which cmd.exe cannot start. init now writes the line without quotes for Antigravity, Cursor and Codex, and starts it the way the host does before it keeps it; doctor calls an old line BROKEN. If Antigravity already blocks every tool call: stroq uninstall --agent antigravity (add --user for the user config), then stroq init --agent antigravity again.
• A FIFO named like a script hung the hook, and a byte-order mark in front of the hook's JSON made every call fail closed. More in the changelog.

Measured

stroq attack replays 36 scenarios: 17 blocked, 19 asked, 0 passed through; --fuzz: 500 variants, 0 escapes. The classifier was run against real bash and zsh on 1,296 command shapes, 2,890 spellings, 8,338 fuzzed stacks per shell and 19,928 grammar-fuzzed commands: none evaded.

Not covered

The Antigravity fix was checked against the real cmd.exe on CI, not against Antigravity itself, and Cursor and Codex have not been seen on Windows. Inline Node programs after a fetch are asked about, and Perl, Ruby and PHP ones stay denied. Rules on user_input stay dormant: Stroq never sees the user's own messages.