v0.24.0

Install: npm i -g @stroq/cli@0.24.0, or npx @stroq/cli@latest init. Every change, with the reasons, is in the changelog.

Changed

• Attack and action-benchmark JSON reports are version 2. stroq attack, its fuzz mode, and stroq bench --actions report policy, corpus and execution context. Timeouts and errors are explicit inconclusive outcomes; benchmarks exclude them from judged measurements. Consumers of JSON reports must handle the new version and fields: in attack --json the ruleId of a post step now names the first rule that matched (it was always null). stroq attack, attack --fuzz and stroq bench --actions exit 1 when anything is inconclusive, and the bench rate is null then. These are in-process measurements, not evidence of live-host enforcement.

Fixed

• An interrupted scan can no longer count as protection. Attack and fuzz runs fail on inconclusive scenarios, and both CI and release gates reject inconclusive fuzz variants as well as escapes. This includes the scan of the text a write puts into an instruction file (CLAUDE.md, AGENTS.md): when it runs out of its time budget the call is still asked about, as before, but PreResult.signals now says instruction-scan-took-too-long and a report counts it as inconclusive, not as a rule that held.
• A ; or | inside quotes no longer hides what a command writes. The plain cut of a command cuts at a separator even inside quotes, so echo x > '/tmp/a;b/p/.git/hooks/pre-commit' or cp payload 'a|b/../.git/hooks/pre-commit' came apart into two pieces, none of which held both the write and the file, and deny-git-exec (and, for a path under ~/.stroq, deny-self-tamper) did not fire. The stages that the quote-aware reading has whole are now read too, besides the plain cut. This was so in 0.23.0 and earlier; it was found by a review of 0.24.0.
• stroq exposure counts every incident. Incidents that timed out or failed were left out of its total, so a machine that could not judge 20 of 36 showed a shorter, cleaner count; it now reports them as incident-unjudged.
• Secret scanning skips spans too short to be a secret before it builds candidates for them, which cuts the time spent on settings files with many short strings by about a third. The candidates it produces are the same.

Added

• Internal host-verification library. Correlates issued commands, hook audit and temporary sentinels with a matching no-op control; missing evidence, limits and billing uncertainty stay inconclusive or not attempted.
• Internal reversible configuration-edit library. Adds bounded previews, JSON and marked-block edits, atomic writes, private backups and undo that preserves later owner edits. Files containing credential-shaped text are not copied into backups; replaced JSON credentials are masked in undo records, and credential-bearing text blocks are not replaced. Linked-target previews require acknowledgement.
• Artifact contracts. Strict source/passport schemas, bounded trees and the versioned stroq-tree/1 digest reject unsafe paths, aliases and inconsistent metadata before acceptance.
• Task-scope foundations. The classifier exposes bounded file/network resources; core scope evaluation validates signed Ed25519 permits and exact-call extensions while retaining hard denies and rejecting incomplete resources.

These foundations do not yet provide prove, harden, vet, add, remove, task or permit commands, live-host drivers, adapter-wide task enforcement or filesystem isolation.