v0.4.0 - Cursor adapter and Claude Code plugin

Stroq 0.4.0 adds a second agent and a second install path.

Cursor support

• stroq init --agent cursor writes .cursor/hooks.json (or ~/.cursor/hooks.json with --user; --dry-run previews) and registers stroq hook cursor on six events: beforeShellExecution and beforeMCPExecution are blocking and installed with failClosed: true, answered as {"permission":"deny"|"ask","user_message","agent_message"}; beforeReadFile scans the file body before the agent sees it (a suspect file is allowed with a warning and taints the session; a credential path under taint is denied); afterShellExecution and afterMCPExecution scan, taint and record provenance (a suspect MCP result adds additional_context); afterFileEdit is audit-only because Cursor has no beforeFileEdit.
• The engine, rules, policy, provenance, secret-egress guard and audit format are shared with the Claude Code adapter unchanged. Both the official and the community field spellings are accepted.
• Hardened against a hostile MCP server or repository: the workspace root, not the shell's cwd, is the project for the secret index (a cd /tmp does not shed it); MCP tool names are sanitised so no __ can be synthesised inside a segment and a pre-shaped mcp__… name cannot override the reported server; non-object tool inputs stay visible to the secret guard.
• stroq doctor gains a cursor hooks line; a runnable demo (examples/demo/run-cursor-demo.sh) runs in CI.
• Documented limits: Cursor honours no output after shell commands (the taint still applies to the next action), edits cannot be blocked (recorded in the audit as decisions that were not enforced), multi-root workspaces index only the first root; Tab hooks, generic preToolUse/postToolUse, beforeSubmitPrompt, updated_input, enterprise/team hook locations and the Cursor CLI are out of scope for now; Windows is untested.

Claude Code plugin and marketplace

• The repository is a plugin marketplace with one plugin: /plugin marketplace add AGGIB/Stroq then /plugin install stroq@stroq installs the same hooks as stroq init without touching .claude/settings.json. The hook wrapper prefers a globally installed stroq and falls back to npx -y @stroq/cli@<pinned>; if neither can start, a PreToolUse event exits 2 (block), so a missing runtime never silently disables the firewall.

Also

• Site: current default policy in the YAML figure, shipped-feature tiles, Vercel Web Analytics (first-party, cookieless); README: stroq attack badge, seven-scene demo GIF; SECURITY.md supported versions.

Verification

• 744 tests across 56 files, coverage ≈ 97 / 89 / 100 / 99 (statements / branches / functions / lines); CI on Node 22 and 24 runs both demos and the attack suite.
• The Cursor adapter went through a whole-branch security review that found and fixed a tool-name shape ("__", "!", non-ASCII) which would have made an MCP call unclassifiable and let a secret value out through it on Cursor only.

Install: npm install -g @stroq/cli then stroq init (Claude Code) or stroq init --agent cursor; or npx @stroq/cli init.