strike v0.5.2

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Patch release: TUI and web cockpit share a sharp royal-purple look, and the
web inspector and runtime bar no longer overflow or stack into an unusable pane.

Changed

• TUI matches the web cockpit — header chips (S STRIKE + status), left-accent transcript rows (YOU / STRIKE / tools), a single outlined instruction composer, and a thin right inspector. Pane modes, keybinds, and slash commands are unchanged; there is still no left session rail (#1231, #1245, #1250).
• Shared royal-purple tokens — schemas/ui-tokens.json is the source of truth for TUI Default() and web CSS. Accent is royal #5b21b6 / #7c3aed (not pastel lavender). Status colors (ready / working / needs-you / error) match across surfaces (#1233, #1237, #1239, #1244).
• Default TUI chrome is sharp bordered — stock panels use square ┌┐└┘ outlines (ChromeBordered) instead of Family soft-rounded cards. Upgrade note: theme files that omit chrome now resolve to bordered; set "chrome": "soft" to restore rounded surface-filled tiles (#1234, #1242).
• Web cockpit chrome — 0–2px rules, token-driven CSS, segmented Chat / Code / Team / Project / Ops (#1235, #1241).
• Web inspector is one column — compact scrollable tabs (grouped Surface select on phone) and one body. Context, activity, and queue are exclusive Chat surfaces, not a stack on top of every panel (#1247, #1249).

Fixed

• Runtime… no longer spills the page — expanding the top config bar scrolls that strip instead of widening the shell (#1246, #1248).
• Web shell flex — Chat, inspector, and rails stay inside the viewport at desktop (~1280) and narrow (~360) widths (#1236, #1243).

Full changelog: v0.5.1...v0.5.2

strike v0.5.1

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Patch release: new inspect/verify tools, content-addressed attachments, and
clearer deferred-tool and subagent naming.

Added

• Content-addressed attachments — user images and typed blobs (PDF, diagram, log, archive, build) persist as att:sha256: refs instead of embedding payloads in session JSONL. Provider requests still receive selected image bytes when the model supports them; unsupported formats fail visibly. Includes region redaction for PNG/JPEG, structured visual-compare evidence, and retention (#1055, #1195). Wire schema 1.18.0.
• browser tool (read-only inspect) — isolated per session/task profile for navigate, DOM/accessibility snapshot, console, and network capture. Domain/network.allow/SSRF apply below the model; clicks, typing, uploads, downloads, and script eval are denied. First slice of #1052 (#1187).
• LSP call hierarchy, rename preview, and impact tools — call_hierarchy, rename_preview, and impact query incoming/outgoing calls, preview a rename as unapplied file edits, and group symbol usage by file/package. Unsupported language-server capabilities return a non-fatal result and suggest references (#1184, #1191).
• git tool — read-only structured status / diff / log / blame / show as bounded JSON, not pager dumps. Mutators are refused. Workspace-root git only; distinct from unrestricted bash (#1179, #1193).
• verify tool — run the project's documented A/B/C gate and return failures only (package, test name, snippet, command). Missing docs fail closed instead of guessing go test ./... (#1180, #1197).
• status tool — this-turn harness working set: dirty paths, create/update/delete, optional content hashes. Reuses TurnDiff / FileState; empty when the turn is unchanged (#1182, #1198).
• tui_snapshot tool — last painted TUI frame as a redacted, size-bounded text dump (optional image_ref, never an embedded payload). Fails with precondition_failed when no frame is available (#1183, #1192).

Changed

• Deferred tools are named in first-turn guidance — pending tool names are listed (sorted, capped) without sending their InputSchemas until toolsearch, a direct call, history, or workflow activation. deferTools: "off" is unchanged (#1181, #1188).
• Subagent names come from the assigned task — omitted task / delegate name is derived from the prompt (or context-bundle goal) as a unique slug (fix-auth, fix-auth-2). Invalid or duplicate explicit names still fail closed (#1189, #1196).
• Ledger assumptions go stale when pinned evidence changes — optional evidence_pins (path+hash, symbol, recorded command) are checked before prompt inject. Stale rows stay active with a reason; ledger_write revalidate refreshes pins. Decisions and constraints are never auto-staled (#1185, #1194).

Fixed

• Agent and subagent tabs show that session's model — labels append the resolved model; inspecting a child shows the child's provider/model, not the parent's (#1186, #1190).

Full changelog: v0.5.0...v0.5.1

strike v0.5.0

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Minor release: Agent Plugins 1.0.0, a leaner default OS sandbox, --auto
vs --dangerously-skip-permissions, and web cockpit TUI-parity polish.

Added

• strike plugin migrate — convert a legacy Strike-native bundle to Agent Plugins 1.0.0 (plugin.json, portable skills/ + mcp.json, Strike-only files under com.strike.cli/). Atomic: stage, validate, then replace. Installed plugins require --yes; digest is recomputed and trust is cleared (not auto-granted). --dry-run prints the plan. Already-APS packages are refused (#1145).
• Agent Plugins 1.0.0 load path — install and run APS packages (plugin.json, skills/, mcp.json) plus Strike-only com.strike.cli extensions; CLI, catalog, doctor, TUI, and conformance tests follow the same contract (#1141–#1148).
• Web cockpit TUI parity — composer autocomplete (arrows + top-down list), plugin panes docked beside Chat, Chat session-group inspector, and inspector/completion chrome aligned with the TUI (#1140, #1155, #1156).

Changed

• Default OS sandbox is leaner — workspace-write still keeps $HOME and
  ~/.strike/config read-only, but now allows the toolchain/XDG caches and
  Strike session dirs coding workflows actually need. macOS Seatbelt grants
  file-map-executable, process-info, local IPC, and tty ioctls; Linux bwrap
  re-binds the host /dev/tty. Two strike processes (or a nested launch
  from sandboxed bash) can start without turning isolation off.
• --auto vs --dangerously-skip-permissions — they are no longer aliases. Both still skip configured permission asks (agent denies remain). Only --dangerously-skip-permissions bypasses network.allow (bash preflight, webfetch, websearch). --auto keeps the allowlist. OS sandbox is unchanged for both. Eval runners stay on --auto so isolation still holds.
• Plugin contract — native on-disk format is Agent Plugins 1.0.0 (plugin.json, portable skills/ + mcp.json). Strike-only assets use com.strike.cli. See docs/plugins.md (#1142).
• Upgrade note: Agent Plugins is native. Strike-native plugin manifests (schemaVersion + contributions) are deprecated; removal is planned for a future major. Use strike plugin migrate. strike plugin install of a Strike-native tree fails unless --legacy is passed. Already-installed legacy packages continue to load (#1147).

Deprecated

• Strike-native plugin authoring (schemaVersion + contributions + plugin.jsonc). Installed legacy bundles still load with a deprecation diagnostic until a future major. New installs require strike plugin install --legacy (#1147).

Fixed

• Second strike binary failing to launch — the default macOS Seatbelt
  profile allowed process-exec but not file-map-executable / process-info /
  host tty, so a second Go binary (or nested strike from sandboxed bash)
  could not start. The availability probe now uses those primitives and runs
  in its own process group so a nested Seatbelt failure cannot signal the
  parent instance.

Full changelog: v0.4.0...v0.5.0

strike v0.4.0

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Minor release: cohesive web cockpit, serve security hardening, nested
AGENTS.md, WSL2-only Windows posture, and session resume performance.

Security

• Web cockpit auth — /v1/* no longer accepts ?token= query credentials (they leak via shell history, proxy logs, and Referer). Open the printed /attach?token=… URL once for HttpOnly cookie handoff, or send Authorization: Bearer (#574).
• Web cockpit bind — strike serve --expose / --allow-cidr removed. Serve binds loopback only; remote access is ssh -L 8787:127.0.0.1:8787 (no cleartext LAN control plane) (#575).
• Web cockpit ops — per-IP rate limit on POST /v1/ops and WS op frames; serve_op audit records (type + source IP); optional --read-only rejects mutating ops (#576).

Added

• Docs (accuracy) — prompt caching (Anthropic three-breakpoint strategy, thinking-block skip, agent-switch miss; OpenAI/xAI/ChatGPT prompt_cache_key; Google unwired), image attach how-to, provider stream retry vs overflow compaction, checkpoint coverage/limits, permission/sandbox honesty, and threat-model.md for injection via files, MCP, and webfetch (#546).
• strike serve --read-only — reject mutating protocol ops while keeping attach/SSE (#576).
• Cohesive responsive multi-agent web cockpit (epic #1069) — strike serve is a progressive Chat/Code/Team/Project/Ops workspace for desktop, tablet, and phone:
  • Progressive mode shell, surface registry, and deep links (?mode= / ?surface= / ?entity=) with root isolation
  • Command palette, slash help, composer history, and @file completion
  • Transcript tool/diff/cost cards; long-session virtualization and stream batching
  • Scoped Code explorer with reviewed, confined file apply
  • Observe-first Team roster/board/attention plus artifacts, ledger, handoff/conflict review
  • Public human orchestration Ops with safe Team controls (CAS, idempotency, attach-only blocks)
  • Provider auth (key/OAuth/device), theme catalog preview/apply, scheduler presets, Project/Ops regroup (MCP, plugins, panes)
  • Real-browser smokes (make web-e2e) and operator conformance docs (docs/web.md, docs/web-cockpit-contract.md)
  • Not claimed: native apps, offline execution, push notifications, multi-user collaboration, or cross-device controller arbitration (see #1056 / #1060)

Changed

• Windows support — v1 is macOS, Linux, and Windows via WSL2 only. Native Windows is not supported (#579).
• Nested project instructions — AGENTS.md / CLAUDE.md from the workspace root down to the working directory are merged (root first, deepest last) instead of first-match-wins walking up. Global ~/.strike/AGENTS.md still layers first (#578).

Removed

• strike serve --expose / --allow-cidr — legacy flags error with an SSH migration hint. Upgrade note: replace LAN expose with SSH local forward; non-loopback --addr is rejected.

Fixed

• Session resume — opening or continuing a previous session from the welcome screen restores the transcript instead of a blank session, and JSONL replay no longer freezes the composer. Turns started while the session is still loading stay on /timeline (#1126, #1134).
• Sandbox probe — macOS Seatbelt availability is checked on first bash, not at startup (#1098, #1125).
• Echo catalog on serve — GET /v1/models?provider=echo returns 200 with synthetic models instead of 502 (#1131).

Full changelog: v0.3.1...v0.4.0

strike v0.3.1

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Patch release: child permission-mode inheritance and spawned-root welcome
screen corrections.

Fixed

• Child agents now inherit the parent session's live permission mode when they
  spawn or resume, while managed locks and persisted child modes remain
  authoritative
  (#1093,
  #1095).
• Spawned and newly created root sessions now show a minimal new-agent
  placeholder instead of the full welcome dashboard, including safe handling
  before a session id is available
  (#1092,
  #1094).

Full changelog: v0.3.0...v0.3.1

strike v0.3.0

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Minor release: plugins, containerization (E12), progressive tools, security
hardening, cost budgets, session lifecycle, steer, hooks, MCP surface, and the
wave 1030–1043 reliability/security pack. Protocol wire 1.17.0.

Added

• Session cost envelope — session.maxSessionCostUSD / session.maxTurnTokens
  plus CLI --max-cost cap catalog-priced usage. Emits session.budget_warning at
  50/80/100%; hard stop uses budget_exhausted (not silent). TUI status-bar budget
  chip and notices; per-child MaxCostUSD nests under the session envelope
  (#577,
  #1029).

• Root turn wall-clock deadline — session.turnTimeoutS (default 1800s;
  negative/off disables) and CLI --turn-timeout. Prefer timeout stop reason
  over tool-stamped canceled when the turn deadline fires
  (#1037,
  #1044).

• Lifecycle hooks vocabulary v1.0.0 — versioned shell/declarative hooks for
  session start/resume/end, turn start/end, provider attempt/retry, permission
  resolution, compaction, phase transition, child lifecycle, verification gates,
  and pre/post tool use. Stable correlation ids, schema_version, redacted
  bounded payloads; deterministic order declarative → shell
  (#1041,
  #1047).

• MCP prompts, resources, OAuth, catalog refresh — capability negotiation;
  typed list_prompts / get_prompt / list_resources / read_resource; HTTP
  OAuth (discover, authorize, refresh, revoke); list_changed rebinds catalogs
  without restart; missing capabilities degrade cleanly
  (#1042,
  #1061).

• Per-child worktree isolation — session.childIsolation / task.isolation
shared (default) or worktree. Isolated git worktrees under
  .strike/worktrees/<child-id>/; completion handoff includes patch +
  baseRevision and optional patch_collab submit; soft-fail to shared outside
  git repos (#1036,
  #1067).

• Resume persisted child sessions — task({action:"resume", id, …}) reopens
  an owned child JSONL with ownership/lineage checks; terminal refuse unless
  continue=true; incomplete tools settled on restore
  (#1035,
  #1062).

• Bash shadow-git checkpoints — bash mutations covered via per-session
  shadow-git baseline so /undo files restores formatter/codegen/sed -i
  changes; durable checkpoint stack under ~/.strike/checkpoints/<session-id>/
  (#572,
  #1028).

• DX grab-bag — optional OTLP/HTTP export (STRIKE_OTLP_ENDPOINT); skill
  adjacent resource reads + live catalog Reload; LSP missing-binary install
  hints (never auto-install); eval pass@k / pass^k / flakiness metrics
  (#1043,
  #1065).

• Active-turn steering — new steer op redirects a running root turn at the
  next safe request boundary (distinct from queued user.input and
  interrupt). Durable turn.steered events record boundary /
  cancel_restart / queued_fallback decisions. Wire schema 1.17.0
  (#1039).

• strike exec approval callbacks — --approval-control unix socket/FIFO
  NDJSON channel for per-request permission and question replies (once/reject;
  durable always/project requires explicit durable:true). Timeout, disconnect,
  and malformed replies fail closed; request payloads are secret-redacted.
  Legacy auto-reject without the flag is unchanged
  (#1040).

• Public session lifecycle contract — list/get/fork/fork_at/load/rewind_points
  shared across RPC, HTTP, ACP, and pkg/sdk with capability discovery and
  structured errors (session_not_found, session_busy, …). Wire schema
  protocol.Version 1.16.0
  (#1038).

Changed

• Progressive disclosure validation — offline fixture pack compares full vs
  progressive tool surfaces (schema tokens, completion, wall time) with documented
  rollback thresholds; legacy task shims stay registered/deferred; docs prefer
  task (#992,
  #993).

• Workflow tool activation — deferred plan/child/team tool families and
  advanced task promote from deterministic engine state (plan mode, children,
  multi-child) without toolsearch or a classifier; hard denies still win
  (#991,
  #993).

• Progressive task schemas — task starts with a compact basic schema
  (prompt-only create + status/wait/cancel). Advanced fields load after
  toolsearch, advanced args, or workflow activation; one tool name and one
  executor throughout (#989,
  #993).

• Progressive tool disclosure default — deferTools now defaults to on
  with a smaller always-visible core (read/glob/grep/edit/write/
  apply_patch/move/delete/bash/task/toolsearch/question).
  Compatibility delegation, team coordination, and plan tools stay registered
  but deferred until toolsearch, direct call, or workflow activation.
  Set deferTools: "off" to restore the full permitted tools[] surface
  (#988,
  #993).

Added

• Containerization test suite — golden Dockerfiles, preflight failure table,
  naming/hash/labels, /devcontainer skill contract, offline eject→launch→exec
  round-trip (E12.8 / #590).

• Eval container pool — SWE-bench runner uses internal/container CLI
  runtime and acquires scheduler.PoolContainer for the full instance
  lifecycle (admit before create; always release) (#592).

• Isolation indicator — header badge and /container show the E12.7 posture
  ladder (host+yolo → host+default → host+sandbox → container →
  container+no-network). STRIKE_ISOLATION is injected at launch (not
  inferred from /.dockerenv); recorded on session.meta (isolation).
  Protocol wire 1.15.0. Legend + context pane include the label (descriptive,
  not graded) (#589).

• Zone retired — peasant-community/zone archived with README pointing at
  strike; NOTICE records MIT→Apache-2.0 provenance for the container port
  (#591).

• Attach to live container — one container per repo (ContainerName);
  launch joins a compatible running container instead of creating a second.
  Stale config/image raises a prompt (attach / rebuild / cancel) or flags
  --container-attach-stale / --container-rebuild / --container-cancel.
  strike container ls / status; stderr reports attached vs started
  (#588).

• /devcontainer skill — built-in /devcontainer scaffolds project container
  config: strike container detect scans go.mod / package.json / Python
  manifests / Cargo.toml / flake.nix / Makefile; skill always asks via
  question (base image, deps, network, resources), writes
  .strike/container.json, shows Dockerfile diff, then strike container eject
  only after confirm. Config: needsNode/needsPython/needsGo/needsRust
  (#587).

• Queue right pane — /queue focuses a session-group pane listing buffered
  prompts, scheduled /loop jobs, and scheduler pool waits; reorder/edit/
  promote/delete/run-next from the pane (m opens the overlay browser)
  (#1007).

• Write-time content guards — write / edit / apply_patch /
  notebook_edit scan proposed content before disk. Default: credential
  shapes (PEM, AWS AKIA…, provider keys, GitHub/Slack tokens, …) deny
  with stable error code content_guard_denied; high-confidence dangerous
  sinks (language-limited eval/exec/os.system/…) ask. Config
  contentGuard.mode (off|default|ask|deny) and pathAllow globs;
  managed mode: deny is a ForcedDeny ceiling yolo cannot widen. Shares
  pkg/redact.Findings with egress redaction (write guard ≠ redact-on-read).
  Optional skill /write-guards
  (#890).

• Durable security audit sink — append-only redacted JSONL under
  ~/.strike/audit/ for permission/sandbox/admission (and related) decisions,
  retention prune, and strike audit export machine-readable bundles
  (#893).

• Schema-first security/harness telemetry families — versioned registry at
  schemas/telemetry/v1/registry.json with Go export structs, redaction
  annotations, golden fixtures, and make telemetry-check drift gate in...

strike v0.2.2

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Patch release: session scratch temp, harness tool broker, partial child handoffs on soft budget stop, diagnostics tool, config JSON Schema, and plugin contract docs. Protocol wire 1.12.0.

Added

• Session temporary directory — each engine session gets a private os.TempDir()/strike/<session-id>/ scratch root. Path tools (write / edit / apply_patch / notebook_edit) may write absolute paths under that root (siblings, .., and symlink escapes stay denied). The path is exposed in the environment prompt; the directory is removed on Run shutdown with bounded stale cleanup for crashes. Relative paths still bind only to the workspace (#877, #884).
• Harness tool execution — custom function harnesses can run allowed tools mid-turn through the Strike runtime (Input.Tools.Execute embedded; additive tool.execute / tool.result on the external JSONL ABI) with the same permissions, hooks, sandbox, scheduler, redaction, and protocol events as the built-in loop. Final harness.Result remains the only committed assistant response. Go/TypeScript/Lean SDKs updated; provider-only Lean harnesses stay arity-compatible (#878, #885).
• Partial child handoffs on budget exhaustion — soft per-child budgets (tool_calls, tokens, wall_clock, cost_usd, dangerous_tools, hard stall/loop) attempt one tools-disabled finalization turn (~45s reserve) so children can return structured findings before stop. ChildCompleted records budgetKind and finalization outcome; handoff quality is complete | partial | unavailable. Engine-tracked files and artifact refs always merge into the handoff. Hard cancel skips finalization (#879, #886).
• diagnostics tool — read-only, deferred model-facing workspace diagnostics backed by the LSP manager (workspace / directory / file scopes, severity filter, bounded stable JSON). Soft structured status when servers are missing or down; allow-by-default including the read-only permission preset (#880, #898).
• Main config JSON Schema — versioned schemas/strike-config.schema.json for editor autocomplete/validation of high-traffic config keys. Point $schema at the raw GitHub URL; Strike ignores $schema at runtime (no fetch). additionalProperties: true so unknown/future keys stay valid (#873, #900).
• Plugin bundle contract (docs) — normative PLUGIN.1 contract in docs/plugins.md (manifest, contribution matrix, trust/digest, path confinement, secrets). Loaders and install UX are not shipped yet (#725, #899).

Fixed

• Fixed live sessions losing their scratch temp dir when peer EnsureSessionTemp ran stale cleanup after >24h idle on disk by refreshing mtime (at most hourly) on ensure hits (#877, #884).
• Fixed macOS sandbox still blocking credential-backed CLIs (Keychain / SecurityServer / trustd) after the initial Keychain allowlist (#887).

Full changelog: v0.2.0...v0.2.2

strike v0.2.0

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Minor milestone: OS sandbox and scheduler, first-run onboarding, public protocol/SDK surfaces, LSP, multi-agent orchestration harness, plans and workflows, and enterprise settings.

Added

• OS sandbox for bash — Linux bwrap / macOS sandbox-exec isolation with config/CLI dial sandbox: off | read-only | workspace-write (default workspace-write; --sandbox, /sandbox). Permission deny globs compile into OS filesystem denials; /sandbox explain shows the generated profile. Structured denials, process rlimits, and an isolation matrix document the two-dial model with permissionMode. yolo with sandbox: off requires --i-know (#551, #552, #553, #799).
• Network allowlist — config network.allow (global/project) whitelists hosts, *.suffix wildcards, IPs, and CIDRs for webfetch. Empty means unrestricted public hosts (SSRF private blocks unchanged). Shown in /sandbox explain (#527).
• Named-pool scheduler — fair cancellable admission for model streams and agent bash, layered limits, command classification, build-system presets (CMake, Ninja, Gradle, Bazel, Maven, Cargo, npm/yarn/pnpm/bun), and queue state on the protocol/TUI (#706–#711).
• /ftue onboarding — setup wizard (provider, model, optional /init), contextual feature tour, optional scheduler preset step, and one-shot auto-open for clean installs via ~/.strike/onboarding.json. Established installs are not surprised; exec/auth/serve skip onboarding (#702–#705).
• Public protocol package and clients — pkg/protocol Op/Event wire schema (through 1.11.0), Go SDK (pkg/sdk), strike rpc stdio JSON-RPC, strike acp Agent Client Protocol adapter, strike mcp-serve (strike_task), and strike exec --json / --output-format envelopes. Unknown event types decode as UnknownEvent for forward-compat; normative docs/protocol.md (#564–#569, #811).
• LSP — JSON-RPC client, extension registry, diagnostics injection into file-tool results, default servers, /lsp, diagnostics pane, and optional definition/references/symbols nav tools (#555–#558).
• Multi-agent orchestration harness — atomic delegation lifecycle (delegate + task criteria/deps/subscribe; states through review/done), structured child handoffs, agent-to-agent contracts (require_ack, urgency, agent_thread), event subscriptions/wait, independent verification gates and claim-vs-verified attach, per-agent budgets, capability-aware routing, path-ownership overlap detection, patch-level collaboration, scoped context bundles, typed shared artifacts, and a decision/assumption ledger (#770–#782, #806).
• Cancellation, deadlines, retry, and tool contracts — stable canceled/timeout/queue_full codes, turn timeouts, process-group kill, tool error recovery/retry policy, strong side-effect/idempotency contracts, and FS transaction safety (baseHash, atomic writes, turn diffs) (#793–#797, #795).
• Plans and workflows — root-owned plan domain with plan_read/plan_write, editable plans pane, plan-mode handoff gate, section delegate through team runtime; workflow schema v1, lifecycle/resume, autonomy-authoritative gates, phase permission review, catalog/activation UX, model-generated drafts, visual builder, and web authoring parity (#712–#724, #719).
• Run timeline, sessions, and diagnostics — structured run timeline with redacted export, storage bounds/blob spill/trace retention; durable JSONL append, schema header, export/import, retention; deterministic recording, branch-from-event, run compare, multi-agent snapshots; prompt/config diagnostic bundles; shared secret redaction and secret-ref env indirection (#790–#792, #796, #803, #810).
• Context controls — token-by-source visibility, pin/exclude, fit warnings; compaction with structured provenance residue (#802, #804).
• Permissions and settings — explain/scopes/presets/audit trail; /settings ports for compaction/prune, permissionAutoApprove, maxChildDepth, and other high-value dials; main config JSONC + optional $schema; managed/MDM config layer for enterprise policy (#761–#764, #798, #509).
• Harness trust and undo UX — TUI harness trust/control surfaces; /undo previews harness paths from the last turn, surfaces checkpoint-skipped counts, and warns on uncovered bash mutations (SessionRewound carries restored paths + uncovered). Full bash snapshot coverage remains #572; checkpoint stack across --continue remains #573 (#801, #809).
• TUI polish — queue browser for buffered prompts, richer DiffPreview (LCS/word-diff/gutters), /pets companion pane, hide file bodies from chat for reads and @ mentions, toolsearch quoted phrases (#525, #524, #395, #746, #8).
• Session replay and harness eval — deterministic replay against the echo provider, prompt regression suite, and harness evaluation/regression tracking (#559, #560, #807).

Changed

• Upgrade note: Bash runs under the OS sandbox by default (sandbox: workspace-write). Set sandbox: off (or --sandbox off) to restore unsandboxed shell; combining yolo with sandbox off requires --i-know (#552).
• Bash sandbox network default — host networking stays on under default permissions so gh, git, and package managers work; network isolation applies only when both webfetch and mcp are hard-deny on *. Air-gap is opt-in via NoNetwork on the sandbox policy (#750).
• FTUE build presets — scheduler preset rows use [x] / [ ] checkbox marks so selected vs unselected tools are obvious (#747).

Fixed

• Fixed default OS sandbox / bash path guard blocking normal shell use: redirects, temp-dir writes, and tool caches (~/.cache, Go/npm/cargo) are shared-writable while the workspace stays isolated (#752).
• Fixed bash under the default OS sandbox failing DNS/network (gh auth status, git push, etc.) by keeping host networking as the policy zero value (#750).
• Fixed macOS sandbox blocking Keychain access needed for credentials and system tools (#868).
• Fixed multi-root agent order jumping when switching sessions (#865, #869).
• Hardened path-mutation writes against TOCTOU races and closed cheap holes in the destructive bash guard (#549–#551, #699).

Security

• OS-level isolation for bash (filesystem + optional network), permission-compiled deny profiles, webfetch host allowlists, shared credential redaction on exports/traces, and secret-ref env indirection reduce accidental credential and workspace leakage (#551, #527, #796).

Full changelog: v0.1.2...v0.2.0

strike v0.1.2

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Patch release focused on TUI composer input and live subagent transcript stability.

Changed

• Upgrade note: Default tool-apply keybind is now alt+a (was bare a/A). Override nav.tool-apply in keybinds.jsonc to restore the previous binding (#693, #694).

Fixed

• Fixed bare a/A being captured as tool-apply instead of typing in the chat composer when a tool cell was selected (#693, #694).
• Fixed focusing a running subagent corrupting the live transcript and multi-pane layout while the child continued streaming (#692, #695).
• Reduced repeated disk I/O when listing sessions via a short-lived in-memory cache (#619, #696).

strike v0.1.1

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Patch release focused on TUI layout stability and launch-screen usability.

Fixed

• Fixed lean launch-screen autocomplete suggestions appearing far above the prompt on tall terminals (#688, #690).
• Fixed Egyptian hieroglyphs and other historic scripts disrupting multi-column TUI layout when rendered in terminals that display them double-wide (#689, #691).