Skip to content

strike v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 06 Aug 13:39
· 796 commits to main since this release
v0.2.0
8e8b3b7

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Minor milestone: OS sandbox and scheduler, first-run onboarding, public protocol/SDK surfaces, LSP, multi-agent orchestration harness, plans and workflows, and enterprise settings.

Added

  • OS sandbox for bash — Linux bwrap / macOS sandbox-exec isolation with config/CLI dial sandbox: off | read-only | workspace-write (default workspace-write; --sandbox, /sandbox). Permission deny globs compile into OS filesystem denials; /sandbox explain shows the generated profile. Structured denials, process rlimits, and an isolation matrix document the two-dial model with permissionMode. yolo with sandbox: off requires --i-know (#551, #552, #553, #799).
  • Network allowlist — config network.allow (global/project) whitelists hosts, *.suffix wildcards, IPs, and CIDRs for webfetch. Empty means unrestricted public hosts (SSRF private blocks unchanged). Shown in /sandbox explain (#527).
  • Named-pool scheduler — fair cancellable admission for model streams and agent bash, layered limits, command classification, build-system presets (CMake, Ninja, Gradle, Bazel, Maven, Cargo, npm/yarn/pnpm/bun), and queue state on the protocol/TUI (#706–#711).
  • /ftue onboarding — setup wizard (provider, model, optional /init), contextual feature tour, optional scheduler preset step, and one-shot auto-open for clean installs via ~/.strike/onboarding.json. Established installs are not surprised; exec/auth/serve skip onboarding (#702–#705).
  • Public protocol package and clients — pkg/protocol Op/Event wire schema (through 1.11.0), Go SDK (pkg/sdk), strike rpc stdio JSON-RPC, strike acp Agent Client Protocol adapter, strike mcp-serve (strike_task), and strike exec --json / --output-format envelopes. Unknown event types decode as UnknownEvent for forward-compat; normative docs/protocol.md (#564–#569, #811).
  • LSP — JSON-RPC client, extension registry, diagnostics injection into file-tool results, default servers, /lsp, diagnostics pane, and optional definition/references/symbols nav tools (#555–#558).
  • Multi-agent orchestration harness — atomic delegation lifecycle (delegate + task criteria/deps/subscribe; states through review/done), structured child handoffs, agent-to-agent contracts (require_ack, urgency, agent_thread), event subscriptions/wait, independent verification gates and claim-vs-verified attach, per-agent budgets, capability-aware routing, path-ownership overlap detection, patch-level collaboration, scoped context bundles, typed shared artifacts, and a decision/assumption ledger (#770–#782, #806).
  • Cancellation, deadlines, retry, and tool contracts — stable canceled/timeout/queue_full codes, turn timeouts, process-group kill, tool error recovery/retry policy, strong side-effect/idempotency contracts, and FS transaction safety (baseHash, atomic writes, turn diffs) (#793–#797, #795).
  • Plans and workflows — root-owned plan domain with plan_read/plan_write, editable plans pane, plan-mode handoff gate, section delegate through team runtime; workflow schema v1, lifecycle/resume, autonomy-authoritative gates, phase permission review, catalog/activation UX, model-generated drafts, visual builder, and web authoring parity (#712–#724, #719).
  • Run timeline, sessions, and diagnostics — structured run timeline with redacted export, storage bounds/blob spill/trace retention; durable JSONL append, schema header, export/import, retention; deterministic recording, branch-from-event, run compare, multi-agent snapshots; prompt/config diagnostic bundles; shared secret redaction and secret-ref env indirection (#790–#792, #796, #803, #810).
  • Context controls — token-by-source visibility, pin/exclude, fit warnings; compaction with structured provenance residue (#802, #804).
  • Permissions and settings — explain/scopes/presets/audit trail; /settings ports for compaction/prune, permissionAutoApprove, maxChildDepth, and other high-value dials; main config JSONC + optional $schema; managed/MDM config layer for enterprise policy (#761–#764, #798, #509).
  • Harness trust and undo UX — TUI harness trust/control surfaces; /undo previews harness paths from the last turn, surfaces checkpoint-skipped counts, and warns on uncovered bash mutations (SessionRewound carries restored paths + uncovered). Full bash snapshot coverage remains #572; checkpoint stack across --continue remains #573 (#801, #809).
  • TUI polish — queue browser for buffered prompts, richer DiffPreview (LCS/word-diff/gutters), /pets companion pane, hide file bodies from chat for reads and @ mentions, toolsearch quoted phrases (#525, #524, #395, #746, #8).
  • Session replay and harness eval — deterministic replay against the echo provider, prompt regression suite, and harness evaluation/regression tracking (#559, #560, #807).

Changed

  • Upgrade note: Bash runs under the OS sandbox by default (sandbox: workspace-write). Set sandbox: off (or --sandbox off) to restore unsandboxed shell; combining yolo with sandbox off requires --i-know (#552).
  • Bash sandbox network default — host networking stays on under default permissions so gh, git, and package managers work; network isolation applies only when both webfetch and mcp are hard-deny on *. Air-gap is opt-in via NoNetwork on the sandbox policy (#750).
  • FTUE build presets — scheduler preset rows use [x] / [ ] checkbox marks so selected vs unselected tools are obvious (#747).

Fixed

  • Fixed default OS sandbox / bash path guard blocking normal shell use: redirects, temp-dir writes, and tool caches (~/.cache, Go/npm/cargo) are shared-writable while the workspace stays isolated (#752).
  • Fixed bash under the default OS sandbox failing DNS/network (gh auth status, git push, etc.) by keeping host networking as the policy zero value (#750).
  • Fixed macOS sandbox blocking Keychain access needed for credentials and system tools (#868).
  • Fixed multi-root agent order jumping when switching sessions (#865, #869).
  • Hardened path-mutation writes against TOCTOU races and closed cheap holes in the destructive bash guard (#549–#551, #699).

Security

  • OS-level isolation for bash (filesystem + optional network), permission-compiled deny profiles, webfetch host allowlists, shared credential redaction on exports/traces, and secret-ref env indirection reduce accidental credential and workspace leakage (#551, #527, #796).

Full changelog: v0.1.2...v0.2.0

Assets 7
Loading