strike v0.3.0

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Minor release: plugins, containerization (E12), progressive tools, security
hardening, cost budgets, session lifecycle, steer, hooks, MCP surface, and the
wave 1030–1043 reliability/security pack. Protocol wire 1.17.0.

Added

• Session cost envelope — session.maxSessionCostUSD / session.maxTurnTokens
  plus CLI --max-cost cap catalog-priced usage. Emits session.budget_warning at
  50/80/100%; hard stop uses budget_exhausted (not silent). TUI status-bar budget
  chip and notices; per-child MaxCostUSD nests under the session envelope
  (#577,
  #1029).

• Root turn wall-clock deadline — session.turnTimeoutS (default 1800s;
  negative/off disables) and CLI --turn-timeout. Prefer timeout stop reason
  over tool-stamped canceled when the turn deadline fires
  (#1037,
  #1044).

• Lifecycle hooks vocabulary v1.0.0 — versioned shell/declarative hooks for
  session start/resume/end, turn start/end, provider attempt/retry, permission
  resolution, compaction, phase transition, child lifecycle, verification gates,
  and pre/post tool use. Stable correlation ids, schema_version, redacted
  bounded payloads; deterministic order declarative → shell
  (#1041,
  #1047).

• MCP prompts, resources, OAuth, catalog refresh — capability negotiation;
  typed list_prompts / get_prompt / list_resources / read_resource; HTTP
  OAuth (discover, authorize, refresh, revoke); list_changed rebinds catalogs
  without restart; missing capabilities degrade cleanly
  (#1042,
  #1061).

• Per-child worktree isolation — session.childIsolation / task.isolation
shared (default) or worktree. Isolated git worktrees under
  .strike/worktrees/<child-id>/; completion handoff includes patch +
  baseRevision and optional patch_collab submit; soft-fail to shared outside
  git repos (#1036,
  #1067).

• Resume persisted child sessions — task({action:"resume", id, …}) reopens
  an owned child JSONL with ownership/lineage checks; terminal refuse unless
  continue=true; incomplete tools settled on restore
  (#1035,
  #1062).

• Bash shadow-git checkpoints — bash mutations covered via per-session
  shadow-git baseline so /undo files restores formatter/codegen/sed -i
  changes; durable checkpoint stack under ~/.strike/checkpoints/<session-id>/
  (#572,
  #1028).

• DX grab-bag — optional OTLP/HTTP export (STRIKE_OTLP_ENDPOINT); skill
  adjacent resource reads + live catalog Reload; LSP missing-binary install
  hints (never auto-install); eval pass@k / pass^k / flakiness metrics
  (#1043,
  #1065).

• Active-turn steering — new steer op redirects a running root turn at the
  next safe request boundary (distinct from queued user.input and
  interrupt). Durable turn.steered events record boundary /
  cancel_restart / queued_fallback decisions. Wire schema 1.17.0
  (#1039).

• strike exec approval callbacks — --approval-control unix socket/FIFO
  NDJSON channel for per-request permission and question replies (once/reject;
  durable always/project requires explicit durable:true). Timeout, disconnect,
  and malformed replies fail closed; request payloads are secret-redacted.
  Legacy auto-reject without the flag is unchanged
  (#1040).

• Public session lifecycle contract — list/get/fork/fork_at/load/rewind_points
  shared across RPC, HTTP, ACP, and pkg/sdk with capability discovery and
  structured errors (session_not_found, session_busy, …). Wire schema
  protocol.Version 1.16.0
  (#1038).

Changed

• Progressive disclosure validation — offline fixture pack compares full vs
  progressive tool surfaces (schema tokens, completion, wall time) with documented
  rollback thresholds; legacy task shims stay registered/deferred; docs prefer
  task (#992,
  #993).

• Workflow tool activation — deferred plan/child/team tool families and
  advanced task promote from deterministic engine state (plan mode, children,
  multi-child) without toolsearch or a classifier; hard denies still win
  (#991,
  #993).

• Progressive task schemas — task starts with a compact basic schema
  (prompt-only create + status/wait/cancel). Advanced fields load after
  toolsearch, advanced args, or workflow activation; one tool name and one
  executor throughout (#989,
  #993).

• Progressive tool disclosure default — deferTools now defaults to on
  with a smaller always-visible core (read/glob/grep/edit/write/
  apply_patch/move/delete/bash/task/toolsearch/question).
  Compatibility delegation, team coordination, and plan tools stay registered
  but deferred until toolsearch, direct call, or workflow activation.
  Set deferTools: "off" to restore the full permitted tools[] surface
  (#988,
  #993).

Added

• Containerization test suite — golden Dockerfiles, preflight failure table,
  naming/hash/labels, /devcontainer skill contract, offline eject→launch→exec
  round-trip (E12.8 / #590).

• Eval container pool — SWE-bench runner uses internal/container CLI
  runtime and acquires scheduler.PoolContainer for the full instance
  lifecycle (admit before create; always release) (#592).

• Isolation indicator — header badge and /container show the E12.7 posture
  ladder (host+yolo → host+default → host+sandbox → container →
  container+no-network). STRIKE_ISOLATION is injected at launch (not
  inferred from /.dockerenv); recorded on session.meta (isolation).
  Protocol wire 1.15.0. Legend + context pane include the label (descriptive,
  not graded) (#589).

• Zone retired — peasant-community/zone archived with README pointing at
  strike; NOTICE records MIT→Apache-2.0 provenance for the container port
  (#591).

• Attach to live container — one container per repo (ContainerName);
  launch joins a compatible running container instead of creating a second.
  Stale config/image raises a prompt (attach / rebuild / cancel) or flags
  --container-attach-stale / --container-rebuild / --container-cancel.
  strike container ls / status; stderr reports attached vs started
  (#588).

• /devcontainer skill — built-in /devcontainer scaffolds project container
  config: strike container detect scans go.mod / package.json / Python
  manifests / Cargo.toml / flake.nix / Makefile; skill always asks via
  question (base image, deps, network, resources), writes
  .strike/container.json, shows Dockerfile diff, then strike container eject
  only after confirm. Config: needsNode/needsPython/needsGo/needsRust
  (#587).

• Queue right pane — /queue focuses a session-group pane listing buffered
  prompts, scheduled /loop jobs, and scheduler pool waits; reorder/edit/
  promote/delete/run-next from the pane (m opens the overlay browser)
  (#1007).

• Write-time content guards — write / edit / apply_patch /
  notebook_edit scan proposed content before disk. Default: credential
  shapes (PEM, AWS AKIA…, provider keys, GitHub/Slack tokens, …) deny
  with stable error code content_guard_denied; high-confidence dangerous
  sinks (language-limited eval/exec/os.system/…) ask. Config
  contentGuard.mode (off|default|ask|deny) and pathAllow globs;
  managed mode: deny is a ForcedDeny ceiling yolo cannot widen. Shares
  pkg/redact.Findings with egress redaction (write guard ≠ redact-on-read).
  Optional skill /write-guards
  (#890).

• Durable security audit sink — append-only redacted JSONL under
  ~/.strike/audit/ for permission/sandbox/admission (and related) decisions,
  retention prune, and strike audit export machine-readable bundles
  (#893).

• Schema-first security/harness telemetry families — versioned registry at
  schemas/telemetry/v1/registry.json with Go export structs, redaction
  annotations, golden fixtures, and make telemetry-check drift gate in
  pkg/telemetry (tool, permission, sandbox, usage, error, egress, admission).
  Export/observability only; Op/Event wire unchanged
  (#894).

• Bash egress allowlist preflight — when network.allow is set, bash
  preflight denies curl/wget/ssh/scp/sftp/nc destinations outside
  the shared host/CIDR/*.suffix list (same CheckNetworkAllow as webfetch).
  Structured network_denied on the tool result/timeline. /sandbox explain
  shows egress enforcement: preflight and documents that OS backends still
  have no per-host filter (#892).

• Admission scan for MCP, skills, and plugins — register/load-time
  scanners apply a severity→action matrix (allow / warn / block /
  quarantine) before MCP tools bind or skills enter the catalog. Config
  admission.preset (permissive | default | strict), home-anchored
  allowPaths only (bare relative markers rejected — spoof-via-subdirectory
  regression tested), and explicit fail-closed on strict. Emits
  admission.decided (protocol 1.14.0) for timeline/audit. Shared
  internal/security.Finding types for future write-time content guards.
  Docs: docs/admission.md
  (#889).

• Hardened path I/O helpers — internal/safefile centralizes FIFO/special
  file rejection, symlink-leaf refuse on write, timed reads, path identity for
  grant/overlap matching, and atomic replace; adopted by read/write/edit/
  apply_patch (#896).

• Permission explain dry-run + diff — /permission explain --preset <id>
  evaluates under an alternate shipped preset without applying it;
  /permission diff <a> <b> lists added/removed/changed rules with layer
  labels; managed-ceiling and sandbox/network.allow notes on the explain
  surface; HTTP preset= + /v1/permissions/diff
  (#895).

• Launch inside container (E12.4) — --launch-inside-container and
  container.execution: container preflight the engine/Dockerfile, start the
  managed container, copy the strike binary, and docker exec -it with
  STRIKE_ISOLATION=container. Credentials forward via env; session worktree
  is mounted when worktrees are enabled
  (#586).

• Container Dockerfile eject (E12.3) — strike container eject writes
  Dockerfile.devcontainer with a config-hash header; strike container drift
  checks staleness; --force / --dockerfile supported. Template drops Zone
  harness install and hardcodes strike-at-launch
  (#585).

• Container config (E12.2) — layered container block in main config plus
  optional container.jsonc/container.json (defaults → global → project →
  managed). Fields cover base image, packages, shell, resources, workspace,
  auth forwarding, network mode/allow shape, execution dial, and engine binary.
  Maps to internal/container via ToRuntime
  (#584).

• Tool-chain correlation — content-free multi-step permission correlation
  within a turn: sensitive read → network/bash, write executable → bash
  execute, and identical denial retry storms. Matches ask or deny with
  explainable chain summaries (tool names/classes only); chainId on
  permission.decided and timeline entries. State clears on turn end/interrupt
  and caps pending nodes (#891).

• Container runtime foundation (E12.0–E12.1) — internal/container shells
  out to docker/podman via an injectable ExecFunc (no Moby SDK). Low-level
  Runtime plus per-repo Manager lifecycle (build/launch/attach/exec/stop/
  restart/destroy/clean), build cache under .strike/container/, resource/port/
  env/SSH forwarding, deterministic strike-<repo>-<hash> names, and
  com.strike.* labels. Zone harness abstraction stripped. Docs:
  docs/container.md
  (#582,
  #583).

• Plugin theme contributions — theme packages load through the plugin
  catalog/lifecycle (same lockfile and integrity path). /theme shows plugin
  provenance and collision winners, live-previews on cursor move without
  persisting, applies on enter, reverts on esc, and saves defaults with
  ctrl+d. Invalid/disabled/staging plugin themes are skipped so startup cannot
  break (#511).

• TUI plugin manager — /plugin opens a centered manager over
  host.Plugins: browse installed plugins (version, source, status, trust,
  contribution counts), inspect capabilities/findings, catalog search/install,
  enable/disable, update with review, and remove/trust/untrust with explicit
  confirmation. Executable trust review names commands and contribution types;
  no secret or env values are rendered; failed ops preserve prior state
  (#730).

• SWE-bench Verified subset runner (E3.3) — strike eval swebench runs a
  fixed 50-instance internal regression subset with Docker per instance and
  strike exec --json, recording pass rate, tokens, cost, and wall-clock to
  versioned report.json / predictions JSONL under evals/swebench/results/.
  Internal signal only — do not publish pass rates in the README
  (#561).

• Plugin catalog and updates — remote catalog format (catalog.json),
  strike plugin search / install catalog:pkg[@ver] --registry / outdated /
  update --yes. Installs pin immutable version + verified artifact digest;
  lockfile records registry/package/version/URL/digests for reproduce; archive
  extract guards zip-slip/tar traversal; failed download/verify/validate keeps
  the prior version; contribution/capability review before update; executable
  changes clear prior trust. Catalog metadata cannot enable execution
  (#729).

• websearch tool — permissioned, provider-neutral web search with
  citation-ready titles/URLs/snippets, domain filters, result limits, and
  network allowlist / redaction / audit controls. Separate from webfetch
  (discover vs retrieve). Configure via webSearch (provider: brave,
  apiKeyEnv, optional baseURL); missing backend returns structured setup
  guidance. Default permission is ask; read-only preset denies it
  (#882).

• Plugin lifecycle CLI — strike plugin list/inspect/install/enable/disable/remove/doctor
  for local paths and Git sources. Atomic install into global or project scope,
  pinned Git commits in plugins.lock.json (source + digest, never credentials),
  disable preserves files, remove requires --yes, doctor reports paths without
  secrets or env values (#727).

• Delegation-worthiness policy — before task / delegate create, a deterministic gate prefers local execution for bare tiny or path-overlapping work and denies fan-out past hard ceilings (depth, optional max live children, delegation count, session budget hook). Config session.delegationPolicy (mode off|soft|enforce, thresholds). Soft local is overridable with force_delegate; decisions expose policyReason on tool metadata and child.started. Orchestrator guidance has a single pre-spawn decision table (#876).

• Passive plugin load — enabled bundles under ~/.strike/plugins/<id>/ and
  ./.strike/plugins/<id>/ contribute agents, skills, workflows, themes, and
  provider profiles through existing surfaces. Manifest validation, path
  confinement, strike/schema version checks, collision diagnostics, and
  plugins.lock.json disablement; executable MCP/harness/hook entries stay
  inactive until trusted activation (#726).

Fixed

• Provider Retry-After — preserve delay-seconds and HTTP-date on normalized
  status errors; stream retries prefer valid provider guidance with cancelable
  waits; ProviderRetrying reports DelayMs + FromProvider
  (#1034,
  #1064).
• Live session persistence recovery — latch on partial write/fsync failure;
  Recover truncates to known-good size, validates via Replay, retries once;
  unrecoverable persistence cancels the runtime without forwarding unpersisted
  terminal events (#1033,
  #1063).

Security

• Fail-closed bash isolation and egress — expanded network.allow preflight
  (interpreters, /dev/tcp, package network subcommands, unknown binaries);
  sandbox degrade fail-closed by default (sandboxAllowDegrade: true to opt in);
  minimal bash environment + bashSecrets secret-ref injection
  (#1030,
  #1046).
• Executable hook fail-closed default — pre/post_tool_use timeout/launch/
  process errors fail closed (failClosed: false opts into fail-open); shell
  hooks run under OS sandbox (read-only + no network) with resource caps;
  hook.matched audit decisions
  (#1031,
  #1066).
• Complete durable audit coverage — audit.Observe maps network_denied,
  content_guard_denied, blocked, hook.matched, chain-rule permissions,
  admission.decided, and secret_ref_use (hash only)
  (#1032,
  #1068).