Skip to content

strike v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 13 Aug 00:05
· 251 commits to main since this release
v0.4.0
4bfe2fc

Install

curl -fsSL https://strike.jonathanung.ca/install | bash

Or download an archive below, verify checksums.txt, and place strike on your PATH.

Changelog

Minor release: cohesive web cockpit, serve security hardening, nested
AGENTS.md, WSL2-only Windows posture, and session resume performance.

Security

  • Web cockpit auth — /v1/* no longer accepts ?token= query credentials (they leak via shell history, proxy logs, and Referer). Open the printed /attach?token=… URL once for HttpOnly cookie handoff, or send Authorization: Bearer (#574).
  • Web cockpit bind — strike serve --expose / --allow-cidr removed. Serve binds loopback only; remote access is ssh -L 8787:127.0.0.1:8787 (no cleartext LAN control plane) (#575).
  • Web cockpit ops — per-IP rate limit on POST /v1/ops and WS op frames; serve_op audit records (type + source IP); optional --read-only rejects mutating ops (#576).

Added

  • Docs (accuracy) — prompt caching (Anthropic three-breakpoint strategy, thinking-block skip, agent-switch miss; OpenAI/xAI/ChatGPT prompt_cache_key; Google unwired), image attach how-to, provider stream retry vs overflow compaction, checkpoint coverage/limits, permission/sandbox honesty, and threat-model.md for injection via files, MCP, and webfetch (#546).
  • strike serve --read-only — reject mutating protocol ops while keeping attach/SSE (#576).
  • Cohesive responsive multi-agent web cockpit (epic #1069) — strike serve is a progressive Chat/Code/Team/Project/Ops workspace for desktop, tablet, and phone:
    • Progressive mode shell, surface registry, and deep links (?mode= / ?surface= / ?entity=) with root isolation
    • Command palette, slash help, composer history, and @file completion
    • Transcript tool/diff/cost cards; long-session virtualization and stream batching
    • Scoped Code explorer with reviewed, confined file apply
    • Observe-first Team roster/board/attention plus artifacts, ledger, handoff/conflict review
    • Public human orchestration Ops with safe Team controls (CAS, idempotency, attach-only blocks)
    • Provider auth (key/OAuth/device), theme catalog preview/apply, scheduler presets, Project/Ops regroup (MCP, plugins, panes)
    • Real-browser smokes (make web-e2e) and operator conformance docs (docs/web.md, docs/web-cockpit-contract.md)
    • Not claimed: native apps, offline execution, push notifications, multi-user collaboration, or cross-device controller arbitration (see #1056 / #1060)

Changed

  • Windows support — v1 is macOS, Linux, and Windows via WSL2 only. Native Windows is not supported (#579).
  • Nested project instructions — AGENTS.md / CLAUDE.md from the workspace root down to the working directory are merged (root first, deepest last) instead of first-match-wins walking up. Global ~/.strike/AGENTS.md still layers first (#578).

Removed

  • strike serve --expose / --allow-cidr — legacy flags error with an SSH migration hint. Upgrade note: replace LAN expose with SSH local forward; non-loopback --addr is rejected.

Fixed

  • Session resume — opening or continuing a previous session from the welcome screen restores the transcript instead of a blank session, and JSONL replay no longer freezes the composer. Turns started while the session is still loading stay on /timeline (#1126, #1134).
  • Sandbox probe — macOS Seatbelt availability is checked on first bash, not at startup (#1098, #1125).
  • Echo catalog on serve — GET /v1/models?provider=echo returns 200 with synthetic models instead of 502 (#1131).

Full changelog: v0.3.1...v0.4.0

Assets 7
Loading