@stroq/cli 0.19.0 → 0.19.1

package/README.md

@@ -9,7 +9,18 @@
   <a href="https://github.com/AGGIB/Stroq/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache%202.0-blue.svg" alt="License: Apache 2.0"></a>
 </p>
 
-**Local action firewall for AI coding agents.** Stroq scans what your agent reads (files, web pages, MCP tool results, command output) for indirect prompt injection, taints the session when it finds instruction-like text, and deterministically blocks the dangerous follow-up actions an injected agent would take — outbound network commands, secret access, external git pushes, encoded execution, self-tampering. Everything runs locally; nothing is sent to a cloud.
+# Stroq — find known secrets in AI coding-agent sessions
+
+**Check a session you already ran:** `stroq sent` looks for exact matches to credentials currently available on your machine in local Claude Code, Codex CLI and Cursor session records. It reports the credential name, source file and recorded tool call without printing the value. A match proves that the value appears in a local record; it does not prove that a model provider received it, that the credential is still valid or that a breach occurred.
+
+```bash
+npx @stroq/cli sent --last       # inspect the newest supported session in this project
+npx @stroq/cli replay --last     # trace recorded content to later agent actions
+```
+
+Run these commands from the project directory with Node.js 22 or newer. They work on sessions from before Stroq was installed. `npx` downloads the CLI from npm; `sent` reads local credential sources to know what values to match and does not upload them. See the [guide's coverage and limits](https://github.com/AGGIB/Stroq/blob/main/docs/GUIDE.md).
+
+**Guard future sessions:** Stroq scans content visible to installed agent hooks, carries suspicion and source information into later decisions, and applies a local policy to the tool calls those hooks expose. It supports native hooks, an OpenClaw plugin and a stdio MCP proxy; coverage differs by agent and channel. The hooks do not send telemetry.
 
 Supported today: **Claude Code**, **Cursor**, **Codex**, **Copilot CLI**, **Windsurf**, **Google Antigravity** (native hooks) · **OpenClaw** (in-process plugin) · **any MCP client** (stdio proxy).
 
@@ -22,6 +33,7 @@ npx @stroq/cli init --agent codex    # Codex CLI: writes .codex/hooks.json
 npx @stroq/cli init --agent copilot  # Copilot CLI: writes .github/hooks/stroq.json
 npx @stroq/cli init --agent openclaw # OpenClaw: installs a plugin into ~/.stroq/openclaw-plugin
 npx @stroq/cli init --agent windsurf # Windsurf: merges into .windsurf/hooks.json
+npx @stroq/cli init --agent antigravity # Google Antigravity: merges into .agents/hooks.json
 npx @stroq/cli init --agent mcp --client claude-desktop   # any MCP client: wraps its stdio servers
 npx @stroq/cli doctor                # check the installation
 ```
@@ -36,21 +48,23 @@ MCP proxy note: for clients with no hook API, `--agent mcp` rewrites the client'
 
 ## Commands
 
-| Command                                                 | What it does                                                                                                                                                                                                                  |
-| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `stroq init [--agent <name>] [--user] [--dry-run]`      | Install hooks for `claude-code`, `cursor`, `codex`, `copilot`, `openclaw` or `windsurf`, or wrap an MCP client's stdio servers with `--agent mcp --client <name>` or `--config <path>` (`--user` for the home-directory copy) |
-| `stroq hook <agent>`                                    | Hook entrypoint (reads the event on stdin; `copilot` and `openclaw` take a `pre`/`post` argument, the others do not)                                                                                                          |
-| `stroq mcp --server <name> -- <cmd>`                    | MCP stdio proxy: judges every `tools/call` and scans every result for one wrapped server                                                                                                                                      |
-| `stroq doctor`                                          | Check Node version, rules, hooks for every agent, self-test                                                                                                                                                                   |
-| `stroq log [--count 20]`                                | Show recent audit entries                                                                                                                                                                                                     |
-| `stroq verify`                                          | Verify the audit hash chain                                                                                                                                                                                                   |
-| `stroq untaint [--session <id>] [--all]`                | Clear a false-positive session's taint and provenance, or every session's                                                                                                                                                     |
-| `stroq why [--seq <n>]`                                 | Explain the most recent denied/asked action: rule, provenance, taint                                                                                                                                                          |
-| `stroq canary [--name <NAME>]`                          | Print a canary secret to plant; its outbound use is denied and taints the session                                                                                                                                             |
-| `stroq attack [--json] [--only <id>] [--fuzz]`          | Replay 20 recorded incidents against your policy; `--fuzz` crosses every scenario with a deterministic mutation set and reports the variants that still reach `allow`; exit 1 if any gets through                             |
-| `stroq exposure [--probe] [--share] [--json]`           | Map this machine's agent surface and report what reaches you; exit 1 on any finding                                                                                                                                           |
-| `stroq bench [--corpus <dir>] [--json] [--verbose]`     | Measure the shipped rule set's false-positive rate against a corpus of benign developer documentation; `--verbose` lists the flagged files                                                                                    |
-| `stroq coverage [--format <table\|navigator>] [--json]` | Print the control mapping against MITRE ATLAS and OWASP ASI, built from the attack corpus's own scenario tags; `--format=navigator` emits an ATT&CK Navigator layer                                                           |
+| Command                                                 | What it does                                                                                                                                                                                                                                 |
+| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `stroq init [--agent <name>] [--user] [--dry-run]`      | Install hooks for `claude-code`, `cursor`, `codex`, `copilot`, `openclaw`, `windsurf` or `antigravity`, or wrap an MCP client's stdio servers with `--agent mcp --client <name>` or `--config <path>` (`--user` for the home-directory copy) |
+| `stroq hook <agent>`                                    | Hook entrypoint (reads the event on stdin; `copilot` and `openclaw` take a `pre`/`post` argument, the others do not)                                                                                                                         |
+| `stroq mcp --server <name> -- <cmd>`                    | MCP stdio proxy: judges every `tools/call` and scans every result for one wrapped server                                                                                                                                                     |
+| `stroq doctor`                                          | Check Node version, rules, hooks for every agent, self-test                                                                                                                                                                                  |
+| `stroq log [--count 20] [--json]`                       | Show recent audit entries; `--json` prints one entry per line                                                                                                                                                                                |
+| `stroq verify`                                          | Verify the audit hash chain                                                                                                                                                                                                                  |
+| `stroq untaint [--session <id>] [--all]`                | Clear a false-positive session's taint and provenance, or every session's                                                                                                                                                                    |
+| `stroq why [--seq <n>]`                                 | Explain the most recent denied/asked action: rule, provenance, taint                                                                                                                                                                         |
+| `stroq sent [--last] [--transcript <path>] [--json]`    | Match known local credentials against a recorded session, including tool results where a transcript is available; report names and sources, never values                                                                                     |
+| `stroq replay [--last] [--transcript <path>] [--json]`  | Reconstruct which recorded content preceded later agent actions and show the matching evidence                                                                                                                                               |
+| `stroq canary [--name <NAME>] [--file <path>]`          | Print a canary secret to plant; its outbound use is denied and taints the session. `--file` plants it as a decoy file: any call naming the file is denied and taints the session                                                             |
+| `stroq attack [--json] [--only <id>] [--fuzz]`          | Replay 21 documented-incident and synthetic scenarios against your policy; `--fuzz` crosses each with a deterministic mutation set and reports variants that reach `allow`; exit 1 if any gets through                                       |
+| `stroq exposure [--probe] [--share] [--json]`           | Map this machine's agent surface and report what reaches you; exit 1 on any finding                                                                                                                                                          |
+| `stroq bench [--corpus <dir>] [--json] [--verbose]`     | Measure the shipped rule set's false-positive rate against a corpus of benign developer documentation; `--verbose` lists the flagged files                                                                                                   |
+| `stroq coverage [--format <table\|navigator>] [--json]` | Print the control mapping against MITRE ATLAS and OWASP ASI, built from the attack corpus's own scenario tags; `--format=navigator` emits an ATT&CK Navigator layer                                                                          |
 
 `stroq exposure` reads files only. `--probe` is the one flag that starts a process: it launches each configured stdio MCP server, asks once for `tools/list`, scans the tool descriptions and shuts the server down — no tool is ever called. Without it, tool-description poisoning is not covered by the run, and the report says so. `--share` prints a redacted summary built from a whitelist, locally; nothing is transmitted.
 

package/dist/index.js

@@ -11711,8 +11711,8 @@ var VIA_LABEL = {
   tool_argument: "in the arguments of"
 };
 var FILE_EVIDENCE_LINE = {
-  read: "its contents came back to the model",
-  named: "named in the command; whether its contents were printed depends on the command"
+  read: "a Read/Grep call was recorded for this path; its returned content is not established here",
+  named: "named in a shell command; whether it read or printed the file is unknown"
 };
 function timestamp(iso) {
   return Number.isNaN(Date.parse(iso)) ? "an unrecorded time" : iso.replace(".000Z", "Z");
@@ -11751,8 +11751,8 @@ function coverageLines(report2) {
   const lines = [
     "COVERAGE",
     `  Matched against ${c.indexedSecrets} value(s) indexed from: ${sources}`,
-    "  Reading those credential files is what this command does; it opens nothing else,",
-    "  and it stores and prints names and sources only, never a value.",
+    "  To match known values, this command reads supported local credential files",
+    "  and project .env sources. It stores and prints names and sources, never values.",
     "  Credential-shaped variables in the environment this command ran with are matched",
     "  too, and are not counted above.",
     "  A credential you have rotated or deleted since that session is not in the index,",
@@ -11760,39 +11760,38 @@ function coverageLines(report2) {
   ];
   if (c.toolResultsRead) {
     lines.push(
-      `  Tool results were read in full from the agent's own transcript (${c.results} of ${c.calls} calls).`
+      `  Recorded tool result text was scanned from the agent transcript (${c.results} of ${c.calls} calls).`
     );
   } else {
     lines.push(
-      "  The audit log records what each call SENT, never what came back, so only tool",
-      "  arguments and credential-file reads are covered here. Run `stroq sent --last`",
-      "  to read the agent's own transcript instead, which still has the result text."
+      "  The audit log records call arguments, never what came back, so only recorded",
+      "  argument matches and supported file-path references are covered here.",
+      "  Run `stroq sent --last` to read the agent's own transcript instead,",
+      "  which may still have the result text."
     );
   }
   return lines;
 }
 var MEANING = [
   "WHAT THIS SAYS, AND WHAT IT DOES NOT",
-  "  What is above was in the text of that session, so it went to the model provider",
-  "  along with everything else in it. That is how a coding agent works.",
-  "  Nothing here says the provider retained any of it, that a person ever saw it, or",
-  "  that this was a breach. It says the value was in that traffic, and that you may",
-  "  not have known it was.",
-  "  If one of them matters, rotate it. Rotating is cheap; being sure is not."
+  "  These findings come from a local agent transcript or Stroq audit log.",
+  "  Where shown, a matching value appeared in a tool result or call argument.",
+  "  A file entry records a supported tool using or naming its path.",
+  "  This record alone cannot confirm a later model request, delivery to a provider,",
+  "  the recipient, retention, human access, or whether a credential is still valid.",
+  "  It does not prove a breach. Review the session and rotate active credentials",
+  "  when the potential exposure warrants it."
 ];
 function formatSent(report2) {
   const lines = [
-    "stroq sent \u2014 which of your credentials already reached a model provider",
+    "stroq sent \u2014 credential evidence in recorded agent sessions",
     "",
     `  session ${report2.sessionId} \xB7 ${report2.coverage.calls} tool call(s)${duration2(report2)}`,
     origin(report2),
     ""
   ];
   if (report2.credentials.length > 0) {
-    lines.push(
-      `CREDENTIALS THAT WERE IN THIS SESSION'S TRAFFIC (${report2.credentials.length})`,
-      ""
-    );
+    lines.push(`CREDENTIAL VALUES FOUND IN THIS SESSION RECORD (${report2.credentials.length})`, "");
     for (const credential of report2.credentials) lines.push(...credentialBlock(credential));
   }
   if (report2.files.length > 0) {
@@ -11804,16 +11803,16 @@ function formatSent(report2) {
     if (report2.files.some((f) => f.evidence === "read")) {
       lines.push(
         "",
-        "  A file whose contents came back was sent to the model whole, including any",
-        "  value Stroq does not have indexed and therefore could not name above."
+        "  A Read/Grep result may contain sensitive content absent from today's index.",
+        "  Inspect the agent transcript to learn what was actually returned."
       );
     }
     lines.push("");
   }
   if (report2.credentials.length === 0 && report2.files.length === 0) {
     lines.push(
-      "No indexed credential appeared in this session, and no credential file was",
-      "read or named by it. Read the coverage below before treating that as clean.",
+      "No indexed credential match or credential-file finding was recorded for",
+      "this session. Read the coverage below before treating that as clean.",
       ""
     );
   } else {
@@ -12758,7 +12757,7 @@ function emit(report2, out) {
   const found = report2.credentials.length > 0 || report2.files.length > 0;
   return out.failOnFinding && found ? 1 : 0;
 }
-var USAGE = `stroq sent \u2014 which of your credentials already reached a model provider
+var USAGE = `stroq sent \u2014 credential evidence in recorded agent sessions
 
   stroq sent --last                 read the newest session in this directory
   stroq sent --transcript <path>    read a specific transcript or rollout
@@ -12774,7 +12773,7 @@ Reads sessions recorded by ${readerLabels()}.
 addressed as <store>#<session>. It reads this machine's credential files to
 know what to look for, and prints names and sources only, never a value. A
 finding exits 0 by default: a session that already happened cannot be
-un-sent by today's commit.
+changed by today's commit. A transcript match does not confirm provider delivery.
 `;
 async function runSent(args) {
   let parsed;
@@ -13073,15 +13072,16 @@ Commands:
   untaint [--session <id>] [--all]   clear a false-positive session's taint, or every session's
   why [--seq <n>]                    explain the most recent denied/asked action: rule, provenance, taint
   replay [<session>] [--last] [--transcript <path>] [--json] [--list]
-                                     rebuild a session's causal history: which content the agent read,
-                                     and which actions came out of it. --last reads the agent's own
+                                     rebuild the recorded sequence: which content the agent read,
+                                     and which later actions matched it. --last reads the agent's own
                                      transcript, so it works on sessions that ran before you installed
   sent [<session>] [--last] [--transcript <path>] [--json] [--fail-on-finding]
-                                     which of your credentials already reached a model provider, in
-                                     which past session, put there by which tool call. --last reads
+                                     which credentials appear in a recorded agent session, and in
+                                     which tool result or call. This local evidence does not confirm
+                                     a model request or provider delivery. --last reads
                                      the agent's own transcript, so it covers sessions from before
                                      you installed and can see what tools RETURNED, not just what
-                                     they sent. To match values it reads this machine's credential
+                                     they called. To match values it reads this machine's credential
                                      files (~/.aws/credentials, ~/.npmrc, ~/.netrc,
                                      ~/.docker/config.json, ./.env*); it reports names and sources
                                      only, never a value. Exits 0 even when it finds something \u2014

package/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "stroq",
   "name": "Stroq",
   "description": "Local action firewall for OpenClaw: scans what the agent reads, taints the session, blocks or asks before dangerous tool calls.",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stroq-openclaw-plugin",
-  "version": "0.19.0",
+  "version": "0.19.1",
   "private": true,
   "description": "Stroq's OpenClaw plugin entry: forwards before_tool_call and after_tool_call to the Stroq CLI.",
   "type": "module",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stroq/cli",
-  "version": "0.19.0",
-  "description": "Local action firewall for AI agents: scans what the agent reads, taints the session, blocks dangerous follow-up actions",
+  "version": "0.19.1",
+  "description": "Find known secrets in local Claude Code, Codex and Cursor sessions; trace risky AI agent actions and guard future tool calls",
   "license": "Apache-2.0",
   "type": "module",
   "bin": {
@@ -32,10 +32,13 @@
     "agent-security",
     "prompt-injection",
     "claude-code",
+    "codex",
+    "openclaw",
     "mcp",
     "firewall",
-    "guardrails",
     "cursor",
+    "secret-scanning",
+    "credential-exposure",
     "llm-security"
   ],
   "publishConfig": {