@stroq/cli 0.19.2 → 0.20.0

package/README.md

@@ -51,6 +51,7 @@ MCP proxy note: for clients with no hook API, `--agent mcp` rewrites the client'
 | Command                                                 | What it does                                                                                                                                                                                                                                 |
 | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | `stroq init [--agent <name>] [--user] [--dry-run]`      | Install hooks for `claude-code`, `cursor`, `codex`, `copilot`, `openclaw`, `windsurf` or `antigravity`, or wrap an MCP client's stdio servers with `--agent mcp --client <name>` or `--config <path>` (`--user` for the home-directory copy) |
+| `stroq uninstall [--agent <name>] [--user] [--dry-run]` | Take Stroq's hooks out of an agent's config, leaving everything else as it was                                                                                                                                                               |
 | `stroq hook <agent>`                                    | Hook entrypoint (reads the event on stdin; `copilot` and `openclaw` take a `pre`/`post` argument, the others do not)                                                                                                                         |
 | `stroq mcp --server <name> -- <cmd>`                    | MCP stdio proxy: judges every `tools/call` and scans every result for one wrapped server                                                                                                                                                     |
 | `stroq doctor`                                          | Check Node version, rules, hooks for every agent, self-test                                                                                                                                                                                  |

package/dist/index.js

@@ -1488,8 +1488,27 @@ function isSelfConfigReadOnly(segment2, word) {
 var OPENCLAW_PLUGIN_OFF = /\bopenclaw\s+plugins\s+(?:disable|remove|uninstall)\b/;
 var OPENCLAW_PLUGIN_CONFIG_WRITE = /\bopenclaw\s+config\s+set\s+plugins\./;
 var disablesAgentPlugin = (segment2) => OPENCLAW_PLUGIN_OFF.test(segment2) || OPENCLAW_PLUGIN_CONFIG_WRITE.test(segment2);
+var STROQ_RUNNERS = /* @__PURE__ */ new Set(["npx", "pnpm", "bunx", "yarn", "npm", "node"]);
+var STROQ_PACKAGE = /^@stroq\/cli(?:@\S*)?$/;
+var STROQ_ENTRY = /[\\/]@stroq[\\/]cli[\\/]dist[\\/]index\.js$/;
+function changesStroqState(segment2) {
+  const word = commandWord(segment2);
+  if (word !== "stroq" && !STROQ_RUNNERS.has(word)) return false;
+  const tokens = tokenize(segment2).map((token) => token.replace(/["']/g, ""));
+  const at = tokens.findIndex(
+    (token) => word === "stroq" ? token.replace(/^.*[\\/]/, "") === "stroq" : STROQ_PACKAGE.test(token) || STROQ_ENTRY.test(token)
+  );
+  if (at === -1) return false;
+  const args = tokens.slice(at + 1).filter((token) => token !== "--");
+  if (args.includes("--dry-run")) return false;
+  const sub = args.find((token) => !token.startsWith("-"));
+  if (sub === "untaint" || sub === "init" || sub === "uninstall") return true;
+  if (sub !== "trust") return false;
+  const after = args.slice(args.indexOf("trust") + 1);
+  return after.includes("--remove") || after.some((token) => !token.startsWith("-"));
+}
 function classifySelfConfigSegment(segment2) {
-  if (disablesAgentPlugin(segment2)) return "deny";
+  if (disablesAgentPlugin(segment2) || changesStroqState(segment2)) return "deny";
   const word = commandWord(segment2);
   if (!touchesSelfConfig(segment2, word)) return null;
   if (isSelfConfigWriteIntent(segment2, word)) return "deny";
@@ -1534,7 +1553,9 @@ function selfTamperSignals(segments) {
   for (const segment2 of segments) {
     const verdict = classifySelfConfigSegment(segment2);
     if (verdict === "deny" || verdict === "ask" && interpreterInlineElsewhere) {
-      deny.push(disablesAgentPlugin(segment2) ? "self-config-disable" : "self-config-write");
+      deny.push(
+        changesStroqState(segment2) ? "stroq-state-change" : disablesAgentPlugin(segment2) ? "self-config-disable" : "self-config-write"
+      );
     } else if (verdict === "ask") {
       ask.push("self-config-touch");
     }
@@ -1963,10 +1984,9 @@ var FileTrustStore = class {
     this.cache = parseTrustList(raw);
     return this.cache;
   }
-  trusts(source, text) {
-    if (source === "") return false;
+  trusts(text) {
     const digest = trustDigest(text);
-    return this.load().entries.some((e) => e.source === source && e.sha256 === digest);
+    return this.load().entries.some((e) => e.sha256 === digest);
   }
   list() {
     return this.load().entries;
@@ -2019,7 +2039,7 @@ var DEFAULT_POLICY = {
     {
       id: "deny-self-tamper",
       effect: "deny",
-      reason: "Modifying agent security configuration is blocked",
+      reason: "Modifying agent security configuration is blocked; that change is yours to make, outside the agent (to take Stroq out: stroq uninstall)",
       when: { classes: ["config.self"], taint: "any" }
     },
     {
@@ -2041,7 +2061,7 @@ var DEFAULT_POLICY = {
     {
       id: "deny-origin-suspect",
       effect: "deny",
-      reason: "Action was dictated by content Stroq flagged as suspicious; blocked (a false positive can be cleared with: stroq untaint --session <id>)",
+      reason: "Action was dictated by content Stroq flagged as suspicious; blocked",
       when: { classes: ["origin.suspect"], taint: "any" }
     },
     {
@@ -2636,6 +2656,53 @@ function addCanaryFile(file, absolutePath) {
   renameSync(temp, file);
 }
 
+// ../core/src/util/controls.ts
+var UNSAFE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f‪-‮⁦-⁩]/g;
+function neutralizeControls(text) {
+  return text.replace(UNSAFE, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+}
+
+// ../core/src/provenance/describe.ts
+function ageLabel(fromIso, now) {
+  const from = Date.parse(fromIso);
+  if (Number.isNaN(from)) return "unknown time";
+  const seconds = Math.max(0, Math.round((now.getTime() - from) / 1e3));
+  if (seconds < 90) return `${seconds} s`;
+  if (seconds < 5400) return `${Math.round(seconds / 60)} min`;
+  return `${Math.round(seconds / 3600)} h`;
+}
+function toEvidence(hit) {
+  const { kind, excerpt, tool, source, at, suspect } = hit.record;
+  return { kind, excerpt, tool, source, at, suspect };
+}
+function describeEvidence(evidence, now) {
+  const flagged = evidence.suspect ? "Stroq flagged that content as suspicious." : "that content was not flagged, but tool output is data, not instructions.";
+  const quoted = neutralizeControls(
+    `"${evidence.excerpt}" appeared in the output of ${evidence.tool} (${evidence.source})`
+  );
+  return `${quoted} ${ageLabel(evidence.at, now)} ago; ${flagged}`;
+}
+
+// ../core/src/policy/way-out.ts
+var SAFE_WORD = /^[\w@%+=:,./-]+$/;
+var shellQuote = (word) => SAFE_WORD.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`;
+function withWayOut(decision, policy, taint, sessionId, now) {
+  if (decision.effect === "allow" || decision.ruleId === null) return decision;
+  const rule = policy.rules.find((r) => r.id === decision.ruleId);
+  if (rule === void 0) return decision;
+  const byTaint = rule.when.taint === "suspect" && taint !== null;
+  const byOrigin = rule.when.classes.includes("origin.suspect");
+  if (!byTaint && !byOrigin) return decision;
+  const source = byTaint ? taint.sources.at(-1) : void 0;
+  const path = source?.source === void 0 ? "" : neutralizeControls(source.source);
+  const what = source === void 0 ? "" : ` Tainted by ${source.tool}${path === "" ? "" : ` ${path}`} ${ageLabel(source.at, now)} ago.`;
+  const trust = source?.tool === "Read" && path !== "" ? `; to stop that file tainting it again: stroq trust ${shellQuote(path)}` : "";
+  return {
+    ...decision,
+    reason: `${decision.reason.replace(/\.$/, "")}.${what} If that was a false positive, clear it yourself, outside the agent: stroq untaint --session ${shellQuote(sessionId)}${trust}`
+  };
+}
+
 // ../core/src/provenance/action-atoms.ts
 import { readdirSync } from "node:fs";
 import { join as join3 } from "node:path";
@@ -2944,33 +3011,6 @@ function originClasses(hits, classes) {
   return { classes: out, counted };
 }
 
-// ../core/src/util/controls.ts
-var UNSAFE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f‪-‮⁦-⁩]/g;
-function neutralizeControls(text) {
-  return text.replace(UNSAFE, (char) => `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
-}
-
-// ../core/src/provenance/describe.ts
-function ageLabel(fromIso, now) {
-  const from = Date.parse(fromIso);
-  if (Number.isNaN(from)) return "unknown time";
-  const seconds = Math.max(0, Math.round((now.getTime() - from) / 1e3));
-  if (seconds < 90) return `${seconds} s`;
-  if (seconds < 5400) return `${Math.round(seconds / 60)} min`;
-  return `${Math.round(seconds / 3600)} h`;
-}
-function toEvidence(hit) {
-  const { kind, excerpt, tool, source, at, suspect } = hit.record;
-  return { kind, excerpt, tool, source, at, suspect };
-}
-function describeEvidence(evidence, now) {
-  const flagged = evidence.suspect ? "Stroq flagged that content as suspicious." : "that content was not flagged, but tool output is data, not instructions.";
-  const quoted = neutralizeControls(
-    `"${evidence.excerpt}" appeared in the output of ${evidence.tool} (${evidence.source})`
-  );
-  return `${quoted} ${ageLabel(evidence.at, now)} ago; ${flagged}`;
-}
-
 // ../core/src/secrets/extract.ts
 var MIN_SECRET_LENGTH = 12;
 var MAX_TEXT_CHARS = 262144;
@@ -3355,7 +3395,13 @@ var StroqEngine = class {
       ...secrets.length > 0 ? ["secret.egress"] : [],
       ...unscannable ? ["secret.unscannable"] : []
     ];
-    const decision = evaluatePolicy(this.opts.policy, classes, state.taint?.level ?? null);
+    const decision = withWayOut(
+      evaluatePolicy(this.opts.policy, classes, state.taint?.level ?? null),
+      this.opts.policy,
+      state.taint,
+      event.sessionId,
+      new Date(this.now())
+    );
     const provenance = origin2.counted.map(toEvidence);
     const summary = await this.safeSummary(
       summarizeInput(event.toolName, event.auditInput ?? event.toolInput),
@@ -3407,7 +3453,7 @@ var StroqEngine = class {
     );
     const ruleIds = [...new Set(scan.matches.map((m) => m.ruleId))];
     const source = redact(summary).slice(0, MAX_STORED_CHARS);
-    const trusted = scan.verdict === "suspect" && this.opts.trust?.trusts(source, event.toolResultText) === true;
+    const trusted = scan.verdict === "suspect" && this.opts.trust?.trusts(event.toolResultText) === true;
     await this.opts.audit.append({
       sessionId: event.sessionId,
       phase: "post",
@@ -6942,9 +6988,9 @@ var openclawInstallArgv = (dir) => [
   ["plugins", "install", "--link", dir],
   ["plugins", "enable", OPENCLAW_PLUGIN_ID]
 ];
-var SAFE_WORD = /^[\w@%+=:,./-]+$/;
-var shellQuote = (arg) => SAFE_WORD.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
-var openclawInstallCommands = (dir) => openclawInstallArgv(dir).map((argv) => [OPENCLAW_BIN, ...argv].map(shellQuote).join(" "));
+var SAFE_WORD2 = /^[\w@%+=:,./-]+$/;
+var shellQuote2 = (arg) => SAFE_WORD2.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
+var openclawInstallCommands = (dir) => openclawInstallArgv(dir).map((argv) => [OPENCLAW_BIN, ...argv].map(shellQuote2).join(" "));
 function openclawOnPath(env = process.env, plat = process.platform) {
   const names = plat === "win32" ? (env["PATHEXT"] ?? ".COM;.EXE;.BAT;.CMD").split(";").filter((ext) => ext !== "").map((ext) => `${OPENCLAW_BIN}${ext.toLowerCase()}`) : [OPENCLAW_BIN];
   for (const entry2 of (env["PATH"] ?? "").split(delimiter)) {
@@ -7016,12 +7062,12 @@ function mcpConfigPath(client, scope, cwd = process.cwd()) {
 }
 var readMcpConfig = (file) => readJsonObject(file);
 var hasValidMcpServers = (config) => config.mcpServers === void 0 || isPlainObject(config.mcpServers);
-var STROQ_ENTRY = /(^|[\\/])(index\.(?:js|ts|mjs|cjs)|stroq(?:\.js|\.cmd)?)$/;
+var STROQ_ENTRY2 = /(^|[\\/])(index\.(?:js|ts|mjs|cjs)|stroq(?:\.js|\.cmd)?)$/;
 function wrapperIndex(args) {
   for (let i = 1; i < args.length; i += 1) {
     if (args[i] !== "mcp" || args[i + 1] !== "--server" || args[i + 3] !== "--client") continue;
     const entry2 = args[i - 1];
-    if (typeof entry2 !== "string" || !STROQ_ENTRY.test(entry2)) continue;
+    if (typeof entry2 !== "string" || !STROQ_ENTRY2.test(entry2)) continue;
     if (args.indexOf("--", i) === -1) continue;
     return i;
   }
@@ -7511,6 +7557,9 @@ async function runInit(args) {
   const code = install[agent](scope, command, dryRun);
   if (code === 0 && !dryRun) {
     recordInstall(agent, scope, agent === "openclaw" ? hookArgv(node, entry2).join(" ") : command);
+    const flags = `${agent === "claude-code" ? "" : ` --agent ${agent}`}${scope === "user" ? " --user" : ""}`;
+    process.stdout.write(`To remove them: stroq uninstall${flags}
+`);
   }
   return code;
 }
@@ -8241,7 +8290,7 @@ function flaggedTools(tools) {
   ).map((t) => typeof t.name === "string" ? t.name : "(unnamed)");
 }
 async function probeOne(spec, timeoutMs) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     const empty = { server: spec.name, tools: 0, flagged: [] };
     let child;
     try {
@@ -8251,7 +8300,7 @@ async function probeOne(spec, timeoutMs) {
         stdio: ["pipe", "pipe", "ignore"]
       });
     } catch (err) {
-      resolve14({ ...empty, error: err.message });
+      resolve15({ ...empty, error: err.message });
       return;
     }
     let buf = "";
@@ -8261,7 +8310,7 @@ async function probeOne(spec, timeoutMs) {
       done = true;
       clearTimeout(timer);
       killChildTree(child, "SIGTERM");
-      resolve14(result);
+      resolve15(result);
     };
     const timer = setTimeout(
       () => finish({ ...empty, error: `no tools/list response within ${timeoutMs} ms` }),
@@ -9709,8 +9758,8 @@ async function withDeadline(work, ms, onTimeout) {
   try {
     return await Promise.race([
       work,
-      new Promise((resolve14) => {
-        timer = setTimeout(() => resolve14(onTimeout()), ms);
+      new Promise((resolve15) => {
+        timer = setTimeout(() => resolve15(onTimeout()), ms);
       })
     ]);
   } finally {
@@ -10307,12 +10356,12 @@ async function writeBackpressured(sink, text, source) {
     return;
   }
   source.pause();
-  await new Promise((resolve14) => {
+  await new Promise((resolve15) => {
     const done = () => {
       sink.off("drain", done);
       sink.off("error", done);
       sink.off("close", done);
-      resolve14();
+      resolve15();
     };
     sink.once("drain", done);
     sink.once("error", done);
@@ -10877,14 +10926,14 @@ async function runMcpProxy(options) {
   const onSigterm = relay("SIGTERM");
   process.on("SIGINT", onSigint);
   process.on("SIGTERM", onSigterm);
-  const code = await new Promise((resolve14) => {
+  const code = await new Promise((resolve15) => {
     child.on("error", (err) => {
       options.stderr.write(`stroq mcp: cannot start the MCP server: ${err.message}
 `);
-      resolve14(1);
+      resolve15(1);
     });
     child.on("close", (exitCode, signal) => {
-      resolve14(signal === null ? exitCode ?? 1 : 1);
+      resolve15(signal === null ? exitCode ?? 1 : 1);
     });
   });
   shuttingDown = true;
@@ -11088,7 +11137,7 @@ async function feedLines(path, parser) {
   return parser.finish();
 }
 function projectSlug(cwd) {
-  return cwd.replace(/[/.]/g, "-");
+  return cwd.replace(/[^a-zA-Z0-9]/g, "-");
 }
 var transcriptRoot = () => join22(homedir20(), ".claude", "projects");
 async function findTranscripts(cwd) {
@@ -11217,12 +11266,18 @@ function buildReplay(allEntries, sessionId) {
   };
 }
 var RULE_PREVIEW = 3;
-function verdictTag(entry2) {
+function verdictTag(entry2, voice) {
   const d = entry2.decision;
   if (!d) return "";
-  if (d.effect === "deny") return `DENIED  ${d.ruleId ?? "default"}`;
-  if (d.effect === "ask") return `ASKED   ${d.ruleId ?? "default"}`;
-  return `allowed ${d.ruleId ?? "default"}`;
+  const rule = d.ruleId ?? "default";
+  if (voice === "replayed") {
+    if (d.effect === "deny") return `WOULD DENY  ${rule}`;
+    if (d.effect === "ask") return `WOULD ASK   ${rule}`;
+    return `would allow ${rule}`;
+  }
+  if (d.effect === "deny") return `DENIED  ${rule}`;
+  if (d.effect === "ask") return `ASKED   ${rule}`;
+  return `allowed ${rule}`;
 }
 function readLine(src) {
   const scan = src.read?.scan;
@@ -11238,24 +11293,25 @@ function readLine(src) {
   return `SUSPECT ${scan.score.toFixed(2)} \u2014 ${scan.ruleIds.length} rules: ${ids}${more}${waived}`;
 }
 var secretLine = (s) => `${s.name} from ${s.source}${s.canary ? " (canary)" : ""}`;
-function consequenceBlock(c, last) {
+function consequenceBlock(c, last, voice) {
   const elbow = last ? "  \u2514\u2500\u25BA" : "  \u251C\u2500\u25BA";
   const rail = last ? "     " : "  \u2502  ";
   const gap = ageLabel(c.evidence.at, new Date(c.action.ts));
+  const tag = verdictTag(c.action, voice);
   return [
     `${elbow} #${c.action.seq} ${c.action.tool}  ${c.action.summary}`,
-    `${rail}   ${verdictTag(c.action)}${" ".repeat(Math.max(1, 34 - verdictTag(c.action).length))}${gap} later`,
+    `${rail}   ${tag}${" ".repeat(Math.max(1, 34 - tag.length))}${gap} later`,
     `${rail}   carried over: "${c.evidence.excerpt}" (${c.evidence.kind})` + (c.alsoCarried > 0 ? ` and ${c.alsoCarried} more` : "")
   ];
 }
-function sourceBlock(src) {
+function sourceBlock(src, voice) {
   const seq = src.read ? `#${src.read.seq} ` : "";
   const head = [`  \u25A0 ${seq}${src.tool}  ${src.source}`, `      ${readLine(src)}`];
   if (src.consequences.length === 0) {
     return [...head, "      nothing traced back to it", ""];
   }
   const body = src.consequences.flatMap(
-    (c, i) => consequenceBlock(c, i === src.consequences.length - 1)
+    (c, i) => consequenceBlock(c, i === src.consequences.length - 1, voice)
   );
   return [...head, "  \u2502", ...body, ""];
 }
@@ -11263,7 +11319,7 @@ function duration(model) {
   if (!model.first || !model.last) return "";
   return ` \xB7 ${ageLabel(model.first, new Date(model.last))} long`;
 }
-function formatReplay(model) {
+function formatReplay(model, voice = "recorded") {
   if (model.total === 0) {
     return `no audit entries for session ${model.sessionId}
 `;
@@ -11272,18 +11328,18 @@ function formatReplay(model) {
   const lines = [
     "stroq replay \u2014 what the agent did, and what told it to do it",
     "",
-    `  session ${model.sessionId} \xB7 ${model.total} events${duration(model)} \xB7 ${model.denied} denied \xB7 ${model.asked} asked`,
+    `  session ${model.sessionId} \xB7 ${model.total} events${duration(model)} \xB7 ` + (voice === "replayed" ? `${model.denied} would be denied \xB7 ${model.asked} would ask (today's policy)` : `${model.denied} denied \xB7 ${model.asked} asked`),
     ""
   ];
   if (model.sources.length > 0) {
     lines.push("CONTENT THE AGENT READ, AND WHAT CAME OUT OF IT", "");
-    for (const src of model.sources) lines.push(...sourceBlock(src));
+    for (const src of model.sources) lines.push(...sourceBlock(src, voice));
   }
   if (model.secretActions.length > 0) {
     lines.push("ACTIONS CARRYING A KNOWN SECRET VALUE", "");
     for (const a of model.secretActions) {
       lines.push(`  \u25CF #${a.seq} ${a.tool}  ${a.summary}`);
-      lines.push(`      ${verdictTag(a)}`);
+      lines.push(`      ${verdictTag(a, voice)}`);
       for (const s of a.secrets ?? []) lines.push(`      ${secretLine(s)}`);
       lines.push("");
     }
@@ -11291,7 +11347,7 @@ function formatReplay(model) {
   if (model.unlinked.length > 0) {
     lines.push(`ACTIONS WITH NO UNTRUSTED ORIGIN (${model.unlinked.length})`, "");
     for (const a of model.unlinked) {
-      const tag = a.decision ? a.decision.effect : "-";
+      const tag = a.decision ? verdictTag(a, voice) : "-";
       lines.push(`  \u25CB #${a.seq} ${a.tool}  ${a.summary}`);
       lines.push(`      ${tag}`);
     }
@@ -11301,6 +11357,12 @@ function formatReplay(model) {
   lines.push(
     traced === 0 ? "No action in this session traced back to content the agent read." : `${traced} of ${judged} judged actions traced back to content the agent read.`
   );
+  if (voice === "replayed")
+    lines.push(
+      "",
+      "These are the verdicts today's policy gives the recording \u2014",
+      "not a record of what was blocked at the time. Guard the next session: stroq init"
+    );
   return `${lines.join("\n")}
 `;
 }
@@ -11371,7 +11433,7 @@ async function runReplay(args) {
 `);
       return 0;
     }
-    process.stdout.write(`${formatReplay(model2)}
+    process.stdout.write(`${formatReplay(model2, "replayed")}
 replayed from ${path}
 `);
     return 0;
@@ -11466,7 +11528,7 @@ async function launch(options) {
   const relays = RELAYED.map((signal) => ({ signal, listener: () => kill(child, signal) }));
   for (const { signal, listener } of relays) signals.on(signal, listener);
   try {
-    return await new Promise((resolve14) => {
+    return await new Promise((resolve15) => {
       child.on("error", (err) => {
         const code = err.code;
         stderr.write(
@@ -11474,9 +11536,9 @@ async function launch(options) {
 ` : `stroq run: cannot start "${options.command}": ${err.message}
 `
         );
-        resolve14(code === "ENOENT" ? NOT_FOUND : 1);
+        resolve15(code === "ENOENT" ? NOT_FOUND : 1);
       });
-      child.on("close", (code, signal) => resolve14(exitCodeFor(code, signal, plat)));
+      child.on("close", (code, signal) => resolve15(exitCodeFor(code, signal, plat)));
     });
   } finally {
     for (const { signal, listener } of relays) signals.off(signal, listener);
@@ -11793,6 +11855,7 @@ stroq run \u2014 ${invocation.command}${agent === null ? "" : ` (${agent})`}`);
 
 // src/commands/sent.ts
 import { homedir as homedir25 } from "node:os";
+import { isAbsolute as isAbsolute6, relative as relative6, resolve as resolve13 } from "node:path";
 import { parseArgs as parseArgs9 } from "node:util";
 
 // src/sent/format.ts
@@ -11908,10 +11971,18 @@ function formatSent(report2) {
   } else {
     lines.push(...MEANING, "");
   }
-  lines.push(...coverageLines(report2));
+  lines.push(...coverageLines(report2), "", ...nextLines(report2.credentials.length > 0));
   return `${lines.join("\n")}
 `;
 }
+function nextLines(found) {
+  return [
+    "NEXT",
+    ...found ? ["  Rotate each credential named above that is still live."] : [],
+    "  stroq replay --last    what the session read, and which later actions matched it",
+    "  stroq init             guard the next session (--agent <name> for another agent)"
+  ];
+}
 
 // src/sent/readers.ts
 import { open as open3 } from "node:fs/promises";
@@ -12865,6 +12936,10 @@ know what to look for, and prints names and sources only, never a value. A
 finding exits 0 by default: a session that already happened cannot be
 changed by today's commit. A transcript match does not confirm provider delivery.
 `;
+function isWithin(dir, root) {
+  const rel = relative6(resolve13(root), resolve13(dir));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute6(rel);
+}
 async function runSent(args) {
   let parsed;
   try {
@@ -12921,6 +12996,15 @@ ${USAGE}`);
       return 1;
     }
     const transcript = await found.reader.read(found.path);
+    if (values.transcript === void 0 && transcript.cwd !== null && !isWithin(cwd, transcript.cwd)) {
+      process.stdout.write(
+        `no agent session recorded in ${cwd}.
+The newest one on this machine ran in ${transcript.cwd}: run \`stroq sent --last\` there,
+or name a session with --transcript <path>.
+`
+      );
+      return 1;
+    }
     if (transcript.events.length === 0) {
       process.stdout.write(`no tool calls recorded in ${found.path}
 `);
@@ -12947,7 +13031,7 @@ ${USAGE}`);
 
 // src/commands/trust.ts
 import { chmodSync as chmodSync4, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "node:fs";
-import { dirname as dirname11, resolve as resolve13 } from "node:path";
+import { dirname as dirname11, resolve as resolve14 } from "node:path";
 import { parseArgs as parseArgs10 } from "node:util";
 function read2(file) {
   try {
@@ -13010,7 +13094,7 @@ function runTrust(argv, now = () => /* @__PURE__ */ new Date()) {
   });
   const file = trustFile();
   if (values.remove !== void 0) {
-    const path = resolve13(values.remove);
+    const path = resolve14(values.remove);
     const current = read2(file);
     const entries = current.entries.filter((e) => e.source !== path);
     if (entries.length === current.entries.length) {
@@ -13031,24 +13115,154 @@ function runTrust(argv, now = () => /* @__PURE__ */ new Date()) {
     );
     return 0;
   }
-  const { code, message } = add(file, resolve13(positionals[0]), now);
+  const { code, message } = add(file, resolve14(positionals[0]), now);
   process.stdout.write(message);
   return code;
 }
 
+// src/commands/uninstall.ts
+import { existsSync as existsSync15, rmSync as rmSync3 } from "node:fs";
+import { parseArgs as parseArgs11 } from "node:util";
+var ownedBy = (agent) => (handler2) => isPlainObject(handler2) && typeof handler2["command"] === "string" && new RegExp(` hook ${agent}(?: \\S+)?$`).test(handler2["command"]);
+function stripEvent(entries, ours) {
+  return entries.flatMap((entry2) => {
+    if (ours(entry2)) return [];
+    if (!isPlainObject(entry2) || !Array.isArray(entry2["hooks"])) return [entry2];
+    const hooks = entry2["hooks"];
+    const kept = hooks.filter((handler2) => !ours(handler2));
+    if (kept.length === hooks.length) return [entry2];
+    return kept.length > 0 ? [{ ...entry2, hooks: kept }] : [];
+  });
+}
+function stripEvents(events, ours) {
+  const out = {};
+  for (const [event, value] of Object.entries(events)) {
+    if (!Array.isArray(value)) {
+      out[event] = value;
+      continue;
+    }
+    const kept = stripEvent(value, ours);
+    if (kept.length > 0 || value.length === 0) out[event] = kept;
+  }
+  return out;
+}
+function stripHooksKey(settings, ours) {
+  const { hooks, ...rest } = settings;
+  if (!isPlainObject(hooks)) return settings;
+  const kept = stripEvents(hooks, ours);
+  return Object.keys(kept).length > 0 ? { ...rest, hooks: kept } : rest;
+}
+var JSON_TARGETS = {
+  "claude-code": {
+    path: settingsPath,
+    strip: (s) => stripHooksKey(s, ownedBy("claude-code"))
+  },
+  cursor: { path: cursorHooksPath, strip: (s) => stripHooksKey(s, ownedBy("cursor")) },
+  windsurf: { path: windsurfHooksPath, strip: (s) => stripHooksKey(s, ownedBy("windsurf")) },
+  // Codex also reads events kept at the file's root, so both levels are stripped.
+  codex: {
+    path: codexHooksPath,
+    strip: (s) => stripEvents(stripHooksKey(s, ownedBy("codex")), ownedBy("codex"))
+  },
+  antigravity: {
+    path: antigravityHooksPath,
+    strip: ({ [ANTIGRAVITY_HOOK_NAME]: _ours, ...rest }) => rest
+  }
+};
+var nothing = (file) => ({
+  removed: false,
+  message: `No Stroq hooks in ${file}; nothing to remove.
+`
+});
+function uninstallJson(target, file, dryRun) {
+  if (!existsSync15(file)) return nothing(file);
+  const before = readJsonObject(file);
+  const after = target.strip(before);
+  if (JSON.stringify(after) === JSON.stringify(before)) return nothing(file);
+  if (dryRun) return { removed: true, message: `${JSON.stringify(after, null, 2)}
+` };
+  writeJsonObject(file, after);
+  return {
+    removed: true,
+    message: `Removed Stroq's hooks from ${file}. Anything else in it is unchanged.
+Run "stroq doctor" to check.
+`
+  };
+}
+function uninstallCopilot(file, dryRun) {
+  if (!existsSync15(file)) return nothing(file);
+  const text = JSON.stringify(readJsonObject(file));
+  if (!/ hook copilot (?:pre|post)\b/.test(text)) return nothing(file);
+  if (dryRun) return { removed: true, message: `would delete ${file}
+` };
+  rmSync3(file);
+  return {
+    removed: true,
+    message: `Deleted ${file}, which held only Stroq's hooks.
+Run "stroq doctor" to check.
+`
+  };
+}
+function uninstallAgent(agent, scope, cwd, dryRun) {
+  if (agent === "openclaw")
+    return {
+      removed: false,
+      message: "The OpenClaw plugin is registered with your Gateway. Switch it off with:\n  openclaw plugins disable stroq\n"
+    };
+  if (agent === "copilot") return uninstallCopilot(copilotHooksPath(scope, cwd), dryRun);
+  const target = JSON_TARGETS[agent];
+  return uninstallJson(target, target.path(scope, cwd), dryRun);
+}
+async function runUninstall(args) {
+  const { values } = parseArgs11({
+    args: [...args],
+    options: {
+      agent: { type: "string" },
+      user: { type: "boolean" },
+      "dry-run": { type: "boolean" },
+      client: { type: "string" },
+      config: { type: "string" }
+    }
+  });
+  const agent = values.agent ?? "claude-code";
+  if (!isInitAgent(agent)) {
+    process.stderr.write(`stroq uninstall: unknown agent "${agent}"
+`);
+    return 2;
+  }
+  if (agent === "mcp")
+    return runInit([
+      "--agent",
+      "mcp",
+      "--unwrap",
+      ...values.user === true ? ["--user"] : [],
+      ...values["dry-run"] === true ? ["--dry-run"] : [],
+      ...values.client === void 0 ? [] : ["--client", values.client],
+      ...values.config === void 0 ? [] : ["--config", values.config]
+    ]);
+  const result = uninstallAgent(
+    agent,
+    values.user === true ? "user" : "project",
+    process.cwd(),
+    values["dry-run"] === true
+  );
+  process.stdout.write(result.message);
+  return 0;
+}
+
 // src/commands/untaint.ts
-import { existsSync as existsSync15, readdirSync as readdirSync6 } from "node:fs";
+import { existsSync as existsSync16, readdirSync as readdirSync6 } from "node:fs";
 import { rm as rm6 } from "node:fs/promises";
 import { join as join28 } from "node:path";
-import { parseArgs as parseArgs11 } from "node:util";
+import { parseArgs as parseArgs12 } from "node:util";
 var USAGE2 = "usage: stroq untaint --session <id> | --all\n";
 async function clearAll() {
   const dir = sessionsDir();
-  if (!existsSync15(dir)) return;
+  if (!existsSync16(dir)) return;
   await Promise.all(readdirSync6(dir).map((f) => rm6(join28(dir, f), { force: true })));
 }
 async function runUntaint(args) {
-  const { values } = parseArgs11({
+  const { values } = parseArgs12({
     args: [...args],
     options: {
       session: { type: "string" },
@@ -13085,7 +13299,7 @@ async function runVerify() {
 }
 
 // src/commands/why.ts
-import { parseArgs as parseArgs12 } from "node:util";
+import { parseArgs as parseArgs13 } from "node:util";
 function verdictLine(entry2) {
   if (entry2.decision) {
     return `${entry2.decision.effect} by ${entry2.decision.ruleId ?? "default"}: ${entry2.decision.reason}`;
@@ -13118,7 +13332,7 @@ function formatWhy(entry2, state, now) {
 `;
 }
 async function runWhy(args) {
-  const { values } = parseArgs12({ args: [...args], options: { seq: { type: "string" } } });
+  const { values } = parseArgs13({ args: [...args], options: { seq: { type: "string" } } });
   const entries = await new AuditLog(auditFile()).readAll();
   const seq = values.seq === void 0 ? null : Number.parseInt(values.seq, 10);
   const target = seq === null ? [...entries].reverse().find((e) => e.decision !== void 0 && e.decision.effect !== "allow") : entries.find((e) => e.seq === seq);
@@ -13134,76 +13348,369 @@ async function runWhy(args) {
   return 0;
 }
 
-// src/index.ts
-var USAGE3 = `stroq <command>
-
-Commands:
-  init [--agent <name>] [--user] [--dry-run]
-                                     install hooks (--agent claude-code | cursor | codex | copilot | openclaw | windsurf | antigravity; project config by default)
-                                     or wrap a client's MCP servers (--agent mcp --client <name>)
-  hook <claude-code|cursor|codex>    hook entrypoint: reads the event JSON on stdin, prints a decision
-  hook windsurf                      Windsurf entrypoint: its events name themselves, and a block is exit 2 with the reason on stderr
-  hook copilot <pre|post>            Copilot entrypoint: its events carry no name, so the phase is an argument
-  hook openclaw <pre|post>           OpenClaw plugin entrypoint: same, answered in Stroq's own JSON
-  hook antigravity <pre|post|preinvocation>
-                                     Antigravity entrypoint: same, plus PreInvocation, where a tainted
-                                     session's status is stated to the model before it is called
-  run [--sandbox] -- <agent> \u2026       start an agent already confined: exports the git settings that
-                                     stop a repository running a command during the startup
-                                     "git status", refuses to launch into a repository that runs
-                                     something before you could approve it, and checks that Stroq's
-                                     hooks are installed for that agent. --sandbox additionally wraps
-                                     the launch in Anthropic's srt, when srt is installed, with a
-                                     read-deny list built from this machine's real credential files
-  mcp --server <n> -- <cmd> \u2026        stdio MCP proxy: judges every tools/call, scans every result
-  doctor [--all]                     check the installation (--all lists every agent and scope)
-  log [--count 20] [--json]          show recent audit entries (--json: one JSON line each)
-  verify                             verify the audit hash chain
-  untaint [--session <id>] [--all]   clear a false-positive session's taint, or every session's
-  why [--seq <n>]                    explain the most recent denied/asked action: rule, provenance, taint
-  replay [<session>] [--last] [--transcript <path>] [--json] [--list]
-                                     rebuild the recorded sequence: which content the agent read,
-                                     and which later actions matched it. --last reads the agent's own
-                                     transcript, so it works on sessions that ran before you installed
-  sent [<session>] [--last] [--transcript <path>] [--json] [--fail-on-finding]
-                                     which credentials appear in a recorded agent session, and in
-                                     which tool result or call. This local evidence does not confirm
-                                     a model request or provider delivery. --last reads
-                                     the agent's own transcript, so it covers sessions from before
-                                     you installed and can see what tools RETURNED, not just what
-                                     they called. To match values it reads this machine's credential
-                                     files (~/.aws/credentials, ~/.npmrc, ~/.netrc,
-                                     ~/.docker/config.json, ./.env*); it reports names and sources
-                                     only, never a value. Exits 0 even when it finds something \u2014
-                                     the past cannot be fixed by this build; use --fail-on-finding
-                                     to gate on it anyway
-  canary [--name <NAME>] [--file <path>]
-                                     print a canary secret to plant, or plant it as a decoy file; its
-                                     outbound use, or any call naming the file, is denied and taints
-  attack [--json] [--only <id>] [--fuzz]
-                                     replay recorded incidents against your policy; exit 1 if any gets
-                                     through. --fuzz crosses every scenario with every mutation and
-                                     prints the ones that escape
-  exposure [--probe] [--share] [--json] [--verbose]
-                                     map this machine's agent surface and report what reaches you;
-                                     --probe starts your MCP servers to read their tool descriptions
-  inspect [<dir>] [--json|--sarif] [--env]
-                                     read what a repository runs before you open it with an agent;
-                                     --sarif for code scanning, --env prints the git settings that
-                                     neutralise it
-  trust [<file>] [--list] [--remove <file>] [--json]
-                                     waive a false positive on a file's exact content; without
-                                     arguments, list what is trusted
-  bench [--corpus <dir>] [--json] [--verbose]
-                                     measure how much benign developer text the rule set flags
-  coverage [--format table|navigator] [--json]
-                                     control mapping against MITRE ATLAS and OWASP ASI
-  --version                          print the CLI version
+// src/help.ts
+var COMMANDS = [
+  {
+    name: "init",
+    synopsis: "init [--agent <name>] [--user] [--dry-run]",
+    about: [
+      "install hooks for an agent, in this project by default,",
+      "or wrap an MCP client's stdio servers in Stroq's proxy (--agent mcp)"
+    ],
+    flags: [
+      [
+        "--agent <name>",
+        "claude-code (default), cursor, codex, copilot, openclaw, windsurf, antigravity or mcp"
+      ],
+      ["--user", "install into the user's config instead of this project's"],
+      ["--dry-run", "print the change and write nothing"],
+      ["--client <name>", "with --agent mcp: claude-desktop, windsurf, cursor or claude-code"],
+      ["--config <path>", 'with --agent mcp: any file with an "mcpServers" object'],
+      ["--unwrap", "with --agent mcp: put every wrapped server back the way it was"],
+      [
+        "--cloak",
+        "with --agent mcp: replace detected values in results before the model reads them"
+      ]
+    ]
+  },
+  {
+    name: "uninstall",
+    synopsis: "uninstall [--agent <name>] [--user] [--dry-run]",
+    about: [
+      "take Stroq's hooks out of an agent's config, leaving everything else in it as it",
+      "was; with --agent mcp, put every wrapped MCP server back"
+    ],
+    flags: [
+      ["--agent <name>", "the agent to remove Stroq from, as for init (default claude-code)"],
+      ["--user", "remove from the user's config instead of this project's"],
+      ["--dry-run", "print the result and change nothing"],
+      ["--client <name>", "with --agent mcp: the client whose servers to unwrap"],
+      ["--config <path>", "with --agent mcp: the config file to unwrap"]
+    ]
+  },
+  {
+    name: "hook",
+    synopsis: "hook <agent> [<phase>]",
+    about: [
+      "the entrypoint an agent runs on every tool call: reads the event JSON on stdin and",
+      "prints a decision. Agents: claude-code, cursor, codex, windsurf, copilot <pre|post>,",
+      "openclaw <pre|post>, antigravity <pre|post|preinvocation>. `stroq init` writes it"
+    ],
+    flags: []
+  },
+  {
+    name: "run",
+    synopsis: "run [--sandbox] [--agent <id>] -- <agent> \u2026",
+    about: [
+      "start an agent already confined: sets the git settings that stop a repository",
+      'running a command during the startup "git status", refuses to launch into a',
+      "repository that runs something before you could approve it, and checks that",
+      "Stroq's hooks are installed for that agent"
+    ],
+    flags: [
+      ["--agent <id>", "the agent whose hooks to check, when the command does not say"],
+      [
+        "--sandbox",
+        "also wrap the launch in Anthropic's srt, with this machine's credential files unreadable"
+      ],
+      ["--allow-domain <host>", "with --sandbox: a host the agent may reach; repeat for more"],
+      ["--no-inspect", "skip reading what the repository runs"],
+      ["--force", "launch even after printing a refusal"],
+      ["--dry-run", "print what would run and start nothing"]
+    ],
+    passThrough: true
+  },
+  {
+    name: "mcp",
+    synopsis: "mcp --server <name> [--cloak] -- <command> \u2026",
+    about: [
+      "the stdio MCP proxy `init --agent mcp` writes into a client config: judges every",
+      "tools/call against your policy and scans every result on its way back"
+    ],
+    flags: [
+      ["--server <name>", "the server name from the client config"],
+      ["--client <name>", "the client, for the session id and the audit"],
+      ["--cwd <dir>", "the project directory decisions are made for"],
+      ["--session <id>", "the session id; default mcp:<client>"],
+      ["--pass-env <names>", "comma-separated variables the server is started with"],
+      ["--cloak", "replace detected values in results before the model reads them"]
+    ],
+    passThrough: true
+  },
+  {
+    name: "doctor",
+    synopsis: "doctor [--all]",
+    about: ["check the installation: Node, rules, the hooks of every agent, a self-test"],
+    flags: [["--all", "list every agent and scope, installed or not"]]
+  },
+  {
+    name: "log",
+    synopsis: "log [--count 20] [--json]",
+    about: ["show recent audit entries"],
+    flags: [
+      ["--count <n>", "how many entries, newest last (default 20)"],
+      ["--json", "one JSON object per line"]
+    ]
+  },
+  {
+    name: "verify",
+    synopsis: "verify",
+    about: ["verify the hash chain of the audit log"],
+    flags: []
+  },
+  {
+    name: "untaint",
+    synopsis: "untaint [--session <id>] [--all]",
+    about: [
+      "clear a false-positive session's taint and provenance, or every session's.",
+      "`stroq why` and `stroq log` show the session id"
+    ],
+    flags: [
+      ["--session <id>", "the session to clear"],
+      ["--all", "clear every session"]
+    ]
+  },
+  {
+    name: "why",
+    synopsis: "why [--seq <n>]",
+    about: ["explain the most recent denied or asked action: rule, provenance, taint"],
+    flags: [["--seq <n>", "explain the audit entry with this sequence number instead"]]
+  },
+  {
+    name: "replay",
+    synopsis: "replay [<session>] [--last] [--transcript <path>] [--json] [--list]",
+    about: [
+      "rebuild the recorded sequence: which content the agent read, and which later",
+      "actions matched it. --last reads the agent's own transcript, so it works on",
+      "sessions that ran before you installed"
+    ],
+    flags: [
+      ["--last", "the newest session recorded for this directory"],
+      ["--transcript <path>", "a specific transcript"],
+      ["--json", "machine-readable output"],
+      ["--list", "list the sessions in the audit log"]
+    ]
+  },
+  {
+    name: "sent",
+    synopsis: "sent [<session>] [--last] [--transcript <path>] [--json] [--fail-on-finding]",
+    about: [
+      "which credentials appear in a recorded agent session, and in which tool result",
+      "or call. Reads names and sources only, never a value"
+    ],
+    flags: [
+      ["--last", "the newest session recorded for this directory"],
+      ["--transcript <path>", "a specific transcript or rollout"],
+      ["--json", "machine-readable output"],
+      ["--fail-on-finding", "exit 1 when a credential is found"]
+    ]
+  },
+  {
+    name: "canary",
+    synopsis: "canary [--name <NAME>] [--file <path>]",
+    about: [
+      "print a canary secret to plant, or plant it as a decoy file. Its outbound use, or",
+      "any call naming the file, is denied and taints the session"
+    ],
+    flags: [
+      ["--name <NAME>", "the variable name to print it under (default STROQ_CANARY_KEY)"],
+      ["--file <path>", "create a credentials-shaped decoy file holding it"]
+    ]
+  },
+  {
+    name: "attack",
+    synopsis: "attack [--json] [--only <id>] [--fuzz]",
+    about: ["replay recorded attacks against your policy; exit 1 if any gets through"],
+    flags: [
+      ["--json", "machine-readable output"],
+      ["--only <id>", "one scenario, e.g. 05"],
+      ["--fuzz", "cross every scenario with every mutation and print the ones that escape"]
+    ]
+  },
+  {
+    name: "exposure",
+    synopsis: "exposure [--probe] [--share] [--json] [--verbose]",
+    about: ["map this machine's agent surface and report what reaches you; exit 1 on a finding"],
+    flags: [
+      ["--probe", "start your MCP servers once to read their tool descriptions"],
+      ["--share", "print a redacted summary you can paste"],
+      ["--json", "machine-readable output"],
+      ["--verbose", "list every file behind a count"]
+    ]
+  },
+  {
+    name: "inspect",
+    synopsis: "inspect [<dir>] [--json|--sarif] [--env]",
+    about: ["read what a repository runs before you open it with an agent"],
+    flags: [
+      ["--json", "machine-readable output"],
+      ["--sarif", "SARIF 2.1.0, for code scanning"],
+      ["--env", "print the git settings that neutralise it"]
+    ]
+  },
+  {
+    name: "trust",
+    synopsis: "trust [<file>] [--list] [--remove <file>] [--json]",
+    about: [
+      "waive a false positive on a file's exact content; any change to the file taints",
+      "again. Without arguments, list what is trusted"
+    ],
+    flags: [
+      ["--list", "list trusted files"],
+      ["--remove <file>", "stop trusting a file"],
+      ["--json", "machine-readable output"]
+    ]
+  },
+  {
+    name: "bench",
+    synopsis: "bench [--corpus <dir>] [--json] [--verbose]",
+    about: ["measure how much benign developer text the rule set flags"],
+    flags: [
+      ["--corpus <dir>", "measure your own files instead of the shipped corpus"],
+      ["--json", "machine-readable output"],
+      ["--verbose", "list the flagged files"]
+    ]
+  },
+  {
+    name: "coverage",
+    synopsis: "coverage [--format table|navigator] [--json]",
+    about: ["the control mapping against MITRE ATLAS and OWASP ASI"],
+    flags: [
+      ["--format <table|navigator>", "navigator emits an ATT&CK Navigator layer"],
+      ["--json", "machine-readable output"]
+    ]
+  }
+];
+var byName = new Map(COMMANDS.map((c) => [c.name, c]));
+var INDENT = 37;
+function usage() {
+  const blocks = COMMANDS.map((c) => {
+    const head = `  ${c.synopsis}`;
+    const [first = "", ...more] = c.about;
+    const lines = head.length < INDENT - 1 ? [`${head.padEnd(INDENT)}${first}`, ...more.map((l) => `${" ".repeat(INDENT)}${l}`)] : [head, ...c.about.map((l) => `${" ".repeat(INDENT)}${l}`)];
+    return lines.join("\n");
+  });
+  return [
+    "stroq <command>",
+    "",
+    "Commands:",
+    ...blocks,
+    `${"  help [<command>]".padEnd(INDENT)}this list, or one command's options`,
+    `${"  --version".padEnd(INDENT)}print the CLI version`,
+    "",
+    'Run "stroq <command> --help" for its options.',
+    ""
+  ].join("\n");
+}
+function commandHelp(name) {
+  const c = byName.get(name);
+  if (c === void 0) return null;
+  const width = Math.max(0, ...c.flags.map(([spelling]) => spelling.length)) + 4;
+  return [
+    `stroq ${c.synopsis}`,
+    "",
+    ...c.about.map((line3) => `  ${line3}`),
+    ...c.flags.length === 0 ? [] : [
+      "",
+      "Options:",
+      ...c.flags.map(([spelling, meaning]) => `  ${spelling.padEnd(width)}${meaning}`)
+    ],
+    ""
+  ].join("\n");
+}
+function ownArgs(name, args) {
+  if (byName.get(name)?.passThrough !== true) return args;
+  const end = args.indexOf("--");
+  return end === -1 ? args : args.slice(0, end);
+}
+function wantsHelp(name, args) {
+  return ownArgs(name, args).some((arg) => arg === "--help" || arg === "-h");
+}
+function unknownOption(name, args) {
+  const c = byName.get(name);
+  if (c === void 0) return null;
+  const known = /* @__PURE__ */ new Set([
+    "--help",
+    "-h",
+    ...c.flags.map(([spelling]) => spelling.split(/[\s|<]/)[0])
+  ]);
+  for (const arg of ownArgs(name, args)) {
+    if (!arg.startsWith("-") || arg === "-" || arg === "--") continue;
+    const option = arg.split("=")[0] ?? arg;
+    if (!known.has(option)) return option;
+  }
+  return null;
+}
+function usageError(name, problem) {
+  return `stroq ${name}: ${problem}
+Run "stroq ${name} --help" to see its options.
 `;
+}
+function parseArgsProblem(err) {
+  const code = err?.code;
+  if (typeof code !== "string" || !code.startsWith("ERR_PARSE_ARGS_")) return null;
+  const message = err instanceof Error ? err.message : String(err);
+  const first = message.split(/(?<=\.)\s/)[0] ?? message;
+  return first.replace(/\.$/, "");
+}
+function suggestCommand(typed) {
+  let best = null;
+  let bestDistance = 3;
+  for (const { name } of COMMANDS) {
+    const d = distance(typed.toLowerCase(), name);
+    if (d < bestDistance) {
+      best = name;
+      bestDistance = d;
+    }
+  }
+  return best;
+}
+function distance(a, b) {
+  const rows = Array.from(
+    { length: a.length + 1 },
+    (_, i) => Array.from({ length: b.length + 1 }, (_2, j) => i === 0 ? j : j === 0 ? i : 0)
+  );
+  for (let i = 1; i <= a.length; i += 1) {
+    for (let j = 1; j <= b.length; j += 1) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      const row2 = rows[i];
+      const above = rows[i - 1];
+      row2[j] = Math.min(above[j] + 1, row2[j - 1] + 1, above[j - 1] + cost);
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1])
+        row2[j] = Math.min(row2[j], rows[i - 2][j - 2] + 1);
+    }
+  }
+  return rows[a.length][b.length];
+}
+
+// src/index.ts
+var COMMANDS2 = {
+  inspect: runInspect,
+  init: runInit,
+  uninstall: runUninstall,
+  run: runRun,
+  doctor: runDoctor,
+  log: runLog,
+  verify: () => runVerify(),
+  trust: runTrust,
+  untaint: runUntaint,
+  replay: runReplay,
+  why: runWhy,
+  sent: runSent,
+  canary: runCanary,
+  attack: runAttackCommand,
+  exposure: runExposure,
+  bench: runBenchCommand,
+  coverage: runCoverageCommand
+};
 async function main(argv) {
   const [command, ...rest] = argv;
   switch (command) {
     case "hook": {
+      if (rest[0] === void 0 || wantsHelp("hook", rest)) {
+        process.stdout.write(commandHelp("hook") ?? "");
+        return rest[0] === void 0 ? 2 : 0;
+      }
       const out = await runHookCommand(rest[0] ?? "", rest[1] ?? "");
       if (out.stdout) process.stdout.write(out.stdout);
       if (out.stderr) process.stderr.write(out.stderr);
@@ -13211,66 +13718,74 @@ async function main(argv) {
       return out.exitCode;
     }
     case "mcp":
+      if (wantsHelp("mcp", rest)) {
+        process.stdout.write(commandHelp("mcp") ?? "");
+        return 0;
+      }
       return runMcp(rest);
     default:
       return withSafeOutput(() => report(command, rest));
   }
 }
 async function report(command, rest) {
-  switch (command) {
-    case "inspect":
-      return runInspect(rest);
-    case "init":
-      return runInit(rest);
-    case "run":
-      return runRun(rest);
-    case "doctor":
-      return runDoctor(rest);
-    case "log":
-      return runLog(rest);
-    case "verify":
-      return runVerify();
-    case "trust":
-      return runTrust(rest);
-    case "untaint":
-      return runUntaint(rest);
-    case "replay":
-      return runReplay(rest);
-    case "why":
-      return runWhy(rest);
-    case "sent":
-      return runSent(rest);
-    case "canary":
-      return runCanary(rest);
-    case "attack":
-      return runAttackCommand(rest);
-    case "exposure":
-      return runExposure(rest);
-    case "bench":
-      return runBenchCommand(rest);
-    case "coverage":
-      return runCoverageCommand(rest);
-    case "--version":
-    case "-v":
-    case "version":
-      process.stdout.write(`${stroqVersion()}
+  if (command === void 0 || command === "--help" || command === "-h") {
+    process.stdout.write(usage());
+    return 0;
+  }
+  if (command === "--version" || command === "-v" || command === "version") {
+    process.stdout.write(`${stroqVersion()}
 `);
-      return 0;
-    default:
-      process.stdout.write(USAGE3);
-      return command === void 0 || command === "--help" || command === "-h" ? 0 : 1;
+    return 0;
+  }
+  if (command === "help") {
+    const help = rest[0] === void 0 ? usage() : commandHelp(rest[0]);
+    if (help === null) return unknownCommand(rest[0] ?? "");
+    process.stdout.write(help);
+    return 0;
+  }
+  const runner = COMMANDS2[command];
+  if (runner === void 0) return unknownCommand(command);
+  if (command !== "sent" && wantsHelp(command, rest)) {
+    process.stdout.write(commandHelp(command) ?? "");
+    return 0;
+  }
+  const unknown = unknownOption(command, rest);
+  if (unknown !== null) {
+    process.stderr.write(usageError(command, `unknown option ${unknown}`));
+    return 2;
+  }
+  try {
+    return await runner(rest);
+  } catch (err) {
+    const problem = parseArgsProblem(err);
+    if (problem === null) throw err;
+    process.stderr.write(usageError(command, problem));
+    return 2;
   }
 }
+function unknownCommand(typed) {
+  const suggestion = suggestCommand(typed);
+  process.stderr.write(
+    `stroq: unknown command "${typed}".${suggestion === null ? "" : ` Did you mean "${suggestion}"?`}
+Run "stroq --help" for the list of commands.
+`
+  );
+  return 1;
+}
 async function exitNow(code) {
   await Promise.all(
     [process.stdout, process.stderr].map(
-      (stream) => new Promise((resolve14) => {
-        stream.write("", () => resolve14());
+      (stream) => new Promise((resolve15) => {
+        stream.write("", () => resolve15());
       })
     )
   );
   process.exit(code);
 }
+process.stdout.on("error", (err) => {
+  if (err.code === "EPIPE") process.exit(process.exitCode ?? 0);
+  throw err;
+});
 main(process.argv.slice(2)).then(
   (code) => {
     process.exitCode = code;

package/openclaw-plugin/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "stroq",
   "name": "Stroq",
   "description": "Local action firewall for OpenClaw: scans what the agent reads, taints the session, blocks or asks before dangerous tool calls.",
-  "version": "0.19.2",
+  "version": "0.20.0",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "stroq-openclaw-plugin",
-  "version": "0.19.2",
+  "version": "0.20.0",
   "private": true,
   "description": "Stroq's OpenClaw plugin entry: forwards before_tool_call and after_tool_call to the Stroq CLI.",
   "type": "module",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stroq/cli",
-  "version": "0.19.2",
+  "version": "0.20.0",
   "description": "Find known secrets in local Claude Code, Codex and Cursor sessions; trace risky AI agent actions and guard future tool calls",
   "license": "Apache-2.0",
   "type": "module",