stroq

stroq [command] [options]

stroq is the command from the npm package `@stroq/cli`. `npx @stroq/cli` runs the same binary. It needs Node.js 22 or newer. The default invocation prints a card of what local coding agents ran, what they read, and which of those moments are worth opening. Each moment has a show line.init connects those agents so the next session is checked before an action runs. replay works on transcripts from before Stroq was installed, because it reads the agent's own log. Verdicts are what today's policy would do, not a recording of what was allowed at the time. sent answers whether a key left the machine. attack replays a fixed set (36 on the 0.30.0 release notes: some denied, some asked, none expected to pass through) in a sandbox.console listens only on 127.0.0.1, asks for no account, and does not phone home. It does not start the agent. Adding hooks from the console requires macOS or Linux. On Windows, use init.

(no command)

Print the card: counts for recent agent activity and lines you can open with show

Hook the local coding agent so later actions are checked

Explain a stop

Run the published attack set in a throwaway home and report how the current policy treats each one

Print the evidence for card item n

Serve a private page on 127.0.0.1 for the current machine, or for --workspace

Read agent transcripts and score them with the current policy. --all covers every session from the last 30 days. Nothing is executed and nothing is uploaded

Compare Claude Code, Codex CLI, and Cursor sessions with credentials on the machine. Output names the key and where it went. It does not print secret values

Remove the hooks and the local install

List commands that the short help omits

replay and sent read local session files. They do not prove that a future session will be stopped. attack scores the policy you have installed. A newer release can change the counts.The console binds to loopback. Do not put it on a public port. sent is designed to print key names and sources, not the secrets themselves. Treat a transcript you paste elsewhere as sensitive anyway.

Stroq is published by AGGIB as `@stroq/cli` under the Apache-2.0 license. The project site is stroq.dev. The CLI, the console, and the hook installer are one package.

node(1), npm(1), npx(1)

Source code · Homepage