Stroq
Stroq is an Apache-licensed local audit and hook tool for coding agents. It can inspect supported session transcripts for known local secrets and suspicious command provenance, and optionally install hooks that deny or prompt on selected actions.
It is a filter and audit aid, not a sandbox. Its README notes that a script, file or variable can carry a secret without exposing it in a command; replay evaluates old sessions against current rules rather than recording historical decisions. In the HN discussion, readers stress isolation and ask about malicious commands hidden behind ordinary build steps; the author acknowledges a hook may see only the top-level command.