brkomir

A hook plus a background script. The hook tells the session to arm the background script (mail-listener) that check every 30 seconds for anything addressed to it or the entire fleet, using Calude Code’s Monitor tool.

The mailbox is a file-based message queue I’ve been using since June. It can broadcast to every session at once, it holds mail for up to 72 hours, and the messages stay on disk as a record. Claude Code added its own cross-session messaging in the meantime, but I still use my own because of the differences.

For example, the most heavy daily use is for code reviews. Session A writes the code -> dedicated review session reviews it -> Session A fixes the findings or challenges some -> the reviewer runs another round. The loop is closed once every finding is fixed or tracked in todo/backlog (as long as it’s not high or critical severity).

The commit part is a script that refuses any staged file that isn't the committing session's own.

It’s my own design and it's open source if you want to look and play around. I'd appreciate your feedback! https://github.com/brkomir/anja

One of the fake recruiters contacted me on LikedIN for a Solidity dev role, with an assignment repo that came as a zip in DM. Everything looked fine since Finder only showed .sol files, but Finder doesn't show .git and other hidden folders by default. However .git was there, and it had a hook that ran eval() on a remote address on commit/push.

As I read it, .git protection stops the VM from changing hooks, and --clone leaves the hook behind since a clone doesn't copy hooks. However, the hook is still in the folder on the host. Does devvm inspect and warn when a folder already has hooks before you start?

I have received two pre-interview repos from recruiters on LinkedIn (NK hackers targeting crypto people), and both would be hard cases for this. Almost all offers there in DMs are now fake recruiters, and it's not trivial to figure out if the account is fake.

One had an eval() hidden inside a controller function named getCookie(), running whatever a remote server sent back. npm start, npm build and npm test all triggered it. Cursor didn't catch it when I asked "is this repo safe to run?" and then told it to check all dependencies.

Other one came as a bunch of Solidity files in a zip file with an issue to resolve as the interview task, nothing suspicious at first sight. However, that zip carried the whole .git folder, hooks included, which a git clone never copies, and the folder is hidden by default in Finder. Of course, there was a hook that fires on any commit or push, again eval() on some remote address.

In both cases the agent only runs npm test or git commit. Would Stroq see anything in these situations?

I usually run 4-5 claude sessions in parallel on the same branch, each with its own working plan or work item. They coordinate almost in real time, leaving messages in a shared queue and picking them up every 30 seconds. What keeps them from stepping over each other's work is a commit script that allows only staged changes from one session to be committed at a time.

Where it actually pays off to have separate sessions is the code review. Every code change that affects how the app behaves is checked by a session that didn't write the change. Some numbers: 4,454 verdicts on 4,471 commits since September. About four in five first reviews found something, and about half asked for changes.