squad-kit 1.0.0 → 1.1.0

package/CHANGELOG.md

@@ -7,6 +7,151 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] — 2026-11-03
+
+squad-kit 1.1 is about never wondering what the squad is doing, and always having a way out.
+
+### Always know what is happening
+
+- **Every card says what is happening** in plain words: "Builder · step 3 of 6 · editing the booking page", how
+  long it has run, and how long that step usually takes on this project. squad-kit learns the usual times from the
+  project's own history. A ticket over the limit says "Next in line: starts when a slot is free".
+- **The Now tab** says in one sentence what happens now and what comes next. The stage tracker shows how long each
+  stage took. Terminal: `squad status <ticket>`, and `squad show` prints the same.
+- **Ask about a ticket**: "is there a problem?", "when will it be ready?", "what is it doing?". Status questions are
+  answered at once from the live record, in English or Arabic, at no AI cost. A question that would change the work
+  offers Propose a change or a note, and says when the note will be read. Terminal: `squad ask <ticket> "..."`.
+
+### Waiting for you, loud
+
+- **A banner on every page** when something needs you, with the button to press on each item.
+- **The browser tab shows the count**: "(2) roomflow".
+- **Desktop notices**, asked for once: one notice per new question, approval, proof or stop. No sound. Settings ›
+  Desktop notices turns them on or off.
+
+### Time limits you can see
+
+- **"Taking longer than usual"** past twice a step's usual time, with what it is doing, its last progress and when
+  squad-kit stops it: **Give it 10 more minutes**, **Stop and try again**, **Stop**. Terminal:
+  `squad wait <ticket> --more 10m`, `squad stop <ticket> --again`.
+- **"Looks stuck"** says what squad-kit checked, and keeps **End the stuck command**.
+
+### Your apps
+
+- **Start, Open, Restart and Stop** your app from the sidebar. squad-kit runs it from its own copy of `main` (never
+  your folder), brings the copy up to date first, copies your `.env` files into it, and says Running only when the
+  address answers. **Show output**
+  has the last lines.
+- **Run the new version** after Looks right.
+- **A busy port** gets a plain message, and the fix when there is one. No start command: **Ask the Architect to find
+  it**, or **Type it**.
+- Terminal: `squad app start|stop|restart|status|set|find`.
+
+### Delete and Archive
+
+- **Delete** a ticket that is not merged: squad-kit stops the squad on it, then removes its copy of the code, its
+  branch, its files, its unmerged decisions, its chats and screenshots. The tracker item and the cost stay. A delete
+  cut off half-way finishes with **Delete again**.
+- **Archive** a merged or released ticket to take it off the board; **Show archived** and **Unarchive** bring it
+  back.
+- Terminal: `squad delete <ticket>`, `squad archive <ticket> [--undo]`, `squad board --archived`.
+
+### When something goes wrong
+
+- **Every stop says what happened, what is safe, and the ways out** as buttons. The exact error is in the
+  Developer tab and the app log.
+- **Claude's usage limit pauses the squad** for every project, shows when it resets, and carries on by itself from
+  the same step, without counting a failed try. **Try now** carries on at once (`squad try-now`).
+- **Report a problem** saves one `.zip` to send for help: the ticket, its conversations, the last day of the app
+  log and the versions. Never sign-ins, tokens or `.env` files. Terminal: `squad report [ticket]`.
+- **An app log** in `~/.squad-kit/logs/`, one file a day, kept 14 days. Terminal: `squad logs --tail`.
+
+### Also
+
+- **On a phone**, the sidebar folds away behind a menu button, and the ticket drawer takes the whole screen.
+- **`squad inbox`** names a newer decision that changes a plan correctly (it said "Looks stuck").
+- **Copied terminal commands quote pasted text safely.** A note or answer with `$(…)`, backticks or a trailing `\`
+  could run or break when the command beside its button was pasted into a terminal.
+- **Tracker text is decoded once.** A written `&amp;lt;` in a Jira or Azure DevOps item no longer turns into `<`.
+- **Security**: GitHub code scanning, secret scanning with push protection and Dependabot are on, the release
+  workflow's Actions are pinned to exact versions, npm publishing runs only from release tags, and `SECURITY.md`
+  describes 1.0. The issues code scanning found are fixed.
+
+## [1.0.1] — 2026-11-03
+
+squad-kit 1.0.1 makes the squad steadier and easier to follow, from what we saw in the first trials. To get it
+from 1.0.0, run `squad upgrade` once. From now on the app updates itself with one button.
+
+### Easier to follow
+
+- **"From an idea or message" works and shows its progress.** The dialog no longer disappears behind a blurred
+  board. The Analyst works in the background with three steps and a clock, and you can press Cancel. You can
+  close the window: the draft waits for you under New ticket.
+- **Errors stay on screen** until you close them.
+- **The Conversation tab reads in plain words.** "Handed in its answer" replaces the raw answer, and a command
+  the step may not run shows in grey as skipped, not in red as a failure.
+- **A ticket waiting for a free place says so**: "Waiting for a free place", with the limit, instead of
+  looking as if it runs.
+- **"Resumed after sleep"** shows when the computer slept in the middle of a step.
+
+### The Update button
+
+- **The app looks for a new version** on start and once a day. When one is out, Home and every project show
+  it with what is new. **Update now** waits until no agent is in the middle of a step, installs, and restarts
+  the app on the same link. Every ticket carries on where it was.
+- **Settings › About squad-kit** shows your version, when it last checked, and a switch for the daily check.
+  Terminal: `squad upgrade`.
+
+### Quality
+
+- **A new Quality setting** on the Squad and AI page: **Best** (the default), **Balanced** or **Thrifty**.
+  On Best, the strongest model builds and reviews at high effort. On Claude Code that is Opus. Terminal:
+  `squad config set quality best`.
+- **A new "extra high" effort.** On Best, a Builder run that fails moves the next one up to extra high.
+- **The Reviewer is never weaker than the Builder** on Best and Balanced.
+- **Reading the project after a merge is cheaper.** The project map is only read again when files are added,
+  moved or removed, and that read runs on a lighter model.
+
+### No silent hangs
+
+- **Stop works at every moment**, also between two runs, and it ends the agent with everything it started. A
+  step that runs out of time ends the same way.
+- **Git that talks to a remote has a time limit**, and never waits for a password prompt nobody sees.
+- **Starting an agent has a time limit.** If it cannot start, the step says why instead of waiting.
+- **The Builder no longer waits for the "before" screenshots.** They are taken beside it, with their own time
+  limit.
+- **A test, lint or build command with no output for 5 minutes is stopped**, and the ticket says which one.
+
+### Agents stay in their lane
+
+- **Every agent runs with the permissions of its step.** The Tester can run the app but cannot change the code;
+  what it changes anyway, squad-kit puts back.
+- **No agent can change the instruction files** the next session would follow, such as `CLAUDE.md`, or
+  squad-kit's own `.squad/` folder. Agents read copies of the project's rules, never your own folder.
+- **No agent can rewrite git history.** squad-kit checks after each Builder and Tester step.
+- **Every answer is checked.** An incomplete answer is asked for once more, then the step says so plainly.
+- **Text from outside**, such as a tracker item or a pasted message, reaches the agents as data, never as
+  orders.
+- **Test, setup and release commands no longer get the AI and tracker keys.**
+
+### No lost work
+
+- **A release and a "Looks right" at the same moment** no longer get in each other's way.
+- **Stop keeps the step the ticket was at.**
+- **"Bring in the latest main"** uses the remote's main, not an old local copy.
+- **Only a real clash counts as a clash.** Other git errors say what went wrong. `squad doctor` checks the git
+  version.
+- **Tracker updates are kept until they are sent**, and retried when the tracker is down.
+- **A release whose push failed** says "not pushed yet", with **Push again** on the Releases page. Terminal:
+  `squad release <version> --push-again`.
+- **Withdraw change** takes back an approved change the squad has not built yet, and puts the spec back to how
+  it was. Terminal: `squad propose <ID> --withdraw`.
+
+### Fixes
+
+- **The Architect writes the stack**, with each part's role, from the code it reads. `stack.md` was empty.
+- **The Reviewer is told the checks already ran**, so it does not run them again.
+
 ## [1.0.0] — 2026-11-02
 
 squad-kit 1.0 is an agent harness for the whole software cycle. You write a ticket in plain words. A squad of
@@ -728,7 +873,9 @@ First public release.
 - Plan-generation meta-prompt (`generate-plan.md`), intake template (`intake.md`), and plan skeleton reference (`story-skeleton.md`).
 - Documentation: `docs/philosophy.md`, `docs/getting-started.md`, `docs/customization.md`, `docs/vs-spec-kit.md`.
 
-[Unreleased]: https://github.com/AzmSquad/squad-kit/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/AzmSquad/squad-kit/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.1.0
+[1.0.1]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.0.1
 [1.0.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.0.0
 [0.6.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v0.6.0
 [0.5.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v0.5.0

package/README.md

@@ -11,7 +11,7 @@
   <a href="https://squad-kit.com"><img src="https://img.shields.io/badge/site-squad--kit.com-7cffa0?labelColor=0a0a0c" alt="Website"></a>
 </p>
 
-**You write the ticket. Your squad does the rest.**
+**Your AI Engineering Squad. One Unified Harness.**
 
 squad-kit is an agent harness for the whole software cycle. You describe what you need in plain words. A
 squad of AI agents takes it from that ask to a release: the Analyst, the Architect, the Builder, the Tester
@@ -38,8 +38,9 @@ without your approval.
 7. You check this **proof** and press **Looks right**.
 8. You press **Release**. squad-kit writes the changelog, sets the version and adds the git tag.
 
-When the squad needs you, a card shows up in **Waiting for you**. Everything else, the squad handles. Every
-button also has a terminal command, so developers can do the same from the terminal.
+When the squad needs you, a banner shows on every page with the button to press, the browser tab shows how many
+things wait, and a desktop notice can tell you too. Everything else, the squad handles. Every button also has a
+terminal command, so developers can do the same from the terminal.
 
 ## What you need
 
@@ -98,10 +99,33 @@ test, build and run it. You can follow it on the board.
 2. Write what you want in plain words. Add business rules, examples or screenshots if you have them. Or paste
    an idea or a chat message, and the Analyst fills in the ticket for you to check.
 3. Press create. The card moves across the board as the squad works.
-4. Answer, approve and check when a card shows up in **Waiting for you**.
+4. Answer, approve and check when the **Waiting for you** banner asks you.
 
 The step-by-step guide is in [Getting started](docs/getting-started.md).
 
+## While the squad works
+
+- **Every card says what is happening**, for example "Builder · step 3 of 6 · editing the booking page", with how
+  long it has run and how long that step usually takes on this project. A ticket waiting for a free place says so.
+- **Ask about a ticket** on its **Now** tab: "is there a problem?", "when will it be ready?". Status questions are
+  answered at once, in English or Arabic, at no AI cost. Terminal: `squad ask`, `squad status`.
+- **A slow step says so**, with what it is doing and three ways out: **Give it 10 more minutes**, **Stop and try
+  again**, or **Stop**. A step that makes no progress says what squad-kit checked.
+- **Run your app** from **Your apps** in the sidebar: Start, Open, Restart and Stop, from squad-kit's own copy of
+  `main`. After **Looks right**, **Run the new version** shows the change. Terminal: `squad app start`.
+- **Remove a ticket** you no longer want with **Delete**, and take finished ones off the board with **Archive**.
+  The dialog lists what goes and what stays; the cost stays in Usage. Terminal: `squad delete`, `squad archive`.
+
+## When something goes wrong
+
+- **Every stop says what happened, what is safe, and the ways out**, as buttons: Try again, Fix it yourself,
+  Continue anyway, or Report a problem. The exact error is one click away in the ticket's Developer tab.
+- **Claude's usage limit pauses the squad** for every project, shows when it resets, and the squad carries on by
+  itself, from the same step. **Try now** carries on at once.
+- **Report a problem** saves one `.zip` to send to whoever helps you: the ticket, its conversations, the last day
+  of the app log and the versions. It never holds sign-ins, tokens or `.env` files. Terminal: `squad report`.
+- **The app log** is in `~/.squad-kit/logs/`, one file a day, kept 14 days. Terminal: `squad logs --tail`.
+
 ## Where your files live
 
 squad-kit keeps files in two places. The test is simple: does another person need it to carry on?
@@ -148,9 +172,10 @@ linked ticket or a bug report.
 
 ## Cost and models
 
-- squad-kit picks a **model level** for each role and step: **strongest** where a mistake is expensive (spec,
-  design, review), **balanced** for building, **fast** for screenshots and small helpers. The team or each
-  person can change them on the **Squad and AI** page.
+- squad-kit picks a **model level** for each role and step from the project's **Quality** setting: **Best**
+  (the default) builds and reviews on the strongest model, **Balanced** builds on it at medium effort, and
+  **Thrifty** builds on a lighter one. **Fast** stays for screenshots and small helpers. The team or each person
+  can change single steps on the **Squad and AI** page.
 - The board shows **what each ticket and each role used**, in tokens and in money at the AI company's API
   prices. Your own AI subscription pays for it. This shows where the cost goes.
 - One **limit of tickets at once** (2 by default, up to 5) is shared by all your projects, because they use the

package/SECURITY.md

@@ -2,23 +2,24 @@
 
 ## Supported versions
 
-Only the latest minor release of squad-kit receives security fixes.
+Only the latest release of squad-kit receives security fixes. Update with the **Update now** button in the app,
+or `squad upgrade`.
 
 | Version | Supported |
 | ------- | --------- |
-| 0.2.x   | ✅        |
-| 0.1.x   | ❌        |
-| < 0.1   | ❌        |
+| 1.1.x   | ✅        |
+| < 1.1   | ❌        |
 
 ## Reporting a vulnerability
 
 **Please do not open a public GitHub issue for security reports.**
 
-Email the maintainer privately at **momenysr@gmail.com** with:
+Report it privately on GitHub: [Report a vulnerability](https://github.com/AzmSquad/Squad-Kit/security/advisories/new)
+(the repository's **Security** tab). Or email the maintainer at **momenysr@gmail.com**. Include:
 
 - A description of the issue and its impact.
 - Steps to reproduce (proof-of-concept preferred).
-- Affected version(s) and environment (OS, Node version).
+- Affected version(s) and environment (OS, Node version, AI tool and its version).
 - Any suggested mitigation, if you have one.
 
 You can expect:
@@ -29,7 +30,27 @@ You can expect:
 
 Credit will be given in the release notes unless you prefer to remain anonymous.
 
-## Handling credentials
+## How squad-kit keeps you safe
+
+- **The app runs on your computer only.** It listens on `127.0.0.1`, behind a private link with a token kept in
+  `~/.squad-kit/app.json`. Nothing is hosted.
+- **Sign-ins stay on this computer.** Tracker tokens and keys live in `~/.squad-kit/projects/<id>/secrets.yaml`
+  (mode `0600` on POSIX), never in the project folder or in git. A project moved from 0.x has its
+  `.squad/secrets.yaml` moved there once. To run your app, squad-kit copies your project's `.env` files into its own
+  copy of the code in `~/.squad-kit/projects/<id>/apps/` (mode `0600`), never anywhere else.
+- **Agents never see your secrets.** No agent may read squad-kit's secret files, and the commands squad-kit runs for
+  you (tests, setup and release) start without the AI and tracker keys.
+- **Agents stay in their lane.** Every step runs with the permissions it needs and no more: the Builder edits only its
+  own copy of the code, the Tester cannot change code, and no agent may change the instruction files the next session
+  would follow, squad-kit's own `.squad/` folder, or git history. squad-kit checks after each step and puts back what
+  an agent changed outside its lane. Text from trackers and pasted messages reaches agents as data, never as orders.
+- **The engine owns git and the release.** Agents never merge, push or grade their own work.
+- **The npm package is built and published by GitHub Actions** from a release tag, with npm trusted publishing (no
+  npm token exists) and a signed provenance statement you can check on npmjs.com.
+
+## 0.x commands: credentials
+
+The 0.x commands that still ship (`new-plan`, `auth`, `config` and others) keep their own credential handling:
 
 squad-kit reads API tokens from (in order):
 
@@ -59,13 +80,21 @@ squad-kit runs the Agent SDK with `settingSources: []`, which prevents it from r
 
 ## Scope
 
-squad-kit is a local-only CLI. It can call **optional** network APIs (tracker fetch, direct planner) when the user enables those flows and provides credentials. It does not execute user code. Reports in scope include:
+squad-kit runs on your computer and starts AI agents (Claude Code today) that read and change code in their own copy
+of your project and run commands there. It calls network APIs you set up: your tracker, your code host and your AI
+tool. Reports in scope include:
 
-- Arbitrary file read/write outside the workspace caused by malformed input (e.g. path-traversal via feature slugs or intake paths).
-- Command injection via clipboard helpers or spawned processes.
-- Supply-chain concerns in shipped dependencies (`@inquirer/prompts`, `commander`, `fs-extra`, `js-yaml`, `kleur`).
+- A secret (a sign-in, a token, a key) reaching an agent, a log, a report file or git.
+- The app answering anyone other than you, from this computer or another one.
+- An agent getting past its permissions: writing outside its copy, changing instruction files, git history or
+  `.squad/`, or merging or pushing.
+- Arbitrary file read/write outside the project caused by malformed input (for example path traversal through a
+  ticket name or an attachment).
+- Command injection through anything squad-kit runs for you.
+- Supply-chain concerns in shipped dependencies or in how the package is built and published.
 
 Out of scope:
 
-- Content of user-authored intakes and plans under `.squad/stories/` and `.squad/plans/` (treat as trusted project input to your agents).
-- Vulnerabilities in the AI agents that consume squad-kit output (Claude Code, Cursor, Copilot, Gemini). Report those upstream.
+- Vulnerabilities in the AI tools themselves (Claude Code and others). Report those upstream.
+- What the code an agent writes does in your project. squad-kit checks it (tests, review, proof), and you approve it
+  before it merges.