squad-kit 1.0.1 → 1.1.0

package/CHANGELOG.md

@@ -7,6 +7,76 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] — 2026-11-03
+
+squad-kit 1.1 is about never wondering what the squad is doing, and always having a way out.
+
+### Always know what is happening
+
+- **Every card says what is happening** in plain words: "Builder · step 3 of 6 · editing the booking page", how
+  long it has run, and how long that step usually takes on this project. squad-kit learns the usual times from the
+  project's own history. A ticket over the limit says "Next in line: starts when a slot is free".
+- **The Now tab** says in one sentence what happens now and what comes next. The stage tracker shows how long each
+  stage took. Terminal: `squad status <ticket>`, and `squad show` prints the same.
+- **Ask about a ticket**: "is there a problem?", "when will it be ready?", "what is it doing?". Status questions are
+  answered at once from the live record, in English or Arabic, at no AI cost. A question that would change the work
+  offers Propose a change or a note, and says when the note will be read. Terminal: `squad ask <ticket> "..."`.
+
+### Waiting for you, loud
+
+- **A banner on every page** when something needs you, with the button to press on each item.
+- **The browser tab shows the count**: "(2) roomflow".
+- **Desktop notices**, asked for once: one notice per new question, approval, proof or stop. No sound. Settings ›
+  Desktop notices turns them on or off.
+
+### Time limits you can see
+
+- **"Taking longer than usual"** past twice a step's usual time, with what it is doing, its last progress and when
+  squad-kit stops it: **Give it 10 more minutes**, **Stop and try again**, **Stop**. Terminal:
+  `squad wait <ticket> --more 10m`, `squad stop <ticket> --again`.
+- **"Looks stuck"** says what squad-kit checked, and keeps **End the stuck command**.
+
+### Your apps
+
+- **Start, Open, Restart and Stop** your app from the sidebar. squad-kit runs it from its own copy of `main` (never
+  your folder), brings the copy up to date first, copies your `.env` files into it, and says Running only when the
+  address answers. **Show output**
+  has the last lines.
+- **Run the new version** after Looks right.
+- **A busy port** gets a plain message, and the fix when there is one. No start command: **Ask the Architect to find
+  it**, or **Type it**.
+- Terminal: `squad app start|stop|restart|status|set|find`.
+
+### Delete and Archive
+
+- **Delete** a ticket that is not merged: squad-kit stops the squad on it, then removes its copy of the code, its
+  branch, its files, its unmerged decisions, its chats and screenshots. The tracker item and the cost stay. A delete
+  cut off half-way finishes with **Delete again**.
+- **Archive** a merged or released ticket to take it off the board; **Show archived** and **Unarchive** bring it
+  back.
+- Terminal: `squad delete <ticket>`, `squad archive <ticket> [--undo]`, `squad board --archived`.
+
+### When something goes wrong
+
+- **Every stop says what happened, what is safe, and the ways out** as buttons. The exact error is in the
+  Developer tab and the app log.
+- **Claude's usage limit pauses the squad** for every project, shows when it resets, and carries on by itself from
+  the same step, without counting a failed try. **Try now** carries on at once (`squad try-now`).
+- **Report a problem** saves one `.zip` to send for help: the ticket, its conversations, the last day of the app
+  log and the versions. Never sign-ins, tokens or `.env` files. Terminal: `squad report [ticket]`.
+- **An app log** in `~/.squad-kit/logs/`, one file a day, kept 14 days. Terminal: `squad logs --tail`.
+
+### Also
+
+- **On a phone**, the sidebar folds away behind a menu button, and the ticket drawer takes the whole screen.
+- **`squad inbox`** names a newer decision that changes a plan correctly (it said "Looks stuck").
+- **Copied terminal commands quote pasted text safely.** A note or answer with `$(…)`, backticks or a trailing `\`
+  could run or break when the command beside its button was pasted into a terminal.
+- **Tracker text is decoded once.** A written `&amp;lt;` in a Jira or Azure DevOps item no longer turns into `<`.
+- **Security**: GitHub code scanning, secret scanning with push protection and Dependabot are on, the release
+  workflow's Actions are pinned to exact versions, npm publishing runs only from release tags, and `SECURITY.md`
+  describes 1.0. The issues code scanning found are fixed.
+
 ## [1.0.1] — 2026-11-03
 
 squad-kit 1.0.1 makes the squad steadier and easier to follow, from what we saw in the first trials. To get it
@@ -803,7 +873,8 @@ First public release.
 - Plan-generation meta-prompt (`generate-plan.md`), intake template (`intake.md`), and plan skeleton reference (`story-skeleton.md`).
 - Documentation: `docs/philosophy.md`, `docs/getting-started.md`, `docs/customization.md`, `docs/vs-spec-kit.md`.
 
-[Unreleased]: https://github.com/AzmSquad/squad-kit/compare/v1.0.1...HEAD
+[Unreleased]: https://github.com/AzmSquad/squad-kit/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.1.0
 [1.0.1]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.0.1
 [1.0.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.0.0
 [0.6.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v0.6.0

package/README.md

@@ -38,8 +38,9 @@ without your approval.
 7. You check this **proof** and press **Looks right**.
 8. You press **Release**. squad-kit writes the changelog, sets the version and adds the git tag.
 
-When the squad needs you, a card shows up in **Waiting for you**. Everything else, the squad handles. Every
-button also has a terminal command, so developers can do the same from the terminal.
+When the squad needs you, a banner shows on every page with the button to press, the browser tab shows how many
+things wait, and a desktop notice can tell you too. Everything else, the squad handles. Every button also has a
+terminal command, so developers can do the same from the terminal.
 
 ## What you need
 
@@ -98,10 +99,33 @@ test, build and run it. You can follow it on the board.
 2. Write what you want in plain words. Add business rules, examples or screenshots if you have them. Or paste
    an idea or a chat message, and the Analyst fills in the ticket for you to check.
 3. Press create. The card moves across the board as the squad works.
-4. Answer, approve and check when a card shows up in **Waiting for you**.
+4. Answer, approve and check when the **Waiting for you** banner asks you.
 
 The step-by-step guide is in [Getting started](docs/getting-started.md).
 
+## While the squad works
+
+- **Every card says what is happening**, for example "Builder · step 3 of 6 · editing the booking page", with how
+  long it has run and how long that step usually takes on this project. A ticket waiting for a free place says so.
+- **Ask about a ticket** on its **Now** tab: "is there a problem?", "when will it be ready?". Status questions are
+  answered at once, in English or Arabic, at no AI cost. Terminal: `squad ask`, `squad status`.
+- **A slow step says so**, with what it is doing and three ways out: **Give it 10 more minutes**, **Stop and try
+  again**, or **Stop**. A step that makes no progress says what squad-kit checked.
+- **Run your app** from **Your apps** in the sidebar: Start, Open, Restart and Stop, from squad-kit's own copy of
+  `main`. After **Looks right**, **Run the new version** shows the change. Terminal: `squad app start`.
+- **Remove a ticket** you no longer want with **Delete**, and take finished ones off the board with **Archive**.
+  The dialog lists what goes and what stays; the cost stays in Usage. Terminal: `squad delete`, `squad archive`.
+
+## When something goes wrong
+
+- **Every stop says what happened, what is safe, and the ways out**, as buttons: Try again, Fix it yourself,
+  Continue anyway, or Report a problem. The exact error is one click away in the ticket's Developer tab.
+- **Claude's usage limit pauses the squad** for every project, shows when it resets, and the squad carries on by
+  itself, from the same step. **Try now** carries on at once.
+- **Report a problem** saves one `.zip` to send to whoever helps you: the ticket, its conversations, the last day
+  of the app log and the versions. It never holds sign-ins, tokens or `.env` files. Terminal: `squad report`.
+- **The app log** is in `~/.squad-kit/logs/`, one file a day, kept 14 days. Terminal: `squad logs --tail`.
+
 ## Where your files live
 
 squad-kit keeps files in two places. The test is simple: does another person need it to carry on?

package/SECURITY.md

@@ -2,23 +2,24 @@
 
 ## Supported versions
 
-Only the latest minor release of squad-kit receives security fixes.
+Only the latest release of squad-kit receives security fixes. Update with the **Update now** button in the app,
+or `squad upgrade`.
 
 | Version | Supported |
 | ------- | --------- |
-| 0.2.x   | ✅        |
-| 0.1.x   | ❌        |
-| < 0.1   | ❌        |
+| 1.1.x   | ✅        |
+| < 1.1   | ❌        |
 
 ## Reporting a vulnerability
 
 **Please do not open a public GitHub issue for security reports.**
 
-Email the maintainer privately at **momenysr@gmail.com** with:
+Report it privately on GitHub: [Report a vulnerability](https://github.com/AzmSquad/Squad-Kit/security/advisories/new)
+(the repository's **Security** tab). Or email the maintainer at **momenysr@gmail.com**. Include:
 
 - A description of the issue and its impact.
 - Steps to reproduce (proof-of-concept preferred).
-- Affected version(s) and environment (OS, Node version).
+- Affected version(s) and environment (OS, Node version, AI tool and its version).
 - Any suggested mitigation, if you have one.
 
 You can expect:
@@ -29,7 +30,27 @@ You can expect:
 
 Credit will be given in the release notes unless you prefer to remain anonymous.
 
-## Handling credentials
+## How squad-kit keeps you safe
+
+- **The app runs on your computer only.** It listens on `127.0.0.1`, behind a private link with a token kept in
+  `~/.squad-kit/app.json`. Nothing is hosted.
+- **Sign-ins stay on this computer.** Tracker tokens and keys live in `~/.squad-kit/projects/<id>/secrets.yaml`
+  (mode `0600` on POSIX), never in the project folder or in git. A project moved from 0.x has its
+  `.squad/secrets.yaml` moved there once. To run your app, squad-kit copies your project's `.env` files into its own
+  copy of the code in `~/.squad-kit/projects/<id>/apps/` (mode `0600`), never anywhere else.
+- **Agents never see your secrets.** No agent may read squad-kit's secret files, and the commands squad-kit runs for
+  you (tests, setup and release) start without the AI and tracker keys.
+- **Agents stay in their lane.** Every step runs with the permissions it needs and no more: the Builder edits only its
+  own copy of the code, the Tester cannot change code, and no agent may change the instruction files the next session
+  would follow, squad-kit's own `.squad/` folder, or git history. squad-kit checks after each step and puts back what
+  an agent changed outside its lane. Text from trackers and pasted messages reaches agents as data, never as orders.
+- **The engine owns git and the release.** Agents never merge, push or grade their own work.
+- **The npm package is built and published by GitHub Actions** from a release tag, with npm trusted publishing (no
+  npm token exists) and a signed provenance statement you can check on npmjs.com.
+
+## 0.x commands: credentials
+
+The 0.x commands that still ship (`new-plan`, `auth`, `config` and others) keep their own credential handling:
 
 squad-kit reads API tokens from (in order):
 
@@ -59,13 +80,21 @@ squad-kit runs the Agent SDK with `settingSources: []`, which prevents it from r
 
 ## Scope
 
-squad-kit is a local-only CLI. It can call **optional** network APIs (tracker fetch, direct planner) when the user enables those flows and provides credentials. It does not execute user code. Reports in scope include:
+squad-kit runs on your computer and starts AI agents (Claude Code today) that read and change code in their own copy
+of your project and run commands there. It calls network APIs you set up: your tracker, your code host and your AI
+tool. Reports in scope include:
 
-- Arbitrary file read/write outside the workspace caused by malformed input (e.g. path-traversal via feature slugs or intake paths).
-- Command injection via clipboard helpers or spawned processes.
-- Supply-chain concerns in shipped dependencies (`@inquirer/prompts`, `commander`, `fs-extra`, `js-yaml`, `kleur`).
+- A secret (a sign-in, a token, a key) reaching an agent, a log, a report file or git.
+- The app answering anyone other than you, from this computer or another one.
+- An agent getting past its permissions: writing outside its copy, changing instruction files, git history or
+  `.squad/`, or merging or pushing.
+- Arbitrary file read/write outside the project caused by malformed input (for example path traversal through a
+  ticket name or an attachment).
+- Command injection through anything squad-kit runs for you.
+- Supply-chain concerns in shipped dependencies or in how the package is built and published.
 
 Out of scope:
 
-- Content of user-authored intakes and plans under `.squad/stories/` and `.squad/plans/` (treat as trusted project input to your agents).
-- Vulnerabilities in the AI agents that consume squad-kit output (Claude Code, Cursor, Copilot, Gemini). Report those upstream.
+- Vulnerabilities in the AI tools themselves (Claude Code and others). Report those upstream.
+- What the code an agent writes does in your project. squad-kit checks it (tests, review, proof), and you approve it
+  before it merges.