squad-kit 1.2.2 → 1.3.0

package/CHANGELOG.md

@@ -1,1204 +0,0 @@
-# Changelog
-
-All notable changes to this project are documented here.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
-## [Unreleased]
-
-## [1.2.2] — 2026-11-05
-
-A patch about the guard. It closes what a review of 1.2.1 found open, moves commit hooks to a throwaway git folder, and says
-plainly what the guard is and is not. Nothing changes in how you work with the squad.
-
-### What the guard promises
-
-- **1.2.1 and earlier promised too much.** The guard stops accidents and most bad behaviour, but it is not a wall against
-  code built on purpose to break out. `SECURITY.md` now says what it stops and what it does not. Use squad-kit on projects and
-  tickets you trust, read what the Builder changes, and use squad-kit's sign-ins, not keys exported in a shell.
-- **It closes more.** A command can no longer move its copy or the folders above git's own. It can no longer write in
-  all of `~/.cache` or `~/Library/Caches`, where your own tools run programs from. On a Mac it can no longer signal other
-  programs, or swap the guard's rules for a later command. A `.env` in your own checkout stays hidden, and so do sockets
-  under `~/.ssh` and `~/.gnupg` and the keys into a runtime's virtual machine. On Linux the guard ran for real for the first
-  time: a `.env` is hidden 3 folders down, and a socket behind `/var/run` no longer stops every command.
-- **A project's own browsers still work.** Playwright gets a folder with the copy, with the browsers this computer has already
-  linked in, so `playwright install` no longer waits on a read-only folder. Puppeteer and Electron download to the copy's
-  cache. On a Mac, Puppeteer's Chrome needs `args: ['--no-sandbox']`, as it did before: its own sandbox cannot start inside
-  the guard. Cypress gets a card until an engineer allows its folder.
-
-### The guard and Docker
-
-- **The project's own commands can no longer reach Docker.** In 1.2.0 and 1.2.1, a command in the guard could connect to
-  Docker's socket, start a container with a hidden folder mounted in it, and read what the guard hides. Now the sockets of
-  Docker Desktop, colima, lima, Rancher Desktop, OrbStack, Finch and Podman are refused, and on a Mac so is Docker's own
-  port on this computer. On Linux that port stays open.
-- **A project whose tests talk to Docker directly now gets a refusal** until a person allows it. The card says Docker is
-  not open to the project's own commands, in a check, a setup or an app's start, and an engineer can allow its socket's
-  folder in Settings.
-
-### The project's commit hooks
-
-- **They run on a throwaway git folder.** squad-kit makes it outside the project for each run, and on Mac and Linux the real
-  git folder is now read only to them, all of it. Only the files in the copy and the commit's words come back, and
-  squad-kit stages the files itself and makes the real commit from those. So **what a hook staged counts for nothing**: a
-  file it force-adds stays out if git ignores it, a file it takes out of the commit goes back in, and a report file it
-  leaves goes in.
-- **The limits 1.2.1 listed are gone.** A hook sees your branch by its real name, not a stand-in's. lint-staged's backup
-  stays out of your `git stash list`, even when a Stop cuts it off. A hook can no longer change a file in git's store of
-  objects.
-- **A Stop, a hook that runs out of time and a crash** put the files back as they were staged and remove new ones. What was
-  on disk then is kept in `refs/squad/on-disk/<ticket>`, so no work is lost half-way through a formatter.
-- **A hook's folder has only the repo's filters of its settings.** A hook that needs a remote, or fetches, gets the usual card
-  with **Save without this check**.
-- **What a hook leaves in its group ends when the commit does**, or at the next start after a crash.
-- **A hook's "no" on a merge being finished holds.** Try again runs the hook again, instead of passing it by.
-
-## [1.2.1] — 2026-11-05
-
-A patch about not losing work and never reaching a dead end. It also moves the project's commit hooks into the guard.
-Nothing changes in how you work with the squad.
-
-### What you type stays
-
-- **Text you type survives** a reload, a closed tab or a dialog closed by mistake: answers, comments, new tickets, bugs
-  and the BRD box are kept for each project, ticket and field, and cleared once sent.
-- **Skip** asks first. Dialogs with files in them ask before closing. Enter works in an **Other** answer.
-
-### When something goes wrong
-
-- **The app going down shows at once.** Within 5 seconds a banner sits over every page, nothing pulses as if it were
-  still working, and the banner goes by itself when the app is back. An update that does not come back gets it after 2
-  minutes.
-- **One error no longer takes the app down.** Each squad turn is guarded, and an error in the screens shows a page with
-  a way back. A full disk or a moved folder holds that project with one banner, and it carries on by itself.
-- **A network blip waits and tries again**, 4 times over about 15 minutes, and never lowers the model level. A merge cut
-  off by a blip is tried again too.
-- **A moved folder is found.** The story copies' links are repaired when the squad starts, at **Looks right** and when a
-  step opens a copy. Home follows a folder moved while the app runs.
-- **A refused release has a way out.** A teammate's push is merged and sent, never forced. A real clash gets the clash
-  card, and a protected main gets plain words and an engineer's steps.
-- **It reached it another way**: a new button on the Releases page, for a release merged by hand. It needs a reason and
-  looks on the remote first. If the release is not there, it warns and asks a second time. Terminal:
-  `squad release --mark-sent --reason "…" [--anyway]`. `squad release` also takes the version with or without the `v`.
-- **Take it**: a new button on a ticket whose owner cannot work on it. Terminal: `squad take-back <ticket> --reason "…"`.
-- **A ticket is never overwritten** by another with the same id, and new ids skip the ones already pushed.
-- **The home folder is refused** by `squad init`, setup and the first commit, and a leftover `~/.squad` is ignored.
-- **The link lasts across tabs.** With no key in the link, the page says to run `squad`.
-- **Stop and closing the board** end a running hook, and closing takes seconds. `squad | tee` stops cleanly, and a run
-  whose output goes to files keeps running when its terminal closes.
-- **An agent's tool calls** no longer fail with a dropped connection after 5 quiet seconds.
-
-### The project's commit hooks
-
-- **They run once, when a change is saved, in the guard, on a stand-in branch.** A hook cannot move a real branch, plant
-  a hook or change a git setting. The real commit is made after, outside the guard, with your signature if your git
-  signs. A crash or a failed signature no longer moves a branch or leaves an unsigned commit.
-- **Every refusal gets a card**: **Let the Builder fix it**, **Fix it yourself**, **Try the save again**, or **Save
-  without this check**. Saving without it needs a reason, which stays on the ticket, the pull request and the release
-  notes. Builds by itself never skips a hook.
-- **Refused code cannot slip through.** Work saved past a refusal is checked whole at **Looks right**, and the branch
-  goes back as it was if the hook still says no.
-- **The Builder cannot change the check to pass it.** Hook files, their settings and their `package.json` keys go back,
-  with one plain line. What a hook calls, like lint rules and tests, stays the Builder's, and the Reviewer reads it.
-- **husky 9 now runs in a story's copy.** Before, its hooks silently never ran there.
-- **squad-kit runs no other hook**: no `pre-push`, `post-merge` or `post-checkout`, since the project's own checks have
-  run by then. Your own terminal still runs them. Git LFS files still upload when squad-kit pushes.
-- **A hook folder with a common name** (`hooks`) no longer costs you work in `src/hooks`. `npx` works in a hook with no
-  packages installed.
-
-### Security
-
-- **`.git` and git's own folder are read only** for the project's commands and for agents.
-- **squad-kit's own git starts nothing a repo names by itself**: no file monitor, no diff program, and nothing from a
-  nested repo, which also stays out of commits.
-- **The app answers only at its own address.** Host and Origin are checked on every route, a key in the link works for
-  reads only, and HTML and SVG from a project download instead of opening at the board's address.
-
-### Known limits
-
-- **A hook built to do harm could change a file in git's store of objects.** A project with no commit hooks is not
-  affected. The next patch closes this by running hooks in a throwaway git folder. See [SECURITY.md](SECURITY.md).
-- A hook that reads the branch name sees the stand-in, `squad/saving/<branch>/now`. A strict one says no, and you get
-  the card.
-- Setup in your own checkout no longer installs husky's hooks. On a fresh clone they stay off until you install them.
-- Stop in the middle of lint-staged leaves its backup in `git stash list`. Your work is safe.
-
-## [1.2.0] — 2026-11-05
-
-squad-kit 1.2 is about trust: squad-kit shows that it understands your project, says what the work really cost, and
-makes the squad's work harder to fake. It also takes a whole requirements document and builds it, story by story.
-Windows is less protected and not fully tested yet (see What's safer).
-
-### What's new
-
-#### From a BRD to a built product
-
-- **A new Requirements page** (after Overview). **Add a BRD**: a PDF, Word or Markdown file, or pasted text, with
-  mockups if you have them. The Analyst reads it live and asks only about what is **missing in the BRD** or where
-  **two parts clash**. Then it writes epics, features and stories, each with its checks (Given, When, Then), size,
-  needs and its place in the document.
-- **Review it as a tree or a map.** Rename, rewrite, move, add or remove any part, or ask the Analyst to redo one.
-  An estimate from this project's own tickets: "20 stories, about $140 and 6 hours, 2 at a time". Nothing is built
-  or sent before **Approve breakdown**.
-- **Send to Azure DevOps**: epics, features and stories with parent and dependency links, into the backlog. **Send
-  changes** updates only what changed. squad-kit never deletes there, and a cut-off send makes no doubles.
-- **Build continuously**: each story becomes a ticket on the new **Builds by itself** track, in the order its needs
-  allow, within the parallel limit and the budgets. No questions, the plan is approved by itself, small choices are
-  listed under **Decided for you** (press **Change** on any), and it merges by itself once the checks, the review
-  and the screenshots pass. It stops only for a gap, a clash or a failed check, and then only that story and the
-  ones that need it wait. Releases stay your button.
-- Terminal: `squad requirements add|show|answer|edit|move|approve|send|build|start|…`, `squad decided`. See
-  [From a BRD to a built product](docs/requirements.md).
-
-#### Proof you can read
-
-- **squad-kit takes the screenshots itself, with its own browser.** The Tester says which pages, steps and sizes.
-  squad-kit opens the story's own copy of the app, does the steps and takes the pictures.
-- **One or more pictures for each "done when"**: one per part or case, up to 6.
-- **Each "done when" gets a verdict**, from the Tester and squad-kit's own check of all its pictures together:
-  **Met**, **Not working yet** (a picture shows it does not work), **Not shown yet** (the pictures do not show it
-  clearly) or **Not on a screen** (it cannot be shown at all, like an email or what happens after a restart). Not
-  working yet goes back to the Builder once, then it is a plain stop. Not shown yet goes back to the Tester up to 2
-  more times, keeps the good pictures and never reaches the Builder. Not on a screen keeps its reason and does not
-  stop the story, unless every "done when" ends that way.
-- **Also changed, not in the plan**: what the change touches beyond its plan, in the Reviewer's words. It never
-  blocks. You see it at your check, on a stop, on the ticket and in the release notes.
-
-#### Your turn
-
-- **Where to look**: each page the proof names, with the "done when" it shows.
-- **Try it yourself**: runs the story's own copy of the app, with the change in it and nothing merged, so you can
-  click through it before **Looks right**. It stops by itself when the story moves on. Terminal: `squad try <ticket>`.
-- **Ask a question** on every story, in every state: working, in the queue, waiting for another story, stopped, at
-  review, taken over or released. Whoever knows the story best answers: the Analyst before the build, the Builder
-  during and after it, the Tester once there are screenshots. It answers questions only, and the story stays exactly
-  where it is. Terminal: `squad chat <ticket> --ask`.
-
-#### First run and Overview
-
-- **Add project says what it found** (code with or without git, an empty folder, several repos, an older
-  squad-kit) and what happens next, before you confirm.
-- **A setup page with live steps**: project memory, the AI tool, the Architect reading the code, how to test and run
-  it, trying the tests, opening the app once with a screenshot, and your overview. Each step has its time; a failure
-  has a way out and never stops the setup. **Notify me when it is ready**. Quality is asked once here.
-- **The Overview page**, first in the sidebar: what the project is, who uses it, what it can do today, how its parts
-  fit together, things worth knowing, the rules found, the proof, and three ideas for a first ticket. It stays up to
-  date after every merged ticket.
-- **The rules the Architect found are proposals until you approve them** with **Looks right, start working**. They
-  used to be saved as approved without being shown. **Something is wrong** opens a talk with the Architect.
-- **An empty project asks "What do you want to build?"**, in your own words, in English or Arabic. The Architect
-  writes down what you want with first stories for it, and picks the technology itself when your first story is
-  planned. Terminal: `squad overview --build "what you want"`.
-- **squad-kit finds the commands of a project that started empty.** After the first build it reads how to test and
-  run the project from its files, and saves that. Nobody is asked.
-- Terminal: `squad setup`, `squad overview`, `squad demo --first-run`.
-
-#### Conversation and Cost
-
-- **Conversation opens on "What happened"**: one card per step with its time, a one-line summary and what it handed
-  in, drawn as the real thing. **Full log** keeps the detail, in plain words, with **Open it in Claude Code**.
-- **Cost follows how you pay.** On a subscription: "Included in your Claude plan. No extra charge.", the size of the
-  work and where it went, with the API-price figure shown as a value, not a bill. With an API key: real dollars, a
-  budget per ticket and per month, a warning at 80% and a pause at 100%.
-- **Averages per Quality setting** (cost and squad time per accepted ticket) on the Squad and AI page.
-- Terminal: `squad cost`, `squad config set payment`, `squad config set budget`.
-
-#### Tickets that depend on each other
-
-- **The Analyst and the Architect see the other open tickets** and the files they change.
-- **A design can depend on another ticket.** The ticket then waits before building: **Build on its branch**, **Build
-  anyway**, or **Wait** (it starts by itself when the other one merges). Terminal: `squad depends`, `squad build`.
-- **Bring in latest main** is a button on a ticket being built (`squad bring-in`).
-
-#### Releases
-
-- **Take a ticket out of the next release** before you release it (`squad release --without`).
-- **Released tickets' branches are cleaned up** on this computer, and on the remote when you ask (`squad branches`).
-  A branch with unmerged work is never deleted.
-- **A release cut off by a restart finishes or rolls back** cleanly on the next start.
-
-#### Also
-
-- **The ticket can go full width** (the button next to Close; remembered in this browser). **Hand over** and
-  **Propose a change** moved to the ⋯ menu, and Propose a change is also on the ticket's bottom bar, so the header is
-  one row at any width.
-- **The Waiting for you banner is one slim, calm row**, and stays readable beside a docked chat.
-- **The update banner shows what is new in every release since your version**, and **Check for updates** reads the
-  notes again.
-- **Free the port and try again** on a stuck Tester step, for programs squad-kit itself started.
-
-### What's safer
-
-- **Agents get fixed tools, "the window"**: `take_screenshots`, `look_at_page`, `start_app`, `stop_app`, `app_status`,
-  `run_checks` and `i_am_stuck`. An agent fills in the fields, squad-kit checks them, does the job itself and hands
-  back the result. There is no free command: only this story's app on this computer, only the project's saved
-  commands, only what squad-kit started. A request outside that is refused and written in the activity, and three
-  refusals in one step stop the agent.
-- **`i_am_stuck`**: when something technical is in an agent's way, squad-kit tries its own fixes (its browser, a free
-  port, starting the app again) and writes one plain line. It is never a question to you.
-- **Technical questions never reach you.** squad-kit reads each question an agent asks, with its choices and
-  everything shown with it, and does not trust the agent's label. A question about ports, commands, files or settings
-  goes back to the agent to decide. An agent that keeps asking stops in plain words. When another program holds a
-  port and going around it did not work, you get one plain card with no port in it: **Stop it** (with a confirm) or
-  **Skip the browser tests**.
-- **Some asks are refused and logged.** Asking you to change squad-kit's settings or protected files, to hand over a
-  password or a key, or to change git history never reaches you. One plain line goes in the activity. A reply in a
-  chat that asks for any of these is left out too.
-- **A second guard for the project's own commands.** The tests, lint, build, setup, the app's start and the release
-  pipeline run in squad-kit's own guard on Mac and Linux. They work normally, browser tests too, and can reach the
-  network, but they can't read your keys, sign-ins, browser profiles, squad-kit's own folder or the `.env` files in
-  your project folder. If a project truly needs a file outside its copy, one plain sentence says so, and an engineer
-  can allow it in Settings or with `squad config set allow-read <path>` and `squad config set allow-write <path>`.
-  `squad doctor` shows whether the guard runs here.
-- **Windows is less protected and not fully tested yet.** There, the agents' own commands and the project's own
-  commands have no guard, so they can reach other files on the computer. Use it on projects you trust. Settings and
-  the Squad and AI page say "Windows: less protected".
-- **"Not checked" instead of a green pass** when a project has no tests. You are asked once per project, with the
-  Architect's suggested test command. A project without tests also checks that the app starts.
-- **Weakened tests stop the ticket**: deleted tests, fewer tests, a changed test setup, or new skip/only markers, in
-  the common languages. **Continue anyway** needs a reason that stays on the record.
-- **Proof is verified**: each screenshot must be a real image taken in this step, and "after" must differ from
-  "before", unless the "done when" says the screen stays as it was.
-- **The Reviewer sees the whole change and the check results** in every round, not only the fix. In its review it can
-  also look at a page of the app itself (`look_at_page`).
-- **A change to the test command is tried first.** squad-kit runs the new command and the current one in the ticket's
-  copy, and keeps the new one only when it passes and runs at least as many tests. You choose only when it cannot
-  tell. Terminal: `squad test-command <ticket> --use | --keep`.
-- **The Builder's and Tester's commands run in Claude Code's sandbox** where the computer allows it: they write only
-  in the ticket's copy, its proof folder and a private package cache, can't read your keys, sign-ins or `.env`
-  files, and reach only package registries and the websites you allow (Settings, `squad config set hosts`). A
-  blocked command says what and why. `squad doctor` shows whether the sandbox runs here.
-- **Turn and spend caps per step** from the Quality setting. Reaching one keeps the work and offers **Give it more**
-  or **Stop**.
-- **Every command squad-kit suggests you copy quotes your text safely**, on the board and in the terminal.
-- **zod 4, the AI SDK 5 and diff 8** for the 0.x planner commands. This closes the last high alert. The planner's
-  file-read tool on the Claude Agent SDK path now works with ranged reads.
-
-### What's fixed
-
-- **Plain stop messages.** A stop says what happened in squad-kit's own plain words, with **Try again**. A tool's raw
-  error never reaches you: the exact words are in the ticket's Developer tab and the app log.
-- **A failed check runs once more** before anyone is sent to fix it, so a flaky test costs no Builder run. If it passes
-  then, the activity and the Developer tab say "failed once, passed when run again". Not after a Stop, a command
-  squad-kit had to end, or a file the guard blocked.
-- **The Builder is told about old failures**: the checks that already failed on the first run, before any story
-  touched the code. It fixes what its story broke and leaves other screens alone. The checks must still pass.
-- **A clash no longer stops a story too soon on Builds by itself.** While main keeps moving, squad-kit brings it in
-  again by itself, up to 3 times, with the checks, the review and the proof each time. If main has not moved, or after
-  the third time, you get the clash card. Other tracks show the card at the first clash, as before.
-- **Apps move to a free port by themselves** when another program holds the usual one: Your apps, the story's own copy
-  and Try it yourself. In Your apps this works when the start command or the app's code takes a port setting; if not,
-  one plain sentence says what is in the way. `--next-port` on `squad app start` and `squad app restart` is still
-  accepted, and now does nothing.
-- **squad-kit installs its own screenshot browser.** No `npx playwright`, and nothing to install by hand. The first
-  time, one line says "Setting up squad-kit's screenshot browser. This happens only once."
-- **The step timer counts only running time.** It stands still while a ticket waits for you, for another story or for
-  a free place, so "Taking longer than usual" no longer shows on a step that was only waiting.
-- **A restart is not a failure.** Restarting the board, Stop or the computer sleeping no longer counts as a failed
-  try or raises the model's effort. The Builder carries on with the same step in the same conversation, instead of
-  starting the work again, and the step's clock keeps its time ("resumed after a restart").
-- **Nothing is left behind.** When a step ends, on Stop, and when the board restarts or quits, squad-kit stops every
-  program it started for the ticket, including test servers that left their process group. It finds them by where
-  they run: inside squad-kit's own copy of the code, never your folders or Your apps.
-- **squad-kit clears its own leftovers before the checks** and says so in one activity line. If an agent asks about a
-  busy port that squad-kit caused, squad-kit answers it and you never see the question.
-- **Desktop notices: Turn on always answers.** It says when the browser is asking, explains how to allow notices
-  when the browser stays silent (for example in Arc), and sends one test notice.
-- **A ticket a teammate deleted** shows "Deleted by <owner>" with **Remove from my board**.
-- **A chat message sent during Claude's usage limit waits** and is answered when the squad carries on.
-- **On a phone**, the banners fold into one slim row while a ticket is open, and the website's docs pages fit.
-
-## [1.1.1] — 2026-11-03
-
-A security update. Nothing changes in how squad-kit works.
-
-### Security
-
-- **Packages with known security problems are updated.** The app's web server (hono 4.13, @hono/node-server 2), the
-  parts of the MCP SDK's server it pulls in (proxy-addr, body-parser, qs, ip-address), @modelcontextprotocol/sdk
-  1.32, fast-uri and js-yaml; in the app's screens, seroval and js-yaml; and the test tools (vitest 4, vite 6).
-- **The website's build tools** move to Astro 7.
-- **Still open:** zod 3, used only by the 0.x planner commands (`squad new-plan` with an API key). Its fix needs
-  zod 4, which those commands' AI library does not read yet. It is planned.
-
-## [1.1.0] — 2026-11-03
-
-squad-kit 1.1 is about never wondering what the squad is doing, and always having a way out.
-
-### Always know what is happening
-
-- **Every card says what is happening** in plain words: "Builder · step 3 of 6 · editing the booking page", how
-  long it has run, and how long that step usually takes on this project. squad-kit learns the usual times from the
-  project's own history. A ticket over the limit says "Next in line: starts when a slot is free".
-- **The Now tab** says in one sentence what happens now and what comes next. The stage tracker shows how long each
-  stage took. Terminal: `squad status <ticket>`, and `squad show` prints the same.
-- **Ask about a ticket**: "is there a problem?", "when will it be ready?", "what is it doing?". Status questions are
-  answered at once from the live record, in English or Arabic, at no AI cost. A question that would change the work
-  offers Propose a change or a note, and says when the note will be read. Terminal: `squad ask <ticket> "..."`.
-
-### Waiting for you, loud
-
-- **A banner on every page** when something needs you, with the button to press on each item.
-- **The browser tab shows the count**: "(2) roomflow".
-- **Desktop notices**, asked for once: one notice per new question, approval, proof or stop. No sound. Settings ›
-  Desktop notices turns them on or off.
-
-### Time limits you can see
-
-- **"Taking longer than usual"** past twice a step's usual time, with what it is doing, its last progress and when
-  squad-kit stops it: **Give it 10 more minutes**, **Stop and try again**, **Stop**. Terminal:
-  `squad wait <ticket> --more 10m`, `squad stop <ticket> --again`.
-- **"Looks stuck"** says what squad-kit checked, and keeps **End the stuck command**.
-
-### Your apps
-
-- **Start, Open, Restart and Stop** your app from the sidebar. squad-kit runs it from its own copy of `main` (never
-  your folder), brings the copy up to date first, copies your `.env` files into it, and says Running only when the
-  address answers. **Show output**
-  has the last lines.
-- **Run the new version** after Looks right.
-- **A busy port** gets a plain message, and the fix when there is one. No start command: **Ask the Architect to find
-  it**, or **Type it**.
-- Terminal: `squad app start|stop|restart|status|set|find`.
-
-### Delete and Archive
-
-- **Delete** a ticket that is not merged: squad-kit stops the squad on it, then removes its copy of the code, its
-  branch, its files, its unmerged decisions, its chats and screenshots. The tracker item and the cost stay. A delete
-  cut off half-way finishes with **Delete again**.
-- **Archive** a merged or released ticket to take it off the board; **Show archived** and **Unarchive** bring it
-  back.
-- Terminal: `squad delete <ticket>`, `squad archive <ticket> [--undo]`, `squad board --archived`.
-
-### When something goes wrong
-
-- **Every stop says what happened, what is safe, and the ways out** as buttons. The exact error is in the
-  Developer tab and the app log.
-- **Claude's usage limit pauses the squad** for every project, shows when it resets, and carries on by itself from
-  the same step, without counting a failed try. **Try now** carries on at once (`squad try-now`).
-- **Report a problem** saves one `.zip` to send for help: the ticket, its conversations, the last day of the app
-  log and the versions. Never sign-ins, tokens or `.env` files. Terminal: `squad report [ticket]`.
-- **An app log** in `~/.squad-kit/logs/`, one file a day, kept 14 days. Terminal: `squad logs --tail`.
-
-### Also
-
-- **On a phone**, the sidebar folds away behind a menu button, and the ticket drawer takes the whole screen.
-- **`squad inbox`** names a newer decision that changes a plan correctly (it said "Looks stuck").
-- **Copied terminal commands quote pasted text safely.** A note or answer with `$(…)`, backticks or a trailing `\`
-  could run or break when the command beside its button was pasted into a terminal.
-- **Tracker text is decoded once.** A written `&amp;lt;` in a Jira or Azure DevOps item no longer turns into `<`.
-- **Security**: GitHub code scanning, secret scanning with push protection and Dependabot are on, the release
-  workflow's Actions are pinned to exact versions, npm publishing runs only from release tags, and `SECURITY.md`
-  describes 1.0. The issues code scanning found are fixed.
-
-## [1.0.1] — 2026-11-03
-
-squad-kit 1.0.1 makes the squad steadier and easier to follow, from what we saw in the first trials. To get it
-from 1.0.0, run `squad upgrade` once. From now on the app updates itself with one button.
-
-### Easier to follow
-
-- **"From an idea or message" works and shows its progress.** The dialog no longer disappears behind a blurred
-  board. The Analyst works in the background with three steps and a clock, and you can press Cancel. You can
-  close the window: the draft waits for you under New ticket.
-- **Errors stay on screen** until you close them.
-- **The Conversation tab reads in plain words.** "Handed in its answer" replaces the raw answer, and a command
-  the step may not run shows in grey as skipped, not in red as a failure.
-- **A ticket waiting for a free place says so**: "Waiting for a free place", with the limit, instead of
-  looking as if it runs.
-- **"Resumed after sleep"** shows when the computer slept in the middle of a step.
-
-### The Update button
-
-- **The app looks for a new version** on start and once a day. When one is out, Home and every project show
-  it with what is new. **Update now** waits until no agent is in the middle of a step, installs, and restarts
-  the app on the same link. Every ticket carries on where it was.
-- **Settings › About squad-kit** shows your version, when it last checked, and a switch for the daily check.
-  Terminal: `squad upgrade`.
-
-### Quality
-
-- **A new Quality setting** on the Squad and AI page: **Best** (the default), **Balanced** or **Thrifty**.
-  On Best, the strongest model builds and reviews at high effort. On Claude Code that is Opus. Terminal:
-  `squad config set quality best`.
-- **A new "extra high" effort.** On Best, a Builder run that fails moves the next one up to extra high.
-- **The Reviewer is never weaker than the Builder** on Best and Balanced.
-- **Reading the project after a merge is cheaper.** The project map is only read again when files are added,
-  moved or removed, and that read runs on a lighter model.
-
-### No silent hangs
-
-- **Stop works at every moment**, also between two runs, and it ends the agent with everything it started. A
-  step that runs out of time ends the same way.
-- **Git that talks to a remote has a time limit**, and never waits for a password prompt nobody sees.
-- **Starting an agent has a time limit.** If it cannot start, the step says why instead of waiting.
-- **The Builder no longer waits for the "before" screenshots.** They are taken beside it, with their own time
-  limit.
-- **A test, lint or build command with no output for 5 minutes is stopped**, and the ticket says which one.
-
-### Agents stay in their lane
-
-- **Every agent runs with the permissions of its step.** The Tester can run the app but cannot change the code;
-  what it changes anyway, squad-kit puts back.
-- **No agent can change the instruction files** the next session would follow, such as `CLAUDE.md`, or
-  squad-kit's own `.squad/` folder. Agents read copies of the project's rules, never your own folder.
-- **No agent can rewrite git history.** squad-kit checks after each Builder and Tester step.
-- **Every answer is checked.** An incomplete answer is asked for once more, then the step says so plainly.
-- **Text from outside**, such as a tracker item or a pasted message, reaches the agents as data, never as
-  orders.
-- **Test, setup and release commands no longer get the AI and tracker keys.**
-
-### No lost work
-
-- **A release and a "Looks right" at the same moment** no longer get in each other's way.
-- **Stop keeps the step the ticket was at.**
-- **"Bring in the latest main"** uses the remote's main, not an old local copy.
-- **Only a real clash counts as a clash.** Other git errors say what went wrong. `squad doctor` checks the git
-  version.
-- **Tracker updates are kept until they are sent**, and retried when the tracker is down.
-- **A release whose push failed** says "not pushed yet", with **Push again** on the Releases page. Terminal:
-  `squad release <version> --push-again`.
-- **Withdraw change** takes back an approved change the squad has not built yet, and puts the spec back to how
-  it was. Terminal: `squad propose <ID> --withdraw`.
-
-### Fixes
-
-- **The Architect writes the stack**, with each part's role, from the code it reads. `stack.md` was empty.
-- **The Reviewer is told the checks already ran**, so it does not run them again.
-
-## [1.0.0] — 2026-11-02
-
-squad-kit 1.0 is an agent harness for the whole software cycle. You write a ticket in plain words. A squad of
-AI agents (Analyst, Architect, Builder, Tester and Reviewer) takes it from that ask to a release, and you stay
-in control through buttons and approvals. It needs Node.js 22 or newer, git, and an AI tool installed and
-signed in: Claude Code today. Moving an existing project: [Moving to 1.0](docs/migrating-to-1.0.md).
-
-### The one app
-
-- **Plain `squad` opens one app for all your projects**, from any folder, in your browser at `127.0.0.1:4571`.
-  It runs on your computer only, behind a private link.
-- **Home** lists your projects and one **Waiting for you** list across all of them.
-- **Add project** opens a folder browser inside the page. It says what kind of folder you picked, and can make
-  a new one.
-- **`squad console`** in a folder adds that project to the app and opens its board, starting the app if needed.
-- Every project has its own board, at its own address. Every button has a terminal command, and commands take
-  `--project <name>` from any folder. New: `squad projects`, and `squad inbox` across every project.
-- `squad --restart` and **Restart the board** start a fresh app on the same link. Running work picks up where it
-  stopped.
-
-### Projects and files
-
-- **Any folder can be a project**: an empty folder (a new repo), code with git (kept as it is), code without git
-  (a new repo with your files in its first commit, without `node_modules`, `dist` or `.env`), or a folder with
-  several code repos.
-- **The project keeps its own memory in `.squad/`**, as Markdown people can read and edit: `config.yaml`, and
-  `tickets/<ID>/` with `ticket.md`, `spec.md`, `questions.md`, `design.md`, `notes.md`, `proof.md` and attached
-  files, plus `decisions/`, `releases/`, `rules/` and `knowledge/`.
-- **This computer keeps its own part in `~/.squad-kit/projects/<id>/`**: live progress, agent chats,
-  screenshots, voice notes, sign-ins and cost. Nothing secret, personal or big goes into the project folder.
-- **Git stays quiet.** `.squad/` goes in git's local ignore list, never in `.gitignore`. For a project whose
-  `.squad/` sits in its one repo, squad-kit commits each ticket's documents on the ticket's branch, and the
-  release commit carries the rest. `git log .squad/tickets/<ID>` shows each big moment of a ticket.
-
-### Tickets and the squad
-
-- **Write a ticket on the board** in plain words, with criteria, business rules, edge cases and files. Or paste
-  an idea or a chat message and the Analyst fills in the ticket for you to check. Bugs have their own form.
-- **Pull a ticket from your tracker.** Azure DevOps today: the backlog by sprint, comments, states, bugs, pull
-  requests on Azure Repos, and items closed with the version on release. Tickets keep the tracker's name, like
-  `AB-46`; a project without a tracker names its own (`LR-1`).
-- **The squad's loop**: questions, spec, design, build, checks, review, proof, release. You answer, approve the
-  spec, approve the design (a developer can do this part), check the proof and release.
-- **Full and Express tracks.** Express is for small fixes: no questions and the plan approved on its own; the
-  build, checks, review and your **Looks right** still run.
-- **squad-kit is the boss.** It runs the tests, lint and build itself, starts a fresh Reviewer, and does the git
-  and tracker work. Agents never merge, push or grade their own work. The Builder works in its own copy of the
-  code; your folder is never touched while it works.
-- **Decisions are saved and linked**, named by the ticket that made them (`AB-46.1`), or `STACK.1` for what the
-  Architect found in the existing code. The Architecture page shows how they build on each other.
-- **Every stop has a way out**: try again, fix it yourself, continue anyway (only you can, with a reason that
-  stays on the record), or go back to the plan. Nothing hangs silently.
-- **Model levels per role and step**: strongest, balanced or fast, with an effort. squad-kit sets the defaults;
-  the team and each person can change them on the Squad and AI page.
-- **One limit of tickets at once** (2 by default, up to 5), shared by all projects, because they share your AI
-  account.
-- AI tools plug in as modules. Claude Code runs every role today; Codex is found but cannot run yet.
-
-### Chat
-
-- **Talk to any agent** on a ticket, with screenshots, files and voice notes.
-- **Asking never stops the work.** While the squad works, the chat runs beside it and changes nothing.
-- **A change goes through the spec.** **Propose a change**: the Analyst writes the old and new wording and says
-  if it is small or big, and you approve. A small change reaches the Builder at the end of its current step. A
-  big one pauses it, the Architect updates the design for your approval, and the Builder redoes only what
-  changed. One change at a time per ticket. Terminal: `squad propose`.
-- **Released work is for questions only.** A change to it becomes a new linked ticket or a bug report.
-- A new chat window is coming in this release: a side panel with tabs, a full-screen page, a phone layout, and
-  Arabic and English shown the right way.
-
-### Teams
-
-- **An owner on each ticket**, kept in `ticket.md`, so two squads never build the same ticket.
-- **Hand over** (button and `squad hand-over`) pushes the ticket's branch with its code and documents, and names
-  the new owner. Their squad carries on from the branch, with a fresh session from the spec, design and code.
-- **A fresh clone shows the same board**: every ticket with its spec, answers, design, stage and owner, and
-  every decision. Live progress, chats and screenshots stay on the computer that made them.
-- Hand over and clones work for a project whose `.squad/` sits in its one repo.
-
-### Cost
-
-- **What each ticket and each role used**: runs, tokens, and the cost at the AI company's API prices, per role
-  and step. On the ticket's Cost tab, the Squad and AI page, the board's footer and in `squad show`.
-- Your own AI subscription pays for it. The numbers show where the cost goes, so the team can tune the levels.
-
-### Moving from 0.x
-
-- **Open a 0.x project** with `squad console` or Add project. Its `stories/`, `plans/` and tracker settings in
-  `config.yaml` stay as they are; `config.yaml` gains a `board:` section.
-- **Sign-ins move** from `.squad/secrets.yaml` to `~/.squad-kit/projects/<id>/secrets.yaml`. The 0.x commands
-  find them there.
-- **A board from an early 1.0 build** (`.squad/board/`) moves to the new layout on its own, once, with a backup
-  in `~/.squad-kit/backups/` and a field-by-field check. Tickets and decisions keep their names. It waits until
-  no board runs.
-- The 0.x commands (`new-story`, `new-plan`, `auth`, `config`, `doctor` and others) still ship. The 0.x console
-  pages are replaced by the 1.0 app.
-
-## [0.12.4] — 2026-08-26
-
-### Bug fixes
-
-- **"Open" on a freshly generated plan 404'd in the console.** After a run finished, the *Plan
-  saved* callout's **Open** link — and the **Open plan** button on the run report — resolved to
-  `/plans/<feature>/.squad%2Fplans%2F<feature>%2F<file>.md`, and the page rendered
-  `404 Not Found: {"error":"not_found"}`. Reported as
-  [#9](https://github.com/AzmSquad/Squad-Kit/issues/9).
-
-  Run records and the `done` event carry `planFile` as a path relative to the workspace root
-  (`.squad/plans/<feature>/<file>.md`) — that is the form shown to the user, and what both
-  `squad new-plan` and the console runs API have always written. The `/plans/$feature/$planFile`
-  route and `GET /api/plans/:feature/:planFile` want the **file name** only, because the API
-  resolves it under `.squad/plans/<feature>/`. Both link sites now normalise the value.
-
-  Normalising in the UI rather than at the writers also repairs every run record already on disk,
-  which all store the long form — so the run report's link works for historical runs too, not just
-  new ones.
-
-  The existing test asserted the correct href but fed the component a bare file name the server
-  never sends, so it passed while the real link was broken. The fixture now matches the actual
-  payload, and reverting the fix makes it fail.
-
-## [0.12.3] — 2026-08-25
-
-### Bug fixes
-
-- **The console's Doctor page was unreachable.** `/doctor` was defined as a route but never added to
-  the router's child list, so the sidebar link, the breadcrumb, and the Cmd+K entry all resolved to a
-  bare "Not Found". Introduced in 0.11.0 (`46519fd`, the runs-pages work) and shipped in every
-  release since. The CLI's `squad doctor` was unaffected throughout, which is why it went unnoticed.
-
-  The route is registered again, and `console-ui/src/router.test.ts` now asserts that **every**
-  sidebar destination resolves to a registered route. Neither the type checker nor the existing
-  tests could catch this: a defined-but-unregistered route is valid unused code, and a link to a
-  non-existent path is just a string.
-
-## [0.12.2] — 2026-08-25
-
-### Bug fixes
-
-- **The planner never read any project files, then hung.** On the Agent SDK runtime a run reported
-  `reads 0/N`, the scout exhausted its turns without reaching `respond_with_scout_result`, the draft
-  produced a plan with no repo context, and the session then stalled indefinitely — the plan file was
-  written but the CLI and the console both kept spinning. Reported as
-  [#8](https://github.com/AzmSquad/Squad-Kit/issues/8). Two causes, both fixed:
-
-  1. **Every tool call is gated on a permission decision**, and the runtime supplied no handler. The
-     model emitted `tool_use` for `read_file` / `grep` / `list_dir` and nothing ever executed them.
-     The runtime now grants its own `mcp__squad-kit-*` tools and denies everything else, so a tool
-     the planner did not register can never run during planning.
-  2. **A claude.ai login carries the account's connectors into the session** as extra MCP servers
-     (Google Drive and friends), crowding the tool namespace the planner depends on — measured at 12
-     tools where the planner registers a handful. Planning now runs with `strictMcpConfig`, so it
-     sees only the tools squad-kit registers.
-
-  Verified on a real subscription run: `reads 0/25` and an indefinite hang before, `scout ✓` with
-  `reads 8/8` and a clean exit after.
-
-  **Scope.** Cause 2 needs a Claude subscription login and so only affects 0.12.x. Cause 1 is
-  auth-independent and dates to the Agent SDK runtime landing in **0.10.0**, so API-key users on
-  `planner.runtime.anthropic: agent-sdk` (the default for Anthropic) were most likely getting
-  context-free plans too. That inference follows from the mechanism; it has not been reproduced
-  against an API-key run.
-
-### Internal
-
-- Pinned `packageManager` to `pnpm@9.15.9` and removed the duplicate pin from the CI workflow.
-  Corepack had been resolving pnpm 11 locally, which re-added a `packageManager` field on every
-  invocation, generated a stray `pnpm-workspace.yaml`, and failed `pnpm install` on unapproved
-  esbuild build scripts — breaking `pnpm build`, `pnpm test`, and `npm publish` (whose
-  `prepublishOnly` runs all three). The lockfile has always been `lockfileVersion 9.0`.
-
-## [0.12.1] — 2026-08-24
-
-### Bug fixes
-
-- `squad auth login` ended a **successful** browser login with
-  `could not verify the login (unknown)` and a warning that the credential "may
-  be invalid or expired". The token was fine. `accountInfo()` resolves from the
-  Agent SDK's `initialize` response, and for `CLAUDE_CODE_OAUTH_TOKEN` auth that
-  response carries `{tokenSource, apiProvider}` and **never** an account — for a
-  valid token exactly as much as for a bogus one. 0.12.0 treated a missing
-  account as a failed credential, which flagged every healthy login through the
-  primary documented flow.
-
-  The probe now separates three outcomes instead of two: an account came back
-  (verified, shown); a credential *source* came back without an account
-  (reported as resolved, with the honest caveat that token validity can only be
-  confirmed by an actual planning run); or nothing came back at all (still
-  treated as unverified). `squad auth login`'s summary and `squad doctor`'s
-  planner credential row both reflect which applies, and neither claims a
-  verification the SDK cannot perform.
-
-  Workspaces that authenticate through the OS credential store are unaffected —
-  those do report an account and are still verified as before.
-
-## [0.12.0] — 2026-08-24
-
-### What's new
-
-- **Plan on your Claude subscription.** The Anthropic planner can authenticate
-  with the Claude login you already have (Pro, Max, or Team/Enterprise) instead
-  of an API key. `squad new-plan --api` and the console Generate page both run
-  on it. No per-token API bill. OpenAI and Google are unchanged and remain
-  API-key only.
-- **`squad auth login | status | logout`.** `login` runs the Anthropic browser
-  authorization flow and stores the resulting token in `.squad/secrets.yaml`;
-  `--token <value>` consumes a `claude setup-token` value on a headless machine,
-  and `--print-only` runs the flow, prints the token, and stores nothing.
-  `status` reports the resolved mode, the credential behind it, and the
-  signed-in account (`--json` for a stable scripting shape, `--offline` to skip
-  the live check). `logout` removes only the token squad-kit stored.
-- **`planner.auth.anthropic`** in `.squad/config.yaml` — `subscription`,
-  `api-key`, or `auto`. The merged default is **`auto`**: prefer a detected
-  Claude login, fall back to a resolvable API key, otherwise fail naming both
-  recovery paths. `squad init` offers the subscription as the first and default
-  choice for new workspaces and writes it explicitly.
-- **`planner.anthropicOauthToken`** is a new secrets-only key. `.squad/config.yaml`
-  rejects it by name at load time.
-- **Subscription runs withhold the API key.** In subscription mode
-  `ANTHROPIC_API_KEY` and `ANTHROPIC_AUTH_TOKEN` are removed (case-insensitively)
-  from the planner subprocess environment. Both outrank the login credential
-  inside Claude Code, so an inherited one would silently bill API credits. The
-  parent shell is untouched.
-- **No new runtime dependency.** `squad auth login` shells out to the `claude`
-  binary that `@anthropic-ai/claude-agent-sdk` already ships through
-  `optionalDependencies`. A separate Claude Code install is never required.
-- **Auth-aware `squad doctor`.** New `planner auth mode` (resolved mode, why,
-  and the credential — naming any API key it is ignoring) and
-  `planner auth vs. runtime` (subscription auth requires the Agent SDK runtime)
-  checks. `planner model resolves at provider` and `planner tier vs. model` now
-  **skip** on subscription auth: there is no API key to list models with and no
-  API rate tier to warn about.
-- **Console auth surface.** An Authentication control on Config (with a
-  hard-conflict callout that disables Save), a Claude Account card on Secrets
-  with a live "Check again" probe and a masked stored token, an auth badge and
-  branched billing copy on Generate, a dedicated recovery callout for
-  `auth_unavailable` failures, and an Auth column on the runs index. The console
-  guides the login and never performs it — it cannot complete an OAuth callback
-  on your behalf.
-- **Run records carry `authMode`**, and the planner stream gained one additive
-  `auth_info` event. Older clients ignore unknown event kinds.
-- **Cost copy branches on auth mode.** `printPlannerApiCostNotice()` and the
-  limit explanations no longer describe per-token billing on a subscription run.
-
-### Bug fixes
-
-- Planner model-list probe (`src/core/probes.ts`): a network-level `fetch`
-  rejection (offline, DNS failure, proxy refusal) or a non-JSON response body
-  threw out of `fetchProviderModelIds` instead of returning a failure result, so
-  `squad doctor`'s `planner model resolves at provider` check surfaced an
-  unexpected error rather than a clean diagnosis. Both are now caught and
-  reported as `status: 0` with the message, and long error bodies are truncated.
-  Shipped to GitHub after v0.11.0 (`d2d67a1`) and missed the 0.11.0 changelog.
-
-### Upgrade notes
-
-Zero-config. A `config.yaml` with no `planner.auth` block merges to `auto` and
-keeps loading; every existing `planner.*` key, including `maxOutputTokens`, is
-unaffected. An untouched 0.11.0 API-key workspace resolves to `api-key` and
-behaves identically — **provided the machine has no Claude login**.
-
-Under `auto`, a detected Claude login **outranks** a stored API key. So on a
-machine that has both, an upgraded workspace switches to subscription billing.
-Nothing errors, and the change is announced rather than silent: `squad doctor`'s
-`planner auth mode` row reads `subscription (auto — Claude login detected) → …
-· ignoring the API key from .squad/secrets.yaml`. Set
-`planner.auth.anthropic: api-key` to pin the previous behaviour.
-
-`squad doctor --fix` deliberately does **not** pin an implicit `auto` to
-`api-key`. `auto` exists so that a Claude login takes over once one appears;
-pinning would silently prevent that forever.
-
-### Notes / limitations
-
-- **Usage draws on your Claude plan's limits.** Per Anthropic's
-  [Use the Claude Agent SDK with your Claude plan](https://support.claude.com/en/articles/15036540-use-the-claude-agent-sdk-with-your-claude-plan),
-  Agent SDK, `claude -p`, and third-party usage consumes the subscription's
-  usage limits, and the separately announced monthly SDK credit is not currently
-  available. The claim this release makes is **"no per-token API bill"** — not
-  free, and not unlimited. Opus planning against a **Pro** plan consumes a usage
-  window noticeably faster than against **Max**. Hitting the ceiling means
-  waiting for the reset window or switching to an API key.
-- **Enterprise managed-settings `apiKeyHelper` still wins.** squad-kit runs the
-  Agent SDK with `settingSources: []`, so user, project, and local settings are
-  not read and an ordinary user-level `apiKeyHelper` cannot hijack a
-  subscription run. **Policy settings are always merged regardless**, so a
-  managed-settings `apiKeyHelper` deployed by MDM is still honoured and still
-  outranks the login credential — on a managed device, `auth: subscription` may
-  resolve through the organization's helper. This was established by reading the
-  credential resolver in the bundled `claude` binary, **not** on a live managed
-  device. `squad auth status` reports the `apiKeySource` the SDK actually
-  resolved.
-- **`auth: subscription` requires the Agent SDK runtime.** `@ai-sdk/anthropic`
-  authenticates with `x-api-key`, and an OAuth credential is not an API key.
-  `auth: subscription` with `planner.runtime.anthropic: vercel`, or with a
-  non-Anthropic provider, is a hard failure before any network call — never a
-  silent downgrade to API billing.
-- **Account details are never persisted.** Email, organization, and plan are
-  fetched live for display in `squad auth status`, `squad doctor`, and the
-  console. `.squad/runs/` records the resolved **mode** and `apiKeySource` only —
-  no token, key, email, or organization. Asserted by a test.
-- **A successful SDK handshake does not prove the credential works.**
-  `accountInfo()` resolves from the subprocess's `initialize` response, which
-  succeeds whether or not the credential is valid. Subscription auth that
-  reports no account **and** no `apiKeySource` is therefore treated as
-  unverified rather than signed in.
-- `docs/auth.md` is not shipped inside the npm tarball. It is served at
-  <https://squad-kit.com/docs/auth> and lives in the repo under `docs/`.
-
-## [0.11.0] — 2026-05-04
-
-### What's new
-
-- API `new-plan` can append planner events to `.squad/runs/<id>.events.jsonl`
-  (thinking text redacted on disk; retention rotates old files).
-- Agent SDK runs emit richer events (tool lifecycle, thinking deltas, caps,
-  runtime metadata) for the CLI and console.
-- API-mode `new-plan` prints stage pipeline, budget meters, and thinking
-  activity; the plan summary cites the events file path.
-- `squad console` HTTP API lists persisted runs and serves stored event streams.
-- Console UI adds a runs index, run report page, and a reworked Generate view
-  with live panels and navigation.
-
-### Bug fixes
-
-- `squad doctor` skips live external probes when `CI` is set and surfaces
-  planner probe errors cleanly.
-- Vitest timeouts increased for slow config loads and console API tests.
-
-## [0.10.0] — 2026-05-04
-
-### What's new
-
-- Anthropic planning defaults to the Claude Agent SDK so Opus 4.7 can use
-  adaptive thinking and effort; OpenAI and Google stay on the Vercel AI SDK.
-- Planner YAML and CLI cover runtime choice, thinking mode, effort, and
-  per-phase effort (`--anthropic-runtime`, `--effort`, `--scout-effort`,
-  `--no-thinking`).
-- The planner summary shows which runtime ran; run JSON may record runtime and
-  a provider-options snapshot for dashboards and tooling.
-- `squad doctor` checks runtime wiring, model vs runtime fit, and the Agent SDK
-  binary.
-- Published CLI no longer bundles `cli.js.map`; set `SQUAD_TSUP_SOURCEMAP=1`
-  when running `tsup` locally if you need a source map.
-- On the Agent SDK path, cache token counts are not surfaced in telemetry
-  (caching still applies); live usage stays aggregate-only until the run ends;
-  cancel may not stop the upstream HTTP request immediately.
-
-## [0.9.1] — 2026-05-04
-
-### Bug fixes
-
-- Anthropic scout and draft attach extended thinking so Opus 4.7+ avoids
-  failed calls when the SDK would send incompatible temperature overrides.
-
-## [0.9.0] — 2026-05-04
-
-### What's new
-
-- Scout precedes the draft planner in API `new-plan` for a cheaper first pass.
-- Validation verifies citations offline and suggests typo fixes for paths.
-- New planner tools: `grep`, `list_dir`, and `read_file` with offset/limit.
-- Scout sees a bullet list of `.squad/plans/` markdown (caps at ~30 files).
-- Anthropic/OpenAI/Google run through Vercel AI SDK (`ai`, `@ai-sdk/*`).
-- Tool outputs keep `toolName`/`isError` metadata across turns where supported.
-- Scout snippets use separate user-role cache blocks for stabler prompts.
-- Generate-plan template adds edge-case, failure-mode, and test-plan sections.
-- Disable scout or validation via flags or YAML (`planner.stages.*`).
-
-### Bug fixes
-
-- Jira Tracker broke on blank search (HTTP 400); bounded JQL restores results.
-- Atlassian JSON errors surface in tracker messages again (snippet capped).
-
-### Breaking changes
-
-- Dropped `planner.budget.maxCostUsd` and `cost_cap` limits (never enforced).
-- Remove lingering keys from `config.yaml` if they are still declared.
-
-## [0.8.0] — 2026-05-03
-
-### What's new
-
-- Generate page shows provider rate limits: countdown, auto-retry banner,
-  and rerun when the planner aborts over the wait cap.
-- Planner emits richer `rate_limit` stream events (`retrying` vs `aborted`,
-  cap seconds, provider, short error snippet). CLI `new-plan` only shows the
-  “waiting to retry” spinner for the retrying phase.
-- Run SSE ends a rate-limit abort with `done` (partial) only — no extra
-  `error` line repeating the same message.
-
-### Bug fixes
-
-- Jira issue search called deprecated `/rest/api/3/search` (Atlassian returns
-  HTTP 410). Search now uses `/rest/api/3/search/jql` with clearer 410 errors
-  if an old client hits removed endpoints.
-
-## [0.7.2] — 2026-04-28
-
-### Bug fixes
-
-- The console sidebar and dashboard still reported `v0.6.0` after 0.7.1
-  because `/api/meta` and `/api/dashboard` had the version hardcoded.
-  Both now read from `package.json` (matching the CLI and `/healthz`
-  fix in 0.7.1).
-- `squad config set tracker --type github` was a no-op stub: it set
-  `tracker.type = github` without prompting for owner/repo or PAT and
-  skipped the connectivity probe. It now matches the Jira and Azure
-  flows — interactive credential prompt, secrets written to
-  `.squad/secrets.yaml`, post-config GitHub probe, and an updated
-  next-steps hint with `--id <github-issue-number>`.
-
-## [0.7.1] — 2026-04-28
-
-### Bug fixes
-
-- `squad --version` printed `0.6.0` on 0.7.0 — the version string was
-  hardcoded in the CLI and the console `/healthz` endpoint. Both now
-  read from `package.json` and stay in sync with the installed package.
-
-## [0.7.0] — 2026-04-28
-
-### What's new
-
-- GitHub Issues works as the issue tracker: set owner/repo in config, PAT (or
-  `GITHUB_TOKEN` / `GITHUB_HOST`) in secrets, search and import like Jira or
-  Azure. Console Secrets page has GitHub host and token fields plus a
-  connectivity test; `squad doctor` probes the GitHub REST API.
-
-### Breaking changes
-
-- Linear is no longer a tracker type. Use GitHub Issues, Jira, or Azure, or
-  set tracker to `none`. Update `.squad/config.yaml` if you had `linear`.
-
-## [0.6.1] — 2026-04-26
-
-### Bug fixes
-
-- Azure DevOps console tracker search was failing on first load and on text
-  search with HTTP 400. WIQL queries now require the team project (`@project`)
-  in the WHERE clause; HTTP 400 responses include a clearer hint about
-  org/project or WIQL scoping.
-
-## [0.6.0] — 2026-04-29
-
-### Why this release
-
-squad-kit 0.5.0 shipped the console end-to-end. Real users found the visual layer hostile for an admin/console surface — too marketing-y, glow orbs everywhere, dialog positioning glitches under our overflow rules — so 0.6.0 is a redesign-only release. Zero CLI behaviour changes, zero API contract changes. The console adopts a Vercel/Geist-inspired palette: flat near-black surfaces, white text, accent green reserved for status (live planner dot, focus rings, active sidebar, success badges). Every dialog is now portal-rendered and centred reliably. The signature Vercel/Linear move — Cmd+K command palette — is in.
-
-### Added
-
-- console-ui: Cmd+K command palette (powered by `cmdk`) — searches stories, plans, and actions; Linear-style chord shortcuts (`g s` for Stories, `g p` for Plans, `n s` for new story, `?` for the cheatsheet, etc.).
-- console-ui: portal-rendered Dialog primitive with focus trap, body scroll lock, ESC + backdrop close, focus restore. Replaces the native `<dialog>` element (and fixes its positioning bugs).
-- console-ui: Toast system (`useToast()`) with bottom-right stack, tone-coloured icons, auto-dismiss, manual dismiss, optional inline action.
-- console-ui: Confirm provider (`useConfirm()`) — promise-based ergonomics for destructive actions.
-- console-ui: Callout component for inline alerts (default / info / success / warning / danger). Replaces every ad-hoc tone block sprinkled through pages.
-- console-ui: Density toggle (Comfortable / Compact) in the topbar; persists to `localStorage`, applies via `[data-density]` on `<html>`.
-- console-ui: Breadcrumbs in the topbar, derived from the route match tree.
-- console-ui: New primitives — `Page`, `Spinner`, `IconButton`, `Tooltip`, `Kbd`, `Field`. All density-aware.
-- console-ui: Internal design playground at `/__design` for primitive sanity checks.
-- console-ui: `lucide-react` for icons; sidebar letter-icons (`D / S / P …`) replaced with proper Lucide icons.
-
-### Changed
-
-- console-ui: complete design-token rewrite — Geist-inspired graphite scale (12 steps from `--gray-1` to `--gray-12`), accent green reserved for status only. The marketing-site palette stays on the marketing site; the console diverges. CSS variable names that pages already used (`--color-bg`, `--color-surface`, `--color-text`, `--color-accent`, etc.) keep working — their values changed.
-- console-ui: layout shell rewritten — sidebar is sectioned (Workspace / Run / Settings) with Lucide icons, project switcher moved into the sidebar header, topbar shows breadcrumbs + density toggle + Cmd+K hint. The decorative `grid-bg` and `glow-orb` divs were removed from the working surface.
-- console-ui: every page rewritten through the new `<Page>` wrapper. Inline tone classes (`bg-emerald-…`, `bg-red-…`, etc.) replaced with `<Badge>`, `<Callout>`, and `<Toast>`. Destructive actions go through `useConfirm()`.
-- console-ui: charts read CSS variables instead of hard-coded hex codes; near-monochrome palette with green only for the most-recent / success series.
-- console-ui: shimmer Skeleton replaces the static `animate-pulse` block.
-- console-ui: Markdown viewer adopts a near-monochrome prism theme matching the new tokens.
-
-### Fixed
-
-- console-ui: dialog positioning bugs caused by the native `<dialog>` element interacting with our layout's overflow rules. Now portal-rendered and reliably centred.
-
-### Migration
-
-No breaking changes for CLI users. The `.squad/` file formats, command flags, planner output, tracker integration, and config schema are byte-identical to 0.5.0. If you've installed `squad-kit@0.5.0` globally and run `squad console`, simply `npm i -g squad-kit@0.6.0` and your next `squad console` opens the new look. No `.squad/config.yaml` changes.
-
-### Internal
-
-- console-ui: `cmdk`, `lucide-react` added to `console-ui/package.json` (consumed at build-time only; the CLI runtime dependency tree is unchanged).
-- console-ui: extensive primitive coverage with vitest — tests grew by ~25 cases across `Button`, `Badge`, `Spinner`, `Field`, `Page`, `Dialog`, `Toast`, `Callout`, `Confirm`, `Breadcrumbs`, `useDensity`, `CommandPalette`, `useGlobalShortcuts`.
-
-## [0.5.0] — 2026-04-25
-
-### Why this release
-
-squad-kit 0.4.0 made the planner reliable and the partial-plan recovery flow first-class. 0.5.0 makes the whole product **shareable**: a local-first, dark-modern web console that exposes every CLI capability with a UI a teammate can use without learning the commands.
-
-The console isn't a hosted dashboard. It binds to `127.0.0.1`, gates every API request behind a per-session token, and reads/writes the same `.squad/` files the CLI already uses. Open it with `squad console`, share a screenshot of a streaming planning run on Slack, close the tab, keep working in the terminal.
-
-### Added
-
-- `squad console` — open `http://127.0.0.1:4571` (configurable) for a dashboard, stories CRUD, plans browser with diff, live planner streaming via SSE, visual editors for `config.yaml` and `secrets.yaml`, tracker issue search and import, graphical `squad doctor`. Token-gated and loopback-only.
-- Persistent run history in `.squad/runs/<runId>.json` (last 20 retained). Dashboard reads from it for cache-hit ratio, token spend sparkline, and run-duration bars.
-- `~/.squad/recent-projects.json` — per-user list of project roots you've opened the console against; surfaces in the topbar dropdown.
-- Internal: `PlannerEventBus` + `runPlanner({ events, runId, abort })` lets multiple consumers share one run; CLI rendering becomes a bus subscriber.
-- Internal: `core/story-mutations.ts` (`createStoryRecord`, `deleteStoryRecord`, `createStoryRecordFromIssue`) is now the single implementation behind the CLI new-story / rm-story commands and the console.
-- Internal: `commands/doctor-engine.ts` extracts `gatherContext` and `runAllChecks` so the doctor logic is reusable from the API.
-- Internal: `TrackerClient.searchIssues` for Jira (REST `/search`) and Azure (WIQL).
-- Build: `pnpm size:guard` — fails CI if the published tarball exceeds 2.5 MB unpacked. Wired into `prepublishOnly`.
-
-### Changed
-
-- `pnpm build` now runs the SPA build (`pnpm -C console-ui build`) before the CLI build (`tsup`) and verifies `dist/console-ui/index.html` was emitted.
-- The npm tarball gains a `dist/console-ui/` tree (~700–900 KB gzipped).
-
-### Migration
-
-No breaking changes. CLI commands behave byte-identically. The `.squad/runs/` directory and `~/.squad/recent-projects.json` are added on first console run; `.squad/runs/` is gitignored automatically (managed block).
-
-## [0.4.0] — 2026-04-24
-
-### Added
-
-- `planner.maxOutputTokens` in merged config (default **16384** tokens per model round).
-- Interactive `squad new-plan --api` prompt when a planner limit is hit: continue (extends read/context/time/round/output budgets for that run) or stop, with a short billing note up front.
-- Incomplete API plans save as `*.partial.md` plus YAML `squad-kit-plan-status: partial`; the CLI exits with code **2** when planning did not finish cleanly (no stack trace for that path).
-
-### Changed
-
-- New plan files are named from the **story folder id** (`NN-story-<id-slug>.md`) instead of slugging the title hint, so paths stay short; `00-overview.md` still carries the human title.
-- Intake scaffolding fills more fields from fetched tracker issues (Azure / Jira) when `squad new-story` pulls work item data.
-- Agent `squad-plan` templates remind editors not to overwrite the first-line `<!-- squad-kit: … -->` plan metadata comment.
-
-### Fixed
-
-- `squad list` reads `generated by` metadata from the first matching `<!-- squad-kit: … -->` line in the first lines of a plan file, not only line 1.
-- `findPlanFor` prefers a non-`.partial.md` plan when both exist for the same story id.
-
-### Site
-
-- Added `robots.txt` and small head metadata tweaks on the Astro site.
-
-## [0.3.0] — 2026-04-24
-
-### Why this release
-
-squad-kit 0.2.2 stabilised rate-limit handling with retries and a softer `squad doctor` warning.
-That made failures loud but didn't reduce the underlying token spend: every planning turn
-re-sent the cumulative transcript, so costs scaled roughly quadratically with the number of
-tool calls. On Anthropic Tier 1 with Opus, that made non-trivial plans structurally infeasible.
-
-0.3.0 adds **prompt caching end-to-end** across Anthropic, OpenAI, and Google. Expected savings
-on a typical 10-turn run: ~70% fewer billed input tokens, and — critically on Anthropic —
-cached reads don't count the same against your per-minute quota. Tier 1 Opus users should find
-moderate plans work where they previously hit 429 from turn 7 onward.
-
-### Added
-
-- Anthropic explicit prompt caching via `cache_control: { type: 'ephemeral' }` on the system
-  prompt and the most recent tool-result block each turn (cache TTL rolls forward).
-- OpenAI and Google implicit prefix caching (no config required; activated by the stable-prefix
-  refactor below).
-- `planner.cache.enabled` config knob (default `true`). Configure via `squad config set planner`.
-- Run-summary line: `cache hit 68% (22.4k read / 32.9k total)` every `squad new-plan --api` run.
-- `squad doctor` now checks `planner cache effectiveness`, reading `.squad/.last-run.json`.
-- `.squad/.last-run.json` persistence of planner run stats (git-ignored, per-user).
-- `Usage.cacheCreationTokens` and `Usage.cacheReadTokens` on every provider response.
-- Deterministic request-body builders (`buildAnthropicBody`, `buildOpenAIBody`, `buildGoogleBody`)
-  exposed for testing; dev-mode warning when a turn mutates the cacheable prefix.
-- Copy-paste mode (`squad new-plan --copy`) now writes the composed prompt to
-  `.squad/.last-copy-prompt.md` and prints a compact summary (mode · story · file · size · est
-  tokens · clipboard status) instead of dumping the full 5–10 KB prompt into the terminal.
-- Clipboard fallbacks for Linux (`xsel` in addition to `xclip`) and Termux
-  (`termux-clipboard-set`). Headless Linux / SSH sessions now surface an actionable reason in
-  the summary ("no display server detected — install xclip or xsel, or use the saved file")
-  instead of silently skipping.
-- `squad config set planner` and `squad config set tracker` print a "▸ Next:" block so users
-  know what to run next (`squad doctor` → `squad new-story` → `squad new-plan`).
-- `squad tracker link` and `squad migrate` also print "▸ Next:" guidance.
-- Managed `.gitignore` block now covers `.squad/.last-run.json` and `.squad/.last-copy-prompt.md`.
-
-### Changed
-
-- System prompt no longer embeds timestamps, random IDs, or absolute host paths (these
-  cache-busted the prefix on every turn).
-- `squad doctor` Anthropic Tier 1 Opus warning softened from "you will hit ITPM" to "tight but
-  viable with caching on."
-- `squad config set planner` no longer prompts for `planner.modelOverride`. The interactive
-  flow is shorter and less intimidating; power users can still set the override directly in
-  `.squad/config.yaml` (documented in `docs/customization.md`).
-- `copyToClipboard()` now returns a structured `{ ok, tool?, reason? }` result instead of a
-  bare boolean, so callers can explain failures to the user.
-
-### Known limitations
-
-- Google `cachedContents` explicit API not implemented (implicit caching is sufficient for
-  single-run CLI use).
-- No cross-run persistence of cache stats yet — doctor only reads the most recent run.
-- No automatic context compression when transcripts exceed ~50 KB. Caching helps but doesn't
-  solve the long-horizon case. 0.4.0 candidate.
-- Anthropic 1-hour cache TTL (`ttl: "1h"`) not used — default 5-minute TTL covers single-run.
-
-### Migration
-
-See `docs/migrating-from-0.1.md` §9 "Upgrading from 0.2.x to 0.3.0" for the full path. Short
-version: `squad upgrade` and you're done. Caching is on by default; no config edits required.
-
-## [0.2.2] - 2026-04-22
-
-### Fixed
-
-- **Rate-limit retry no longer burns a doomed request.** 0.2.1 capped the auto-retry wait at 30 s. When a provider asked for longer than that (common on Anthropic Tier 1, which regularly asks for 60–180 s), squad-kit would retry *inside the same throttle window* and fail a second time. 0.2.2:
-  - Raises the retry cap from 30 s to **90 s**, which comfortably covers the provider-suggested wait for most Tier 1 / free-tier 429s.
-  - **Skips the retry entirely** when `Retry-After` is longer than the 90 s cap, and surfaces a dedicated message explaining the decision (`squad-kit did not auto-retry: the provider's 132s wait is longer than our 90s cap, so retrying would just burn another request inside the same throttle window.`) instead of wasting a request and showing the "already retried" variant.
-
-### Added
-
-- **`squad doctor` now reports planner tier vs. model awareness** (check id `planner-tier`). When `planner.provider === 'anthropic'` and the resolved plan model id contains `opus`, the check emits a **warn** with a fix hint suggesting `squad config set planner` to pick Sonnet or Haiku, which live in separate per-model rate-limit buckets on Anthropic Tier 1 (10 k input tokens / minute). For non-Anthropic providers and non-Opus models, the check is `skip` or `ok` — no noise for users who aren't affected.
-- `rateLimitMessage` gained a `retrySkippedReason` + `maxRetrySec` field, so the error text can distinguish "we retried and got throttled again" (firm over-quota) from "we did not retry because your wait is longer than our cap" (retry would be pointless). Both cases still surface the same four recovery options.
-
-## [0.2.1] - 2026-04-22
-
-### Fixed
-
-- **`squad new-plan --api` now handles provider rate limits (HTTP 429) properly.** Previously a 429 surfaced the generic `Run \`squad doctor\` to verify models and credentials.` hint, which is misleading — the credentials are fine, the org is just over its per-minute quota. `runPlanner` now:
-  - Detects 429s across Anthropic, OpenAI, and Google (new `errorKind: 'rate_limit'` on `ProviderResponse`).
-  - Parses `Retry-After` (seconds or HTTP-date) and Google's body-level `retryDelay` field.
-  - Retries **once** automatically, waiting the provider-requested time capped at 30 seconds. A new `onRateLimit(waitSec)` callback lets the UI show a "retrying in Ns" notice.
-  - When the retry also fails, throws a dedicated error that names the provider, summarises the wait time, and lists four concrete recovery paths: wait and retry, switch planner model (`squad config set planner`), tighten `planner.budget`, or upgrade tier (with a deep-link to each provider's limits page).
-- The generic (non-429) provider-error hint now reads `Run \`squad doctor\` to diagnose, or retry — most 5xx errors are transient.`, which is accurate for the actual 5xx / network cases it covers.
-
-### Added
-
-- `detectRateLimit()` and `rateLimitMessage()` in `src/planner/provider-errors.ts`. Both cover all three supported providers and are unit-tested with real-shaped 429 fixtures.
-
-## [0.2.0] - 2026-04-22
-
-### tracker-intake-fetch
-
-**Added**
-
-- `squad new-story --id <ID>` auto-fetches title, description, labels, and attachments (≤ 10 MB each) from the configured tracker. Supported: Jira Cloud, Azure DevOps Services.
-- `.squad/secrets.yaml` as a second credential source (after environment variables) for planner keys and tracker tokens. Created with mode `0600` on POSIX; auto-added to `.gitignore`.
-- `squad init` now prompts for tracker credentials when a supported tracker is chosen, and offers to save the planner key inline as an alternative to exporting an env var.
-- `squad status` shows tracker type, workspace, and credential source (`env` / `secrets.yaml` / `missing`).
-- `squad new-story` flags: `--no-fetch`, `--no-attachments`, `--attachment-mb <n>`.
-- `squad new-story --no-tracker` — skip tracker id and fetch for a single story in a workspace that normally requires tracker ids. Interactive mode now offers "skip tracker for this story" alongside "enter id" when required.
-
-**Changed**
-
-- `squad new-story` accepts the feature slug as an optional positional; prompts when it is omitted in a TTY (including a picker for existing feature folders). Passing `-y` / `--yes` keeps fail-fast behaviour when the slug is missing. `CI=1` forces non-interactive mode even in a TTY.
-- `squad tracker link` accepts both the story path and the tracker id as optional positionals; prompts with a story picker and id input when omitted. `-y` / `--yes` and `CI=1` force non-interactive fail-fast.
-- CLI-wide: commands treat missing required input as promptable in a TTY; `-y` / `--yes` and `CI=1` opt out.
-- Credential resolution order documented: env var → `.squad/secrets.yaml` → prompt → fail. Applies to both planner and tracker credentials.
-
-**Security**
-
-- `.squad/config.yaml` continues to reject secret-shaped keys (`apiKey`, `token`, …). Secrets live in `.squad/secrets.yaml` only.
-- Auto-managed `.gitignore` block covers `.squad/secrets.yaml`, `.squad/stories/**/attachments/`, and `.squad/.trash/`.
-
-### Added
-
-- `squad config` command group with `show`, `set planner`, `set tracker`, `unset planner`, `unset tracker`, and `remove-credential <section>` subcommands. Every field in `.squad/config.yaml` and `.squad/secrets.yaml` can now be edited interactively without opening a text editor.
-- `squad init` on an existing workspace now offers **Reconfigure planner / Reconfigure tracker / Overwrite / Cancel** instead of silently bailing. `--force` keeps the old overwrite behaviour for scripts.
-
-- `squad upgrade` self-update command. Detects the package manager used to install squad-kit, fetches the latest version from npm, and runs the appropriate global-install command after confirmation. Refuses dev installs and major version bumps (print-manual-guide instead).
-- `squad migrate` command applies one-shot 0.1.x → 0.2.0 structural migrations (delete legacy prompts, gitignore, secrets perms, planner budget defaults, config normalisation). Idempotent; destructive by design; gated behind a confirmation prompt unless `--yes` is passed.
-- `squad doctor` command: a full health check covering planner config, tracker credentials, model list probes (no completion calls), `.gitignore` managed block, `secrets.yaml` permissions, legacy `.squad/prompts/`, and `.squad/` layout. `--fix` applies non-destructive repairs only; destructive fixes belong in `squad migrate`.
-- `planner.modelOverride` (per-provider) lets you pin a different plan-phase model id without editing squad-kit source.
-- `pnpm verify:models` (`scripts/verify-models.ts`) probes provider model list APIs before publish so pinned ids cannot drift unnoticed.
-- Clear, actionable error when the planner model returns 404 (upgrade, config override, or `squad doctor`).
-- `squad status` marks the planner row with `(override)` when `modelOverride` is active for the current provider.
-- Direct planner API (optional): Anthropic, OpenAI, Google. Squad calls the planner for you and writes the plan file.
-- Demand-driven context: planner reads files on request via a bounded budget (file count, bytes, wall-clock).
-- Interactive picker in `squad new-plan` over un-planned intakes.
-- Already-planned guard with `--yes` override.
-- `--api`, `--copy`, `--feature`, `--all` flags on `new-plan`.
-- `squad init` asks about planner setup; `--planner <provider>` for non-interactive.
-- `squad status` shows planner provider, model, and env-var presence.
-- `squad list` shows which plans were generated by the API vs copy-paste.
-- Visual identity: mint-green brand, custom spinner frames, banner, summary boxes, consistent prefixes across all commands.
-- `squad rm` command group: `rm story`, `rm plan`, `rm feature`, each with `--dry-run`, `--trash`, `-y`, and interactive pickers. Deleting a story cascades to the matching plan file and overview row. `.squad/.trash/<timestamp>/` is now git-ignored automatically.
-
-### Changed
-
-- Every user-facing error now ends with a recommended next command (for example, `Run \`squad doctor\` to diagnose`). Failures no longer dead-end users at an error string.
-- `ensureGitignore` now includes `.squad/.trash/` in the managed block. Existing users will see the line appended on the next `squad doctor --fix` or any command that calls `ensureGitignore`.
-- Anthropic plan model pinned to the versioned Claude API id `claude-opus-4-7` (replacing the prior alias default) and execute remains dated `claude-haiku-4-5-20251001`, per Anthropic’s model overview — run `pnpm verify:models` after changes.
-- `new-plan <intake>` is now optional; omit to pick interactively.
-- `--no-copy` renamed to `--no-clipboard` (old flag removed). `--copy` now forces copy-paste mode.
-- Prompts (`generate-plan.md`, `intake.md`, `story-skeleton.md`) now ship entirely within the squad-kit package. Fresh installs no longer create a `.squad/prompts/` directory. Stale `.squad/prompts/` from 0.1.x installs is ignored at runtime and cleaned up by `squad migrate`.
-
-### Breaking changes for 0.1.x users
-
-- 0.1.x users who upgrade should run `squad migrate` once per repo. A `.squad/prompts/` folder left from 0.1.x is deleted outright (prompts are now bundled in the squad-kit package).
-- If you customised `.squad/prompts/*.md`, those customisations are no longer used. The canonical prompts are in the installed squad-kit package. To customise, fork squad-kit and patch `templates/prompts/`. (This is intentional: behaviour was inconsistent before — some commands ignored the user copy — and silent version drift was breaking workflows.)
-
-### Security
-
-- Config loader rejects any YAML entry whose key looks like `apiKey`, `token`, `secret`, or `credential`.
-
-### Known limitations
-
-- OpenAI and Google planner model ids in squad-kit remain provider “latest”-style names for 0.2.0; dated snapshots for those providers are planned for 0.2.1 once verified.
-
-### Non-goals (still deferred)
-
-- OpenAI-compatible generic endpoint (OpenRouter, Ollama, local). Targeted for 0.3.
-- `squad implement` command. Targeted for 0.3.
-- MCP server, telemetry.
-
-## [0.1.0] - 2026-04-21
-
-First public release.
-
-### Added
-
-- `squad init` — scaffolds `.squad/` with `config.yaml`, prompt templates, and agent slash commands.
-- `squad new-story <feature-slug>` — creates `.squad/stories/<feature>/<id>/intake.md` with `attachments/`.
-- `squad new-plan <intake-path>` — composes the plan-generation meta-prompt inline with the intake, prints to stdout, and copies to clipboard.
-- `squad status` — reports story / plan counts and next global `NN`.
-- `squad list [--feature <slug>]` — table of stories and their plan state.
-- `squad tracker link <story> <id>` — upserts a tracker id on an existing intake.
-- Agent slash-command templates for **Claude Code**, **Cursor**, **GitHub Copilot**, and **Gemini CLI**.
-- Tracker id validators for **GitHub**, **Linear**, **Jira**, and **Azure DevOps** (no API calls; format validation only).
-- Plan-generation meta-prompt (`generate-plan.md`), intake template (`intake.md`), and plan skeleton reference (`story-skeleton.md`).
-- Documentation: `docs/philosophy.md`, `docs/getting-started.md`, `docs/customization.md`, `docs/vs-spec-kit.md`.
-
-[Unreleased]: https://github.com/AzmSquad/squad-kit/compare/v1.2.1...HEAD
-[1.2.1]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.2.1
-[1.2.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.2.0
-[1.1.1]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.1.1
-[1.1.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.1.0
-[1.0.1]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.0.1
-[1.0.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v1.0.0
-[0.6.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v0.6.0
-[0.5.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v0.5.0
-[0.3.0]: https://github.com/AzmSquad/Squad-Kit/releases/tag/v0.3.0
-[0.2.2]: https://github.com/AzmSquad/squad-kit/compare/v0.2.1...v0.2.2
-[0.2.1]: https://github.com/AzmSquad/squad-kit/compare/v0.2.0...v0.2.1
-[0.2.0]: https://github.com/AzmSquad/squad-kit/compare/v0.1.0...v0.2.0
-[0.1.0]: https://github.com/AzmSquad/squad-kit/releases/tag/v0.1.0