squad-kit 1.2.2 → 1.3.1

package/README.md

@@ -79,9 +79,11 @@ all your projects:
 Keep the terminal open while you work. Press Ctrl-C there to stop squad-kit. The squad picks up where it was
 the next time you run `squad`.
 
-## Add a project
+## Start or add a project
 
-On Home, press **Add project** and pick a folder in the folder browser. Or open a terminal in the folder and
+Have only a BRD or an idea? On Home, press **New project**: squad-kit makes the folder and the squad starts from what you gave.
+
+Already have a project? Press **Add project** and pick a folder in the folder browser. Or open a terminal in the folder and
 run:
 
 ```bash
@@ -212,7 +214,7 @@ writes one line in the ticket's activity.
 - squad-kit picks a **model level** for each role and step from the project's **Quality** setting: **Best**
   (the default) builds and reviews on the strongest model, **Balanced** builds on it at medium effort, and
   **Thrifty** builds on a lighter one. **Fast** stays for screenshots and small helpers. The team or each person
-  can change single steps on the **Squad and AI** page.
+  can change single steps on the **Harness** page.
 - The board shows **what each ticket and each role used**, the way you pay. On a Claude subscription it says the
   work is included in your plan, and shows its size and its value at API prices (a value, not a bill). With an API
   key it shows real dollars, against a budget per ticket and per month.
@@ -223,7 +225,7 @@ writes one line in the ticket's activity.
 
 - [Getting started](docs/getting-started.md): your first hour, from install to a release.
 - [Moving to 1.0](docs/migrating-to-1.0.md): from squad-kit 0.x, and from early 1.0 boards.
-- [The app](docs/console.md): Home, the board, the ticket drawer, Squad and AI, and Settings.
+- [The app](docs/console.md): Home, the board, the ticket drawer, the Harness page and Settings.
 - [From a BRD to a built product](docs/requirements.md): upload a requirements document, approve the breakdown,
   send it to Azure DevOps and let the squad build it.
 - [CHANGELOG](CHANGELOG.md): what changed in each version.

package/SECURITY.md

@@ -41,6 +41,13 @@ Credit will be given in the release notes unless you prefer to remain anonymous.
   copy of the code in `~/.squad-kit/projects/<id>/apps/` (mode `0600`), never anywhere else.
 - **Agents are kept from your secrets.** No agent may read squad-kit's secret files, and the commands squad-kit runs for
   you (tests, setup and release) start without the AI and tracker keys.
+- **Local files stay out of agents' reach.** An engineer can name files git does not carry, like `.env.dev`. Each one goes
+  in a story's copy for the project's own tests and app, and agents are refused it by its exact path. The project's own
+  commands can still read it, and a test the Builder wrote is one of those. So stories use values kept for them on this
+  computer: give them local test values, never real ones. A file with secrets that is already in git is not covered.
+- **Docker stays closed, with one opening.** Project commands cannot reach Docker. squad-kit opens that one socket for its own
+  `docker compose up`, from the project's settings, when an engineer locked every compose file the command names. A story
+  cannot change those files. What runs inside the containers is the story's code, and the image builds run its Dockerfile.
 - **Agents stay in their lane.** Every step runs with the permissions it needs and no more: the Builder edits only its
   own copy of the code, the Tester cannot change code, and no agent may change the instruction files the next session
   would follow, squad-kit's own `.squad/` folder, or git history. squad-kit checks after each step and puts back what
@@ -57,7 +64,9 @@ Credit will be given in the release notes unless you prefer to remain anonymous.
     GitHub and cloud sign-ins, the keys into a runtime's virtual machine, an `.npmrc` with a token), browser profiles and
     squad-kit's own folder. A place it does not know about is not hidden.
   - Reading the `.env` files in your project folder. On a Mac, all of them. On Linux, the ones it finds 3 folders down when
-    a command starts, outside folders such as `node_modules`.
+    a command starts, outside folders such as `node_modules`. One exception: the setup squad-kit runs in your own
+    checkout after a merge reads that checkout's `.env` files, as it does when you run it yourself (a database setup
+    needs them). It still reads no other `.env` file, key or sign-in.
   - Writing outside its copy, the proof folder, the temp folder and the package caches. `~/.cache` and
     `~/Library/Caches` stay read only: your own tools run programs from there. The copy cannot be moved, and git's own
     folder cannot be changed or moved, so nothing written there can make squad-kit's own git start a program.