Squadra 3+ 3.7.1

Squadra 3+ 3.7.1: a security fix for the memoranda plugin.

What changes

• Private output paths, enforced. If you point the memoranda plugin at an output folder of your own (--out-root), it must belong to you, be writable only by you and not be reached through a link you control; the delivery ledger and its lock must be private files. Otherwise the plugin refuses before sending anything. In 3.7.0 a shared folder could let another account on the same computer replace the ledger and make the plugin propose the same item twice. The default data folder was already private.
• No dynamic code loading. The plugin no longer offers an external registry reader (--squadra-scripts). It checks the bundled reader against its pin and imports it normally, so the public security scan reports no high or critical finding.
• An honest ledger error. If the local ledger cannot be saved after a request, the plugin now says delivery may be uncertain and points to the recovery steps, instead of «nothing sent». An uncertain item is still never resent on its own.
• Plugin versions: memoranda 1.0.1, Playwright 1.0.2 (their bundled registry reader follows this release).

Updating from 3.7.0

Claude Code: /plugin marketplace update squadra, then /plugin update squadra@squadra, then restart Claude Code.
Codex: codex plugin marketplace upgrade, then codex plugin add squadra@squadra again.
Standalone installer: git pull, then run scripts/install.py again with a new backup folder.
If you installed the memoranda plugin from the Store, stop its producer and consumer, then run squadra plugin install memoranda again; settings, key and ledger are kept.