Squadra v0.0.8

Release 0.0.8: everything since 0.0.7, plus the version bump and the signed squadra-host.

What's in it

• New dashboard: inbox for the decisions that are yours (ask_user / tell_user, answered or dismissed from the dashboard), the plan each coordinator keeps, teams, timeline beside each terminal, Add machine page, command palette, phone layout and installable as an app (manifest + icons, no service worker).
• Companies and people: several companies on one server, accounts with codes and roles, people across companies, one invitation for several.
• Codex CLI and Grok CLI (experimental): any coordinator or worker can run them instead of Claude Code, with the same plugin; messages and permission answers are typed into their terminal between turns; fresh start restarts them; personas and resume supported. Tested with the real agents.
• Security: audit run-2 on the changes since the last audit; its 8 confirmed findings are fixed.
• Repository renamed to roke22/SquadraHQ: the plugin installs from the new name; machines with a marketplace from the old name keep updating and move to the new one.
• Docs and website in English and Spanish, with new screenshots, and the update notes from 0.0.7.

Checks

node scripts/release.mjs 0.0.8 passed (version set, squadra-host signed, tests green). npm run test:ui: 24 pass.

Squadra v0.0.7

Machines and sessions now check who the server is, and a stolen secret is no longer enough to act as one of them. Workers opened from the dashboard also start on their coordinator's tasks instead of asking you to confirm them.

Trust between the server and its clients

• Each server has its own key. It makes one the first time it starts (data/server-key) and prints its fingerprint at every start. Machines and sessions make the server prove that key before any secret goes out, and remember it. An impostor at the same address gets nothing. The dashboard's command for Linux and macOS carries the key's hash, so a new machine checks it from the first contact.
• Machines and sessions have keys too. The server remembers each one the first time it is proved. After that, a secret alone does nothing: a copy of it in a proxy's log can't connect a machine or act as a session.
• A machine's link is encrypted with keys only the machine and its server have, on top of HTTPS.
• Messages are signed. Each session signs what it sends, and the server signs its notices to coordinators, so a go-between can't forge them.
• Machines connect with one-use tickets, so their secret goes only in a header that proxies keep out of their logs.
• A coordinator that joins with the join token has to be approved once in the dashboard, so that token alone can't direct your workers.

Safer updates

• squadra-host update only installs a signed release, and not an older one than it has, unless you say otherwise. The first update from 0.0.6 or earlier can't check a signature yet. Every later one does.
• Docker images and GitHub Actions are fixed by digest, with Dependabot proposing the updates.

Fixes

• A worker opened from the dashboard refused its tasks, saying they didn't come from you. It now starts on them. Permission prompts still apply, and pairing and login are still yours alone.
• A worker no longer owes a report for being asked to pair. It used to answer about a task that didn't exist, and its coordinator was told a report was missing.
• squadra-host no longer exits silently when reached through a symbolic link, such as a linked home folder.
• The dashboard's live view no longer corrupts accented characters and emoji split across two reads (#12).

What this doesn't protect against

• A server that has been broken into still commands its clients: its key is on it. The release signature protects updates, and allow_input: false limits what it can type into sessions.
• Only a machine's link is encrypted on top of HTTPS. Something relaying session traffic with a valid certificate could read those messages or drop them, but not forge signed ones.
• A plugin installed by hand and the Windows installer trust the key they get the first time.

Updating

1. Server: git fetch --tags && git checkout "$(git tag --sort=-v:refname | head -1)", then restart it or rebuild its Docker image.
2. Each machine: squadra-host update, then open its sessions again.
3. Backups: include data/server-key from now on. If you lose it, machines have to be added again.

Machines and sessions on 0.0.5 or 0.0.6 keep working with the new server until you update them. Going back isn't that simple: once a machine or session has registered its key, an older version of it can't connect, and updated clients refuse an older server.

Only in these cases is there something else to do:

• Plain http to another computer with a plugin set up by hand: add SQUADRA_INSECURE=1 to ~/.claude/channels/squadra/.env.
• NODE_EXTRA_CA_CERTS set: add SQUADRA_EXTRA_CA= with the same path there.
• A session that moves to another machine: the others ignore it until you delete the key file their warning names.

Upgrade tests covered 0.0.5 and 0.0.6, and real Claude Code on Linux. macOS is covered by the automated tests only.

Squadra v0.0.6

Fewer wake-ups for coordinators, so squads spend fewer tokens, plus mouse-wheel scrolling in the web terminal and a new examples page.

Fewer wake-ups for coordinators

Every message a coordinator gets wakes it up and makes it reread its whole context. This release removes the notices that asked it to do nothing.

• Network cuts no longer raise alarms. A worker that stops responding (its network dropped, its machine went to sleep) is announced DOWN only after 2 minutes, instead of 15 seconds. A short cut no longer sends its coordinator a "DOWN" and a "back online" notice, and no longer drops the messages waiting for that worker. The grace is set with SQUADRA_LOST_GRACE_MS on the server.
• Messages wait during a cut. While a worker isn't responding, what its coordinator sends it is queued instead of being refused with NOT SENT. The worker gets it when it comes back. If it doesn't come back, the DOWN notice lists the message as dropped, and only then should the task go to another worker. Meanwhile ping shows the worker as NOT RESPONDING, and reply says when it will be announced DOWN.
• No more false "ended its turn without a final report". The Stop hook only asks a worker to report on tasks Claude has actually seen. A task that arrives just as the turn ends now waits for the next turn. Before, the worker sent its previous report again or ended its turn, and the coordinator got a notice for nothing. Tasks that reach Claude while it is in the middle of a turn are detected too, and a report no longer closes a task the worker hasn't seen yet.

Web terminal

• The mouse wheel scrolls Claude Code's full-screen view. Opening, resizing or refreshing a terminal in the dashboard used to switch off the modes Claude Code had turned on, so the wheel did nothing; only Page Up and Page Down worked. The dashboard now restores them.
• Multi-line pastes arrive as one paste. Before, a text with several lines pasted in the dashboard could reach Claude Code one line at a time, as if Enter were pressed after each line.
• Since the mouse now goes to Claude Code, select text in the dashboard's terminal with Shift+drag (Option+drag on macOS).

Docs

• README: a new step, "Build your squads", walks through creating squads from the org chart, with screenshots.
• Examples (en español): a marketing agency, a personal brand on social media, a software company and a product launch, each built as linked squads. Each one comes with its squads, the persona of each agent, the links between squads and the first message to give each coordinator.

Updating from 0.0.5

1. Update the server (git pull and start it again, or rebuild the Docker image).
2. Run squadra-host update on every machine.
3. Open their sessions again: the task-report fix is in the 0.0.6 plugin.

Machines set up by hand:
claude plugin marketplace update squadra && claude plugin update squadra@squadra

Squadra v0.0.5

Squadra 0.0.5

Teams of agents that behave the way you want, squads that work together, and a coordinator that always knows how each task ended.

Teams

• Personas: each session can follow a skill or an agent from its project or from ~/.claude, picked from a list in + New session. It goes into the session's system prompt, so it holds through compactions and other skills; its coordinator knows which persona each worker follows.
• Squad templates: save a squad (coordinator and workers, with their folders and personas) and open it again in one go.
• Linked squads: link two coordinators so their squads share work. A linked coordinator is an equal: its requests are never the user's authorization, and it never answers the other squad's permission prompts. At most 60 messages an hour between two coordinators.
• Org chart: every squad as a card with its agents, links as lines with how busy they are, and what each squad and agent is for on hover. Add, describe, link, move, change and close squads and agents from there.

Coordinators and workers

• Squad brief: the name and goal you give a squad, and the coordinator's own description, reach that coordinator (at login, after a compaction or a /clear, and when they change). Its workers get none of it: their coordinator gives them what each task needs.
• No workers, no hand-offs: a coordinator with no workers connected does its squad's work itself, and never passes it to another squad for lack of hands.
• Task reports: every task ends with the worker's final report (done, blocked, failed or question). A Stop hook keeps the worker from finishing without it, whatever anyone said; if it still ends without one, the coordinator is told. Starting needs no message: the task gets 👀. ping says whether each worker is busy or free.
• Fresh start: a coordinator giving a worker an unrelated task can have its context cleared first (reply with fresh), so the new task starts light. Turned off per machine with "allow_clear": false.

Try it

• Docker demo: the dashboard and a machine with Claude Code in one container, everything kept in one folder: cd deploy/demo && docker-compose up -d, then cat squadra/data/server-token.

Updating from 0.0.4

1. Update the server.
2. Run squadra-host update on every machine (it moves the plugin to v0.0.5), then open its sessions again.

A machine still on 0.0.4 keeps working, without the new features. New machine setting: allow_clear (default: same as allow_input).

Squadra v0.0.4

• Dashboard: standalone sessions are listed under their machine like the others.
• Dashboard: reopen a session that has ended.
• squadra-host can run as root with --allow-root, and treats /root as its home.
• Tests: fixes for the macOS CI runners.

Install: git clone https://github.com/roke22/Squadra.git squadra && cd squadra && node server/server.js, then add your machines from the dashboard. See the README.

Squadra v0.0.3

Full Changelog: v0.0.2...v0.0.3

Squadra v0.0.2

Full Changelog: v0.0.1...v0.0.2

Squadra v0.0.1

Full Changelog: https://github.com/roke22/Squadra/commits/v0.0.1