Pisha v0.0.11

SquadraHQ is now Pisha. 0.0.11 adds task boards that stay in step with GitHub Projects, a new look across the dashboard, and an install in one command with npx pisha-server or Docker.

SquadraHQ is now Pisha

New name, new logo, new repository (roke22/pisha). Everything is renamed, the code included: pisha-server, pisha-host, the pisha plugin, PISHA_* variables. This is a clean break: see Updating from 0.0.10 below.

Task boards

• A board keeps the company's tasks, for people and agents alike, in columns or as a list, with types, labels, priority, due date, comments, history and an id such as SQ-12.
• Each column can be a step of the flow: who handles it (a team's coordinator, one agent or a person), what to do there, and where a task goes when it is done or isn't acceptable.
• Giving a task to an agent tells nobody by itself. Hand out as many as you want, then Notify the teams: each coordinator gets one message with its team's new tasks.
• Subtasks up to 8 levels deep, a trash to restore deleted tasks, and agents that read and update the board through the plugin, filtered by the server.

In step with GitHub

• Connect a board to a GitHub project and the two follow each other both ways: columns, agents, types, labels, sub-issues and comments, edited or deleted comments included.
• A task's people are the issue's assignees, by the GitHub user each person sets in their profile.
• Pull requests on their tasks: a PR that names a task (SQ-12 in its title, branch or description) or closes its issue shows on the task with its state and review. Merging it moves the task to Done, unless the board says not to.
• GitHub is asked only while the board is in use, and nothing that comes from it tells an agent until you say so.

A new look

• Built on affectUI's free components (MIT), with a new font and colours, in light and dark.
• Inbox: each entry a card with its state, a Running tab with who is at work and a live clock for each one, and counts that update as things change.
• Org chart: each team a group, its coordinator first and its workers below, each agent with what it is on and for how long, what it does now and how full its context is. Work handed to a worker runs down to it as a light, and pressing an agent opens its terminal.
• Machines in a grid of cards, with their details, installed agents, folders and limits in sections.

Install in one command

npx pisha-server

or with Docker:

docker run -d --name pisha -p 7787:7787 -v pisha-data:/data ghcr.io/roke22/pisha

Its data lives in ~/.pisha (or /data in the container). Cloning the repository still works too.

Updating from 0.0.10

This is a clean break. A server or a machine of 0.0.10 or earlier is installed again, not upgraded, and what SquadraHQ kept is not brought over.

1. Start the new server with npx pisha-server or the Docker image, and create the first owner with the token it prints.
2. On each machine, remove the old one (squadra-host service remove, squadra-host forget --close-sessions, claude plugin uninstall squadra@squadra && claude plugin marketplace remove squadra), then add it again from Machines → Add machine.

From now on, updating means npx pisha-server@latest (or docker pull ghcr.io/roke22/pisha), then pisha-host update on each machine.

Squadra v0.0.10

SquadraHQ 0.0.10 makes coordinators wait for your order and ask you one thing at a time, lets you reply to what they tell you, and reads your inbox aloud so you can answer by voice from your phone.

Coordinators that wait for an order

A coordinator starts work only with an order from you (in its terminal or the inbox) or from a linked coordinator.A worker connecting, its persona or the files in its folder are not one, and while it waits it no longer fills your inbox with "what should I do?".

A clearer inbox

• One decision per question: a list of several questions is refused, and what a coordinator recommends is always one of its options, marked, with its reason underneath.
• Picking an option only marks it: you send it with Send (or Ctrl+Enter), with any detail typed before or after.
• If a task of the plan waits on you and nothing is asked in your inbox, the coordinator is reminded to ask.

Reply to what you are told

The notes under For you to know can now be replied to ("update the branches with main"). The reply reaches the coordinator with what it told you, as your next order; Done still closes one without a reply.

The inbox read aloud

Listen, at the top of the inbox, reads aloud what waits on you, decisions first with their options, and you answer by speaking: "the second one, and tell QA", or your own words. It says back what it understood and sends it only on a "yes". Say "next", "repeat" or "stop"; set the reading speed at the card's corner. It uses your browser's speech recognition and voices, and the microphone needs the dashboard over https (or on localhost).

And also

• Sessions show their role and team in the dashboard before they first connect.
• New team lists the personas of a subfolder as soon as you type it.
• Saving a team as a template says so, instead of "could not complete".
• Node, Caddy 2.11.9 and the GitHub Actions updated.

Updating from 0.0.9

Update the server to the latest release, then run squadra-host update on every machine and open its sessions again: the new coordinator behaviour comes with the 0.0.10 plugin, and a machine not updated keeps working without it.The inbox checks apply to every coordinator as soon as the server is updated. With deploy/docker-compose.yml, run docker compose pull && docker compose up -d --build.

Squadra v0.0.9

SquadraHQ 0.0.9 lets you decide what each agent may do, splits the inbox into Pending and Done with paging for its history, adds a back button and a cleaner phone layout, and fixes the problems reported on 0.0.8.

Permission profiles for agents

• Write a profile in your own words in Settings › Agent permissions: ten capabilities (edit files, run tests, install dependencies, commit, push, rewrite history, delete, web, Docker, sudo), each allowed, always asked, forbidden or left to Claude Code, plus your own Claude Code rules if you need them.
• Give it to a team (on its page, or in New team) or to a single session. Fill from the text suggests the capabilities from what you wrote, for you to review.
• It reaches Claude Code as real permission rules (--settings) when the session opens, so an allowed commit no longer depends on auto mode's judgement, and the text you wrote goes into the session's system prompt as the reason.
• Each machine sets the ceiling with permissions_from_dashboard in its settings.json (allow, restrict or off). Whatever it says, nothing from the dashboard can allow sudo, any command at all, an interpreter with any arguments, or files outside the session's folder.
• The rules match commands as written, so they are a guard rail, not a sandbox.

Inbox: Pending and Done

• Pending is everything that waits on you, complete and live: what arrives shows up by itself and is highlighted for a moment, without moving what you are reading. Mark all as read closes every note listed.
• Done loads from the server 50 at a time as you scroll, grouped by day, with search and a team filter. It is kept for 90 days by default, with no limit of 200; a company's owner changes that in Settings › Activity & data.
• The browser tab's title and the installed app's icon show how many are pending. In Settings › Language, theme and notices you can turn on a system notice, with a sound if you like, while the dashboard is open but not in view.

What each session is doing, in words

• The header, the sidebar and the Now panel say it as a phrase (Running the tests, Reading observe.js, Searching for "function" in src, or the description Claude wrote for its command) instead of the raw command, which stays in the tooltip.

Navigation

• A back button in the header takes you to the screen you came from, named on a wide screen and an arrow on a phone. It uses the browser's own history, so the phone's back gesture agrees with it; with nowhere to go back to, it goes one level up.
• On a phone the sidebar and its menu button are gone: the bar at the bottom has Inbox, Teams, Machines, Go to and Settings, and you can switch company from Go to or Settings.

Fixes from the 0.0.8 report

• A message that reached an agent while it was working could lose its text: the Stop hook asked for a report on a message that was only queued.
• No more false reminders for words like borrador or publicado, for an old plan after every report, or asking in the chat about a question already in the inbox.

Updating from 0.0.8

1. Update the server: git fetch --tags && git checkout v0.0.9, then restart it or rebuild its Docker image.
2. Run squadra-host update on every machine, and open its sessions again.

The 0.0.9 plugin brings the message fix, the quieter reminders and the phrases. A machine not updated keeps working without them, but doesn't open a session that follows a permission profile, and says so. Machines take profiles as permissions_from_dashboard says: allow by default where allow_input is on, otherwise restrict.

Squadra v0.0.8

Release 0.0.8: everything since 0.0.7, plus the version bump and the signed squadra-host.

What's in it

• New dashboard: inbox for the decisions that are yours (ask_user / tell_user, answered or dismissed from the dashboard), the plan each coordinator keeps, teams, timeline beside each terminal, Add machine page, command palette, phone layout and installable as an app (manifest + icons, no service worker).
• Companies and people: several companies on one server, accounts with codes and roles, people across companies, one invitation for several.
• Codex CLI and Grok CLI (experimental): any coordinator or worker can run them instead of Claude Code, with the same plugin; messages and permission answers are typed into their terminal between turns; fresh start restarts them; personas and resume supported. Tested with the real agents.
• Security: audit run-2 on the changes since the last audit; its 8 confirmed findings are fixed.
• Repository renamed to roke22/SquadraHQ: the plugin installs from the new name; machines with a marketplace from the old name keep updating and move to the new one.
• Docs and website in English and Spanish, with new screenshots, and the update notes from 0.0.7.

Checks

node scripts/release.mjs 0.0.8 passed (version set, squadra-host signed, tests green). npm run test:ui: 24 pass.

Squadra v0.0.7

Machines and sessions now check who the server is, and a stolen secret is no longer enough to act as one of them. Workers opened from the dashboard also start on their coordinator's tasks instead of asking you to confirm them.

Trust between the server and its clients

• Each server has its own key. It makes one the first time it starts (data/server-key) and prints its fingerprint at every start. Machines and sessions make the server prove that key before any secret goes out, and remember it. An impostor at the same address gets nothing. The dashboard's command for Linux and macOS carries the key's hash, so a new machine checks it from the first contact.
• Machines and sessions have keys too. The server remembers each one the first time it is proved. After that, a secret alone does nothing: a copy of it in a proxy's log can't connect a machine or act as a session.
• A machine's link is encrypted with keys only the machine and its server have, on top of HTTPS.
• Messages are signed. Each session signs what it sends, and the server signs its notices to coordinators, so a go-between can't forge them.
• Machines connect with one-use tickets, so their secret goes only in a header that proxies keep out of their logs.
• A coordinator that joins with the join token has to be approved once in the dashboard, so that token alone can't direct your workers.

Safer updates

• squadra-host update only installs a signed release, and not an older one than it has, unless you say otherwise. The first update from 0.0.6 or earlier can't check a signature yet. Every later one does.
• Docker images and GitHub Actions are fixed by digest, with Dependabot proposing the updates.

Fixes

• A worker opened from the dashboard refused its tasks, saying they didn't come from you. It now starts on them. Permission prompts still apply, and pairing and login are still yours alone.
• A worker no longer owes a report for being asked to pair. It used to answer about a task that didn't exist, and its coordinator was told a report was missing.
• squadra-host no longer exits silently when reached through a symbolic link, such as a linked home folder.
• The dashboard's live view no longer corrupts accented characters and emoji split across two reads (#12).

What this doesn't protect against

• A server that has been broken into still commands its clients: its key is on it. The release signature protects updates, and allow_input: false limits what it can type into sessions.
• Only a machine's link is encrypted on top of HTTPS. Something relaying session traffic with a valid certificate could read those messages or drop them, but not forge signed ones.
• A plugin installed by hand and the Windows installer trust the key they get the first time.

Updating

1. Server: git fetch --tags && git checkout "$(git tag --sort=-v:refname | head -1)", then restart it or rebuild its Docker image.
2. Each machine: squadra-host update, then open its sessions again.
3. Backups: include data/server-key from now on. If you lose it, machines have to be added again.

Machines and sessions on 0.0.5 or 0.0.6 keep working with the new server until you update them. Going back isn't that simple: once a machine or session has registered its key, an older version of it can't connect, and updated clients refuse an older server.

Only in these cases is there something else to do:

• Plain http to another computer with a plugin set up by hand: add SQUADRA_INSECURE=1 to ~/.claude/channels/squadra/.env.
• NODE_EXTRA_CA_CERTS set: add SQUADRA_EXTRA_CA= with the same path there.
• A session that moves to another machine: the others ignore it until you delete the key file their warning names.

Upgrade tests covered 0.0.5 and 0.0.6, and real Claude Code on Linux. macOS is covered by the automated tests only.

Squadra v0.0.6

Fewer wake-ups for coordinators, so squads spend fewer tokens, plus mouse-wheel scrolling in the web terminal and a new examples page.

Fewer wake-ups for coordinators

Every message a coordinator gets wakes it up and makes it reread its whole context. This release removes the notices that asked it to do nothing.

• Network cuts no longer raise alarms. A worker that stops responding (its network dropped, its machine went to sleep) is announced DOWN only after 2 minutes, instead of 15 seconds. A short cut no longer sends its coordinator a "DOWN" and a "back online" notice, and no longer drops the messages waiting for that worker. The grace is set with SQUADRA_LOST_GRACE_MS on the server.
• Messages wait during a cut. While a worker isn't responding, what its coordinator sends it is queued instead of being refused with NOT SENT. The worker gets it when it comes back. If it doesn't come back, the DOWN notice lists the message as dropped, and only then should the task go to another worker. Meanwhile ping shows the worker as NOT RESPONDING, and reply says when it will be announced DOWN.
• No more false "ended its turn without a final report". The Stop hook only asks a worker to report on tasks Claude has actually seen. A task that arrives just as the turn ends now waits for the next turn. Before, the worker sent its previous report again or ended its turn, and the coordinator got a notice for nothing. Tasks that reach Claude while it is in the middle of a turn are detected too, and a report no longer closes a task the worker hasn't seen yet.

Web terminal

• The mouse wheel scrolls Claude Code's full-screen view. Opening, resizing or refreshing a terminal in the dashboard used to switch off the modes Claude Code had turned on, so the wheel did nothing; only Page Up and Page Down worked. The dashboard now restores them.
• Multi-line pastes arrive as one paste. Before, a text with several lines pasted in the dashboard could reach Claude Code one line at a time, as if Enter were pressed after each line.
• Since the mouse now goes to Claude Code, select text in the dashboard's terminal with Shift+drag (Option+drag on macOS).

Docs

• README: a new step, "Build your squads", walks through creating squads from the org chart, with screenshots.
• Examples (en español): a marketing agency, a personal brand on social media, a software company and a product launch, each built as linked squads. Each one comes with its squads, the persona of each agent, the links between squads and the first message to give each coordinator.

Updating from 0.0.5

1. Update the server (git pull and start it again, or rebuild the Docker image).
2. Run squadra-host update on every machine.
3. Open their sessions again: the task-report fix is in the 0.0.6 plugin.

Machines set up by hand:
claude plugin marketplace update squadra && claude plugin update squadra@squadra

Squadra v0.0.5

Squadra 0.0.5

Teams of agents that behave the way you want, squads that work together, and a coordinator that always knows how each task ended.

Teams

• Personas: each session can follow a skill or an agent from its project or from ~/.claude, picked from a list in + New session. It goes into the session's system prompt, so it holds through compactions and other skills; its coordinator knows which persona each worker follows.
• Squad templates: save a squad (coordinator and workers, with their folders and personas) and open it again in one go.
• Linked squads: link two coordinators so their squads share work. A linked coordinator is an equal: its requests are never the user's authorization, and it never answers the other squad's permission prompts. At most 60 messages an hour between two coordinators.
• Org chart: every squad as a card with its agents, links as lines with how busy they are, and what each squad and agent is for on hover. Add, describe, link, move, change and close squads and agents from there.

Coordinators and workers

• Squad brief: the name and goal you give a squad, and the coordinator's own description, reach that coordinator (at login, after a compaction or a /clear, and when they change). Its workers get none of it: their coordinator gives them what each task needs.
• No workers, no hand-offs: a coordinator with no workers connected does its squad's work itself, and never passes it to another squad for lack of hands.
• Task reports: every task ends with the worker's final report (done, blocked, failed or question). A Stop hook keeps the worker from finishing without it, whatever anyone said; if it still ends without one, the coordinator is told. Starting needs no message: the task gets 👀. ping says whether each worker is busy or free.
• Fresh start: a coordinator giving a worker an unrelated task can have its context cleared first (reply with fresh), so the new task starts light. Turned off per machine with "allow_clear": false.

Try it

• Docker demo: the dashboard and a machine with Claude Code in one container, everything kept in one folder: cd deploy/demo && docker-compose up -d, then cat squadra/data/server-token.

Updating from 0.0.4

1. Update the server.
2. Run squadra-host update on every machine (it moves the plugin to v0.0.5), then open its sessions again.

A machine still on 0.0.4 keeps working, without the new features. New machine setting: allow_clear (default: same as allow_input).

Squadra v0.0.4

• Dashboard: standalone sessions are listed under their machine like the others.
• Dashboard: reopen a session that has ended.
• squadra-host can run as root with --allow-root, and treats /root as its home.
• Tests: fixes for the macOS CI runners.

Install: git clone https://github.com/roke22/Squadra.git squadra && cd squadra && node server/server.js, then add your machines from the dashboard. See the README.

Squadra v0.0.3

Full Changelog: v0.0.2...v0.0.3

Squadra v0.0.2

Full Changelog: v0.0.1...v0.0.2