v0.19.1

[0.19.1] - 2026-08-28

Added

• Per-role thinking level → --effort. Roles could already pin a model (defaults.roles.<role>.model); they can now also pin a thinking level via a new thinking field, emitted as claude's --effort <level> flag (plus squadrant launch --thinking / crew spawn --thinking CLI overrides). Deliberately distinct from the existing defaults.effort tokenomics dial (squadrant effort) — same word, different concept, kept apart on purpose. Claude-only; codex/opencode/gemini reject the flag.
• Crew answer (#592). squadrant crew answer <project> <name> <option> deliberately answers a crew's open AskUserQuestion/permission modal — reads the rendered option list, requires an explicit index/text match (never an implicit default), and drives the selection via Down/Up + Enter. crew reply now delivers through the same path as crew send before transitioning task state, instead of silently dropping the message body on a no-op "success".

Fixed

• False CREW STALLED from a stale pendingTool (#542). Root cause: the daemon's cmux events-bridge had no case for agent.hook.PostToolUse, so pendingTool never closed for a crew whose tool call had genuinely finished. The #492 stall veto then vetoed every real turn-completion forever, and the watchdog eventually fired a false CREW STALLED against an idle crew. Fixed at the transition — events-bridge now closes the window on PostToolUse, the state machine recognizes the cmux bridge's own PostToolUse spelling, and the watchdog gained a defense-in-depth check that recovers to awaiting-input instead of stalling when idle evidence already exists.
• Pane-error false terminalization (#704). The interactive-probe's error detector matched its error vocabulary against any pane line — including content a crew merely displayed or quoted — and unconditionally terminalized the crew. It now skips visibly quoted/prefixed lines (box borders, blockquotes, cat -n echoes) and cross-checks the crew's surface-liveness probe before terminalizing; an "alive"/"unknown" verdict downgrades to a new non-terminal task.warn ControlEvent, surfaced to the captain pane as "CREW WARN" instead of being silently dropped.
• Heal daemon restart verification (#729). squadrant heal daemon previously deferred to a cautious plain kickstart (no -k), a documented no-op on an already-healthy daemon, so a plist-matching heal run could report "restart complete" without touching the running process. It now forces kickstart -k, polls the pid until it actually changes, and retries the kickstart -k call itself (default 5×300ms) to avoid racing a preceding bootout's still-unloading exit handler.
• Unclean daemon death detection and delivery jam isolation (#589, #590). Persists a JSON exit marker on every shutdown path (including crash handlers) plus a running heartbeat marker touched every ~60s; a running marker that survives to the next boot with no exit marker to explain it is now logged and alerted as an UNCLEAN death (SIGKILL/OOM/power-loss), instead of reading identically to a first boot. The delivery loop also wraps each project's per-tick pass in its own try/catch so one project's exception can't starve delivery for every project after it, and backs off exponentially (capped at 60s) once a project crosses its max-defer threshold instead of polling forever.
• Task records no longer terminalize while the crew surface is alive (#595). reapOrphanedCrews, the wall-clock task-timeout sweep, and store.put() could all previously terminalize or silently overwrite a task record without checking the crew's own pane was actually gone. All three are now gated on the surface-liveness probe (alive/unknown fail safe), awaiting-input is added to the existing #629 blocked/review ceiling exemption, and crew send's reopen is now reported back to the caller instead of being invisible.
• Oversized first-turn text corruption (#730). A multi-KB first-turn paste into a claude crew's pane could look "settled" before fully landing, letting Enter submit a truncated draft. First-turn text above 1200 bytes is now spilled to a temp file with a short "cat it and follow it exactly" pointer instead of being pasted verbatim; the daemon dispatch still receives the full task text.
• Captain memory write gate (#556). Crews previously had unrestricted write access to their captain's long-term memory directory, which is loaded into every future session. The existing unmatched PreToolUse hook now denies a matching Write/Edit/MultiEdit/NotebookEdit, or a Bash command whose text references a memory path, when issued inside a crew session — with an exact deny reason logged to stderr. Crews report, captains decide what is durable.
• Named peer identity for daemon-sent messages (#711). squadrantd's receipt socket now registers a ~/.claude/sessions/<pid>.json entry keyed to the socket it bound, so CREW DONE/BLOCKED/IDLE/TAKEOVER messages render as a named peer instead of the anonymous "Another Claude session" framing. Registry kind corrected to "daemon" (verified against the Claude Code 2.1.241 binary's interactive|bg|daemon|daemon-worker allowlist), and stale entries are cleaned up on both pid reuse and process exit.
• Delivery probe failures no longer read as "no-box" (#713, #714). A failed cmux read-screen invocation was previously conflated with a genuinely unconfirmed input box. It is now classified as a distinct probe-failed defer reason with its own DELIVERY STUCK wording, and the delivery loop re-resolves the captain surface once per attempt on a probe-failed defer (no-box/modal/draft never re-resolve, since the surface is known alive).
• Heal status delivery-queue visibility (#715). heal status now surfaces delivery-queue health via a structural stuck boolean on ComponentHealth/HealComponent (no string parsing) — only a genuinely stuck queue fails heal status; a merely deferring queue is advisory.
• Liveness-tick captain log spam (#732). runLivenessTick logged a captain's derived state on every ~6s tick regardless of change, burying real events for stopped-but-still-listed projects. It now logs only on an actual state transition (or first observation).

Changed

• Docs. Added the AFK auto-continue safe-option-only clause to captain/crew templates (#616); made the #711 kind-allowlist evidence reproducible in-comment; dropped the stale "unreadable screen" phrasing from the no-box doc (#714); corrected opencode channel state, the captain socket path, and shadow-rollout wording across the agent-control-channel and architecture diagrams (#667).