Repository navigation
feat(claude): Squad Claude Code plugin and team dashboard (#2443, #2459, #2460) - #2463
Open
bradygaster wants to merge 23 commits into
Open
bradygaster wants to merge 23 commits into
bradygaster wants to merge 23 commits into
Conversation
A prototype of the multi-agent dashboard used in the Squad + Claude Code
end-to-end run (BRICKBREAK). server.mjs tails `claude -p --output-format
stream-json --verbose` logs, maps each member subagent (and the background
shells it owns) to a lane, and streams the timeline over SSE. index.html
shows it as a GitHub-style Board, Roadmap ("who's working when") and
Conversation view, with light and dark themes.
Prototype only: it reads captured stream-json logs, not live sessions,
and has no tests. Saved here so the plugin work (#2443) can build on it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude Code 2.1.318, clean environment: a squad_state server supplied by a plugin connects with no approval prompt and no --mcp-config, interactively and headless, from the repo root and a package subfolder. A project .mcp.json server still prompts interactively (default: continue without); headless -p now connects it without the flag. The plugin's settings.json agent makes squad:squad the main agent with no --agent. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With "claudePlugin": true in .squad/config.json (squad init --client claude --claude-plugin, squad upgrade --[no-]claude-plugin), the Squad Claude Code plugin carries the coordinator, skills, hooks and squad_state MCP server. The projection then writes only per-repository files: member subagents (with the plugin MCP prefix), the CLAUDE.md block, the .gitignore lines and two .claude/settings.json keys: agent "squad:squad" so a plain `claude` starts the plugin coordinator, and squad_state in disabledMcpjsonServers so the project .mcp.json entry is not loaded twice or prompted for. It removes the Squad-owned coordinator, skills and hook handlers and leaves .mcp.json alone. Without plugin mode the output is unchanged apart from the version in the generated note. Plugin hooks take --plugin, defer when the project settings already have Squad handlers, and treat squad:squad as the coordinator. buildClaudePlugin and buildClaudeMarketplace in claude-plugin.ts generate the plugin. Spec: harness adapters §5 (v3), §7.4 (plugin mode), §13 (settings keys). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
plugins/squad/ is generated from the SDK by scripts/build-claude-plugin.mjs (--check reports drift) and listed in .claude-plugin/marketplace.json, so `claude plugin marketplace add github/squad` then `claude plugin install squad@squad` installs it. It bundles the coordinator (squad:squad), the coordinator and template skills, /squad:ralph, /squad:cast, /squad:ceremony and /squad:status, the advisory hooks and the squad_state MCP server, all run through a launcher that finds the project's Squad CLI, one on PATH, or the matching npx version. bin/squad puts squad on the Bash tool's PATH. test/claude-plugin.test.ts rebuilds the plugin from source and requires the committed tree to match. Checked live with --plugin-dir on Claude Code 2.1.318: the coordinator is the main agent, plugin:squad:squad_state connects without an approval prompt, the skills and commands load, the advisory SessionStart hook adds context and a member subagent runs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Dashboard events from the session JSONL Claude Code writes for every session, plus each subagent transcript and its meta file, following appends (including --continue turns). stream-json logs stay as a second source. Unknown and internal line types are skipped and only counted. Tested against a scrubbed real session: parallel background members, a --continue turn with a foreground member, hook events and an unknown line type. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…2459) Claude Code can write a subagent's .meta.json before the dispatch line reaches the main transcript. The reader now registers subagents on discovery and starts a lane from the meta file only if no dispatch arrived by the next poll, so each member starts exactly once. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…:dashboard (#2460) Moves the prototype dashboard into the CLI: - dashboard/server.ts serves the page and an SSE event stream on 127.0.0.1 only, rejects other Host headers (DNS rebinding), and sends a CSP with no inline script; transcript text goes out as JSON data and the page escapes it. - dashboard-ui/ is the prototype's page split into index.html, app.css and app.js, with the repo and roster read from /meta. - `squad dashboard [stop | status] [--detach] [--open] [--port] [--session] [--stream]` follows the newest Claude Code session in the directory, reuses a running dashboard, and keeps its state under the Squad home so /squad:dashboard (Claude's Bash has its own TMPDIR) and a terminal find the same instance; it also checks the default ports. - The plugin gains /squad:dashboard, allowed to run only `squad dashboard`, and never passes the user's words to the shell. - prototypes/claude-dashboard is removed. No runtime dependencies beyond Node. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…2460) New features/claude-code-plugin page: marketplace install, init with --claude-plugin, what the plugin provides, and the team dashboard (/squad:dashboard and `squad dashboard`). README, the CLI reference, the multi-client scenario and the spec point to it; changesets for the plugin and the dashboard. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
, #2460) - The plugin coordinator said "a global Squad CLI", which the retired-symbol gate reads as the retired global squad; it now says "a globally installed Squad CLI". - `--claude-plugin` joins the `--client` help lines and `dashboard` takes one line; the help budget grows by one for the new command. - command-help's documented-subcommand list includes `dashboard`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
🔴 Impact Analysis — PR #2463Risk tier: 🔴 CRITICAL 📊 Summary
🎯 Risk Factors
📦 Modules Affectedcopilot-config (1 file)
docs (6 files)
root (91 files)
scripts (1 file)
squad-cli (17 files)
squad-sdk (8 files)
templates (2 files)
tests (10 files)
|
Contributor
🏗️ Architectural Review
Automated architectural review — informational only. |
Contributor
🛫 PR Readiness Check
PR Scope: 📦🔧 Mixed (product + infrastructure)
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 23 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with dev |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | No .squad/ or docs/proposals/ files |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | 5 active Copilot thread(s) resolved (9 outdated skipped) |
| ✅ | CI passing | All checks passing |
Files Changed (136 files, +13649 −160)
| File | +/− |
|---|---|
.changeset/claude-code-plugin.md |
+8 −0 |
.changeset/claude-dashboard.md |
+5 −0 |
.claude-plugin/marketplace.json |
+20 −0 |
.copilot/skills/distributed-mesh/sync-mesh.sh |
+8 −3 |
.gitattributes |
+6 −1 |
.gitignore |
+2 −0 |
.squad-templates/skills/distributed-mesh/sync-mesh.sh |
+8 −3 |
.squad-templates/skills/gh-auth-isolation/SKILL.md |
+13 −15 |
CHANGELOG.md |
+56 −0 |
README.md |
+12 −1 |
cspell.json |
+1 −0 |
docs/specification/client-harness-adapters-v0.2.md |
+63 −8 |
docs/src/content/docs/features/claude-code-plugin.md |
+91 −0 |
docs/src/content/docs/reference/cli.md |
+1 −0 |
docs/src/content/docs/reference/host-feature-matrix.md |
+4 −2 |
docs/src/content/docs/scenarios/using-squad-across-clients.md |
+2 −0 |
docs/src/navigation.ts |
+1 −0 |
packages/squad-cli/package.json |
+1 −1 |
packages/squad-cli/src/cli-entry.ts |
+21 −6 |
packages/squad-cli/src/cli/commands/dashboard.ts |
+413 −0 |
packages/squad-cli/src/cli/commands/hook.ts |
+4 −2 |
packages/squad-cli/src/cli/commands/watch/agent-spawn.ts |
+5 −3 |
packages/squad-cli/src/cli/commands/watch/capabilities/execute.ts |
+2 −2 |
packages/squad-cli/src/cli/core/clients.ts |
+35 −1 |
packages/squad-cli/src/cli/core/command-help.ts |
+16 −0 |
packages/squad-cli/src/cli/core/init.ts |
+11 −2 |
packages/squad-cli/src/cli/core/upgrade.ts |
+4 −0 |
packages/squad-cli/src/cli/dashboard/server.ts |
+197 −0 |
packages/squad-cli/src/cli/dashboard/sources.ts |
+552 −0 |
packages/squad-cli/src/dashboard-ui/app.css |
+132 −0 |
packages/squad-cli/src/dashboard-ui/app.js |
+327 −0 |
packages/squad-cli/src/dashboard-ui/index.html |
+56 −0 |
packages/squad-cli/templates/skills/distributed-mesh/sync-mesh.sh |
+8 −3 |
packages/squad-cli/templates/skills/gh-auth-isolation/SKILL.md |
+13 −15 |
packages/squad-sdk/src/client/adapters/adapters.ts |
+56 −32 |
packages/squad-sdk/src/client/adapters/claude-hooks.ts |
+129 −6 |
packages/squad-sdk/src/client/adapters/claude-members.ts |
+10 −3 |
packages/squad-sdk/src/client/adapters/claude-plugin.ts |
+555 −0 |
packages/squad-sdk/src/client/adapters/claude-skills.ts |
+12 −3 |
packages/squad-sdk/src/client/adapters/index.ts |
+1 −0 |
packages/squad-sdk/templates/skills/distributed-mesh/sync-mesh.sh |
+8 −3 |
packages/squad-sdk/templates/skills/gh-auth-isolation/SKILL.md |
+13 −15 |
plugins/squad/.claude-plugin/plugin.json |
+19 −0 |
plugins/squad/.mcp.json |
+11 −0 |
plugins/squad/LICENSE |
+21 −0 |
plugins/squad/README.md |
+37 −0 |
plugins/squad/agents/squad.md |
+56 −0 |
plugins/squad/bin/squad |
+3 −0 |
plugins/squad/bin/squad.cmd |
+3 −0 |
plugins/squad/commands/cast.md |
+20 −0 |
| ... | +86 more files |
Total: +13649 −160
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Unreleased notes for the whole Claude Code track: the Squad plugin and plugin mode, `squad dashboard` and /squad:dashboard, member subagents, native skills and the slimmer coordinator, advisory hooks, the watch runner, and the first real execution harnesses, with their PRs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…#2438) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add Mcpjson (disabledMcpjsonServers) to cspell, escape the session id before building a regex in the fixture scrubber, and make the page test's inline-script check case-insensitive. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The repository-wide bin/ ignore (for .NET output) kept plugins/squad/bin/squad and squad.cmd out of git, so a marketplace install, which clones the repo, had no squad command. Un-ignore the plugin's bin/, commit both launchers (squad as 100755), and fail both the plugin test and build --check when a generated file is untracked or ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The mesh sync script and Windows launcher contain unresolved shell-injection vulnerabilities that can execute commands embedded in URLs or forwarded arguments.
14 open issues
What changed in this PR
Adds Squad as a Claude Code plugin alongside the existing project-based installation, with a local dashboard for following coordinator and member activity.
Changes:
- Generates the plugin and marketplace with launchers, skills, commands, advisory hooks, and MCP wiring.
- Adds opt-in Claude projection v3 support to initialization and upgrades, plus dashboard command wiring and asset packaging.
- Updates installation docs, host measurements, regression tests, and scrubbed transcript fixtures.
| File | Description |
|---|---|
test/speed-gates.test.ts |
Adjusts the help-line budget for dashboard. |
test/docs-build.test.ts |
Expects the new plugin documentation page. |
test/clients.test.ts |
Tests plugin flags and mode switching. |
test/cli/command-help.test.ts |
Includes dashboard in command-help coverage. |
test/claude-projection-v2-rollback.test.ts |
Updates version and ownership checks for v3. |
test/claude-hooks.test.ts |
Covers the plugin coordinator and hook deduplication. |
test-fixtures/spec/suite-v0.2/host-feature-matrix.json |
Records interactive and headless MCP measurements. |
test-fixtures/claude-dashboard/scrub.mjs |
Produces sanitized transcript fixtures. |
test-fixtures/claude-dashboard/projects/-work-demo/b7e1c0de-0000-4000-8000-000000000001/subagents/agent-a9b01195fdaca6322.meta.json |
Supplies foreground member metadata. |
test-fixtures/claude-dashboard/projects/-work-demo/b7e1c0de-0000-4000-8000-000000000001/subagents/agent-a9b01195fdaca6322.jsonl |
Supplies a continued-session member response. |
test-fixtures/claude-dashboard/projects/-work-demo/b7e1c0de-0000-4000-8000-000000000001/subagents/agent-a1c1fead56bda0172.meta.json |
Supplies background member metadata. |
test-fixtures/claude-dashboard/projects/-work-demo/b7e1c0de-0000-4000-8000-000000000001/subagents/agent-a1c1fead56bda0172.jsonl |
Supplies member tool calls and results. |
test-fixtures/claude-dashboard/projects/-work-demo/b7e1c0de-0000-4000-8000-000000000001/subagents/agent-a0b0691c332de398a.meta.json |
Supplies parallel member metadata. |
test-fixtures/claude-dashboard/projects/-work-demo/b7e1c0de-0000-4000-8000-000000000001/subagents/agent-a0b0691c332de398a.jsonl |
Supplies a parallel member response. |
scripts/build-claude-plugin.mjs |
Generates and checks plugin artifacts. |
README.md |
Introduces plugin installation and dashboard usage. |
plugins/squad/skills/windows-compatibility/SKILL.md |
Bundles cross-platform guidance. |
plugins/squad/skills/versioning-policy/SKILL.md |
Bundles release-version guidance. |
plugins/squad/skills/test-discipline/SKILL.md |
Bundles contract-testing guidance. |
plugins/squad/skills/squad-help/SKILL.md |
Bundles onboarding guidance. |
plugins/squad/skills/squad-coordinator-ralph-mode/SKILL.md |
Provides the backlog-monitor workflow. |
plugins/squad/skills/squad-coordinator-prd-mode/SKILL.md |
Provides requirements-planning guidance. |
plugins/squad/skills/squad-coordinator-issues-mode/SKILL.md |
Provides the GitHub Issues workflow. |
plugins/squad/skills/squad-coordinator-init-mode/SKILL.md |
Provides coordinator casting guidance. |
plugins/squad/skills/squad-coordinator-ceremonies/SKILL.md |
Provides ceremony orchestration guidance. |
plugins/squad/skills/squad-conventions/SKILL.md |
Bundles Squad development conventions. |
plugins/squad/skills/session-recovery/SKILL.md |
Bundles session-recovery guidance. |
plugins/squad/skills/reviewer-protocol/SKILL.md |
Bundles reviewer lockout rules. |
plugins/squad/skills/retro-enforcement/SKILL.md |
Bundles retrospective guidance. |
plugins/squad/skills/reskill/SKILL.md |
Bundles team-context maintenance guidance. |
plugins/squad/skills/ralph-two-pass-scan/SKILL.md |
Bundles efficient issue-scanning guidance. |
plugins/squad/skills/project-conventions/SKILL.md |
Bundles a project-conventions starter. |
plugins/squad/skills/pr-screenshots/SKILL.md |
Bundles screenshot workflow guidance. |
plugins/squad/skills/notification-routing/SKILL.md |
Bundles notification-routing guidance. |
plugins/squad/skills/nap/SKILL.md |
Bundles context-hygiene guidance. |
plugins/squad/skills/iterative-retrieval/SKILL.md |
Bundles scoped delegation guidance. |
plugins/squad/skills/init-mode/SKILL.md |
Bundles the team initialization recipe. |
plugins/squad/skills/humanizer/SKILL.md |
Bundles communication guidance. |
plugins/squad/skills/history-hygiene/SKILL.md |
Bundles history-maintenance guidance. |
plugins/squad/skills/github-multi-account/SKILL.md |
Bundles multi-account setup guidance. |
plugins/squad/skills/gh-auth-isolation/SKILL.md |
Bundles authentication-isolation guidance. |
plugins/squad/skills/fact-checking/SKILL.md |
Bundles verification guidance. |
plugins/squad/skills/error-recovery/SKILL.md |
Bundles recovery and escalation guidance. |
plugins/squad/skills/economy-mode/SKILL.md |
Bundles cost-aware model guidance. |
plugins/squad/skills/docs-standards/SKILL.md |
Bundles documentation standards. |
plugins/squad/skills/distributed-mesh/sync-mesh.sh |
Bundles the Bash mesh-sync helper. |
plugins/squad/skills/distributed-mesh/sync-mesh.ps1 |
Bundles the PowerShell mesh-sync helper. |
plugins/squad/skills/distributed-mesh/mesh.json.example |
Supplies example mesh configuration. |
plugins/squad/skills/coordinator-source-of-truth/SKILL.md |
Bundles state-ownership guidance. |
plugins/squad/skills/coordinator-response-mode/SKILL.md |
Bundles response-mode selection guidance. |
plugins/squad/skills/client-compatibility/SKILL.md |
Bundles host-adaptation guidance. |
plugins/squad/skills/cli-wiring/SKILL.md |
Bundles command-wiring guidance. |
plugins/squad/skills/ci-validation-gates/SKILL.md |
Bundles CI validation guidance. |
plugins/squad/skills/architectural-proposals/SKILL.md |
Bundles architecture-proposal guidance. |
plugins/squad/skills/agent-conduct/SKILL.md |
Bundles shared agent rules. |
plugins/squad/skills/agent-collaboration/SKILL.md |
Bundles collaboration guidance. |
plugins/squad/scripts/squad.mjs |
Resolves and launches the Squad CLI. |
plugins/squad/README.md |
Documents plugin contents and setup. |
plugins/squad/LICENSE |
Includes the distribution license. |
plugins/squad/hooks/hooks.json |
Registers plugin governance hooks. |
plugins/squad/commands/status.md |
Adds team and backend status reporting. |
plugins/squad/commands/ralph.md |
Adds the backlog-monitor command. |
plugins/squad/commands/dashboard.md |
Adds dashboard start, status, and stop commands. |
plugins/squad/commands/ceremony.md |
Adds ceremony invocation. |
plugins/squad/commands/cast.md |
Adds team casting and member setup. |
plugins/squad/bin/squad.cmd |
Provides the Windows launcher wrapper. |
plugins/squad/bin/squad |
Provides the POSIX launcher wrapper. |
plugins/squad/.mcp.json |
Registers the plugin state server. |
plugins/squad/.claude-plugin/plugin.json |
Defines plugin identity and version metadata. |
packages/squad-sdk/src/client/adapters/index.ts |
Exports plugin support. |
packages/squad-sdk/src/client/adapters/claude-skills.ts |
Removes projected skills in plugin mode. |
packages/squad-sdk/src/client/adapters/claude-members.ts |
Supports plugin-prefixed member MCP tools. |
packages/squad-sdk/src/client/adapters/claude-hooks.ts |
Adds plugin settings and hook coexistence logic. |
packages/squad-sdk/src/client/adapters/adapters.ts |
Introduces Claude projection v3 plugin mode. |
packages/squad-cli/src/cli/core/upgrade.ts |
Passes plugin-mode options through upgrades. |
packages/squad-cli/src/cli/core/init.ts |
Passes plugin-mode options through initialization. |
packages/squad-cli/src/cli/core/command-help.ts |
Documents dashboard command options. |
packages/squad-cli/src/cli/core/clients.ts |
Parses and persists plugin-mode configuration. |
packages/squad-cli/src/cli/commands/hook.ts |
Identifies plugin-origin hook calls. |
packages/squad-cli/src/cli-entry.ts |
Wires plugin flags and the dashboard command. |
packages/squad-cli/package.json |
Copies dashboard assets into build output. |
docs/src/navigation.ts |
Adds plugin documentation navigation. |
docs/src/content/docs/scenarios/using-squad-across-clients.md |
Links the alternative plugin installation. |
docs/src/content/docs/reference/cli.md |
Adds dashboard command reference information. |
docs/src/content/docs/features/claude-code-plugin.md |
Documents installation, plugin mode, and dashboard usage. |
docs/specification/client-harness-adapters-v0.2.md |
Defines projection v3 and plugin ownership rules. |
cspell.json |
Adds settings-field terminology. |
.gitignore |
Allows committed plugin launchers. |
.gitattributes |
Pins generated plugin files to LF. |
.claude-plugin/marketplace.json |
Publishes the repository’s plugin listing. |
.changeset/claude-dashboard.md |
Records the dashboard feature release. |
.changeset/claude-code-plugin.md |
Records SDK and CLI plugin support. |
Review effort: Max (auto)
Comment on lines
+51
to
+52
| const version = pluginVersion(); | ||
| return [win ? 'npx.cmd' : 'npx', ['-y', version ? `${PKG}@${version}` : PKG]]; |
Collaborator
Author
There was a problem hiding this comment.
Still open: 07d7131 intentionally does not invent a release or publish packages. The committed plugin and marketplace still pin 2.0.0-preview.4. Clearing this finding requires the authorized release owner to publish a CLI containing these features, regenerate the plugin/marketplace against that real version, and exercise a clean install. Registry verification was unavailable here (official npm restore failed; a bounded direct metadata request also failed). Project/local source validation does not establish that the pinned public runtime has these commands.
…er CLI (#2443) Commands use "${CLAUDE_PLUGIN_ROOT}/bin/squad" so they always go through the launcher's version check instead of picking up an older global CLI that Claude Code put earlier on PATH. The launcher now also reads BUNDLE-INFO.json and the nested app/node_modules package.json, so Homebrew cask bundles are detected and skipped when they are older than the plugin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…#2443) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bradygaster
commented
Nov 10, 2026
bradygaster
left a comment
bradygaster
left a comment
Collaborator
Author
There was a problem hiding this comment.
cli-dev bounded dashboard review: two additional reproduced findings below, distinct from the existing UTF-8, EventSource reconnect, and session-end cleanup threads. Dashboard tests pass (22/22); real scrubbed-fixture browser smoke passes Board/Roadmap/Conversation/theme, with only favicon 404. Postbuild and package dry-run include all three UI assets. Reviewed f51257f against dev 675c9e9; no source changes or merge verdict.
Preserve plugin settings and prior MCP ownership; support direct init and watch callers; avoid shell reparsing and launcher recursion; skip disabled hooks; preserve transcript bytes, reset reconnects and reap unused dashboards. Part of #2443, #2459, #2460. Addresses review feedback on #2463. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c8c234f1-ee3b-49e1-9406-11d4a2238c23
bradygaster
commented
Nov 10, 2026
bradygaster
left a comment
bradygaster
left a comment
Collaborator
Author
There was a problem hiding this comment.
Plugin integration review and existing-feedback follow-up
Published normal follow-up commit 07d7131145374ba9e366aa2c5bb31d9e63f01a43 from an isolated checkout: exactly 20 repair files, no deletions. Latest dev (675c9e97bd5e5e9d3906b175147ddb7eff997499) was already an ancestor; no merge/rebase/force push was needed. Author worktrees and local branch refs were not edited.
Implemented 13 of the 14 existing Copilot findings and replied individually with evidence. This includes Windows JS-entry argv forwarding, safe mesh curl arguments and header transport, direct-init/watch plugin integration, settings/MCP ownership across transitions, per-event hook coexistence, cheap disabled hooks, launcher symlink exclusion, transcript byte buffering, reconnect reset, idle dashboard cleanup, and terminal CLI prerequisites. Ownership records cannot reconstruct values already lost by an earlier unrecorded installation; unknown provenance is preserved conservatively.
Reproduced validation
SKIP_BUILD_BUMP=1 npm run build— passed.node scripts/build-claude-plugin.mjs --check— passed; 72 generated files current, canonical SDK/template parity and tracked launcher checks pass.TMPDIR="$PWD/.validation-tmp" GIT_CEILING_DIRECTORIES="$PWD/.validation-tmp" npm test -- --run test/claude-plugin.test.ts test/claude-projection-v3-plugin.test.ts test/claude-hooks.test.ts test/claude-projection-v2-rollback.test.ts test/clients.test.ts test/dashboard-sources.test.ts test/dashboard-server.test.ts test/cli/watch-claude-preset.test.ts test/claude-members.test.ts test/claude-skills.test.ts test/claude-v2-review-fixes.test.ts test/squad-20-host-feature-matrix.test.ts test/cli/command-help.test.ts test/docs-build.test.ts test/speed-gates.test.ts— 15 files passed: 322 passed, 34 expected failures, 20 skipped. The in-checkout scratch had a CommonJS package boundary and Git discovery ceiling to preserve standalone-fixture semantics; it was removed afterward.npm run lint— passed. Targeted ESLint — zero errors, synchronous-I/O/style warnings remain.npx --no-install markdownlint-cli2 docs/src/content/docs/features/claude-code-plugin.mdandnpx --no-install cspell --no-progress --dot docs/src/content/docs/features/claude-code-plugin.md— passed.claude plugin validate plugins/squad— passed with the already documented two missing-frontmatter warnings and icon warning.
Still open / not approval
- Existing runtime-pin thread 4523810478: the plugin/marketplace still pin
2.0.0-preview.4; an authorized release containing these commands and a clean-install check are still required. No package publication or invented version was attempted. Registry access failed, so public-runtime availability was not independently established. - Dashboard contributor's new P2 findings 4528370267 (concurrent starts) and 4528370280 (transcript rewind semantic state) remain open, are still reproducible at this head, and were not duplicated or silently implemented.
- Existing automated advisory suggestions about unattended npx opt-in, Ralph mutation approvals, and dashboard argument/tool permission restrictions remain open for explicit policy disposition; canonical authorization policy was not broadened or rewritten here.
No additional independently confirmed plugin finding beyond the inventoried feedback. Real marketplace installation, native Windows execution, paid/live model runs and the full repository suite were not reproduced; author-provided live measurements are not presented as my own. Current-head hosted CI is newly running, not the earlier head's green result. This COMMENT records implementation/review evidence, not approval or a merge recommendation; no threads were resolved on a reviewer's behalf.
) JsonlTail restarted at byte zero after a truncation, but the transcript source kept its member runs, so a run that had ended never ended again and the page showed a finished member as in progress. Now any rewind (main or member transcript) drops the source's state and replays every file from the start, and the server clears its history and tells the page to start over. Addresses review feedback on #2463. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…at once (#2460) Checking for a running dashboard and starting one were separate steps, so two concurrent `squad dashboard` starts both served, and `stop` found only one. A lock file beside the state file, created exclusively, now makes check-and-start one step: a second start waits, then reports the running dashboard; a lock left by a dead process is taken over. A detached start accepts the dashboard that won the race. Addresses review feedback on #2463. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
… fenced as data (#2443) /squad:dashboard's allowed-tools now lists the three exact invocations (stop, status, --detach --open) instead of `dashboard:*`, and its prompt takes only the first argument word, which selects one of them. /squad:ralph keeps its free-text scope but passes it between markers, as data that can only narrow the work or set a stop condition. Checked live (claude-haiku-5-5): start and status run with no prompt; an argument asking for another command was denied by the permission rules. Addresses review feedback on #2463. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The skill showed pushing to a personal repo with the token in the git URL (and once in the remote), which leaks it to shell history, process listings, tool logs and .git/config. The examples now pass the token through GH_TOKEN to gh's credential helper for the one command. Updated in the canonical .squad-templates copy, its mirrors and the Claude plugin. Addresses review feedback on #2463. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
#2443) With no suitable Squad CLI, the plugin launcher ran `npx -y @bradygaster/squad-cli@<version>`, so a slash command or hook could download and run code without the user asking. It now fails with install instructions unless SQUAD_ALLOW_NPX=1 is set (in the shell or Claude Code's settings env). The coordinator text, plugin README, docs, changelog and changeset say so. Addresses review feedback on #2463. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…fenced data (#2443) The cast request and ceremony name now sit between markers, as data the coordinator takes only names, roles, a project description or a ceremony name from, never instructions. Neither command pre-approves any tool, so every Bash call still goes through the user's permission settings; a test keeps $ARGUMENTS fenced in every command and allowed-tools on the dashboard only. Addresses review feedback on #2463. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The command no longer puts $ARGUMENTS in its prompt. It reads $0 and $1 and matches each exactly against go, status, idle, issues, prs and skip-ci; any other word is ignored and reported. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 5 of #2438: Squad as a Claude Code plugin, plus a live team dashboard.
Closes #2443
Closes #2459
Closes #2460
Plugin and marketplace (#2443)
plugins/squad/is generated from the SDK (claude-plugin.ts) bynode scripts/build-claude-plugin.mjs(--checkin tests), and published through.claude-plugin/marketplace.json.squad:squad), thesquad_stateMCP server (no.mcp.jsonapproval or--mcp-config, measured in the host matrix), skills, advisory hooks, and/squad:ralph,/squad:cast,/squad:ceremony,/squad:status,/squad:dashboard. A launcher putssquadon the Bash PATH.squad init|upgrade --client claude --claude-pluginrecordsclaudePluginand then writes only the per-repository files (member subagents, theCLAUDE.mdblock,agentanddisabledMcpjsonServersin.claude/settings.json).Transcript reader (#2459)
dashboard/sources.tsreads Claude Code session transcripts (main file plus each member's subagent transcript), including--continueturns and background members running in parallel, incrementally. Unknown line types are skipped and never passed on. Tests use a scrubbed real session undertest-fixtures/claude-dashboard/. A stream-json source coversclaude -plogs.Dashboard (#2460)
squad dashboard [stop|status] [--detach] [--open] [--port] [--session] [--stream]and/squad:dashboard(allowed to run onlysquad dashboard; the user's words never reach the shell).~/.squad/dashboards/(Claude's Bash tool has its own TMPDIR), with a/healthscan of the default ports as fallback.prototypes/claude-dashboard/is moved intopackages/squad-cli/src/dashboard-ui/and removed.Docs
New
features/claude-code-pluginpage (install, quick start, dashboard); README, CLI reference, the multi-client scenario and the adapter spec point to it. Changesets for the plugin and the dashboard.Testing
npm run lintclean;claude plugin validate plugins/squadpasses with warnings; plugin--checkcurrent.test/claude-plugin.test.ts,test/claude-projection-v3-plugin.test.ts,test/dashboard-sources.test.ts,test/dashboard-server.test.ts./squad:dashboardstarts a detached dashboard with no permission prompt;squad dashboard status/stopfrom a terminal find it; the page follows a new session with two background members. In the browser: no CSP or console errors, injected HTML stays inert, a bad Host gets 403.npm testlocally: the failures left (memory-, profile-fs-guard, squad-20 matrix "Path traversal blocked", upstream-, export-import, state-backend, stress, upgrade-profile-teamroot) fail identically on the merge-base in the same environment; the journey, e2e and gh-aw files pass when run without file parallelism.Not covered
--plugin-dirwas exercised).npxquoting.cli-wiringandretro-enforcementtemplate skills lack frontmatter (validate warnings); no plugin icon.🤖 Generated with Claude Code