…v0.3.0 — 2/7] (#732)

* feat(run): workflow rewrite — smart skip, org cycle, wave execution, focus/resume

Run engine and workflow rewrite from v0.3.0 development cycle.

Fixes applied from Gemini Code Assist review:
- HIGH: task directive now includes planPrompt context (was bypassed)
- HIGH: converged reflects actual status (was forced true)
- MEDIUM: setTimeout cleared on close/error (resource leak)
- MEDIUM: skip logic query limit bumped to 500
- MEDIUM: fallback assigns ALL workers, not just first
- Added CLI_RUN_COMPLETE telemetry event
- Removed unused imports (dirname, homedir, bold)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(test): add findProjectRoot to squad-parser mock in workflow tests

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(test): findProjectRoot mock should use mockReturnValue (sync, not async)

findProjectRoot() returns string|null, not a Promise.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(test): update workflow tests for spawn-based agent execution

workflow.ts now uses spawn instead of execSync. Updated test mocks:
- Added createMockChild helper for spawn-based child processes
- Added appendFileSync to fs mock
- Added observability mock (snapshotGoals, diffGoals, logObservability)
- All 16 tests pass

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: remove hardcoded squad names from org cycle waves

Wave definitions had our internal squad names (research, intelligence,
cli, marketing, etc.) hardcoded. A user's squads would never match.

Now: all planned squads run in a single parallel wave. Custom wave
ordering can be added later via SQUAD.md `wave:` field.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: remove hardcoded git commit of .agents/memory/ between waves

Auto-committing hq memory between waves was our internal pattern,
not a product feature. Users won't have .agents/memory/ in their
project root. Removed.

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor: extract plan prompt to templates/prompts/plan.md

"No prompts in code" — behavioral instructions live in markdown.
Extracted the inline planPrompt template string to a markdown file
with {{VARIABLE}} placeholders. TypeScript loads and substitutes.

Also: squadContext is now included in the template (was passed as
empty string, losing goals/priorities context).

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(lint): remove unused execSync import from run.ts

No longer needed after removing hardcoded git commit between waves.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

* feat(conversation): agents talk + use tools, cognition engine, convergence

Conversation mode rewrite and cognition engine from v0.3.0 cycle:

- conversation.ts: Rewritten so agents talk AND use tools (was text-only).
  Parallel same-role agents within cycles. Hard-stop on lead completion.
  Squad cwd resolution for all agent turns. Transcript serialization fixes.
  Agent classification by name first, then role description.
- cognition.ts: Local-first intelligence engine. Quality grading.
  Escalation pause for daemon. Signal synthesis via Claude CLI.
  Push memory signals after daemon cycles.

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor: remove cognition.ts changes from this PR

Cognition engine is not actively used (post-pivot, daemon is stopped).
Changes parked in future/cognition-t2 branch for Tier 2 reactivation.
This PR now only contains conversation.ts changes.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

… — 4/7] (#734)

* feat(commands): add review, credentials, goals, log commands + minor fixes

New commands:
- credentials.ts: per-squad GCP service account management
- goals.ts: goals dashboard with status tracking
- log.ts: run history with timestamps, duration, status
- review.ts: post-cycle evaluation dashboard

Fixes applied:
- Added CLI_LOG telemetry event
- Removed unused imports (writeFileSync, formatRelativeTime)
- Removed unused variables (blockedStr, achievedStr)
- Fixed hardcoded org name in review.ts issue URL resolution

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: address Gemini review on credentials.ts

- Use static renameSync import instead of dynamic import('fs')
- Remove redundant --all handling (dedicated create-all command exists)

Co-Authored-By: Claude <noreply@anthropic.com>

* refactor(credentials): remove hardcoded squad names, read config from SQUAD.md

credentials.ts had our internal squad names and GCP roles hardcoded.
Now fully agnostic:

- Permissions read from SQUAD.md `credentials.gcp.roles/apis` fields
- Squads discovered dynamically from squads directory
- No hardcoded squad names, org names, or internal structure
- Helpful error message shows users how to configure their SQUAD.md
- create-all discovers squads with GCP config automatically

Co-Authored-By: Claude <noreply@anthropic.com>

* test(credentials): add 8 tests for SQUAD.md GCP credentials parser

Extracted parseGcpCredentials() as pure function for testability.
Tests cover: inline YAML, quoted values, multiple APIs, missing config,
empty content, roles without apis, mixed SQUAD.md content.

All 8 pass.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

…735)

* feat(init): demo agent scaffold, what's next guidance, email capture

Init UX improvements from v0.3.0 cycle:

- "What's next" guidance after init with actionable next steps
- Opt-in email capture for product updates
- Demo squad scaffold with hello-world starter agent
- IDP catalog seeding for agent frontmatter schemas
- Competitor collection during init
- Hints for empty business description
- cli.run.complete telemetry event

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(test): update E2E to expect 5 squads (4 core + demo)

Init now creates a demo squad with hello-world agent.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

… — 6/7] (#736)

* feat(security): PreToolUse guardrail hooks for spawned agent sessions

guardrail.json template injected into all spawned Claude sessions.
Prevents agents from running destructive commands, force-pushing,
publishing packages, or accessing secrets directly.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(security): add npm/yarn/pnpm publish to guardrail blocked commands

Gemini review caught missing publish checks. Agents should never
publish packages — that requires founder approval.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

…#737)

* test+docs: coverage + tier 2 docs + version bump to 0.3.0

Tests added (213 new tests):
- catalog.test.ts: catalog command tests
- dashboard.test.ts: dashboard engine, renderers, loader tests
- services.test.ts: services command tests
- first-run.e2e.test.ts: updated for demo squad scaffold
- guardrail.test.ts: guardrail hook tests
- init.test.ts: expanded init command tests
- telemetry.test.ts: telemetry event tests

Docs:
- docs/tier2.md: Tier 2 architecture documentation

Version:
- package.json: bump to 0.3.0

Note: cli.test.ts failures are pre-existing on develop (not introduced by this PR).

Co-Authored-By: Claude <noreply@anthropic.com>

* docs: remove tier2.md — internal architecture, not product docs

Hardcoded our repo structure, ports, service names. Belongs in
private engineering repo, not the public CLI.

Co-Authored-By: Claude <noreply@anthropic.com>

* test: replace mock-heavy tests with real integration tests

Before: 2,299 lines mocking fs, squad-parser, child_process, etc.
Testing mocks, not the product. False confidence.

After: 465 lines testing real files on real filesystem.
- catalog: real IDP directory with YAML files
- dashboard: zero mocks, real data structures into renderers
- services: real docker-compose.yml in temp dir
- init: real temp directory, verify actual files created

39 tests, all passing. 80% less code, 100% more real coverage.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

* fix(services): make agnostic — remove hardcoded paths and internal assumptions

Before: searched for docker-compose.yml in ~/agents-squads/engineering/docker/
and hardcoded squads-postgres container name, internal DB table names.

Now:
- Discovers docker-compose.yml from project root, ./docker/, ./infra/,
  SQUADS_COMPOSE_FILE env var, or --file flag
- Uses docker compose ps against user's compose file
- Removed hardcoded port output and DB introspection
- --file option on all 3 subcommands (up/down/status)
- Health check verifies containers are actually running
- Updated tests to match new agnostic implementation

Co-Authored-By: Claude <noreply@anthropic.com>

* test(services): update tests for agnostic services command

- Use SQUADS_COMPOSE_FILE env var instead of hardcoded engineering path
- Check --file option on all subcommands
- Fix health check mock to return 'running' state
- Updated status test for Docker not installed case

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

…0.3.0] (#739)

* fix(telemetry): restore write-only API key — telemetry broken since March 14

Commit 6261882 removed the telemetry key and replaced it with an env var
that no user has set. Result: zero telemetry events since ~March 14.

Write-only analytics keys are standard practice (Segment, PostHog,
Mixpanel all ship them in public code). The key can only write events;
it cannot read, delete, or access any data. Users can still opt out.

Closes #388 (GitHub Traffic API — this restores our primary data signal)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: use plain string for telemetry key, drop base64 obfuscation

Gemini review: base64 encoding adds no security and reduces transparency.
Plain string is honest — it's a write-only key, nothing to hide.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: lock telemetry key — no env var override

Telemetry goes to our infrastructure only. No reason to let users
redirect it. They can opt out, but not redirect.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>

….0] (#740)

* fix(run): UX improvements — prerequisites check, no-args squad list, schedule hint (#675, #694, #695)

- Add checkPrerequisites() validating Node >= 18 and Claude CLI before run
- Show available squads with missions when `squads run` invoked without args
- Display scheduling tip after first successful squad run (persisted in ~/.squads-cli/schedule-hint-shown)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: skip prerequisites check in CI/test environments

checkPrerequisites() called process.exit(1) when Claude CLI not found,
killing the test runner. Now skips when CI or VITEST env vars are set.

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: address Gemini review — remove redundant CLI check, fix cron hint, cleanup

- Removed redundant Claude CLI check (preflightExecutorCheck handles it)
- Removed non-existent --cron flag from schedule hint
- Removed unused runAutopilot import (replaced by squad listing)
- Added VITEST to skip conditions

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(lint): remove unused execSync import

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Jorge Vidaurre <jorge@agents-squads.com>
Co-authored-by: Claude <noreply@anthropic.com>