release: v0.2.4 — conversations, credentials, review, goals

[kokevidaurre]

Summary

Major release: squads now run as full team conversations, with per-squad credentials and a founder review dashboard.

New Commands

• squads review — post-cycle evaluation dashboard (goals, costs, blockers, founder actions with links)
• squads credentials create|rotate|list|revoke — per-squad GCP service account management
• squads goals — goals dashboard across all squads

Architecture Changes

• squads run --org now runs full squad conversations (lead→scan→work→verify) instead of solo leads
• Execution engine auto-injects GOOGLE_APPLICATION_CREDENTIALS per squad
• All hardcoded prompts extracted to markdown files (.agents/config/)

Improvements

• Init UX: "What's next" guidance + opt-in email capture
• Guardrails: PreToolUse hooks injected into spawned agent sessions
• Observability: agent name normalization, services tests, Tier 2 docs
• Quota detection: re-throw agent failures so org cycle detects limits

Bug Fixes

• Model routing: agent frontmatter takes priority over SQUAD.md
• Workflow: coerce rolesContent to string (prevents CI test failures)
• Merge: main synced back to develop (v0.2.2 release divergence resolved)

Test plan

• npm run build passes
• squads review shows dashboard
• squads goals shows goals
• squads credentials list shows 10 squads
• squads tier shows Tier 1

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces several new commands, including goals, credentials, and review, while enhancing the run command with goal-aware skipping and improved quota management. It externalizes many agent prompts and protocols into markdown files, adds GCP service account management, and implements a guardrail system to block destructive shell commands. Review feedback identifies a high-severity command injection risk in the credentials management logic and critical runtime errors caused by using require in ESM modules. Additionally, it is recommended to make the founder identity configurable rather than hardcoded in the review dashboard.

[gemini-code-assist]

The squad parameter is used to construct shell commands without validation or sanitization. This poses a command injection risk if a malicious string is provided (e.g., $(bad_cmd)). While createCredential validates the input against SQUAD_PERMISSIONS, revokeCredential and rotateCredential do not. Consider adding a regex validation (e.g., ^[a-z0-9-]+$) at the start of these functions to ensure the input is safe.

[gemini-code-assist]

Using require in an ESM module will result in a ReferenceError at runtime in most Node.js environments. Since this function is asynchronous, use dynamic import() instead.

Suggested change

	const { findProjectRoot } = require('./squad-parser.js');
	const { findProjectRoot } = await import('./squad-parser.js');

[gemini-code-assist]

Using require in an ESM module will result in a ReferenceError at runtime. Since this function is asynchronous, use dynamic import() instead.

Suggested change

	const { findProjectRoot: findRoot } = require('./squad-parser.js');
	const { findProjectRoot: findRoot } = await import('./squad-parser.js');

[gemini-code-assist]

Hardcoding a specific username (kokevidaurre) in the codebase makes the tool less portable and harder to maintain for other users. Consider making the founder identity configurable via a settings file or environment variable.

[kokevidaurre]

Closing: Gemini flagged issues that need fixing before release.

1. security-high: credentials.ts:263 — security issue in credential handling
2. high: cognition.ts:332,484 — require() in ESM module will crash at runtime
3. medium: review.ts:142 — hardcoded username kokevidaurre (should be org-agnostic)

CLI squad: fix these findings, then create a fresh develop→main PR for v0.2.4 release.