fix(claude): allow Squad's own tools; enforce the reviewer gate (demo dry-run blockers)

.changeset/claude-demo-blockers.md

@@ -0,0 +1,6 @@
+---
+"@bradygaster/squad-sdk": patch
+"@bradygaster/squad-cli": patch
+---
+
+Claude Code: `squad init`/`squad upgrade` add a scoped `.claude/settings.json` allowlist for Squad's own tools (the coordinator's `squad_state` tools by name, `squad cast`, `squad client sync`, `squad lockout reject` and `status` (the steps that release a lockout still ask); launcher rules only for Squad's own launcher; rollback removes only the rules Squad recorded adding), `squad cast` refuses to write through a symlink, and it is turned off with `"claudePermissions": "off"`. The non-Copilot coordinators run the reviewer gate on every code or test change unasked, treat a known gap against the issue or a recorded decision as a REJECT, never let an author review their own work, and name the recorded decision that shapes the work.

CHANGELOG.md

@@ -78,6 +78,8 @@ Claude Code is the first host after GitHub Copilot where Squad uses the host's o
   - `.squad/squad.mjs` is a launcher Squad commits. It finds a Squad CLI on each machine: `SQUAD_CLI`, the project's `node_modules`, then `squad` on PATH. It skips a CLI older than the one that wrote it, and uses `npx` only with `SQUAD_ALLOW_NPX=1`. It shares its code with the plugin's launcher.
   - Claude hooks reach the launcher through `$CLAUDE_PROJECT_DIR`. Standalone bundle installs write `squad state-mcp`. A CLI run through `npx` keeps the exact-version `npx` command.
   - `squad doctor` flags machine-specific launch commands and a missing launcher. Run `squad upgrade` once to fix an existing repository.
+- **Squad's own tools no longer prompt in Claude Code.** In a demo dry run, a fresh `squad init --client claude` project hit 13 permission prompts while casting the team, and the coordinator ended up hand-writing charters and asking the user to run `squad cast` themselves. `squad init` and `squad upgrade` now add a scoped allowlist to `.claude/settings.json`: the `squad_state` tools the coordinator uses, by name (never the experimental backend's approval tools), and `squad cast`, `squad client sync` `squad lockout reject` and `squad lockout status` (the steps that release a lockout, `assign`, `submit`, `approve` and `override`, still ask), as `squad …` and, when `.mcp.json` runs Squad's own launcher, as `node .squad/squad.mjs …`. Nothing else is allowed, and `squad cast` now refuses to write through a symbolic link. Your own rules come first and are never touched; Squad records the rules it added in `.claude/.squad-permissions.json`, and rollback removes only those, and `"claudePermissions": "off"` in `.squad/config.json` turns it off. Claude Code applies project allow rules only after the folder is trusted (the trust prompt on your first interactive `claude` run there). `squad init` now says so, and if a cast is still denied the coordinator stops and asks instead of retrying variants or hand-writing the team.
+- **The reviewer gate runs on its own and means it.** In the same dry run, the coordinator declared a bug fix done without the lead's review even though `routing.md` named the lead as the approval gate; when asked, the lead listed six known gaps against the issue and still approved; and a reviewer's own fix went unreviewed. The non-Copilot coordinators now send every code or test change to the reviewer before calling it done, unasked; the reviewer is never an author, judges against the issue and the team's recorded decisions (a known gap against either is a REJECT, not an advisory), and code a reviewer writes needs a different reviewer. The coordinator also names a recorded decision when it shapes the work ("Per the team decision of <date>: …").
 - **Coordinators wait for a human's sign-off.** When `team.md` or `routing.md` says a human must sign off on work (a release, tag, publish, merge or deploy), the Claude, Kiro, OpenCode, Cursor, Codex and Antigravity coordinators no longer treat the request itself as the sign-off. They name the rule and the human, ask whether you are that human or have their sign-off, go ahead only on an explicit yes, and record it in the decisions inbox. In a non-interactive run they stop at the gate. Seen in a live test: asked to "cut the 1.0.0 release", the Claude coordinator used to bump, tag and run `npm publish` itself.
 - `squad_state` works when the team folder is reached through a symlink, such as macOS `/tmp` (really `/private/tmp`) or a linked team root. Squad stores the folder's resolved path but was given paths in the original spelling, so it refused reads and writes there with "Path traversal blocked". Paths that really leave the team folder, including through a symlink inside it, are still refused.
 - The Claude Code plugin has an icon (the Squad logo, 512 px), so `claude plugin validate` reports no warnings. Images are marked binary in `.gitattributes`, so the plugin folder's LF rule never rewrites them.

docs/src/content/docs/scenarios/client-compatibility.md

@@ -223,6 +223,16 @@ Interactive Claude Code doesn't load project-scoped `.mcp.json` servers until yo
 | **Hooks** | ✅ Opt-in, advisory | Off by default. See [Governance hooks](#governance-hooks). |
 | **`squad watch --execute`** | ✅ Preset | `squad watch --execute --agent-preset claude` (or `"agentPreset": "claude"` under `watch` in `.squad/config.json`) runs each round as `claude -p … --agent squad` with a `squad_state`-only MCP config written by the `squad` CLI (never the repository's `.mcp.json`, whose other servers keep Claude Code's approval). Execute mode defaults to `--permission-mode bypassPermissions`, the counterpart of Copilot's `--yolo`; override it with `--claude-flags`. Fleet dispatch (`--dispatch-mode fleet`) stays Copilot-only. |
 
+### Permissions for Squad's own tools
+
+`squad init --client claude` and `squad upgrade --client claude` add these rules to `permissions.allow` in `.claude/settings.json`, so the coordinator can cast a team and use its state without a permission prompt for each call:
+
+- each `squad_state` tool the coordinator uses, by name: `mcp__squad_state__squad_decide`, `…__squad_state_read`, `…_write`, `…_append`, `…_delete`, `…_list`, `…_create_if_absent`, `…_health` and `…_upstreams` (in plugin mode, the same tools under `mcp__plugin_squad_squad_state__`). Not the whole server: the experimental backend tools, such as approving a harness request, and the `memory.*` tools still ask.
+- `Bash(squad cast:*)`, `Bash(squad client sync:*)`, `Bash(squad lockout reject:*)` and `Bash(squad lockout status:*)`. Recording a rejection only adds a restriction. The steps that move a lockout toward release (`assign`, `submit`, `approve` and `override`) always ask, so an agent can't clear a lockout on its own.
+- The same commands through the repository launcher, `node .squad/squad.mjs …`, only while `.mcp.json` runs Squad's own launcher from a folder inside the repository. A `squad.mjs` Squad didn't write is never pre-approved.
+
+Nothing else is allowed: no edits, no other commands, no other MCP servers. `squad cast` refuses to write through a symbolic link, so a pre-approved cast can't be pointed at a file outside the team folder. Your own rules stay first and are never changed. Squad records the rules it added in `.claude/.squad-permissions.json` (commit it with `settings.json`), and removing Claude Code from the team, or turning the allowlist off, removes only those: a rule you had already written stays. Claude Code applies a project's allow rules only once you've trusted the folder (the trust prompt on your first interactive `claude` run there); until then, and in headless runs in an untrusted folder, it ignores them and says so. To turn the allowlist off, set `"claudePermissions": "off"` in `.squad/config.json` and run `squad upgrade --client claude`.
+
 ### Governance hooks
 
 To turn the hooks on, add `"claudeHooks": "advisory"` to `.squad/config.json` and run `squad upgrade --client claude`. Squad then adds these hooks to `.claude/settings.json`:

packages/squad-cli/src/cli/commands/cast.ts

@@ -5,6 +5,7 @@
  * @module cli/commands/cast
  */
 
+import * as fs from 'node:fs';
 import * as path from 'node:path';
 import {
   FSStorageProvider,
@@ -27,6 +28,48 @@ import { fatal, fatalNoSquad } from '../core/errors.js';
 
 const storage = new FSStorageProvider();
 
+/**
+ * The first symlink on the way from `root` down to `target` (`root` itself may be a link: a linked
+ * team or external state directory), or null. `squad cast` can run without an approval prompt in
+ * Claude Code, so it must not follow a planted link out of the team directory.
+ */
+export function symlinkUnder(root: string, target: string): string | null {
+  const rel = path.relative(root, target);
+  if (!rel || rel.startsWith('..') || path.isAbsolute(rel)) return null;
+  let cur = root;
+  for (const part of rel.split(path.sep)) {
+    cur = path.join(cur, part);
+    try {
+      if (fs.lstatSync(cur).isSymbolicLink()) return cur;
+    } catch {
+      return null; // Does not exist yet: nothing below it can be a link either.
+    }
+  }
+  return null;
+}
+
+/** Refuse to cast when a file `squad cast` writes is reached through a symlink. */
+function assertCastTargetsConfined(squadDir: string, teamRoot: string, agentDir: string): void {
+  const castingDir = path.join(squadDir, 'casting');
+  let castingEntries: string[] = [];
+  try {
+    castingEntries = fs.readdirSync(castingDir).map((f) => path.join(castingDir, f));
+  } catch {
+    // No casting directory yet.
+  }
+  const targets: Array<[string, string]> = [
+    ...[agentDir, path.join(agentDir, 'charter.md'), path.join(agentDir, 'history.md'),
+      path.join(squadDir, 'team.md'), path.join(squadDir, 'routing.md'), castingDir, ...castingEntries]
+      .map((t): [string, string] => [squadDir, t]),
+    [teamRoot, path.join(teamRoot, 'squad.config.ts')],
+    [teamRoot, path.join(teamRoot, '.github', 'agents', 'squad.agent.md')],
+  ];
+  for (const [root, target] of targets) {
+    const link = symlinkUnder(root, target);
+    if (link) fatal(`Refusing to cast: ${link} is a symbolic link. squad cast only writes real files inside the team directory.`);
+  }
+}
+
 export interface CastAddOptions {
   name: string;
   role: string;
@@ -329,6 +372,8 @@ export async function runCastAdd(cwd: string, options: CastAddOptions): Promise<
   const charterPath = path.join(agentDir, 'charter.md');
   const historyPath = path.join(agentDir, 'history.md');
 
+  assertCastTargetsConfined(squadDir, teamRoot, agentDir);
+
   if (storage.existsSync(charterPath) && !options.force) {
     fatal(`Agent "${rawName}" already exists at ${charterPath} (use --force to overwrite)`);
   }

packages/squad-cli/src/cli/commands/state-mcp.ts

@@ -31,7 +31,7 @@ const SERVER_INFO = {
   version: getPackageVersion(),
 };
 
-const MCP_TOOL_ALIASES: Record<string, string> = {
+export const MCP_TOOL_ALIASES: Record<string, string> = {
   squad_decide: 'squad_decide',
   squad_state_read: 'squad_state_read',
   squad_state_write: 'squad_state_write',

packages/squad-cli/src/cli/core/init.ts

@@ -198,14 +198,22 @@ type Styled = (on: string, off: string) => string;
  * No `--client` means Copilot, the default host. With one host the line is
  * bare; with several, each line is prefixed with the host's name.
  */
+/**
+ * Claude Code applies the project's allow rules only in a trusted folder, so until the first
+ * interactive run (and in `claude -p` before it) every Squad tool call prompts or is denied.
+ */
+export const CLAUDE_TRUST_NOTE =
+  'Run claude interactively here first and accept "trust this folder": until then Claude Code ignores the permission rules Squad added, so its tools prompt each time (and claude -p denies them).';
+
 export function initNextSteps(
   clients: readonly ClientId[] | undefined,
   claudePlugin?: boolean,
-): { lines: Styled[]; tips: string[] } {
+): { lines: Styled[]; tips: string[]; notes: string[] } {
   const chosen: ClientId[] = clients && clients.length > 0 ? [...new Set(clients)] : ['copilot'];
   if (claudePlugin && !chosen.includes('claude')) chosen.push('claude');
   const steps: { host: string; text: Styled }[] = [];
   const tips: string[] = [];
+  const notes: string[] = [];
   for (const id of chosen) {
     const host = getHostProjection(id).label;
     if (id === 'copilot') {
@@ -214,15 +222,17 @@ export function initNextSteps(
     } else if (id === 'claude' && claudePlugin) {
       steps.push({ host, text: (on, off) => `Run ${on}claude${off}; the Squad plugin's coordinator starts by default in this repository.` });
       tips.push('"squad:claude": "claude -p --agent squad:squad"');
+      notes.push(CLAUDE_TRUST_NOTE);
     } else if (id === 'claude') {
       steps.push({ host, text: (on, off) => `Run ${on}claude --agent squad --mcp-config .mcp.json${off} and tell it what you're building.` });
       tips.push('"squad:claude": "claude -p --agent squad --mcp-config .mcp.json"');
+      notes.push(CLAUDE_TRUST_NOTE);
     } else {
       steps.push({ host, text: () => `Open ${host} in this repository and ask for the squad agent.` });
     }
   }
-  if (steps.length === 1) return { lines: [steps[0]!.text], tips };
-  return { lines: steps.map(s => (on: string, off: string) => `${s.host}: ${s.text(on, off)}`), tips };
+  if (steps.length === 1) return { lines: [steps[0]!.text], tips, notes };
+  return { lines: steps.map(s => (on: string, off: string) => `${s.host}: ${s.text(on, off)}`), tips, notes };
 }
 
 /**
@@ -646,6 +656,7 @@ export async function runInit(dest: string, options: RunInitOptions = {}): Promi
     console.log(`${GREEN}${BOLD}Squad initialized.${RESET} Next, in the host you want to use:`);
     for (const step of steps) console.log(`  ${step}`);
   }
+  for (const note of next.notes) console.log(`${DIM}${note}${RESET}`);
   console.log();
   if (next.tips.length > 0) {
     console.log(`${DIM}Tip: for non-interactive scripts that need squad_state tools, add to package.json:${RESET}`);