Bohan Jiang 405d88c1dc feat(squad): allow members to create and manage their own squads (MUL-4223) (#5071) ...

Squad create/manage was gated behind workspace owner/admin, inconsistent with
agents and projects which any member can create. Move squads to a creator-scoped
model: any member can create a squad and becomes its creator, and manages only
the squads they created; owner/admin continue to manage every squad.

Backend (server/internal/handler/squad.go):
- Add canManageSquad (admin/owner OR creator) and gate UpdateSquad, DeleteSquad,
  AddSquadMember, RemoveSquadMember, UpdateSquadMemberRole on it (member load +
  squad load + per-squad check, replacing requireWorkspaceRole).
- CreateSquad is now member-creatable.
- Add memberCanWireAgent: a non-admin may only wire agents they can @-trigger
  (canInvokeAgent as themselves) as squad leader (create/update) or worker
  (add member); admins may wire any workspace agent. Prevents a creator from
  smuggling an agent they cannot invoke into a squad.

Frontend:
- squad-detail-page: compute per-squad canManage (admin || creator) and render
  the inspector, members tab, instructions and archive read-only otherwise,
  mirroring the agent detail canEdit pattern.
- squads-page: per-row actions and the actions column now key off per-squad
  canManage instead of workspace-admin.

Squads stay visible workspace-wide (ListSquads unfiltered); creator transfer is
out of scope for this iteration.

Co-authored-by: J <j@multica.ai>
Co-authored-by: multica-agent <github@multica.ai>

2026-07-08 14:51:54 +08:00

..

activity_test.go

refactor(timeline): drop server-side comment + timeline pagination (#2322)

2026-05-09 16:11:58 +08:00

activity.go

MUL-3328: add retry button for failed agent comments (#4217)

2026-06-17 15:18:44 +02:00

actor_guards_test.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

actor_guards.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

agent_access_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

agent_access.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

agent_composio_allowlist_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

agent_env.go

MUL-2792 fix(agent): preserve skills in update/archive/restore response (#3464)

2026-05-28 19:06:57 +08:00

agent_permission_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

agent_permission.go

fix(agents): thread permission_mode/invocation_targets through the template create path (MUL-4010) (#4897)

2026-07-03 17:56:02 +08:00

agent_runtime_config_mask_test.go

feat(openclaw): support connecting to existing OpenClaw gateway (#3260) [MUL-3158] (#3664)

2026-06-13 15:33:28 +08:00

agent_template_permission_test.go

fix(agents): thread permission_mode/invocation_targets through the template create path (MUL-4010) (#4897)

2026-07-03 17:56:02 +08:00

agent_template.go

fix(agents): thread permission_mode/invocation_targets through the template create path (MUL-4010) (#4897)

2026-07-03 17:56:02 +08:00

agent_test.go

MUL-2792 fix(agent): preserve skills in update/archive/restore response (#3464)

2026-05-28 19:06:57 +08:00

agent_thinking_test.go

MUL-3341: clear incompatible model on runtime switch

2026-06-17 08:23:20 +02:00

agent_work_dir_test.go

MUL-2771: feat(transcript): server-derived relative work_dir chip (#3428)

2026-05-28 15:53:16 +08:00

agent.go

Skip local directory lock for squad leaders (#4951)

2026-07-06 17:19:56 +08:00

auth_signup_test.go

…

auth.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

autopilot_list_test.go

fix: archive autopilots on delete (#5042)

2026-07-07 20:49:42 +08:00

autopilot_permissions_test.go

feat(autopilot): View/Write permission layer + member access delegation (MUL-3807) (#4695)

2026-06-30 12:29:11 +08:00

autopilot_private_leader_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

autopilot_subscriber_test.go

fix: archive autopilots on delete (#5042)

2026-07-07 20:49:42 +08:00

autopilot_webhook_handler_test.go

MUL-2703: feat(autopilots): webhook event filters per trigger (MUL-2334 follow-up) (#3231)

2026-05-27 15:47:36 +08:00

autopilot_webhook_iprl_test.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

autopilot_webhook_test.go

MUL-2703: feat(autopilots): webhook event filters per trigger (MUL-2334 follow-up) (#3231)

2026-05-27 15:47:36 +08:00

autopilot_webhook.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

autopilot.go

fix: archive autopilots on delete (#5042)

2026-07-07 20:49:42 +08:00

cancel_task_by_user_test.go

feat(chat): workspace-scoped attachment binding + fire-and-forget send (#4249)

2026-06-18 09:40:38 +08:00

chat_history_test.go

feat(slack): two-command channel reads — chat history (overview) + chat thread [id] (MUL-3871) (#4762)

2026-07-01 12:46:47 +08:00

chat_history.go

feat(slack): two-command channel reads — chat history (overview) + chat thread [id] (MUL-3871) (#4762)

2026-07-01 12:46:47 +08:00

chat_pending_tasks_test.go

perf(chat): fix pending-task index mismatch + cut aggregate request storm (MUL-4159) (#5018)

2026-07-07 13:20:30 +08:00

chat_test.go

feat(integrations): add platform-agnostic channel foundation (MUL-3515) (#4412)

2026-06-24 12:46:20 +08:00

chat.go

perf(chat): fix pending-task index mismatch + cut aggregate request storm (MUL-4159) (#5018)

2026-07-07 13:20:30 +08:00

cloud_billing_test.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

cloud_billing.go

feat(billing): proxy /api/cloud-billing/* + Stripe webhook to multica-cloud (#3434)

2026-05-28 16:05:19 +08:00

cloud_runtime_test.go

feat(auth): support mcn_ Cloud Node PATs verified via Fleet (#3349)

2026-05-27 14:52:03 +08:00

cloud_runtime.go

feat(auth): support mcn_ Cloud Node PATs verified via Fleet (#3349)

2026-05-27 14:52:03 +08:00

comment_fold_test.go

feat(comments): resolve-aware fold for agent comment reads (MUL-3555) (#4463)

2026-06-24 09:52:18 +08:00

comment_list_test.go

fix(comments): preserve direct parent on replies (#3579)

2026-06-01 08:28:15 +08:00

comment_resolve_test.go

fix(comments): enforce single resolution per thread (#3984)

2026-06-10 14:20:39 +08:00

comment_trigger_preview_test.go

MUL-3794: rewrite comment routing cascade

2026-06-30 12:24:57 +08:00

comment.go

MUL-4024 tighten squad leader self-trigger guard (#4896)

2026-07-03 17:42:06 +08:00

config_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

config.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

contact_sales_test.go

feat(landing): add Contact Sales page and inquiry endpoint (MUL-2493) (#2988)

2026-05-22 13:22:36 +08:00

contact_sales.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

daemon_chat_prompt_test.go

fix(chat): deliver every debounced user message to the agent (MUL-2968) (#3744)

2026-06-04 13:12:32 +08:00

daemon_feature_flags_test.go

MUL-3618: dispatch daemon feature flag snapshots (#4509)

2026-06-24 16:19:30 +08:00

daemon_test.go

fix(projects): honor repo resource checkout refs (MUL-3593) (#4470)

2026-06-24 16:25:17 +08:00

daemon_ws.go

Make custom runtimes appear immediately (#4234)

2026-06-17 16:00:22 +08:00

daemon.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

dashboard_test.go

test(rollup): serialise shared-singleton rollup tests across packages (MUL-3980) (#4854)

2026-07-02 18:31:45 +08:00

dashboard.go

fix(usage): disambiguate model pricing by provider (MUL-3346)

2026-06-18 11:10:06 +08:00

featureflag_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

feedback_test.go

…

feedback.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

file_test.go

feat(attachments): support HTTP Range resume on proxy download (MUL-3962)

2026-07-07 12:38:07 +08:00

file.go

feat(attachments): support HTTP Range resume on proxy download (MUL-3962)

2026-07-07 12:38:07 +08:00

github_test.go

fix(github): hide reference-only PR links from the issue PR list (#4611)

2026-07-05 13:30:18 +08:00

github.go

fix(github): hide reference-only PR links from the issue PR list (#4611)

2026-07-05 13:30:18 +08:00

handler_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

handler_writejson_test.go

feat(api): emit Content-Length header on JSON responses (#5021)

2026-07-07 14:43:19 +08:00

handler.go

feat(api): emit Content-Length header on JSON responses (#5021)

2026-07-07 14:43:19 +08:00

heartbeat_scheduler_test.go

…

heartbeat_scheduler.go

…

heartbeat_test.go

…

inbox.go

feat(sidebar): dot the workspace switcher when other workspaces have unread inbox (MUL-3695) (#4577)

2026-06-26 12:09:15 +08:00

integrations_composio_test.go

MUL-4009: hide not-configured Composio toolkits at Service layer (#4880)

2026-07-03 16:10:19 +08:00

integrations_composio.go

MUL-4009: hide not-configured Composio toolkits at Service layer (#4880)

2026-07-03 16:10:19 +08:00

invitation_test.go

…

invitation.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

issue_assignee_types_test.go

MUL-3903: Extract shared issue surfaces (#4774)

2026-07-02 14:11:10 +08:00

issue_batch_test.go

MUL-3508: stage sub-issues so the parent wakes per stage, not per child (#4410)

2026-06-23 00:14:42 +08:00

issue_child_done_stage_test.go

fix(issues): don't call an intermediate stage final in child-done comment (MUL-4062) (#4932)

2026-07-05 01:35:00 +08:00

issue_child_done_test.go

fix(issues): wake parent squad leader on same-squad/shared-leader child-done (MUL-3969) (#4843)

2026-07-02 15:48:45 +08:00

issue_child_done.go

fix(squad): wake private-leader squad parent leader on child-done (MUL-4063) (#4934)

2026-07-05 02:35:19 +08:00

issue_children_for_parents_test.go

fix(issue): order sub-issues by number ASC instead of position (#4511)

2026-06-24 16:06:14 +08:00

issue_create_position_test.go

fix(issues): place new issues at top of column in manual sort mode

2026-05-28 14:20:20 +08:00

issue_grouped_test.go

Add assignee grouping for issue boards (#2693)

2026-05-15 18:44:08 +08:00

issue_involves_test.go

feat(my-issues): cover squad assignees via involves_user_id (MUL-2397) (#2829)

2026-05-19 10:37:38 +08:00

issue_limit_validation_test.go

fix(issues): validate and clamp limit/offset in ListIssues (MUL-2847) (#3585)

2026-06-02 17:17:41 +08:00

issue_metadata_test.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

issue_metadata.go

feat(issues): per-issue metadata KV (MUL-2017) (#2845)

2026-05-21 16:35:45 +08:00

issue_reaction.go

…

issue_reassign_no_cancel_test.go

fix(server): do not cancel issue tasks on assignee change (MUL-4113, #4963) (#4975)

2026-07-06 19:11:47 +08:00

issue_scheduled_test.go

feat(projects): scheduled-only Gantt data source + WS reactivity (MUL-1881) (#2856)

2026-05-19 17:04:16 +08:00

issue_trigger_preview_test.go

MUL-3416: Issue pre-trigger preview + Handoff Note (#4383)

2026-06-23 13:17:13 +08:00

issue_trigger.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

issue_validation_test.go

fix: validate issue status and priority (#4156)

2026-06-16 12:26:44 +08:00

issue.go

fix(server): do not cancel issue tasks on assignee change (MUL-4113, #4963) (#4975)

2026-07-06 19:11:47 +08:00

label_test.go

fix(labels): reject control characters in label names (#4531)

2026-06-25 00:19:13 +08:00

label.go

fix(labels): reject control characters in label names (#4531)

2026-06-25 00:19:13 +08:00

lark_test.go

feat(integrations): add platform-agnostic channel foundation (MUL-3515) (#4412)

2026-06-24 12:46:20 +08:00

lark.go

feat(integrations): add platform-agnostic channel foundation (MUL-3515) (#4412)

2026-06-24 12:46:20 +08:00

mcp_overlay_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

mcp_overlay.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

mention_self_trigger_test.go

MUL-3794: rewrite comment routing cascade

2026-06-30 12:24:57 +08:00

notification_preference.go

…

onboarding_shim.go

feat(server): funnel/community/commercial business metrics + PostHog pairing (MUL-2949) (#3698)

2026-06-03 16:39:06 +08:00

onboarding_test.go

revert(self-host): remove source channel reporting (#4799)

2026-07-01 17:53:16 +08:00

onboarding.go

revert(self-host): remove source channel reporting (#4799)

2026-07-01 17:53:16 +08:00

parse_since_param_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

personal_access_token_test.go

MUL-2744: feat(auth): auto-renew daemon PAT in-place within 7-day window (#3360)

2026-05-27 22:22:26 +08:00

personal_access_token.go

MUL-2744: feat(auth): auto-renew daemon PAT in-place within 7-day window (#3360)

2026-05-27 22:22:26 +08:00

pin.go

…

project_resource_test.go

Revert "feat(daemon): worktree_pool mode for local_directory (MUL-3483) (#4986)" (#5037)

2026-07-07 17:35:33 +08:00

project_resource.go

Revert "feat(daemon): worktree_pool mode for local_directory (MUL-3483) (#4986)" (#5037)

2026-07-07 17:35:33 +08:00

project_validation_test.go

MUL-3438: fix(projects): require admin for project deletion (#4327)

2026-06-21 23:54:58 +08:00

project.go

fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)

2026-07-06 12:34:51 +08:00

quick_create_parent_test.go

MUL-3244: Bind quick-create attachments to created issues (#4062)

2026-06-12 16:45:38 +08:00

reaction.go

…

reserved_slugs.json

feat(web): add use-cases content pipeline with welcome page (MUL-2349) (#2795)

2026-05-25 10:05:17 +08:00

rollup_guard_test.go

test(rollup): serialise shared-singleton rollup tests across packages (MUL-3980) (#4854)

2026-07-02 18:31:45 +08:00

runtime_archive_squad_cleanup_test.go

MUL-2489 fix(runtime): delete archived squads before runtime teardown (#2955)

2026-06-08 13:08:38 +08:00

runtime_cascade_test.go

MUL-4158: allow deleting orphaned profile runtimes

2026-07-07 12:01:14 +08:00

runtime_liveness_store_test.go

…

runtime_liveness_store.go

…

runtime_local_skills_overwrite_test.go

MUL-2802: add skill import conflict strategies (#3997)

2026-06-11 13:00:56 +08:00

runtime_local_skills_redis_store_test.go

fix(skills): preserve runtime import files (#5066)

2026-07-08 13:11:22 +08:00

runtime_local_skills_redis_store.go

fix(skills): preserve runtime import files (#5066)

2026-07-08 13:11:22 +08:00

runtime_local_skills_test.go

fix(skills): preserve runtime import files (#5066)

2026-07-08 13:11:22 +08:00

runtime_local_skills.go

fix(skills): preserve runtime import files (#5066)

2026-07-08 13:11:22 +08:00

runtime_models_redis_store_test.go

…

runtime_models_redis_store.go

fix(handler): keep runtime pending redis keys in one slot

2026-07-02 14:38:05 +08:00

runtime_models_test.go

…

runtime_models.go

feat(agent): per-agent thinking_level for claude + codex (MUL-2339) (#2865)

2026-05-20 12:30:10 +08:00

runtime_profile_handler_test.go

MUL-4158: allow deleting orphaned profile runtimes

2026-07-07 12:01:14 +08:00

runtime_profile.go

MUL-4158: allow deleting orphaned profile runtimes

2026-07-07 12:01:14 +08:00

runtime_redis_keys_test.go

fix(handler): keep runtime pending redis keys in one slot

2026-07-02 14:38:05 +08:00

runtime_test.go

fix(usage): disambiguate model pricing by provider (MUL-3346)

2026-06-18 11:10:06 +08:00

runtime_update_redis_store_test.go

…

runtime_update_redis_store.go

fix(handler): keep runtime pending redis keys in one slot

2026-07-02 14:38:05 +08:00

runtime_update_test.go

…

runtime_update.go

…

runtime_visibility_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

runtime.go

MUL-4158: allow deleting orphaned profile runtimes

2026-07-07 12:01:14 +08:00

search_test.go

fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)

2026-07-06 12:34:51 +08:00

search_timeout_test.go

fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)

2026-07-06 12:34:51 +08:00

search.go

fix(search): pg_trgm index fallback + statement_timeout guard (MUL-4059) (#4925)

2026-07-06 12:34:51 +08:00

skill_create.go

MUL-2802: add skill import conflict strategies (#3997)

2026-06-11 13:00:56 +08:00

skill_import_archive_test.go

feat(skills): import skills from a .skill/.zip archive (#4735)

2026-06-30 14:46:46 +08:00

skill_import_archive.go

feat(skills): import skills from a .skill/.zip archive (#4735)

2026-06-30 14:46:46 +08:00

skill_import_duplicate_test.go

MUL-2802: add skill import conflict strategies (#3997)

2026-06-11 13:00:56 +08:00

skill_list_test.go

fix(handler): validate skill id UUID at request boundary (#3025)

2026-05-22 12:22:07 +08:00

skill_search_test.go

feat: add skill search CLI (#3601)

2026-06-01 15:19:42 +08:00

skill_test.go

fix(skills): authenticate raw.githubusercontent.com downloads for private repo imports (#4389)

2026-06-22 13:34:06 +08:00

skill.go

feat(skills): import skills from a .skill/.zip archive (#4735)

2026-06-30 14:46:46 +08:00

slack_test.go

feat(slack): bring-your-own-app install + per-installation Socket Mode (MUL-3666) (#4566)

2026-06-29 14:09:34 +08:00

slack.go

feat(slack): bring-your-own-app install + per-installation Socket Mode (MUL-3666) (#4566)

2026-06-29 14:09:34 +08:00

squad_assign_trigger_test.go

feat: implement Squad feature MVP (#2505)

2026-05-13 18:46:20 +08:00

squad_briefing_claim_test.go

fix(squad): inject leader briefing by task flag, not issue assignee (MUL-3730) (#4606)

2026-06-26 16:01:33 +08:00

squad_briefing_test.go

fix(squad): inject leader briefing by task flag, not issue assignee (MUL-3730) (#4606)

2026-06-26 16:01:33 +08:00

squad_briefing.go

fix(squad): inject leader briefing by task flag, not issue assignee (MUL-3730) (#4606)

2026-06-26 16:01:33 +08:00

squad_comment_trigger_test.go

MUL-4024 tighten squad leader self-trigger guard (#4896)

2026-07-03 17:42:06 +08:00

squad_creator_scope_test.go

feat(squad): allow members to create and manage their own squads (MUL-4223) (#5071)

2026-07-08 14:51:54 +08:00

squad_id_enqueue_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

squad_member_status_test.go

fix(agents): surface archived status for retired agents (#3608)

2026-06-02 13:03:15 +08:00

squad_no_action_test.go

fix(squad): suppress no-action leader comments (#2583)

2026-05-14 14:07:26 +08:00

squad_private_leader_test.go

fix(squad): wake private-leader squad parent leader on child-done (MUL-4063) (#4934)

2026-07-05 02:35:19 +08:00

squad_worker_comment_wakes_leader_test.go

MUL-4024 tighten squad leader self-trigger guard (#4896)

2026-07-03 17:42:06 +08:00

squad.go

feat(squad): allow members to create and manage their own squads (MUL-4223) (#5071)

2026-07-08 14:51:54 +08:00

subscriber_test.go

feat(agents): gate private-agent surfaces with allowed_principals predicate (#2359)

2026-05-11 12:39:45 +08:00

subscriber.go

…

task_lifecycle.go

MUL-2771: feat(transcript): server-derived relative work_dir chip (#3428)

2026-05-28 15:53:16 +08:00

trigger_test.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

user_language_test.go

i18n: add japanese locale (MUL-2893) (#3538)

2026-06-02 14:29:29 +08:00

user_timezone_test.go

MUL-2488 feat(timezone): Scheduling / Viewing two-layer timezone architecture (#2968)

2026-05-21 15:33:47 +08:00

webhook_delivery_test.go

feat(autopilots): webhook delivery layer + idempotency/signature/replay (MUL-2334) [PR1] (#2774)

2026-05-18 14:59:40 +08:00

webhook_delivery.go

feat(autopilot): View/Write permission layer + member access delegation (MUL-3807) (#4695)

2026-06-30 12:29:11 +08:00

webhook_rate_limiter_test.go

feat(autopilots): webhook triggers (server + CLI + UI + docs) MUL-2049 (#2348)

2026-05-18 12:17:39 +08:00

webhook_rate_limiter.go

fix(webhook): use unique ZSET member in Redis rate limiter (#4546)

2026-06-25 01:29:20 +08:00

workspace_reserved_slugs.go

refactor(reserved-slugs): single JSON source for backend + frontend (#2148)

2026-05-08 19:14:12 +08:00

workspace_revoke.go

feat(composio): gate MCP apps behind feature flag (#4876)

2026-07-03 14:18:43 +08:00

workspace_test.go

feat(integrations): add platform-agnostic channel foundation (MUL-3515) (#4412)

2026-06-24 12:46:20 +08:00

workspace.go

feat(cli): manage workspace repo registry (#4067)

2026-06-13 01:22:45 +08:00