chore: promote dev → main (v0.11.0) - #1422
Merged
Merged
Conversation
The Fact Checker role landed in v0.10.0 (#789) with catalog entry, charter template, skill, AGENT_TEMPLATES map entry, and template manifest entry — but was never wired into the user-facing onboarding flow. Users running 'squad init' got Scribe/Ralph/Rai but never saw Fact Checker as a default or cast option. This mirrors how Rai was wired: - init.ts: adds 'fact-checker' to the default agents: array passed to sdkInitSquad() - cast.ts: adds factCheckerMember(), factCheckerCharter(), hasFactChecker branches in castTeam(), and the roster banner line Smoke-tested locally: 'squad init' in a clean repo now produces .squad/agents/fact-checker/charter.md alongside scribe/ralph/Rai. Closes #1222 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Extends the #1222 fix to the third code path. \squad upgrade\ was intentionally silent on agents (preserves user state). For users upgrading from v0.9.x or earlier (no Rai) or v0.10.0 (no fact-checker), this means they'd never get the built-in agents unless they re-ran \squad init\ (which would overwrite other state). Adds \�nsureBuiltinAgents()\ to \ unEnsureChecks()\. Idempotent — only scaffolds when the agent directory is absent. Never overwrites existing charters or history files. Sources content from the shipped \ emplates/{Rai,fact-checker}-charter.md\ templates (already present via TEMPLATE_MANIFEST). Scribe and Ralph are intentionally NOT scaffolded by upgrade — they predate this fix in every squad, and their charters are inlined in cast.ts (no shipped template file). Smoke tested locally: - Set up a simulated v0.9.4 squad (scribe + ralph only) - Ran \squad upgrade\ → 'scaffolded 2 built-in agent(s): Rai, fact-checker' - Ran upgrade again → no re-scaffold (idempotent) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…-scaffold fix: auto-scaffold Fact Checker agent during init and cast (#1222)
#1192) The Copilot CLI post-v1.0.54 changed the permission handler contract to expect 'approve-once' instead of 'approved'. Update the handler, type definition, and error hint to match the new contract. Closes #1191 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ad CLI (#1207) * feat: Squad.Agents.AI community NuGet for MAF integration Squad CLI as Microsoft.Extensions.AI IChatClient, composing GitHub.Copilot.SDK via AsAIAgent() from Microsoft.Agents.AI.GitHub.Copilot 1.7.0-preview. Closes Track A of the Q1-Q7 design lock (see tamresearch1 .squad/decisions.md Decisions 441, 443, 444, 447). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add PR body for #3 * fix(SquadAgent): inherit AIAgent (was IChatClient force-cast) - SquadAgent now properly inherits from Microsoft.Agents.AI.AIAgent - Removed (IChatClient)(object)agent force-cast - Overrides all AIAgent abstract members (CreateSessionCoreAsync, RunCoreAsync, etc.) - DI registration now registers AIAgent (not IChatClient) - README updated to use AIAgent.RunAsync API - No more abstraction inversion; AIAgent is the correct layer Fixes the architectural error identified by Tamir. * docs(SquadAgent): rewrite README — prerequisites, Hello World, troubleshooting, preview callout Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat(SquadAgent): GitHubTokenProvider callback + redact options ToString Adds async token provider pattern for production scenarios (KeyVault/MSI integration). - GitHubTokenProvider property takes precedence over GitHubToken - GitHubToken marked [JsonIgnore] to prevent serialization leaks - SquadAgentOptions.ToString() redacts GitHubToken field - Updated CreateCopilotClient to resolve token from provider first Mitigates P0 #3: token leakage via ILogger structured-log calls, IOptions snapshots, and serializers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(SquadAgent): document GitHubTokenProvider callback for production token management Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(SquadAgent): bind ConnectionStrings__squad via IConfigureOptions + add smoke tests Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(README): replace removed WithTeamRoot with positional teamRoot ctor WithTeamRoot was deleted in commit 35767c90 in favor of mandatory positional teamRoot constructor argument on AddSquad. The Aspire example in the Squad.Agents.AI README still showed the old fluent API, which would now fail at compile time for anyone copy-pasting. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test(squad-agents-ai): add routing integration tests Closes the routing-verification gap identified during squad-squad onboarding: the API surface existed but routing semantics weren't functionally tested. New tests verify persona pass-through, boundary-instruction injection on first turn, WorkingDirectory isolation (Decision 452a), and CopilotClientOptions-based routing (Decision 447). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci(squad-agents-ai): add .NET build/test/pack workflow PR #3 CI was Node/docs-only — adding the .NET gate so green actually reflects the package code. Matrix on ubuntu + windows, restore/build/test/pack, uploads TestResults and nupkg artifacts. Closes the build-verification gap identified during squad-squad onboarding (see .squad/decisions.md adoption record, 2026-06-02). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci(squad-agents-ai): NuGet publish workflow + Dependabot config - .github/workflows/squad-agents-ai-release.yml: workflow_dispatch and tag-driven publish to nuget.org with --skip-duplicate idempotency, fail-fast on missing NUGET_API_KEY secret, optional GitHub Release on tag - .github/dependabot.yml: nuget (src + test) + github-actions, weekly, M.A.AI major allowed, OpenTelemetry major deferred (per Decision 602) Closes the release-pipeline + supply-chain-tracking gaps identified during squad-squad onboarding. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(squad-agents-ai): release-ready docs + .csproj packaging metadata - README updates / XML docs on public surface - CHANGELOG.md with [0.1.0-preview] - 2026-06-02 entry - .csproj: Description, RepositoryUrl, Authors, PackageTags, PackageReadmeFile - Verified via dotnet pack — .nupkg contains README, LICENSE, xml-docs Closes the docs-readiness gap for v0.1-preview publish. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * ci(squad-agents-ai): switch release triggers to dev/main branch-driven Per Tamir's release-strategy directive (decisions.md 2026-06-02): - dev merges → prerelease publish (suffix scheme mirrors Squad CLI) - main merges → stable publish - workflow_dispatch retained as manual escape hatch - tag-driven trigger removed (branches are the source of truth) Version derivation pattern adapted from the Squad CLI's existing release workflow. --skip-duplicate retained for idempotent reruns. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs+fix: PR #3 review pass — hygiene, XML docs, cliArgs, multi-named connections - Rewrite the package README and PR validation flow around the AIAgent surface and ambient Copilot authentication. - Keep public docs free of internal process references and remove obsolete deferral language. - Preserve connection-string cliArgs through CopilotClientOptions and cover the behavior with a routing test. - Add named connection-string lookup via AddSquadAgent("name") using ConnectionStrings:squad-{name}. - Document the new public overloads and verify the package builds without warnings. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: Round 2 — keyed DI, BYOK delegate, routing gate, security hardening - Add ConfigureCopilotClient delegate on SquadAgentOptions for BYOK - Add routing gate: snapshot/restore Cwd/CliPath/CliArgs after delegate (Picard C1) - Add 4 AddKeyedSquadAgent overloads with .NET 8+ keyed DI - Fix Environment credential leak: [JsonIgnore] on Environment, GitHubTokenProvider, ConfigureCopilotClient - ToString() redacts token-pattern keys (TOKEN/KEY/SECRET/HMAC/PASSWORD/CREDENTIAL) - Add 21 new tests (43 total): security redaction, keyed DI, BYOK routing gate - Update README: streaming, keyed DI, BYOK, security sections Complies with: Picard C1-C4, Worf SC-1 through SC-8. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * feat: add Squad.Agents.AI sample app demonstrating DI, keyed DI, BYOK, and streaming - samples/squad-agents-ai-sample/Program.cs: four runnable flows Flow 1 -- AddSquadAgent + RunAsync (basic DI) Flow 2 -- AddKeyedSquadAgent x2 + GetRequiredKeyedService<SquadAgent> Flow 3 -- ConfigureCopilotClient delegate (BYOK token + env var injection) Flow 4 -- RunStreamingAsync with await foreach token-by-token output - samples/squad-agents-ai-sample/Squad.Agents.AI.Sample.csproj: net10.0, project reference to src/Squad.Agents.AI, Microsoft.Extensions.Hosting 10.0.0 - samples/squad-agents-ai-sample/README.md: prerequisites, run commands, per-flow walkthrough, troubleshooting table - .github/workflows/squad-agents-ai-ci.yml: adds paths trigger and restore + build steps for the sample (no run step -- requires live CLI) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(Squad.Agents.AI): co-locate sample under src/ and consolidate README - Moves the sample app from samples/squad-agents-ai-sample/ to src/Squad.Agents.AI/samples/Squad.Agents.AI.Sample/ so it lives alongside the package it demonstrates. - Folds the sample's standalone README into the package README, giving consumers one canonical doc for both the API and the runnable demo. - Adds <Compile Remove="samples/**/*.cs" /> to Squad.Agents.AI.csproj so the library's wildcard glob does not pick up Program.cs in the co-located samples subdirectory. - Updates the .csproj project reference, and CI workflow paths to match the new layout. - Verified end-to-end: dotnet build, dotnet test (43/43 passing), and a sample sanity-check run (clear CLI-not-found error, no stack trace). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore(Squad.Agents.AI): remove outdated draft PR body file The standalone pr-body.md was an early draft authored before the live PR description took its final shape. The PR body on GitHub is the canonical source; this file is dead weight and would confuse maintainers reviewing the diff. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(Squad.Agents.AI): address PR #1207 reviewer feedback (12 items) - Snapshot CliArgs by value, not reference, so in-place mutation by SDK consumers is also caught by the routing guard. - Validate name/connectionName/serviceKey is non-empty in all DI registration overloads; previously null/whitespace produced invalid connection-string keys. - Replace ghp_-prefixed placeholder in the sample with a clearly-fake token to avoid tripping secret-scanning and to remove a real-token lookalike. - Remove brittle 'PR #3' references from README and CHANGELOG; describe the feature without tying to a specific PR thread. - Update NuGet metadata and README links to point to bradygaster/squad (canonical repo) instead of the tamirdresher fork. - Multi-target the test project to match the package's target framework set so CI exercises every framework the package ships against. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * refactor(Squad.Agents.AI): adopt DelegatingAIAgent base + MAF ctor pattern (PR #1207 r2) Addresses westey-m's review feedback: - Extend Microsoft.Agents.AI.DelegatingAIAgent — drops ~70 lines of manual Core* overrides; pass-through is provided by the base class. - Adopt MAF constructor pattern: \(string squadFolderPath, SquadAgentOptions? options = null, ILoggerFactory? loggerFactory = null)\. Required settings on the constructor, options optional, ILoggerFactory stays on ctor for DI injection. - Routing-guard, IAsyncDisposable, and security posture preserved. - Add Squad.Agents.AI.slnx solution for easy IDE open. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Reno (Copilot) <reno@clawpilotsquad.dev> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: tamirdresher <tamirdresher@users.noreply.github.com>
#1240) Replace the long-lived NUGET_API_KEY repo secret with NuGet/login@v1 OIDC token exchange (1-hour API key) per the modern Trusted Publishing flow: https://learn.microsoft.com/nuget/nuget-org/trusted-publishing Why --- - No long-lived credentials stored in the repo. - Token is scoped to this workflow + repo + branch via the OIDC subject claim and the Trusted Publishing policy registered on nuget.org. - Eliminates the chicken-and-egg between needing admin to set NUGET_API_KEY and needing the package live to validate the workflow. What changed ------------ - Add `id-token: write` to the publish job (required for OIDC). - Drop the `Verify NuGet API key` step. - Drop the `--api-key ` reference to secrets.NUGET_API_KEY. - Add `NuGet/login@v1` step that exchanges the OIDC token for a short-lived API key, exposed via `steps.nuget-login.outputs.NUGET_API_KEY`. - Add a fail-fast check for the new `vars.NUGET_USER` repository variable (non-sensitive; the nuget.org profile name that performs the exchange). - Update the file header documentation to reflect the new flow and link to the Trusted Publishing setup page. Required configuration before first publish ------------------------------------------- 1. Create the `Squad` organization on nuget.org and add owners. 2. Configure a Trusted Publishing policy at https://www.nuget.org/account/trusted-publishing owned by the Squad org: Repository Owner: bradygaster Repository: squad Workflow File: squad-agents-ai-release.yml Environment: (empty) 3. Set repository variable NUGET_USER (Settings → Secrets and variables → Actions → Variables) to a Squad-org-member's nuget.org profile name (NOT email). Variable, not secret — the username is non-sensitive. Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…est (#1252) Squad.Agents.AI 0.1.0-preview.2 calls `CopilotClient.AsAIAgent(instructions, name)` which leaves `SessionConfig.OnPermissionRequest` unset. The first call to `SquadAgent.CreateSessionAsync()` therefore throws: System.ArgumentException: An OnPermissionRequest handler is required when creating a session. For example, to allow all permissions, use CreateSessionAsync(new() { OnPermissionRequest = PermissionHandler.ApproveAll }); There was no public way for consumers to fix it from the outside — `ConfigureCopilotClient` only exposes `CopilotClientOptions`, not the per-session `SessionConfig` that owns the permission handler. What changed ------------ - `SquadAgent` now switches to the `AsAIAgent(client, sessionConfig, ...)` overload and constructs a `SessionConfig` with: - `OnPermissionRequest = PermissionHandler.ApproveAll` (sensible default for a host-process Squad adapter; the host already chose to instantiate Squad and is responsible for sandboxing). - `WorkingDirectory` defaulting to the resolved `Cwd` / `SquadFolderPath`. - `SystemMessage = new SystemMessageConfig { Content = Instructions }` when `SquadAgentOptions.Instructions` is set. - `SquadAgentOptions.ConfigureSession: Action<SessionConfig>?` is new — runs after Squad applies its defaults so a consumer can swap in a stricter permission handler, pin the model, restrict tools, etc. Tests ----- - New `SquadAgentSessionConfigTests` (4 cases) exercising the new surface: `ConfigureSession` is settable, runs against the live SessionConfig, can replace the permission handler, and can set `AvailableTools`. - All existing 43 tests still pass per TFM (141 total across net8/9/10). Verified -------- - The end-to-end consumer smoke test in `C:\Users\tamirdresher\source\repos\squad-agents-ai-consume-test` previously had to fall back to the raw SDK because of the missing handler. With this change, `SquadAgent.CreateSessionAsync()` returns successfully and `RunAsync` drives real 3-turn conversations against `.squad/`-init'd teams. Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…O works (#1259) * Squad.Agents.AI: bump to MAF 1.10.0-rc1 / SDK 1.0.0 GA — file-IO now works Microsoft.Agents.AI.GitHub.Copilot bumped from 1.7.0-preview to 1.10.0-rc1, which transitively brings GitHub.Copilot.SDK 1.0.0 GA. SDK 1.0.0 reshaped CopilotClientOptions and SessionConfig (the breaking namespace + property renames are mirrored below), but in return Copilot CLI 1.0.61 talks to the SDK over the new ACP-style protocol — meaning the agent's view/grep/powershell tools finally work end-to-end without 'permission errors' or 'content exclusion policy' hallucinations. SDK 1.0.0 API migrations applied: * Namespace GitHub.Copilot.SDK -> GitHub.Copilot. * CopilotClientOptions.Cwd -> WorkingDirectory. * CopilotClientOptions.CliPath + .CliArgs collapsed into a single CopilotClientOptions.Connection (RuntimeConnection). We now build the Connection via RuntimeConnection.ForStdio(CliPath, CliArgs) only when the consumer supplied either a custom CLI path or extra CLI args; otherwise the SDK's default child-process connection is used and the bundled copilot.exe (downloaded by the SDK's build/ targets) is invoked. * SessionConfig.ConfigDir -> SessionConfig.ConfigDirectory. * PermissionRequestHandler is no longer a named delegate type; we use type inference where the test code referenced it. Public Squad.Agents.AI surface is intentionally unchanged: SquadAgentOptions still exposes Cwd, CliPath, CliArgs, ConfigureSession, ConfigureCopilotClient. We translate to the SDK 1.0.0 shape internally. Routing gate (Picard Condition 1 / Worf SC-3) updated to snapshot and restore WorkingDirectory + Connection instead of the old Cwd / CliPath / CliArgs trio. A delegate that REPLACES Connection (e.g. via RuntimeConnection.ForStdio(...)) is reverted, mirroring the previous CliPath / CliArgs hijack tests. Verified end-to-end against a real .squad-initialised team root: the coordinator successfully reads .squad/team.md and enumerates every cast member with their role. The dotnet test suite passes 46/46 across net8.0, net9.0, and net10.0 (-1 vs baseline because the old CliPath and CliArgs hijack tests collapsed into a single Connection hijack test, which is the right granularity for SDK 1.0.0). Version bumped 0.1.0-preview -> 0.2.0 to surface the MAF/SDK transitive bump. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address Copilot review feedback (#1259) - Remove duplicate 'using GitHub.Copilot' in SquadAgentSessionConfigTests (regex replace inadvertently doubled the directive when migrating from the old GitHub.Copilot.SDK namespace). - Drop hardcoded teamRoot override I left behind in the sample Program.cs during the CLI-not-found debug session. The sample now correctly reads SQUAD_TEAM_ROOT (or falls back to CWD) as documented. - Fix mismatched comment in SquadAgent: the SDK-protocol section now correctly references --allow-all (matching the flag actually injected in CreateCopilotClient), not the narrower --allow-all-tools. - Detect more existing permission-opening flags before injecting our default --allow-all so a host that opts in via --allow-all-paths, --allow-all-urls, or the omnibus --yolo no longer gets --allow-all prepended on top. Comparison is now case-insensitive. Updated the connection-string test that asserted the old over-eager behavior. Also add .vs/, *.user, *.userprefs to .gitignore so VS solution junk doesn't surface in git status. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Workflow permissions: add issues: write to squad-pr-nudge, squad-impact, and squad-repo-health workflows that call issues.createComment - Logic bug: fix ahead_by → behind_by in pr-nudge stale branch check - Logic bug: fix PR_LABELS fallback producing string instead of null - Script fix: check legacy statuses for failure/error in checkCIStatus() - Script fix: truncation row column count mismatch in pr-readiness.mjs - Script fix: validate JSON.parse result is array before using as labels - Script fix: isNodeBuiltin now validates node: prefix against known builtins - YAML escaping: use JSON.stringify for skill descriptions in apm.yml Closes #1213 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…line (#1251) - Expose memory.classify, memory.write, memory.search, memory.promote, memory.delete, memory.audit through the squad_state MCP server (#1244) - Pin squad_state to user-level ~/.copilot/mcp-config.json during init/upgrade for external `copilot -p` mode compatibility (#1247) - Update squad.agent.md directive-capture and decision-recording instructions to route through memory.write instead of raw squad_state_write to the drop-box (#1246) Closes #1244 Closes #1247 Closes #1246 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…skills/ (#1260) The CLI and SDK write skills to .copilot/skills/ by default, but docs still referenced .squad/skills/. Update all documentation to use the canonical .copilot/skills/ path and add a note about legacy fallback. Closes #1241 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#1262) Add an interactive prompt during squad init that asks users if they want to add @copilot (the GitHub Copilot coding agent) as an autonomous team member. If accepted, adds the Coding Agent section to team.md and copies copilot-instructions.md into the project. Non-interactive mode skips silently with a hint to run `squad copilot enable` later. Closes #1147 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…1249) - Update all docs references from .squad/skills/ to .copilot/skills/ - Note that both paths are scanned at read time but .copilot/skills/ is write default - List all 6 git hooks (add pre-commit and post-commit to docs) - Correct 'read-only reference' claim about migrated files - Add recovery section for pre-commit hook refusal scenarios Closes #1241 Closes #1226 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds a typed OnSubagentTrace callback + OpenTelemetry ActivitySource so consumers
can see subagent dispatch (the coordinator's 'task' tool spawning specialist
sub-agents and their replies) without writing their own polymorphic dispatch over
the raw GitHub.Copilot SessionEvent hierarchy.
The previous 0.2.x surface required consumers to write the same boilerplate the
aspire-squad-resource demo had to (CopilotSessionTraceMapper.cs): switch on every
event subtype, unwrap subagent context, manage Activity lifetime. 0.3.0 makes that
the SDK's job.
New public surface:
* SquadAgentOptions.OnSubagentTrace (Action<SquadAgentTraceEvent>)
Set this to subscribe to subagent lifecycle (Selected / Started / Completed /
Failed), assistant messages from coordinator AND subagents, tool start/complete,
and SessionIdle. Setting OnSubagentTrace implicitly turns on
SessionConfig.IncludeSubAgentStreamingEvents so subagent replies actually flow
up to the parent session (otherwise they stay inside the subagent session and
never reach the callback).
* SquadAgentTraceEvent record — typed envelope (Kind, RawEventType, Timestamp,
SdkAgentId, SubagentName, SubagentDisplayName, ToolCallId, Content, Success,
RawEvent). Carries the original SessionEvent on RawEvent for advanced consumers
but exposes everything else through neutral primitive types so the callback
signature has no transitive dependency on GitHub.Copilot.SDK.
* SquadAgentTraceEventKind enum — categorises the SessionEvent into the well-known
cases that downstream observability surfaces want.
* SquadAgentDiagnostics.ActivitySourceName ('Microsoft.Agents.AI.Squad') +
SquadAgentDiagnostics.ActivitySource — one Activity per subagent dispatch is
opened on SubagentStartedEvent and disposed on the matching
SubagentCompletedEvent / SubagentFailedEvent, tagged with squad.subagent.name,
squad.subagent.display_name, squad.subagent.sdk_agent_id, and
squad.subagent.reply_preview (a short truncated copy of the subagent's
assistant message). Hosts that .AddSource(SquadAgentDiagnostics.ActivitySourceName)
on their OpenTelemetry tracer get these spans in their backend — the Aspire
dashboard renders them in the trace view automatically.
Internal:
* SquadSubagentTraceMapper — wires SessionEvent -> SquadAgentTraceEvent and the
Activity lifecycle. Held by SquadAgent and disposed during DisposeAsync to
drain any subagent activities that never received a matching Completed event
(e.g. session ended mid-dispatch).
* InternalsVisibleTo=Squad.Agents.AI.Tests so the mapper can be unit tested
directly without spinning a real CLI session.
Tests: 54/54 passing across net8, net9, net10 (+8 new tests for the
observability surface including Activity lifetime, tag propagation, mid-session
disposal, and consumer-callback exception isolation).
Verified end-to-end against the tamresearch1 Star Trek squad: the OnSubagentTrace
callback observed two parallel subagent dispatches (Picard, Data), captured each
of their replies attributed to the right SdkAgentId, and the matching
'squad.subagent Picard' / 'squad.subagent Data' OTel spans opened and closed
cleanly with the reply tagged on each span.
Version bumped 0.2.0 -> 0.3.0 to signal the new public surface.
Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…mp (#1266) After the v0.10.0 stable release on 2026-06-07, the root package-lock.json still recorded packages/squad-cli@0.9.6-preview.15 and packages/squad-sdk@0.9.6-preview.13 for the workspace entries. The package.json files were updated correctly during the release, but the lockfile workspace metadata was not regenerated. This causes `npm ci --ignore-scripts` to fail in the `sdk-exports-validation` CI job whenever package.json versions diverge from these stale lockfile entries (which happens on every build that runs `scripts/bump-build.mjs`). Confirmed on PR #1257. This commit regenerates only the workspace version metadata (`packages/squad-cli` and `packages/squad-sdk`) — no dependency trees are touched. Verified locally on Windows + Node v23.5.0: - `npm ci --ignore-scripts` at repo root: ✅ exit 0 (was already passing on dev because root package.json/lockfile match; failure mode is the workspace-entry mismatch surfacing under specific build conditions) - `npm install --ignore-scripts`: no further drift produced - Full `npm test` suite: 6535 passed / 134 failed / 60 skipped — the 134 failures are all pre-existing Windows file-locking flakiness (EBUSY/ENOTEMPTY/hook-timeout); identical failure mode and similar count on the immediate pre-merge commit cc37a2f (125 failures pre-merge, 134 post-merge — diff is within flake noise). - Targeted re-run of the 5 "newly failing" files in isolation: 93/93 passing — confirms the bulk-run failures are concurrency-induced flakes, not regressions from the recent merges (#1251, #1258, #1260, #1262, #1249). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix: release pipeline version pinning (#1203, #1204) - Lower SDK dependency floor from >=0.10.0 to >=0.9.0 so the CLI tarball resolves against the last published SDK when current version isn't yet on the registry (Closes #1203) - Add isLocalOrUnpublishedVersion guard so local dev builds and versions with build metadata (+) fall back to @insider instead of writing unresolvable version strings into MCP config (Closes #1204) - Extend resolveSquadStateMcpSpec to short-circuit for build-metadata versions - Add CI step to verify SDK dependency is resolvable before CLI publish Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: reset accidentally-bumped version 0.10.0-build.2 -> 0.10.0 Pre-publish version guard rejects -build.N suffixes (release pipeline policy). The bump was made by an unintended local 'npm run build' run before commit. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> Co-authored-by: Copilot <tamirdresher@users.noreply.github.com>
* chore: include CHANGELOG.md in published npm tarball Add CHANGELOG.md to the files array in both squad-cli and squad-sdk package.json files so changelogs are included in published npm tarballs. This enables offline what's-new prompts and removes the need for GitHub API calls to show release notes. Closes #1171 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: reset accidentally-bumped versions to 0.10.0 Pre-publish version guard rejects -build.N suffixes (release pipeline policy). Both SDK and CLI package.json had -build.4 from a local 'npm run build' run before commit. --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamir.dresher@gmail.com> Co-authored-by: Copilot <tamirdresher@users.noreply.github.com>
…le connection-string lookup (#1271) Two small but high-impact changes that remove ~30 lines of boilerplate from every consumer (Aspire and otherwise) and make the OpenTelemetry story self-explanatory. ## 1. EmitSubagentActivities (default true) — telemetry independent of callback Today, the per-subagent OpenTelemetry Activity emission is a side-effect of setting `OnSubagentTrace`. A host that just wants `squad.subagent {Name}` spans in their backend has to wire a callback they don't need. `Microsoft.Agents.AI.Squad` is silent until then. 0.4.0 makes activity emission the default: * New `SquadAgentOptions.EmitSubagentActivities` (defaults to `true`). * `SquadAgent` installs `SquadSubagentTraceMapper` whenever `EmitSubagentActivities || OnSubagentTrace != null`, so spans flow with zero extra wiring. * `OnSubagentTrace` becomes a pure customisation hook (logging, dashboards, metrics) — independent of telemetry. Set `EmitSubagentActivities = false` to opt out of built-in spans when you want to handle telemetry yourself. Plus richer span shape: every lifecycle phase is now an `ActivityEvent` on the live subagent span (visible as annotated markers on the timeline in Aspire / Jaeger / etc.): * `squad.subagent.start` — on SubagentStarted * `squad.subagent.message` — on AssistantMessage (with message_preview tag) * `squad.subagent.completed` — on SubagentCompleted * `squad.subagent.failed` — on SubagentFailed Net effect for a consumer: builder.Services.AddOpenTelemetry() .WithTracing(t => t.AddSource(SquadAgentDiagnostics.ActivitySourceName)); builder.Services.AddSquadAgent(o => o.SquadFolderPath = "/team"); …and the dashboard lights up. No callback wiring, no Activity.Current?.AddEvent plumbing in the host. ## 2. Aspire-style connection-string lookup (with legacy fallback) Aspire injects connection strings under the literal resource name — e.g. an AppHost that calls `builder.AddSquad("research-squad", ...)` exposes `ConnectionStrings:research-squad` to the consumer. The 0.3.0 SDK only looked at `ConnectionStrings:squad-research-squad` (prefixed), so Aspire consumers had to manually call `Configuration.GetConnectionString(name)`, parse the URI, and feed `SquadFolderPath` into the configure callback themselves. 0.4.0 tries the literal name first and falls back to the legacy prefixed form: | Style | Example | Lookup | |--------------------------------------|---------------------------------------------|--------------------------------------------| | Aspire-style direct (tried first) | `AddSquadAgent("research-squad")` | `ConnectionStrings:research-squad` | | Legacy prefixed fallback | `AddSquadAgent("research")` | `ConnectionStrings:squad-research` | Both work. Existing consumers using `ConnectionStrings:squad-{name}` continue unchanged; new Aspire consumers get the natural one-line registration. ## Tests 54 → 64 tests, all passing on net8.0/9.0/10.0. New `SquadAgentDefaultObservabilityTests` covers: * Default-on activity emission (without consumer callback) * Opt-out path (`EmitSubagentActivities = false`) — span suppression + callback still fires * Each ActivityEvent name (`start` / `message` / `completed` / `failed`) * Connection-string precedence: Aspire-direct preferred, prefixed fallback used, same rule applies for keyed registrations Existing `SquadSubagentTraceTests` and the new class share an `[Collection("SquadActivityListeners")]` so they run serially — process-global `ActivityListener` state caused cross-test pollution otherwise. ## Files * `src/Squad.Agents.AI/SquadAgentOptions.cs` — new `EmitSubagentActivities` property + reworked `OnSubagentTrace` XML doc to clarify independence. * `src/Squad.Agents.AI/SquadAgent.cs` — install trace mapper when telemetry OR callback is requested. * `src/Squad.Agents.AI/SquadSubagentTraceMapper.cs` — accept `emitActivities` flag; gate `StartActivity`/`Dispose` on it; add `ActivityEvent` annotations at every lifecycle boundary. * `src/Squad.Agents.AI/SquadAgentOptionsConfigurator.cs` — accept a list of candidate connection-string names; first non-empty wins. * `src/Squad.Agents.AI/SquadServiceCollectionExtensions.cs` — new `GetConnectionStringNames` returns `[name, "squad-"+name]` so both Aspire and legacy conventions resolve. * `src/Squad.Agents.AI/Squad.Agents.AI.csproj` — bump 0.3.0 → 0.4.0. * `src/Squad.Agents.AI/README.md` — new "Subagent observability" section, updated "Aspire / configuration path" section, two new option rows in the Key Options table. ## Backward compatibility Fully backward compatible. The two-arg `SquadSubagentTraceMapper` constructor defaults `emitActivities` to `true`, `EmitSubagentActivities` defaults to `true`, and the legacy `ConnectionStrings:squad-{name}` lookup still resolves. Net change for an existing consumer that had OnSubagentTrace set: nothing (mapper runs in both 0.3.0 and 0.4.0 because OnSubagentTrace is non-null). Net change for a consumer that did NOT set OnSubagentTrace but did AddSource: they now get spans they always asked for. Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…lt) (#1275) * Squad.Agents.AI 0.5.0: auto-inject --agent squad (CLI parity by default) The whole point of SquadAgent is to wrap a Squad coordinator team — but the 0.4.x SDK launched the underlying copilot.exe with the CLI's built-in generic agent. The coordinator therefore had no instructions to eager-execute, fan out, or dispatch via the task tool, so it role-played responses inline. Concretely: this SDK call builder.Services.AddSquadAgent(o => o.SquadFolderPath = teamRoot); did NOT behave the same as running copilot --agent squad interactively against the same team root. Consumers had to remember to add `opts.CliArgs.Add(""--agent""); opts.CliArgs.Add(""squad"");` themselves, which is an SDK leak — the class is literally called SquadAgent. 0.5.0 makes --agent squad the SDK default: * New `SquadAgentOptions.AgentFileName` (defaults to `""squad""`). * On client construction, SquadAgent looks for `{teamRoot}/.github/agents/{AgentFileName}.agent.md`. If it exists, `--agent {AgentFileName}` is auto-prepended to the CLI args. * If the file is missing (folder not Squad-initialized), the inject is silently skipped and a Debug log line explains why. The CLI then starts with its default agent, which is what 0.4.x did anyway. * If the consumer already supplied `--agent X` in `CliArgs`, the explicit value wins and we do NOT add a second one. * Set `AgentFileName = null` (or whitespace) to opt out entirely. Net effect: SquadAgent.RunAsync now matches `copilot --agent squad` for any Squad-initialized team root, without the consumer doing anything. ## Tests 64 -> 71 tests, all passing on net8.0/9.0/10.0. New `SquadAgentDefaultAgentFlagTests` (uses a per-test temp dir to scaffold or omit the agent file deterministically): * Default AgentFileName is ""squad"" * Auto-inject when squad.agent.md exists * No inject when the file is missing (graceful degradation) * Explicit --agent in CliArgs wins (no second --agent added) * Custom AgentFileName=""data"" injects --agent data when data.agent.md exists * AgentFileName=null opts out entirely * AgentFileName=whitespace opts out entirely Backward compatibility: existing routing tests use a non-existent `C:\squad-team-root` path, so the file-existence check silently skips the inject — those tests continue to pass with no changes. ## Files * `src/Squad.Agents.AI/SquadAgentOptions.cs` — new `AgentFileName` property with XML doc covering the default, the opt-out, and the not-yet-initialized fallback. * `src/Squad.Agents.AI/SquadAgent.cs` — auto-inject logic in `CreateCopilotClient` (after the `--allow-all` block, before `options.CliArgs` are appended) with file-existence + already-supplied guards and a Debug log when the file is missing. * `src/Squad.Agents.AI/Squad.Agents.AI.csproj` — bump 0.4.0 -> 0.5.0. * `src/Squad.Agents.AI/README.md` — new ""Coordinator agent selection"" section with the precedence table; `AgentFileName` row added to Key Options table. * `+test/Squad.Agents.AI.Tests/SquadAgentDefaultAgentFlagTests.cs` Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * amend: use SessionConfig.Agent instead of --agent CLI args GitHub.Copilot SDK's SessionConfigBase exposes an Agent (string) property that is the first-class equivalent of the Copilot CLI's --agent flag. It discovers and loads .github/agents/{name}.agent.md exactly the same way the CLI does, but without us having to munge CliArgs. Switch the 0.5.0 default-coordinator-agent implementation: - SquadAgent now sets sessionConfig.Agent = options.AgentFileName (default ""squad"") right after constructing the SessionConfig, before ConfigureSession runs. - Drop the --agent CliArgs hack (we no longer need to detect ""did the consumer already pass --agent?"" because ConfigureSession naturally wins over our default). - Tests now assert against sessionConfig.Agent via reflection over the inner DelegatingAIAgent — exactly what consumers using ConfigureSession would see. - README ""Coordinator agent selection"" section reworded to say ""sets SessionConfig.Agent"" instead of ""auto-adds --agent"". 71/71 tests still pass on net8.0/9.0/10.0. The fifth new test (ConfigureSession_CanOverrideAutoSetAgent) explicitly proves the ConfigureSession callback can replace the auto-set value, which is the clean override path now that --agent CliArgs is gone. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ot SessionConfig.Agent) (#1277) 0.5.0 (#1275) replaced the previous --agent CliArgs approach with sessionConfig.Agent = options.AgentFileName, on the theory that the SDK property was the first-class equivalent of the CLI's --agent flag. It is not. SessionConfig.Agent looks up the name in the SDK's CustomAgents registry (programmatic agent definitions, never populated by SquadAgent), NOT in .github/agents/*.agent.md files on disk. The result was a runtime error on every RunAsync call against a Squad-initialised team: Communication error with Copilot CLI: Request session.create failed with message: Custom agent 'squad' not found Verified at GitHub.Copilot.SDK 1.0.0: * SessionConfigBase.Agent (string) — selects from CustomAgents * SessionConfigBase.CustomAgents (IList<CustomAgentConfig>) — programmatically defined inline agents (Name, Prompt, Tools, Skills, Model, etc.). Empty by default. * The CLI's --agent flag is currently the only path that reads .github/agents/{name}.agent.md on disk. 0.5.1 reverts to the original CliArgs implementation: * SquadAgent now auto-prepends '--agent {AgentFileName}' to combinedCliArgs (back to what 0.5.0 originally proposed before the SessionConfig.Agent detour). * The file-existence check at {teamRoot}/.github/agents/{name}.agent.md still gates the inject so non-Squad-initialized folders degrade gracefully (no --agent passed -> CLI uses default agent). * The 'consumer already supplied --agent in CliArgs' guard is back so the SDK does not add a duplicate. Tests: * New SquadAgentDefaultAgentFlagTests covers all seven cases via reflection over Connection.Args (the CLI-args path the SDK actually uses): default 'squad' value, auto-inject when file exists, no inject when missing, explicit --agent wins, custom AgentFileName works, AgentFileName=null/whitespace opts out. * The older SquadAgentDefaultAgentTests (which targeted SessionConfig.Agent) is removed since that property does NOT do what we wanted. 71/71 tests passing on net8.0/9.0/10.0. Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
) Closes #1290. Adds CLI surface for managing .squad/squad-registry.json, symmetric to squad upstream. Registry entries are discovery-only (visible to squad discover and squad delegate) but do NOT trigger inheritance of the peer squad's skills/decisions/wisdom/routing. Previously users had to hand-edit .squad/squad-registry.json — even the squad discover empty-state hint told them to "create a squad-registry.json" manually. This adds proper commands: squad registry add <name> <path> # validates manifest, refuses duplicate squad registry list # show all registered peers squad registry remove <name> # remove by name Also fixes a subtle path-semantics confusion: readManifest() now accepts BOTH the repo root AND a path with a trailing .squad segment. The docs and SKILL.md showed the .squad-suffixed form but the code previously joined .squad/manifest.json onto whatever you gave it, so the suffixed form silently failed empirical reproduction (discover returned nothing). Test coverage: 18 new tests in cross-squad-registry.test.ts covering the dual-path readManifest fix, registry round-trip, add/list/remove behavior including duplicate-name and invalid-manifest rejection, and end-to-end integration with discoverSquads. Also updates: - cross-squad SKILL.md (canonical + 2 template mirrors) to document the registry vs upstream distinction explicitly - squad discover empty-state hint to mention squad registry add - squad help text with the new commands - SDK exports for the new registry helpers + RegistryEntry/ AddRegistryEntryResult types End-to-end verified locally: - squad registry add (both repo-root and .squad-suffixed paths) - squad registry list (rich output) - squad registry remove (success + missing-name warning) - squad discover picks up registry entries with source=registry - 50/50 tests pass (32 existing + 18 new) - npm run build clean Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…very init/upgrade (#1296) (#1298) * fix(cli): stop writing squad_state to ~/.copilot/mcp-config.json on every init/upgrade (#1296) squad init (init.ts:408) and squad upgrade (upgrade.ts:738) unconditionally called ensureSquadStateMcpInUserConfig, writing squad_state_<hash> to ~/.copilot/mcp-config.json keyed by a stable project-path hash. Each new squad init accumulated another entry in HOME with no garbage collection. This contradicted the explicit iter-8 design intent documented at packages/squad-cli/src/cli/core/mcp-root.ts:1-27, which says iter-8 stops writing to HOME and writes squad_state ONLY to repo-root .mcp.json. The repo-root .mcp.json writes (init.ts:403 / upgrade.ts:728) already cover all documented Copilot CLI launch modes - copilot and copilot -p both walk up from cwd to find .mcp.json. Out-of-tree copilot -p invocations should use --additional-mcp-config @.mcp.json (already documented at init.ts:494). Changes: * Removed the unconditional ensureSquadStateMcpInUserConfig call from init.ts:408 and upgrade.ts:738. Replaced both with comments explaining iter-8 + #1296. * Removed the now-unused import from both files. * Kept the function definition at mcp-root.ts:178-228 - a future squad doctor --mcp-prune cleanup helper may want to inspect HOME. Tests: * New regression test in test/cli/init.test.ts: "should NOT write any squad_state entries to ~/.copilot/mcp-config.json (#1296)". Isolates the developer's real HOME by setting USERPROFILE/HOME to a temp dir before init, asserts no squad_state* keys appear under temp HOME. * All 40 existing init tests still pass. npm run lint clean. Closes #1296 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: comments reference actual Copilot CLI version (≥1.0.59), drop hardcoded test line numbers Reviewer follow-ups on #1298 (closes #1296): 1. The comments in init.ts/upgrade.ts/mcp-root.ts referenced 'Copilot CLI 5.3+' as the version that auto-loads .mcp.json. The real shipping CLI is at 1.0.62 (5.3 was a typo'd projection from review). Updated all 5 occurrences to '≥1.0.59' — the lowest version where the .mcp.json walk-up behavior is documented. 2. The init.test.ts regression comment hard-coded line numbers (init.ts:408, upgrade.ts:738) that will go stale on any unrelated edit to those files. Rewrote the comment to identify the call by function name (ensureSquadStateMcpInUserConfig) instead — durable against re-orderings. Verified: regression: #1296 test still passes (1/16 in init.test). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(init): post-init package.json script tip includes --agent squad The post-init tip showing how to add a non-interactive `squad:copilot` script to package.json was: "squad:copilot": "copilot --additional-mcp-config @.mcp.json" This omits `--agent squad`, so users who copy/paste it get a generic Copilot CLI session that doesn't load the Squad coordinator, team.md, casting, or MCP-wired memory/state tools — only the additional MCP config gets loaded. Same underlying issue surfaced in the cross-squad- communication SKILL.md sweep (squad/wire-cross-squad-skill commit 6b0eac2): anywhere we spawn `copilot` into a Squad-initialised repo, we must pass `--agent squad`. Single-line fix: "squad:copilot": "copilot --agent squad --additional-mcp-config @.mcp.json" Verified: a fresh `squad init` smoke test now prints the corrected tip line verbatim. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
…y\ (#1288) (#1293) * fix(sdk): wire team.md/routing.md/casting state on `squad preset apply` (#1288) `squad preset apply <name>` only copied agent charters into .squad/agents/. It left .squad/team.md `## Members` empty, .squad/routing.md missing `## Work Type -> Agent` rows, and never created .squad/casting/registry.json, history.json, or policy.json. Net result: the coordinator's mode-switch check saw an empty Members table and treated every session as Init Mode, proposing to re-scaffold the team the user already applied. This change adds a merge-friendly scaffold module (packages/squad-sdk/src/presets/scaffold.ts) that runs after charters are copied and: * writes/updates team.md `## Members` (creates from scratch if missing; appends new rows to an existing table while preserving the surrounding Coordinator / Project Context sections; idempotent on repeat apply) * writes/updates routing.md `## Work Type -> Agent` (creates or appends) * writes/merges casting/registry.json (universe = `preset:<name>`) * appends a snapshot to casting/history.json + a universe_usage_history entry * creates casting/policy.json with defaults only if missing (never clobbers) Agents with `status: 'error'` are excluded from wiring; agents with `status: 'skipped'` (already exist in target) ARE wired so the team reflects user intent. Scaffolder failure is reported as a synthetic error result without masking the per-agent install results. Verified: * npm run lint passes * test/presets.test.ts: 28/28 pass including 4 new regression tests - wires preset agents into team.md ## Members (#1288) - merges preset agents into an existing team.md without duplicating rows - writes casting registry.json, history.json, and policy.json (#1288) - appends routing rows for preset agents to routing.md (#1288) Out of scope (tracked separately): deduplicating these writers with the equivalent fresh-write versions in packages/squad-cli/src/cli/core/cast.ts. Closes #1288 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(presets): role-aware Status cell + non-colliding sentinel for synthetic scaffold error Two reviewer follow-ups on #1293 (closes #1288): 1. Members-table Status was hardcoded to '✅ Active' for every preset agent. Presets that ship one of the always-on built-ins (Scribe, Ralph, Rai, Fact Checker) would render with the wrong status label compared to a fresh cast: '✅ Active' instead of '📋 Silent' / '🔄 Monitor' / '🛡️ RAI' / '🔍 Verifier'. Added a small statusForRole() helper that mirrors the role→status mapping in cast.ts:652-655 (case-insensitive role matching to tolerate preset authors who lowercase the role string). Built-in role names get their canonical labels; everything else falls back to '✅ Active'. Added a regression test asserting the labels for a preset that ships scribe/ralph/rai/fact-checker + one regular agent. 2. Synthetic scaffold-failure result row used 'agent: presetName' for its 'agent' field. If the preset itself happens to include an agent literally named after the preset ('squad preset apply geektime' on a preset whose roster has a 'geektime' agent), the consumer of PresetApplyResult[] could not distinguish the synthetic scaffold- level error from a real per-agent install error. Replaced with the angle-bracketed sentinel '<scaffold>' (which validateName() rejects, so it can never collide with a real agent name) and moved the preset name into the human-readable reason string so consumers don't lose that context. Verified: 29/29 preset tests pass (28 existing + 1 new role-status test). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
…#1299) (#1300) * fix(docs): tell coordinator to roster Fact Checker on first-time cast (#1299) squad init correctly creates .squad/agents/fact-checker/ on disk (per merged PR #1223). But when the user opens copilot --agent squad and the coordinator runs first-time casting, it OMITS Fact Checker from the team.md ## Members table while including Scribe, Ralph, and Rai. Root cause: .squad-templates/squad.agent.md had two gaps: 1. Line 56 said "team size (typically 4-5 + Scribe)" — naming only Scribe 2. Rai had a dedicated ## Rai section with explicit "Rai always appears in team.md" instruction — Fact Checker had no equivalent section So the model added Rai (because instructed to) but had no instruction to add Fact Checker, even though the agent dir was scaffolded on disk. Fix: * Update team-size line to name all 4 always-on built-ins: Scribe + Ralph + Rai + Fact Checker * Add full ## Fact Checker — Verification & Devil's Advocate section mirroring the Rai pattern: roster-entry instruction, dual operating mode (per #789 + #1254), trigger phrase table, confidence ratings, DA brief structure, boundaries, state location Sync via sync-templates.mjs --sync propagates squad.agent.md changes to all 4 mirror targets: .squad-templates/, templates/, packages/squad-cli/ templates/, packages/squad-sdk/templates/, .github/agents/. Tests: new test/squad-agent-roster.test.ts runs against all 4 template targets and asserts: * The "Determine team size" line names all 4 built-ins * A ## Fact Checker section exists with "always appears in team.md" * The section declares dual operating mode (anchors #789 + #1254 design so a future PR can't accidentally split Fact Checker and Devil's Advocate again — cf. closed PR #1294) * Existing Ralph + Rai sections still present 16/16 pass. Closes #1299 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * doc(squad.agent.md): clarify Fact Checker is exempt from casting + correct on-demand reference path Reviewer follow-ups on #1300: 1. Team-size phrasing — the line read 'typically 4-5 + Scribe + Ralph + Rai + Fact Checker' which a model could parse as arithmetic (4-5 + 4 = 8-9, but it could also collapse). Rewrote it to make the composition explicit: '4-5 cast (user-domain) agents + 4 always-on built-ins = 8-9 total roster entries'. 2. Cast-exemption parity — Scribe, Ralph, and Rai each have an explicit 'exempt from casting' bullet but Fact Checker did not. Added the matching bullet right after Rai's. 3. Bad on-demand reference path — the FC section pointed at '.squad/templates/fact-checker-charter.md'. That file IS shipped (TEMPLATE_MANIFEST destination 'templates/fact-checker-charter.md') but only AFTER 'squad init' or 'squad upgrade' has populated .squad/templates/. A reader of squad.agent.md on an un-initialized repo (or in .github/agents/ on the cloud agent surface) would follow a dead link. Repointed to the '.squad/agents/fact-checker/charter.md' instance that ensureBuiltinAgents creates as part of the same init/upgrade path — that's where the rich charter actually lives at runtime per #1299 + #1301. All 4 mirrored copies re-synced via scripts/sync-templates.mjs. fact-checker-role.test.ts: 8/8 pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
…/fact-checker/ state dir (#1299 deep) (#1301) * fix(sdk): plumb Fact Checker like Rai — rich charter at init + .squad/fact-checker/ state dir (#1299 deep) PR #1300 fixed the documentation gap so the coordinator knows to roster Fact Checker. This PR fixes the structural gap behind it. Per user testing 2026-06-13: even after #1300 the actual agent on disk was still "a name on disk with a 21-line placeholder". Three structural problems: 1. squad init never used the rich {role}-charter.md templates. Both Rai and fact-checker got 478-byte generic stubs from generateCharter(). Rich templates only ran via squad upgrade's ensureBuiltinAgents path. 2. fact-checker had no state dir. Rai gets .squad/rai/{policy.md, audit-trail.md} via init.ts lines 879-941. fact-checker had nothing equivalent. 3. fact-checker-charter.md was only in packages/squad-cli/templates/ — missing from .squad-templates/ (canonical source) AND packages/ squad-sdk/templates/. SDK init's getSDKTemplatesDir() resolves to the SDK templates dir, so even if init tried to read the rich charter, the file wasn't there. Fix (4 parts): Part 1 - Rich charter at init (benefits BOTH Rai and fact-checker): * SDK init.ts agent loop now looks up {templatesDir}/{role}-charter.md for each agent and uses that as charter.md content if it exists. Falls back to generateCharter() for user-defined agents. * Result: fresh squad init produces .squad/agents/Rai/charter.md at 4525 bytes (full Rai charter) and fact-checker/charter.md at 3024 bytes (full FC charter). Previously both were 478-byte stubs. Part 2 - .squad/fact-checker/ state dir mirroring .squad/rai/: * New block in init.ts (right after the Rai seeding) creates .squad/fact-checker/policy.md (from templates/fact-checker-policy.md or inline fallback) and audit-trail.md. * New .squad-templates/fact-checker-policy.md (~6KB) is the canonical authority for dual-mode operating rules per #789 + #1254: - Mode 1 Verification: ✅/⚠️ /❌/🔍 confidence rating taxonomy - Mode 2 Devil's Advocate: required brief structure - Hard anti-fabrication rules - Advisory by default with narrow blocking exceptions - Audit trail rules (succinct, never raw source) Part 3 - Fix .squad-templates/ distribution gap: * Copied fact-checker-charter.md into .squad-templates/ so sync-templates.mjs propagates it to all 4 mirror targets including packages/squad-sdk/templates/. This unblocks Part 1. Part 4 - Plumbing: * .gitattributes: .squad/fact-checker/audit-trail.md merge=union * TEMPLATE_MANIFEST: fact-checker-policy.md * squad.agent.md Files Catalog: 2 new rows for FC state files Tests: 3 new regression tests in test/init.test.ts (28/28 pass total). npm run lint clean. Composability: This PR builds on #1300 (which adds the ## Fact Checker section to squad.agent.md and the team-size line fix). Both PRs modify squad.agent.md in disjoint regions and merge in either order. Full plumbing requires BOTH to land. Closes #1299 (deep fix; #1300 was the surface fix) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(sdk): lowercase fallback for rich-charter template lookup + sync .github/agents Two reviewer follow-ups on #1301 (#1299 deep): 1. Case-sensitive FS bug in rich-charter lookup The lookup tried '\-charter.md' and '\-charter.md' only. For Rai (role='Rai', name='Rai') this becomes 'Rai-charter.md', but the actual file shipped lowercase ('rai-charter.md'). On Windows the lookup succeeded because the filesystem is case-insensitive; on Linux CI it silently missed and fell back to the 478-byte generic stub — exactly the regression #1299 was trying to fix. Reproduced by 'should use the rich Rai-charter.md template at init' failing with 'expected 476 to be greater than 1000' on GitHub Actions. Add toLowerCase() candidates after the exact-case ones. De-dupe via a Set so we don't double-stat when role and name are already lowercase (fact-checker case). Guard each candidate against blank keys. 2. Template-sync parity The canonical .squad-templates/squad.agent.md gained two Fact Checker rows in the Files Catalog but the mirrored .github/agents/squad.agent.md copy was never re-synced, so the template-sync.test.ts byte-for-byte parity check would have fired. Run 'node scripts/sync-templates.mjs --sync' to regenerate. Verified: vitest 'rich Rai-charter' passes locally after the fix (previously failing on Linux CI run 27464079078). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
…des #1297) (#1302) * fix(skills): rename disambiguation skill 'squad' -> 'squad-help' (supersedes #1297) PR #1297 added a disambiguation skill named 'squad' so models calling skill(Squad) would get a redirect. After local end-to-end testing on 2026-06-13: skill ships to disk correctly but never shows up in Copilot CLI's /skills list. Root cause (verified against Copilot CLI source 1.0.62-2 app.js): 1. Copilot CLI's skill schema is {name, description, source, baseDir, allowedTools, pluginName, pluginVersion} (line 989). Frontmatter fields triggers:, domain:, confidence:, license: are silently ignored. 2. Skill loader returns {skills, warnings, errors} (line 4427). Skills that fail to load are reported as errors. 3. A skill named 'squad' collides with the Copilot agent named 'Squad' (registered at .github/agents/squad.agent.md). The agent wins; the skill is hidden from /skills. Fix: * Rename 'squad' -> 'squad-help' (avoids the agent-name collision; still descriptive enough for natural-language match when user says 'how do I use squad' or 'squad help') * SKILL.md content: name: 'squad-help', removed unused triggers:/domain:/ confidence:/source:/license: fields, added allowedTools: [], rewrote description: to be self-explanatory, added explicit note that /squad slash command does NOT exist (slash commands are CLI built-ins, not auto-mapped from skills) * MANIFEST_SKILL_NAMES in sdk-init.ts: 'squad' -> 'squad-help' * New TEMPLATE_MANIFEST entry in templates.ts for squad-help (so squad upgrade also propagates the skill - that code path uses TEMPLATE_MANIFEST instead of MANIFEST_SKILL_NAMES) Tests: new test asserts .copilot/skills/squad-help/SKILL.md exists with right frontmatter; explicit regression guard against re-introducing name: 'squad'. 26/26 init tests pass. npm run lint clean. Supersedes #1297. Out of scope (separate issue worth filing): squad upgrade synced only 10 of 16 installed skills - TEMPLATE_MANIFEST (used by upgrade) is out of sync with MANIFEST_SKILL_NAMES (used by init). Skills from PRs #1292 + #1295 (tiered-memory, iterative-retrieval, reflect, cross-squad, cross-squad-communication) have entries in MANIFEST_SKILL_NAMES but not TEMPLATE_MANIFEST. Follow-up will fix. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(skill): add confidence + domain frontmatter to squad-help Reviewer follow-up on #1302: the isSkillContent() classifier in sharing/consult.ts:990 requires BOTH name: AND confidence: in the frontmatter to recognize a file as a skill. Without confidence:, squad-help would not be detected as a skill in cross-squad merge / share / promote flows — it would be misclassified as a generic markdown decision. The Copilot CLI itself silently ignores custom frontmatter fields (per sdk/index.js decompile — only name/description/allowedTools/ user-invocable are read), so adding confidence: high and domain: squad-onboarding is safe at the CLI surface and necessary at the SDK surface. Applied identically to all 3 mirrored copies of squad-help/SKILL.md. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
…re mutating state (closes #1305) (#1306) * fix(prompt): coordinator must probe for squad_state/memory tools before mutating state on non-local backends (closes #1305) Symptom: a coordinator session against a Squad with stateBackend two-layer wrote .squad/decisions.md and history files via raw create/edit tools, never calling any squad_state or memory tool. The pre-commit hook caught the contract violation; the agent treated it as a 'git problem' instead of the symptom it was. Root cause: two failure modes stacked. Mechanical (Copilot CLI): MCP server tools are loaded lazily, not always advertised in the model's initial function list. Squad cannot fix this server-side; out of scope. Behavioral (squad.agent.md): pre-1305 prompt said 'when memory tools are available, use them' which models read as 'if listed' instead of 'after probing'. No hard refusal clause when the agent is about to violate the state-backend contract. Two changes to .squad-templates/squad.agent.md (synced to 4 mirror targets): 1. New 'State-backend handshake' section (MANDATORY, every session): - Skip for local/worktree backends - For orphan/two-layer/git-notes: probe via tool_search_tool_regex for squad_state_health; call it to confirm the bridge answers - On probe fail: HALT and tell the user verbatim how to fix (restart Copilot CLI or change stateBackend to local) 2. Replaced soft 'if not available' language with a HARD RULE in Memory Governance Tools section. Lists 10 forbidden paths (decisions.md, decisions/inbox, agents history, casting JSON, identity, memory, orchestration-log, log, rai+fact-checker audit-trail) that MUST NOT be written via create/edit/write_file on non-local backends when the bridge isn't reachable. Preserved the local/worktree carve-out. Also clarified that memory.* and squad_state_* share the same MCP server (same registry in packages/squad-cli/src/cli/commands/state- mcp.ts), so models stop treating them as separate availability checks. Tests: new test/state-backend-handshake.test.ts asserts 5 invariants against all 4 template mirror targets (20 tests total): handshake mandatory + every-session timing + squad_state_health probe + HALT remediation + HARD RULE with forbidden paths + local-backend carve- out. 20/20 pass. npm run lint clean. Out of scope: server-side MCP tool preload (Copilot CLI feature request), skill reinforcement in init-mode/agent-conduct (small follow-up). Closes #1305 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: tighten handshake-rule regex (split into 3 separate assertions) Reviewer follow-up on #1306: the regex '/create.*edit.*write_file|create\s*\/\s*edit/i' has '|' operator precedence ambiguity — the alternation binds at the top, so the shorter branch 'create\s*/\s*edit' could match the rule paragraph even if 'write_file' was missing entirely. The test was meant to ensure all three tool names appear in the HARD RULE list; this fix replaces it with three separate \b-anchored assertions, one per tool, so dropping any one fails the test. 20/20 handshake tests still pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
…+ rename squad-commands → squad) (#1303) * feat(skills): make /squad a real slash command — rename squad-commands to squad with user-invocable:true Users want /squad in Copilot CLI to show Squad's command catalog. Verified via Copilot CLI 1.0.62-2 source (sdk/index.js line 2618): getLoadedSkills().filter(e => e.userInvocable) .map(e => ({name: \/\\, isSkill: true, skill: e})) Any skill with frontmatter user-invocable: true is auto-registered as a slash command at /<skill-name>. The previous skill 'squad-commands' had no user-invocable field (Copilot CLI defaults to false), so /squad-commands never existed and users had no slash entrypoint. Changes: * Renamed squad-commands -> squad (canonical .squad/skills/squad/) * Frontmatter rewritten to Copilot CLI schema: - name: squad (was squad-commands) - user-invocable: true (the load-bearing change) - description: self-explanatory for natural-language match - allowedTools: [] - Removed unused fields: domain:, confidence:, source:, triggers: * Body updated to reference /squad as primary invocation * MANIFEST_SKILL_NAMES updated * TEMPLATE_MANIFEST updated (so squad upgrade syncs it too) * Removed stale squad-commands template dirs from both packages Tests: new test asserts user-invocable: true frontmatter AND name: squad (both are load-bearing for the slash command to register). 26/26 init tests pass. npm run lint clean. Composability: * Disjoint from #1292 (skills bundling) - both touch MANIFEST_SKILL_NAMES but this is a rename not an add * Disjoint from #1302 (squad-help disambiguation) - that one covers the skill(Squad) misdirect, this one covers the /squad slash UX Out of scope (future): machine-wide install (~/.copilot/skills/squad/) so /squad init works in folders without .squad/ yet. Requires a squad install --global-skill command + 'no .squad yet' menu branch. Will file separate follow-up. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(squad.agent.md): update squad-commands → squad skill xref Follow-up to reviewer comment on #1303: when this PR renamed '.copilot/skills/squad-commands/SKILL.md' to '.copilot/skills/squad/SKILL.md' (to make /squad a real user-invocable slash command), the routing-table entry inside squad.agent.md still pointed at the old path. Coordinators loading squad.agent.md from a freshly upgraded squad would have followed a dead reference and reported 'skill not found'. Updated the row in all 5 mirrored copies (.squad-templates, .github/agents, packages/squad-cli/templates, packages/squad-sdk/templates, templates/). Also added a hint that users can invoke the skill directly via /squad, since that is now the documented surface for the same content. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
…#1304) * fix(skills): install bundled skills to .github/skills/ (closes #1126) Per the official Agent Skills spec docs (GitHub, VS Code), the canonical project-level custom-skills location is .github/skills/. The legacy .copilot/skills/ is invisible to all Copilot surfaces except Squad itself - cloud agent, CLI outside Squad, VS Code extension, @copilot coding agent all ignore it. Changes: * squad init writes bundled skills to .github/skills/{name}/SKILL.md * squad upgrade does the same AND migrates legacy .copilot/skills/{name}/ -> .github/skills/{name}/ for manifest skills only (user-added skills at .copilot/skills/ are preserved). Tombstones empty legacy dir. * TEMPLATE_MANIFEST destinations: 10 skill entries retargeted * ENSURE_DIRECTORIES: .copilot/skills -> .github/skills * squad.agent.md narrative: 5-path scan order now lists .github/skills as primary, .copilot/skills as legacy. Personal scope unchanged. * All user-facing docs updated (README, spawn-reference, squad-commands skill, release-process skill, build.ts skill creation paths, SDK type-comment paths). Migration semantics in upgrade.ts: * Move-only-if-new-location-empty: legacy at .copilot/skills/, new location empty -> move + tombstone legacy * Tombstone-on-collision: both locations exist -> remove legacy, new wins (then syncAllSkills overwrites manifest skills per overwriteOnUpgrade=true semantics) * Preserve user-added: skills NOT in TEMPLATE_MANIFEST stay at .copilot/skills/ untouched * All best-effort with try/catch - disk failures do not block upgrade Tests (188/188 pass): * New: init.test.ts asserts canonical path + legacy NOT created * New: upgrade.test.ts asserts manifest migration + user-skill preservation + collision tombstoning * Updated: 8 existing test files retargeted to .github/skills NOT changed (intentional): * .copilot/skills/ stays in coordinator skill-discovery scan order for backward compat with user-added skills * ~/.copilot/skills/ (personal scope) unchanged - that's Copilot CLI's official personal-skills location * Runtime skill-loader tests (skill-source, skills-export-import, tools, skill-script-loader) unchanged - those test loader behavior which still supports .copilot/skills/ as a scan path Closes #1126 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: squad_skill writes to .github/skills, sync .github/agents copy, align issue refs Reviewer follow-ups on #1304 (closes #1126): 1. squad_skill tool implementation matches its description now Description says skills live at '.github/skills/{name}/SKILL.md' but the handler was still writing to '.copilot/skills/' — every successful 'write' shipped to a different path than what the tool documented (and what squad init/upgrade now install to). Fixed the handler so: - write operations go to '.github/skills/{name}/SKILL.md' - read operations check .github/skills first, then fall back to .copilot/skills (legacy) and .squad/skills (in-repo team skills), in that precedence — so users with un-migrated existing skills can still read them. 2. .github/agents/squad.agent.md re-synced from .squad-templates The canonical template had the corrected routing-table reference ('.github/skills/squad-commands/SKILL.md') but the .github/agents mirror copy was never re-synced. The byte-for-byte template-sync parity test would have fired on next CI. Ran 'node scripts/sync-templates.mjs --sync'. 3. Align issue references: #1304 → #1126 in code/docs/tests This PR closes #1126; #1304 is the PR number. The migrator docstring, the init.ts comment, and the two upgrade.test.ts cases all called the regression '#1304' — confusing for anyone digging into git blame for the canonical issue. Renamed to #1126 where the references describe the bug origin (kept #1304 only where the comment specifically describes 'the PR that implemented it'). 4. Migrator docstring corrected to match reality Old docstring claimed 'skips skills already present at the new location with the same content' but the implementation never compares content — it unconditionally tombstones the legacy copy when the new location exists. Rewrote the doc paragraph to describe what the code actually does (preserves the new-location copy verbatim). Verified locally: ✓ vitest test/cli/upgrade.test.ts -t 'migrate manifest skills|should NOT clobber' ✓ vitest test/tools.test.ts -t squad_skill Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test(tools): squad_skill writes go to .github/skills now (CI fix) CI failure on commit 9de50de: 'squad_skill handler > should write skill file' and 'should default confidence to medium' both still asserted '.copilot/skills/{name}/SKILL.md' as the write destination. With squad_skill's handler now writing to '.github/skills/' (the canonical Copilot CLI custom-skills location, per the fix in the same commit), those assertions need to be updated. The handler's read-fallback chain still finds .copilot/skills/ and .squad/skills/ for legacy installs, but the write target is fixed. Verified locally: 5/5 squad_skill tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test(init): update squad-help + /squad slash test paths to .github/skills/ (cascade fix on top of #1126) After #1303 + #1302 landed first (with their tests asserting .copilot/skills/), the rebase of #1304 (which moves manifest skills to .github/skills/) leaves the test paths pointing at the old location. Update them so the rebased branch's CI is green. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com>
Hardening fixes for the sub-session spawn backend (#1377): - App->task fallback: spawnSingle() falls back to createSession when the platform backend fails instead of failing the agent (emits session.spawn_fallback) - Slot-leak guards: registerSpawnRelease() handles 'completed' status and adds an unref'd max-lifetime safety timer - createSession timeout in both backends (createSessionTimeoutMs, default 60s) - Honest isAvailable() with injectable availabilityCheck predicate - Prompt sanitization for caller task/context (sanitizePromptValue) - Re-synced template platform-detection probe order to mirrors Adds vitest coverage for all six items. Closes #1377 Co-authored-by: brady gaster <bradygaster@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs: rename .NET Aspire references Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Meir Blachman <meirblachman@gmail.com> --------- Co-authored-by: Meir Blachman <meblachm@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…1263) Remove dead .ai-team/ fallback code from workflow templates. The .squad/ directory is the canonical location since the rename — the fallback paths were never triggered and added unnecessary complexity. Changes: - Remove .ai-team/ fallback branches from triage, issue-assign, heartbeat, and sync-squad-labels workflows - Clean up empty if-blocks left by fallback removal - Simplify warning messages to reference only .squad/team.md - Change let → const for team/routing file paths (no longer reassigned) - Sync all template copies (.squad-templates/, packages/) Guard rail checks in squad-preview.yml and squad-promote.yml are preserved since they legitimately prevent .ai-team/ files from shipping. Closes #1167 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
parseRoutingMarkdown kept surrounding quotes on Examples cells, so a quoted example tokenized with the quote glued on and compiled to patterns that never matched, silently routing everything to fallback. Strip leading/trailing quotes so quoted and unquoted examples behave identically. Adds parse and matchRoute regression tests. Co-authored-by: duau_microsoft <107149404+duau_microsoft@users.noreply.github.com>
The top-level `squad --help` command list omitted the externalize and internalize commands, leaving them undiscoverable. Add both entries (descriptions sourced verbatim from command-help.ts) plus a regression test guarding the top-level command list. Closes #1050 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…1365) Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.4 to 26.0.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…1366) Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 25.9.4 to 26.0.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.0.0 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [esbuild](https://github.com/evanw/esbuild) to 0.28.1 and updates ancestor dependency [tsx](https://github.com/privatenumber/tsx). These dependencies need to be updated together. Updates `esbuild` from 0.27.4 to 0.28.1 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.4...v0.28.1) Updates `tsx` from 4.21.0 to 4.22.4 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.21.0...v4.22.4) --- updated-dependencies: - dependency-name: esbuild dependency-version: 0.28.1 dependency-type: indirect - dependency-name: tsx dependency-version: 4.22.4 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…kages/squad-sdk (#1368) Bumps [@opentelemetry/sdk-trace-base](https://github.com/open-telemetry/opentelemetry-js) from 1.30.1 to 2.8.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.30.1...v2.8.0) --- updated-dependencies: - dependency-name: "@opentelemetry/sdk-trace-base" dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…/squad-sdk (#1369) Bumps [@opentelemetry/resources](https://github.com/open-telemetry/opentelemetry-js) from 1.30.1 to 2.8.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-js/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-js/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-js@v1.30.1...v2.8.0) --- updated-dependencies: - dependency-name: "@opentelemetry/resources" dependency-version: 2.8.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [@github/copilot-sdk](https://github.com/github/copilot-sdk) from 0.3.0 to 1.0.4. - [Release notes](https://github.com/github/copilot-sdk/releases) - [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md) - [Commits](github/copilot-sdk@v0.3.0...v1.0.4) --- updated-dependencies: - dependency-name: "@github/copilot-sdk" dependency-version: 1.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
…-sdk (#1371) Bumps [@github/copilot-sdk](https://github.com/github/copilot-sdk) from 0.3.0 to 1.0.4. - [Release notes](https://github.com/github/copilot-sdk/releases) - [Changelog](https://github.com/github/copilot-sdk/blob/main/CHANGELOG.md) - [Commits](github/copilot-sdk@v0.3.0...v1.0.4) --- updated-dependencies: - dependency-name: "@github/copilot-sdk" dependency-version: 1.0.3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [cspell](https://github.com/streetsidesoftware/cspell/tree/HEAD/packages/cspell) from 9.7.0 to 10.0.1. - [Release notes](https://github.com/streetsidesoftware/cspell/releases) - [Changelog](https://github.com/streetsidesoftware/cspell/blob/main/packages/cspell/CHANGELOG.md) - [Commits](https://github.com/streetsidesoftware/cspell/commits/v10.0.1/packages/cspell) --- updated-dependencies: - dependency-name: cspell dependency-version: 10.0.1 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Add spoiler-awareness guideline to casting/naming rules Squad's casting system allocated character names from fictional universes but never screened them for plot spoilers. The existing easter-egg rule only hides the casting *rationale*, not spoiler-bearing names. A name that encodes a character's later title, role, transformation, or fate can spoil a user who is mid-way through the source material, since names appear in plain text across team.md, prompts, and logs. Adds an always-loaded Name Allocation rule in squad.agent.md and a new "Spoiler Awareness" section in casting-reference.md (with a scrubbed motivating example), propagated to all mirrors via sync-templates. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(casting): restore CRLF endings on casting-reference.md to remove false diff The Spoiler Awareness edit was made on files whose committed blobs use CRLF, but local normalization rewrote them to LF. That made all 104 existing lines appear changed (122 ins / 104 del) and hid the real 18-line addition. Restoring CRLF collapses the diff to the genuine change only (18 insertions, 0 deletions). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs(casting): clarify spoiler guidance wording Address review feedback on the Spoiler Awareness section: - Use standard spelling 'midway' instead of 'mid-way'. - Replace the ambiguous 'Never reorganize the casting around the spoiler' with explicit guidance: keep existing name mappings stable and only let the next/new allocation pick a different spoiler-safe character. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * chore: add changeset for spoiler-aware casting Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…te skills (#1311) * feat(prompt): slim squad.agent.md by extracting 3 sections to satellite skills (#1308 phase 1) squad.agent.md is loaded as the agent prompt at every Copilot session start. v0.10.0-insider.1 ships it at 81 KB / 1137 lines and the v0.10 stabilisation pass alone added +10.6 KB / +114 lines. Every byte is paid at every session. Phase 1 fix: extract three low-cross-reference, high-byte sections to satellite skills the coordinator loads on demand via the skill tool — same pattern that worked for cross-squad-communication (#1295). - coordinator-init-mode — Init Mode Phase 1 + Phase 2 (5.4 KB) - coordinator-source-of-truth — Source of Truth Hierarchy (4.4 KB) - coordinator-response-mode — Response Mode Selection + Lightweight Spawn Template (3.9 KB) Result: squad.agent.md 81 KB → 70 KB (-13.9 %, -140 lines). 19 skills installed at .github/skills/ (was 16). Behaviour unchanged — each removed section is replaced with a stub naming the trigger condition and instructing the coordinator to skill(coordinator-X) before acting. Sections that stay in squad.agent.md (intentional): - Team Mode + state-backend handshake + HARD RULE — handshake must fire before any state write - Routing table — hit on every user prompt - Hard trigger keyword-to-skill match paragraph (#1307) — load-bearing - How to Spawn an Agent — referenced from every routing action - Coordinator Identity / Personal Squad / Memory Governance Tools — frequently re-read inline Wired changes: - New canonical sources at .squad/skills/coordinator-{x}/SKILL.md plus 2 template-dir mirrors - MANIFEST_SKILL_NAMES grows by 3 entries (16 → 19) - TEMPLATE_MANIFEST grows by 3 entries with ../.github/skills/ destinations (post-#1304 install location) - .squad-templates/squad.agent.md replaces each section with a stub - 4 mirrored squad.agent.md copies re-synced via scripts/sync-templates.mjs --sync Tests: 287/287 pass. The existing 'should install every manifest-curated skill (regression: #1289, #1264)' already iterates MANIFEST_SKILL_NAMES, so it automatically asserts the 3 new skills install. Smoke test: fresh squad init produces 19 skills at .github/skills/ and squad.agent.md is 70 KB. Follow-ups (separate PRs) for the still-large sections: - Routing (9.2 KB) — extract action-cell verbiage, keep trigger table - Team Mode (5.5 KB) — extract worktree-awareness sub-sections - How to Spawn (3.2 KB) — extract role-emoji catalog Target after 2-3 follow-ups: ~45 KB coordinator file. Closes #1308 (phase 1). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test+changeset: follow 'Determine team size' assertion to coordinator-init-mode skill CI failure on #1311: test/squad-agent-roster.test.ts asserted the 'Determine team size' line is in squad.agent.md.template, but after #1308 phase 1 that line moved into the coordinator-init-mode skill. Restructured the test into two describe blocks: 1. squad.agent.md.template — must still keep an Init Mode STUB that names the coordinator-init-mode satellite skill AND preserves the load-bearing eager-execution exception callout. This makes sure future edits can't accidentally drop the satellite reference. 2. coordinator-init-mode/SKILL.md (3 mirrors) — must contain the 'Determine team size' line naming all four built-ins, AND must mark each of Scribe/Ralph/Rai/Fact Checker as 'exempt from casting'. The regression coverage from #1299 follows the content. 22/22 tests pass. Also addressed the changeset review comment: clarified that .squad/skills/coordinator-*/SKILL.md are the canonical source files in the squad repo (where every other bundled skill source lives), and they're copied to .github/skills/ on install/upgrade per #1304. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: git-add the canonical .squad/skills/coordinator-*/ source dirs (review on #1311) Reviewer caught a real bug: the new coordinator-* skill source dirs existed in my worktree but had never been `git add`-ed because `.squad/` is gitignored on this repo (specific subpaths under it are exception-tracked). The template mirrors at packages/squad-{cli,sdk}/templates/skills/coordinator-*/ shipped fine, but the canonical sources at .squad/skills/coordinator-*/SKILL.md weren't in the tree — so: - The changeset claim that .squad/skills/coordinator-*/ is the canonical source was untrue on dev. - scripts/sync-skill-templates.mjs would not see the new skills when run from a fresh checkout, breaking the contributor workflow (canonical → mirrors). Sync would silently drop the 3 new skills on the next prebuild. Force-added the 3 dirs (`git add -f` because of the .squad/ ignore rule, same as every other tracked skill under .squad/skills/). Verified: `node scripts/sync-skill-templates.mjs` now lists coordinator-* among the 26 discovered skills and re-produces the 2 template mirrors byte-identical to the canonical sources. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: extractInitMode follows satellite skill + version regex tolerates pre-release tail Two narrow fixes uncovered while smoke-testing the slim squad.agent.md PR (#1311) and the 0.10.0-insider.1 release pipeline: 1. test/init-flow.test.cjs — after the Init Mode prose moved from squad.agent.md to the coordinator-init-mode satellite skill (#1308 / PR #1311), the structural assertions in 'Init Mode prompt structure (#66)' had nothing to read in the parent file. They now follow the pointer via the new readSatelliteSkill() helper (which prefers the installed copy at .github/skills/<name>/SKILL.md and falls back to the source repo template at packages/squad-sdk/templates/skills/), so the same gates (STOP/WAIT, 'Look right?', numbered confirm-before- create flow, Phase 2 trigger) keep being enforced — just against the prompt the coordinator actually loads at runtime. 2. test/version-stamping.test.cjs + index.cjs — the version regex [0-9.]+(?:-[a-z]+)? truncated pre-release versions with a numeric tail (e.g. 0.10.0-insider.1 → 0.10.0-insider, 0.10.0-build.3 → 0.10.0-build). That made the test 'upgrade detects same version' fail locally on any contributor who built the package (pkg.version gets stamped 0.10.0-build.N during build). More importantly it made the legacy index.cjs upgrade re-run the full upgrade flow for npm- installed insider users (who have 0.10.0-insider.1 on disk) instead of printing 'Already up to date'. Widened to [0-9.]+(?:-[a-z]+(?:\.[0-9]+)?)? — matches everything we already accepted plus the .N tail used by npm pre-release dist-tags and the build-time stamping script. All 133 .cjs tests now pass (was 123 pass / 10 fail before). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(docs): rephrase 'fenced code block' row in skill-security-scanner table CI failure on dev tip (567f447, Squad CI run 27488323855): test/docs-build.test.ts > 'all code blocks are properly fenced (even count of backticks)' → expected 1 to be 0 test/docs-build.test.ts > 'code blocks contain language specification or valid content' → expected 1 to be greater than 1 Root cause: a 4-backtick table cell intended to display a literal triple-backtick: | Inside a fenced code block (\\\\ \\\ \\\\) | Suppressed | made the regex /\\\/g see 5 triple-backtick occurrences across the file (instead of the 2 from the real bash example), tripping both the even-fence check and the line-count > 1 check. Rephrased the table to say 'three backticks' / 'single backtick' in prose — no embedded delimiters, no need to defend against the markdown fence escape mechanism. Reads cleaner anyway. Verified locally: 22/22 docs-build tests pass; npm run build in docs/ completes (171 files emitted; pagefind indexes 168 pages, 6911 words). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The canonical command for adding team members is now 'cast' — we're casting agents, not hiring humans. 'hire' continues to work silently as an alias (like cls/clear in PowerShell). - squad cast (no args) → shows roster (existing behavior preserved) - squad cast --name X --role Y → launches team creation wizard - squad hire → always launches the wizard (silent alias) Updated all CLI help text, README docs, blog posts, SDK templates, and skill files. Added 'cast' to test expectations while keeping 'hire' in the recognized-commands list. Closes #1393 Co-authored-by: brady gaster <bradygaster@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Add OSS release checklist files - CODE_OF_CONDUCT.md (Contributor Covenant v1.4) - SUPPORT.md (points to GitHub Discussions) - .github/CODEOWNERS (@bradygaster @tamirdresher) - README.md: add Requirements, License, Maintainers, Support, Contributing, Code of Conduct sections Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
…o URL (#1224) (#1225) * feat: add 'squad preset install <source>' for sharing presets via repo URL (#1224) Closes #1224. Adds a new subcommand that installs a single preset from a GitHub URL or local path into \\/presets/<name>/\ — the peer-to-peer preset sharing flow that was missing in v0.10.0. SDK side (squad-sdk/src/presets/index.ts): - New \installPresetFromSource(source, options)\ function - Resolves source: GitHub URL → shallow git clone --depth 1 to OS temp; local path → use as-is - Locates preset within source via 3 patterns: - dir contains preset.json → single-preset source - dir contains presets/ subdir → require --name to pick - dir IS the presets/ dir → require --name (or auto-pick if only one) - Validates preset.json before any destructive action - Copies preset.json (with optional rename) + agents/ into squad home - Cleans up temp clones in finally block (success or failure) - Exports: installPresetFromSource, InstallPresetOptions, InstallPresetResult CLI side (squad-cli/src/cli/commands/preset.ts): - New 'install' dispatcher case + presetInstall() function - Supports --name <override>, --force - Module docstring + default usage help updated to include 'install' Supported source shapes: https://github.com/owner/repo https://github.com/owner/repo#preset-name (frag as subdir hint) https://github.com/owner/repo/tree/branch/path/... (sub-path) git\@github.com:owner/repo.git (SSH) ./local/path (single preset OR collection) Smoke tested all 6 cases locally: 1. Local single-preset → installs under manifest.name ✅ 2. Idempotent re-install fails without --force ✅ 3. --force overwrites ✅ 4. --name renames + updates manifest.name ✅ 5. Invalid source → clear error ✅ 6. GitHub URL (cloned bradygaster/squad's presets/builtin/default) ✅ Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(presets): address 6 review comments — security, validation, fragment semantics, tests, help block Addresses all six review comments on #1225: 1. [security] git clone via execSync was vulnerable to shell injection because the command was built as a string. Switched to execFileSync with an argument array (no shell), so source / ref values containing ';' '&&' '|' backticks etc. can no longer be interpreted by a shell. The earlier ad-hoc whitespace/quote escaping was the wrong defence layer. 2. [security] nameHint was used in path.join without validation. A value like '../something' would have escaped the presets/ directory. Added validatePathSegment() that rejects path separators ('/' '\\'), '..', '.', null bytes. Applied both at the public installPresetFromSource() entry AND inside locatePresetWithinSource() as defence-in-depth in case future callers go direct. Also added validateSubPath() for the URL-fragment-derived subPath: rejects absolute paths and '..' segments. 3. [correctness] Fragment semantics: 'repo#some-name' (bare fragment, no slash) was being treated as a literal subPath, so it looked for <clone>/some-name/ and broke the documented <clone>/presets/some-name/ collection layout from the PR description. Restructured resolveInstallSource to return a new nameHint field alongside subPath: - Fragment WITH '/' -> literal subPath (e.g. repo#packs/team-a) - Fragment WITHOUT '/' -> preset-name HINT (e.g. repo#my-team) The nameHint is forwarded to locatePresetWithinSource without being used as a path segment itself, so the common collection layout now works as advertised. 4. [UX] --name parsing didn't validate that a value was actually provided. 'squad preset install <src> --name' (no value) or '--name --force' (next arg is a flag) silently produced undefined or '--force' as the override and failed downstream with a confusing error. Added an early fail-fast guard with a clear usage hint. 5. [tests] Added 7 focused tests for installPresetFromSource covering the new code path: - single-preset local source (startDir/preset.json present) - collection local source + --name selection - collection source without --name throws with helpful message - --force overwrite of an existing same-name preset - --name rename + manifest.name stamping (other fields preserved) - --name path-escape attempts are rejected - empty source throws 'required' Remote (URL) branch isn't stubbed here — splitting the git-clone call into a small helper that tests can mock is a separate follow-up. 6. [docs] preset help block in command-help.ts still printed Usage: squad preset <list|show|apply|save|init> without 'install'. Updated to include 'install <source>', the new --name option, and a concise documentation of the fragment semantics from fix #3. Verified locally: 36/36 preset tests pass (29 existing + 7 new); 14/14 command-help tests pass. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Tamir Dresher <tamirdresher@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…es (#1403) * fix: update adapter/client.ts for @github/copilot-sdk 1.0.4 API changes - Replace removed cliPath/cliArgs/useStdio/port/cliUrl options with RuntimeConnection - Update ping() return type from timestamp: number to timestamp: string - Make SquadModelBilling.multiplier optional to match upstream ModelBilling - Replace client.on() with client.onLifecycle() for lifecycle events Unblocks Dependabot PRs #1364 and #1370 which surface these type errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix: update test mocks for @github/copilot-sdk 1.0.4 API changes - Add RuntimeConnection and onLifecycle to all 4 copilot-sdk test mocks - Fix command-help.test.ts expected commands list (remove stale entries) - Regenerate package-lock.json after merging dev (OTel dep alignment) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: brady gaster <bradygaster@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
) Bumps both OpenTelemetry SDK packages from 1.x to 2.8.0: - @opentelemetry/sdk-metrics: ^1.30.0 → ^2.8.0 - @opentelemetry/sdk-trace-node: ^1.30.0 → ^2.8.0 The createGauge API is still supported in SDK 2.x — no code changes needed. All OTel tests and SDK export validations pass. Closes #1364, Closes #1370 Co-authored-by: brady gaster <bradygaster@github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#1406) * fix(cli): pin squad-sdk workspace dependency Closes #1405 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix CLI SDK workspace resolution Closes #1405 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Fix green test suite Align local test expectations with current personal squad paths, stabilize observer file category detection, skip unavailable docs/Aspire capabilities, and add the missing OTel context test dependency. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix observer review hardening Closes #1416 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Prepare clean 0.11.0 package versions and CHANGELOG notes for release staging. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(test): guard observer symlink setup Handle restricted symlink creation in the observer symlink test so Windows and locked-down environments can continue the suite. Refs #1416 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address symlink test review feedback Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Resolves dev/main conflicts in favor of dev (release source of truth). Dev already incorporates main hotfix #1415. Cuts v0.11.0. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
🛫 PR Readiness Check
PR Scope: 📦🔧 Mixed (product + infrastructure)
|
| Status | Check | Details |
|---|---|---|
| ❌ | Single commit | 109 commits — consider squashing before review |
| ✅ | Not in draft | Ready for review |
| ✅ | Branch up to date | Up to date with main |
| ❌ | Copilot review | No Copilot review yet — it may still be processing |
| ✅ | Changeset present | Changeset file found |
| ✅ | Scope clean | |
| ✅ | No merge conflicts | No merge conflicts |
| ✅ | Copilot threads resolved | No Copilot review threads |
| ✅ | CI passing | All checks passing |
Files Changed (229 files, +11675 −7381)
| File | +/− |
|---|---|
.changeset/bump-otel-sdk-2x.md |
+5 −0 |
.changeset/cli-upgrade-fixes.md |
+12 −0 |
.changeset/docs-platform-path-fixes.md |
+6 −0 |
.changeset/feat-preset-install.md |
+60 −0 |
.changeset/fix-cli-sdk-workspace-pin.md |
+5 −0 |
.changeset/fix-coordinator-inline-dispatch-gate.md |
+24 −0 |
.changeset/fix-copilot-sdk-type-compat.md |
+12 −0 |
.changeset/fix-dep0190-shell-spawn.md |
+11 −0 |
.changeset/fix-green-suite.md |
+5 −0 |
.changeset/fix-routing-strip-example-quotes.md |
+9 −0 |
.changeset/fix-sdk-export-gitignore-state.md |
+11 −0 |
.changeset/fix-squad-home-env-bugs.md |
+12 −0 |
.changeset/help-externalize-internalize.md |
+5 −0 |
.changeset/ink7-adaptation.md |
+12 −0 |
.changeset/observer-hardening.md |
+5 −0 |
.changeset/otel-resource-api-migration.md |
+5 −0 |
.changeset/reasoning-effort.md |
+17 −0 |
.changeset/release-0.11.0.md |
+6 −0 |
.changeset/rename-dotnet-aspire-to-aspire.md |
+5 −0 |
.changeset/rename-hire-to-cast.md |
+5 −0 |
.changeset/slim-squad-agent-md-phase1.md |
+90 −0 |
.changeset/spawn-backend-followups-1377.md |
+26 −0 |
.changeset/spoiler-aware-casting.md |
+29 −0 |
.changeset/sub-sessions-spawn-backend.md |
+22 −0 |
.changeset/types-node-25.md |
+6 −0 |
.changeset/typescript-6.md |
+10 −0 |
.changeset/vitest-4-upgrade.md |
+6 −0 |
.changeset/vscode-jsonrpc-9-sdk.md |
+5 −0 |
.copilot/skills/cli-wiring/SKILL.md |
+2 −2 |
.copilot/skills/init-mode/SKILL.md |
+4 −4 |
.github/CODEOWNERS |
+4 −0 |
.github/agents/squad.agent.md |
+114 −173 |
.github/dependabot.yml |
+79 −21 |
.github/workflows/squad-agents-ai-ci.yml |
+4 −4 |
.github/workflows/squad-agents-ai-release.yml |
+3 −4 |
.github/workflows/squad-ci.yml |
+11 −11 |
.github/workflows/squad-docs-links.yml |
+2 −2 |
.github/workflows/squad-docs.yml |
+4 −4 |
.github/workflows/squad-heartbeat.yml |
+5 −5 |
.github/workflows/squad-impact.yml |
+3 −3 |
.github/workflows/squad-insider-publish.yml |
+2 −2 |
.github/workflows/squad-issue-assign.yml |
+4 −4 |
.github/workflows/squad-label-enforce.yml |
+2 −2 |
.github/workflows/squad-npm-publish.yml |
+7 −7 |
.github/workflows/squad-pr-nudge.yml |
+1 −1 |
.github/workflows/squad-pr-readiness.yml |
+1 −1 |
.github/workflows/squad-preview.yml |
+2 −2 |
.github/workflows/squad-promote.yml |
+2 −2 |
.github/workflows/squad-release.yml |
+2 −2 |
.github/workflows/squad-repo-health.yml |
+12 −12 |
| ... | +179 more files |
Total: +11675 −7381
This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
tamirdresher
approved these changes
Jun 30, 2026
tamirdresher
left a comment
tamirdresher
left a comment
Collaborator
There was a problem hiding this comment.
✅ Approved — dev→main promotion for v0.11.0 looks good. Test battery passing (6974 tests), changesets documented, conflicts resolved in favor of dev. Ship it! 🚀
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cuts the v0.11.0 release. Promotes dev → main; dev/main conflicts resolved in favor of dev (release source of truth — dev already incorporates main hotfix #1415
tools: ['*']). Source/tests are byte-identical to dev (green CI); only docs/blog/config carry forward from main's non-conflicting additions. Versions 0.11.0 across root/sdk/cli; CHANGELOG has [0.11.0]. On merge, squad-release.yml auto-tags v0.11.0 and creates the GitHub Release. Supersedes #1421. Authorized by Brady — he will merge.