fix(workflow): harden safe-outputs reliability in Plan Activate

.changeset/consolidated-0.11.0.md

@@ -0,0 +1,107 @@
+---
+"@bradygaster/squad-cli": minor
+"@bradygaster/squad-sdk": minor
+---
+
+## Consolidated changelog — 0.11.0 development cycle
+
+> 81 changeset fragments consolidated into a single entry to unblock CI.
+
+### Features
+
+- Add `squad update-check` — reads the existing self-update cache (`update-check.json`) and reports current/latest vers...
+- Fix #1314: ship `ralph-instructions.md` template for `squad watch --execute`
+- feat(models): add category-based cost policy wired end-to-end + `squad models refresh`
+- feat: add `squad preset install <source>` for sharing presets via repo URL or local path (#1224)
+- feat(platform): add `setAssignee()` to PlatformAdapter so assignee changes route through the platform abstraction (Gi...
+- feat(platform): hydrate work-item `body` via `getWorkItem` and route two-pass scan through the adapter
+- Add `externalize` and `internalize` to the top-level `squad --help` command list so they are discoverable (#1050).
+- Add @copilot team member prompt during `squad init`
+- Add reasoning effort support to agent spawning pipeline
+- Add `squad registry add/list/remove` for discovery-only peer squads (no inheritance)
+- Add sub-session spawn backend for Copilot App integration
+- Add **cross-squad-communication** as a built-in skill (companion to cross-squad)
+
+### Bug Fixes
+
+- Fix #1289, #1264: Bundle missing skills on `squad init` and strip fabricated provenance from tiered-memory SKILL.md
+- Fix #1461 canary false-positives: add HEAD canary to coordinator prompt and make the Canary Check three-state + coord...
+- fix: conditional .gitignore entries for two-layer/orphan state backends
+- Coordinator template now warns before launching 2+ parallel background agents in a shared worktree: global-scope git ...
+- Move bundled skills from `.copilot/skills/` to `.github/skills/` so they're visible to all Copilot surfaces (closes #...
+- Fix #1142: `ralph-triage.js` hardcoded `hostname: 'api.github.com'` in its `https.request()` call, so `Squad Heartbea...
+- Fix two upgrade-pipeline gaps from #1190: the postinstall ESM patcher now patches every search root instead of stoppi...
+- Fix StateBackendStorageAdapter.deleteDir leaving nested keys behind: a single-level list+delete pass missed deeper su...
+- Fix #1296: stop writing `squad_state_<hash>` to `~/.copilot/mcp-config.json` on every `squad init` / `squad upgrade`
+- Fix #1299 (deep): Fact Checker gets the same plumbing as Rai — rich charter at init + state directory + policy template
+- Fix #1299: tell the coordinator to roster Fact Checker (and Ralph + Rai explicitly) in the casting flow
+- Fix #1305: coordinator must probe for `squad_state` / `memory.*` tools before writing state, and hard-refuse writes w...
+- Fix #1396: `squad export` now resolves externalized state. After `squad externalize`, export read the local `.squad/`...
+- `squad copilot` and `squad rc` now follow externalized state: roster reads and writes go to the external state dir wh...
+- `squad cast` now discovers project agents from the external state dir when state is externalized. `LocalAgentSource` ...
+- Pin GitHub Actions references to full-length commit SHAs across the 10 shipped workflow templates (`squad-ci.yml`, `s...
+- Fix #1639: `squad watch`'s self-pull capability stashed uncommitted local changes before `git pull --ff-only`, but on...
+- Pin the CLI's squad-sdk dependency to the matching package version so published installs cannot keep an older SDK tha...
+- Force the CLI's squad-sdk dependency through the repo workspace by using a root file dependency plus an npm override ...
+- Fix coordinator inline-dispatch regression: restore always-on dispatch gate in the Squad coordinator template
+- fix: update adapter/client.ts for @github/copilot-sdk 1.0.4 API changes
+- Fix Windows shell spawn issues and gh auth false-negative
+- Add Layer A/B/C dispatch-enforcement governance to coordinator scaffolding and audit hooks
+- Fix `squad doctor` so `decisions.md` passes validation when two-layer or orphan state backends store it on the `squad...
+- Remove duplicate `cast` entry in `squad -h` output
+- Fix `squad externalize`/`internalize` corrupting non-UTF-8 files under `.squad/`. Both commands copied files through ...
+- Fix #1222: Auto-scaffold Fact Checker agent during `squad init`, `squad cast`, and `squad upgrade`
+- Fix local test-suite failures by aligning personal squad path expectations, stabilizing observer file classification,...
+- Fix identity/ state writes and widen squad_decide author validation (#1255, #1256).
+- Fix permission handler to use `approve-once` instead of deprecated `approved` kind, aligning with Copilot CLI v1.0.54...
+- Fix `squad preset save/apply` to round-trip custom routing configuration. Previously, `routing.md` was not included i...
+- fix: release pipeline version pinning (#1203, #1204)
+- Fix: strip surrounding quotes from routing.md example phrases in `parseRoutingMarkdown`
+- fix(sdk): normalize dotted ToolRegistry names at Copilot external-tool boundary
+- fix(sdk): export `addSquadStateGitignoreBlock` / `removeSquadStateGitignoreBlock` from the package root
+- Fix `skill(Squad)` discovery — rename disambiguation skill to `squad-help` (supersedes #1297)
+- fix: respect SQUAD_HOME in capabilities.ts and comms-teams.ts, implement SQUAD_PERSONAL_DIR env var, fix Windows shel...
+- Make `/squad` a real slash command — rename `squad-commands` skill to `squad` with `user-invocable: true`
+- Coordinator now recognises "spawn a squad" / "another squad" / "two squads" as Squad-PRODUCT vocabulary
+- Fix shellcheck SC2086 in workflow templates: quote `$GITHUB_OUTPUT` redirects
+- Fix YAML escaping in skill command apm.yml generation
+- Fix #1288: `squad preset apply` now wires team.md, routing.md, and casting state
+- Fix #1377 follow-ups: spawn-backend fallback, slot-leak guards, timeouts, prompt sanitization
+- Fix cross-building a POSIX standalone bundle from a Windows host. The builder extracted the entire Node.js runtime ar...
+
+### Dependencies
+
+- deps: bump @opentelemetry/sdk-metrics and @opentelemetry/sdk-trace-node from 1.x to 2.8.0
+- Fix CLI and upgrade bugs:
+- Bump @types/node from ^22.0.0 to ^25.9.3 in cli and sdk packages. Removes a no-longer-needed @ts-expect-error directi...
+- chore: upgrade to TypeScript 6 (closes #1325, #1328, #1334)
+- Bump vitest from v3 to v4 alongside @vitest/coverage-v8 v4 to resolve peer-dep mismatch. Both packages now align at ^...
+
+### Chores
+
+- chore: adapt CLI to ink 7.0.6
+- Rename user-facing Aspire terminology in CLI help text and command output. Aspire is a standalone OTLP dashboard, not...
+- Rename `hire` command to `cast` in CLI help and documentation. The `hire` command continues to work as a silent alias...
+
+### Documentation
+
+- Fix platform-specific path examples in personal squad docs, JSDoc, and bundled skill templates.
+
+### Other
+
+- Ensure first-time Squad casting includes the complete proposed roster and universe inside the blocking confirmation p...
+- docs: clarify in `init.ts` and `.gitattributes` / `.gitignore` generators that `.squad/casting/*` files are authorita...
+- Consolidate the duplicated `buildAgentCommand()`/spawn-with-timeout logic in the `execute` and `wave-dispatch` watch ...
+- Thread a `contextTier` concept end-to-end through the agent spawning pipeline, mirroring `reasoningEffort`.
+- `squad init` now defaults to writing `"chat.newSession.defaultMode": "Squad"` into `.vscode/settings.json`, so new VS...
+- Assign unique colors to squad member labels from a curated palette using deterministic hashing of slugified agent names.
+- Expose memory.* tools (classify, write, search, promote, delete, audit) through the squad_state MCP server so agents ...
+- Prefer newest model per series in fallback chains, add GPT-5.6 IDs, fix Ralph free-model wording.
+- Harden squad observer change resolution against directory events, symlinks, and filesystem scan errors.
+- Migrate OTel Resource API to `resourceFromAttributes` for compatibility with `@opentelemetry/resources` 2.x (replaces...
+- Refresh the model catalog to GitHub Copilot CLI-reachable IDs and prune dead fallback IDs.
+- Slim squad.agent.md by extracting 3 sections to satellite skills (closes #1308 phase 1)
+- docs(casting): make agent name allocation spoiler-aware
+- Write an npx-free `squad_state` MCP spec when Squad runs from a standalone bundle. Previously `squad init` and `squad...
+- Prefer `squad.exe` over `squad.cmd` when writing the `squad_state` MCP spec from a standalone bundle on Windows. Sinc...
+- Sync lockfile for the vscode-jsonrpc 8→9 bump in packages/squad-sdk. v9 adds the missing `exports` field that v8 lack...