fix: audit template dirs, sync package templates, expand tests (#461)

.squad/decisions/inbox/fenster-template-audit.md

@@ -0,0 +1,21 @@
+# Decision: Template directory sync enforcement
+
+**Author:** Fenster (Core Dev)
+**Date:** 2026-07-16
+**Issue:** #461
+**PR:** #462
+
+## Context
+
+PR #460 fixed universe count in some but not all template copies, revealing that we had 5 locations with duplicated files and no automated enforcement.
+
+## Decision
+
+1. `.squad-templates/` is the **canonical source** for all template files.
+2. All copies in `templates/`, `packages/squad-cli/templates/`, `packages/squad-sdk/templates/`, and `.github/agents/` must match canonical.
+3. `test/template-sync.test.ts` enforces byte-for-byte parity for casting-policy.json, universe count parity for squad.agent.md, and cross-file count validation.
+4. Any future template changes must update ALL locations and pass the sync tests.
+
+## Impact
+
+All team members editing template files.

package.json

@@ -8,9 +8,9 @@
     "packages/*"
   ],
   "scripts": {
-    "prebuild": "node scripts/bump-build.mjs && node scripts/sync-skill-templates.mjs",
+    "prebuild": "node scripts/bump-build.mjs && node scripts/sync-skill-templates.mjs && node scripts/sync-templates.mjs",
     "build": "npm run build -w packages/squad-sdk && npm run build -w packages/squad-cli",
-    "sync-templates": "node scripts/sync-skill-templates.mjs",
+    "sync-templates": "node scripts/sync-templates.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "tsc --noEmit -p packages/squad-sdk/tsconfig.json && tsc --noEmit -p packages/squad-cli/tsconfig.json",

packages/squad-cli/templates/casting-policy.json

@@ -14,7 +14,8 @@
     "Breaking Bad",
     "Lost",
     "Marvel Cinematic Universe",
-    "DC Universe"
+    "DC Universe",
+    "Futurama"
   ],
   "universe_capacity": {
     "The Usual Suspects": 6,
@@ -30,6 +31,7 @@
     "Breaking Bad": 12,
     "Lost": 18,
     "Marvel Cinematic Universe": 25,
-    "DC Universe": 18
+    "DC Universe": 18,
+    "Futurama": 12
   }
 }

packages/squad-cli/templates/orchestration-log.md

@@ -20,7 +20,7 @@
 
 ## Rules
 
-1. **One file per agent spawn.** Named `{timestamp}-{agent-name}.md`. Timestamps must be filename-safe (replace colons with hyphens, e.g., `2026-02-23T20-16-27Z`).
+1. **One file per agent spawn.** Named `{timestamp}-{agent-name}.md`.
 2. **Log BEFORE spawning.** The entry must exist before the agent runs.
 3. **Update outcome AFTER the agent completes.** Fill in the Outcome field.
 4. **Never delete or edit past entries.** Append-only.

packages/squad-cli/templates/scribe-charter.md

@@ -22,7 +22,7 @@
 
 After every substantial work session:
 
-1. **Log the session** to `.squad/log/{timestamp}-{topic}.md` (use filename-safe timestamps — replace colons with hyphens, e.g., `2026-02-23T20-16-27Z` not `2026-02-23T20:16:27Z`, for Windows compatibility):
+1. **Log the session** to `.squad/log/{timestamp}-{topic}.md`:
    - Who worked
    - What was done
    - Decisions made

packages/squad-cli/templates/skills/nap/SKILL.md

@@ -0,0 +1,24 @@
+# Skill: nap
+
+> Context hygiene — compress, prune, archive .squad/ state
+
+## What It Does
+
+Reclaims context window budget by compressing agent histories, pruning old logs,
+archiving stale decisions, and cleaning orphaned inbox files.
+
+## When To Use
+
+- Before heavy fan-out work (many agents will spawn)
+- When history.md files exceed 15KB
+- When .squad/ total size exceeds 1MB
+- After long-running sessions or sprints
+
+## Invocation
+
+- CLI: `squad nap` / `squad nap --deep` / `squad nap --dry-run`
+- REPL: `/nap` / `/nap --dry-run` / `/nap --deep`
+
+## Confidence
+
+medium — Confirmed by team vote (4-1) and initial implementation

packages/squad-sdk/templates/casting-policy.json

@@ -14,7 +14,8 @@
     "Breaking Bad",
     "Lost",
     "Marvel Cinematic Universe",
-    "DC Universe"
+    "DC Universe",
+    "Futurama"
   ],
   "universe_capacity": {
     "The Usual Suspects": 6,
@@ -30,6 +31,7 @@
     "Breaking Bad": 12,
     "Lost": 18,
     "Marvel Cinematic Universe": 25,
-    "DC Universe": 18
+    "DC Universe": 18,
+    "Futurama": 12
   }
 }

packages/squad-sdk/templates/mcp-config.md

@@ -4,14 +4,6 @@ MCP (Model Context Protocol) servers extend Squad with tools for external servic
 
 > **Full patterns:** Read `.copilot/skills/mcp-tool-discovery/SKILL.md` for discovery patterns, domain-specific usage, and graceful degradation.
 
-## Security Considerations
-
-> ⚠️ **Important:** The sample configs below use `npx -y` to run MCP server packages without version pinning. For production use:
-> - **Pin versions:** Use `npx -y @trello/mcp-server@1.2.3` instead of bare package names
-> - **Audit packages:** Review MCP server source code before granting access to credentials
-> - **Use least-privilege tokens:** Create tokens with minimal required scopes
-> - **Consider local installs:** Install packages locally (`npm install`) rather than fetching on each run
-
 ## Config File Locations
 
 Users configure MCP servers at these locations (checked in priority order):

packages/squad-sdk/templates/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}