Skip to content

fix(cli): ESM runtime patch + secret guardrails sprint (#265, #267)#268

Merged
bradygaster merged 8 commits intomainfrom
squad/267-secret-guardrails
Mar 8, 2026
Merged

fix(cli): ESM runtime patch + secret guardrails sprint (#265, #267)#268
bradygaster merged 8 commits intomainfrom
squad/267-secret-guardrails

Conversation

@bradygaster
Copy link
Copy Markdown
Owner

@bradygaster bradygaster commented Mar 8, 2026

Summary

Sprint addressing issues #267 (agent credential leak) and #265 (ESM/npx crash on Node 24+).

Issue #267 — Secret Guardrails

  • Security audit: Baer scanned 330 files + full git history — zero leaked secrets
  • Architecture: 5-layer defense-in-depth plan (prompts → pre-tool hooks → post-tool hooks → Scribe pre-commit → git hooks)
  • Secret-handling skill: New .squad/skills/secret-handling/SKILL.md
  • 59 TDD tests: est/hooks-security.test.ts (red-first — tests for Phase 2 hooks not yet implemented)
  • Baer's reply posted to Agent can read and leak .env credentials into .squad/ committed files #267 with 3-phase remediation plan

Issue #265 — ESM/npx Fix

  • Root cause: @github/copilot-sdk@0.1.32 has broken ESM import (�scode-jsonrpc/node missing .js). v0.8.23's postinstall patch doesn't run under npx (cache skips postinstall).
  • Fix: Runtime Module._resolveFilename intercept in cli-entry.ts — rewrites the broken import before Node resolves it. Works for all install methods (global, npx, local).
  • Workaround posted to ERR_MODULE_NOT_FOUND vscode-jsonrpc\node #265 for users on v0.8.23.

Release Team Hardening

  • Trejo (Release Manager): Charter updated with branch-first rules, triage gates, release pre-flight
  • Drucker (CI/CD Engineer): Charter updated with CI branch protection, triage gates, pre-commit proposals
  • Keaton (Lead): Release retro with root cause analysis for v0.8.22 disaster + today's main-branch misstep

Process Improvements

Closes #265
Refs #267

⚠️ 37 test failures are expected — they're Hockney's TDD tests for Phase 2 hooks that haven't been implemented yet. The existing 3,811+ tests pass.

bradygaster and others added 8 commits March 8, 2026 06:05
@bradygaster
docs(ai-team): Merge 13 decisions from 9-agent secret guardrails sprint
65f1455 
Session: 2026-03-08T12-49-00Z-secret-guardrails-and-release
Requested by: bradygaster

Changes:
- Merged 13 decision inbox files → decisions.md (consolidated into 442 KB)
- Added 8 agent orchestration logs (Keaton, Verbal, Fenster, Baer, Hockney, Trejo, Drucker, McManus)
- Added session summary log covering 3 workstreams (#267 secret guardrails, #265 ESM fix, release readiness)
- Updated 5 agent history.md files with cross-agent context
- Created .squad/skills/secret-handling/SKILL.md as team reference
- Decisions cover: 5-layer secret architecture, pre-commit hooks, backward-compat testing, release readiness assessment, CI/CD pipeline audit, PRD synthesis, documentation patterns

Status: 8/9 agents complete, Fortier still triaging #265 status
@bradygaster
docs(ai-team): Propagate cross-agent team updates to history.md files
839de5b 
Added context to 6 agent history files:
- Baer: Audit clean result, CI/CD findings
- Drucker: CI/CD gaps, release blockers
- Hockney: Security tests (59), backward compat
- Keaton: Sprint coordination, decisions merged
- Trejo: #265 blocker status, Drucker findings
- Fenster: Hook implementation, ESM fix, RC review
- Verbal: Secret skill created, spawn hardening
- Fortier: #265 triage status, release impact

All agents now aware of:
- .squad/skills/secret-handling/SKILL.md
- 5-layer defense architecture
- Test coverage (Hockney)
- Release readiness blockers (Trejo/Drucker)
@bradygaster
docs(ai-team): Merge user directive — squad branch convention non-neg…
f66fcc6 
…otiable

Merged: copilot-directive-2026-03-08T13-06Z.md

Decision: All team members (agents + humans) must create feature branches before work.
Branching model: squad/{issue-number}-{slug}
Why: Proper git hygiene, PR-based review flow, team consistency
@bradygaster
docs(squad): harden release team charters + retro + security tests
7134d75 
- Trejo: branch-first rules, triage gates, release pre-flight checklist
- Drucker: CI branch protection, triage gates, pre-commit proposals
- Keaton: release retro with root cause analysis and action items
- Hockney: 59 TDD tests for secret leak mitigation (hooks-security)

Refs #267, #265

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bradygaster
fix(cli): runtime ESM patch for npx on Node 24+ (#265)
09e745f 
When npx caches @bradygaster/squad-cli, it skips postinstall scripts,
so the install-time ESM patch never runs. This adds a runtime
Module._resolveFilename intercept that rewrites 'vscode-jsonrpc/node'
to 'vscode-jsonrpc/node.js' before Node's module system tries to
resolve it. Works on both Node 22 and 24+.

Closes #265

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bradygaster
docs(ai-team): Merge charter hardening and release retrospective deci…
79b7283 
…sions

Session: 2026-03-08-charter-hardening
Requested by: Copilot (Scribe)

Changes:
- Merged 4 decisions from inbox into decisions.md
- Trejo charter hardened: git branching discipline, issue triage gates
- Drucker charter hardened: CI branch protection, pre-commit checks
- Keaton release retrospective: root cause analysis, action items
- Deduplication: No exact duplicates found in existing decisions

Decisions merged:
- 2026-03-08T13:07Z: User directive (Git & Release discipline)
- 2026-03-08: Drucker charter hardening (CI branch protection)
- 2026-03-08: Keaton release retro (post-mortem + action items)
- 2026-03-08: Trejo charter hardening (branch-first discipline)

Inbox files deleted after merge:
- copilot-directive-2026-03-08T13-07Z.md
- drucker-charter-hardening.md
- keaton-release-retro-2026-03-08.md
- trejo-charter-hardening.md

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bradygaster
test: mark Phase 2 security hook tests as .todo for CI
8823da9 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@bradygaster
docs(squad): merge secret-guarantee directive into decisions
cd1ce6d 
Session: 2026-03-08T13-32-00Z-secret-guardrails-sprint
Scribe work: final decision merge

Changes:
- Merged copilot-directive-secret-guarantee.md into .squad/decisions.md
- Deleted inbox file after merge
@bradygaster bradygaster merged commit bd6de49 into main Mar 8, 2026
1 check failed
@bradygaster bradygaster deleted the squad/267-secret-guardrails branch March 8, 2026 13:41
@bradygaster bradygaster mentioned this pull request Mar 8, 2026
Closed
jongio pushed a commit to jongio/squad that referenced this pull request Mar 9, 2026
@bradygaster
feat: squad aspire command and squad-observer file watcher (bradygast…
992763e 
…er#265, bradygaster#268)

- Add 'squad aspire' CLI command that launches the .NET Aspire dashboard
  for viewing Squad OTel telemetry. Supports Docker and dotnet launch
  strategies with --docker and --port flags. Auto-configures
  OTEL_EXPORTER_OTLP_ENDPOINT environment variable.

- Add SquadObserver class in SDK runtime that watches .squad/ directory
  for file changes and emits OTel spans (squad.observer.file_change) plus
  EventBus events. Includes file classification (agent, casting, config,
  decision, skill), debounce logic, and full start/stop lifecycle with
  OTel instrumentation.

- Add 16 new tests (14 observer, 2 aspire) — all passing.
- Wire aspire command into CLI entry point with help text.
- Add subpath exports for both new modules.

Closes bradygaster#265, closes bradygaster#268

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jongio pushed a commit to jongio/squad that referenced this pull request Mar 9, 2026
@bradygaster
chore(.squad): update fenster history and decisions for bradygaster#265…
523782e 
…, bradygaster#268

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
jongio pushed a commit to jongio/squad that referenced this pull request Mar 9, 2026
@bradygaster
Merge pull request bradygaster#307 from bradygaster/squad/265-268-asp…
e68eb83 
…ire-and-watcher

feat: OTel Phase 4 — Aspire command, file watcher, event payloads, CI/CD (bradygaster#265, bradygaster#268, bradygaster#304, bradygaster#305)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

ERR_MODULE_NOT_FOUND vscode-jsonrpc\node

1 participant

@bradygaster