Skip to content

Merge dev to main: Publish docs site with updated messaging#997

Merged
bradygaster merged 105 commits intomainfrom
dev
Apr 17, 2026
Merged

Merge dev to main: Publish docs site with updated messaging#997
bradygaster merged 105 commits intomainfrom
dev

Conversation

@bradygaster
Copy link
Copy Markdown
Owner

Merges the latest dev branch into main to trigger the GitHub Pages docs deployment.

Includes PR #989 (Emphasize human-led productivity in docs) and any other accumulated dev changes.

This will auto-trigger the Squad Docs — Build and Deploy workflow to publish the updated docs site.

diberry and others added 30 commits March 30, 2026 07:43
Combines two CI fixes that both modify squad-ci.yml:
- #697: Skip ./client export smoke test + streaming-chat sample
  (workaround for @github/copilot-sdk ESM bug — vscode-jsonrpc/node)
- #698: Run existing patch-esm-imports.mjs after npm ci --ignore-scripts
  (proper fix — patches missing ESM extension at the source)

Resolution: #698's approach (running the patch script) fixes the root
cause, making #697's skip-based workaround unnecessary. The existing
patch-esm-imports.mjs (added for issue #449) was already solving this
problem but was skipped in CI because npm ci --ignore-scripts bypasses
the postinstall hook that runs it.

Both changes target the same workflow file and should ship together.

Refs: #697, #698

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(ci): implement 5 quick-win CI hardening improvements

- Add retry logic for npm install (reduces transient failures 20-30%)
- Tune job timeouts (prevents 6-hour hangs)
- Optimize npm caching (30-40% speedup)
- Conditional docs quality checks (skip on code-only PRs)
- Publish secret validation (fail fast on misconfig)

Closes diberry#121

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(ci): address @copilot review feedback on CI hardening PR

Fixes all issues raised by @copilot in PR #700:
- All retry loops now exit non-zero after exhausting retries (tracks success flag, exits 1 on failure)
- Path filter regex updated to include cspell.json (no dot prefix) alongside .cspell
- changes job now runs on both push and pull_request events (was PR-only, causing docs-quality to skip on push)
- Added cache: npm to publish-sdk and publish-cli setup-node steps for consistency

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Introduces a pluggable storage abstraction for the Squad SDK:
- StorageProvider interface with 24 async methods + 12 deprecated sync methods
- FSStorageProvider (default), InMemoryStorageProvider, SQLiteStorageProvider
- StorageError with typed error codes and operation context
- Dependency injection throughout all public API entry points
- Contract test suite covering all 3 providers
- CHANGELOG entry, README section, docs feature page
- Sample projects: SQLite and Azure Blob Storage

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…shed

feat(sdk): StorageProvider abstraction — complete migration + example providers
Implements 5 short-term CI hardening improvements:
- Lockfile stability check in preflight
- Composite action for npm setup (DRY)
- Cron schedule audit and cleanup (refs #120)
- GitHub API rate limit monitoring (values masked per security review)
- npm registry health check before publish

Security: Rate limit values masked in CI logs per RETRO review.

Refs: diberry#121

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Upgrades squad watch from simple triage poller to full autonomous work monitor.

- Plugin-based capability system (WatchCapability interface, CapabilityRegistry)
- 9 opt-in capabilities: execute, board, monitor-teams, monitor-email, two-pass, wave-dispatch, retro, decision-hygiene, self-pull
- Auto-execute mode (--execute) spawns Copilot/agents on eligible issues
- Platform abstraction via SDK PlatformAdapter (GitHub + Azure DevOps auto-detected)
- Config-driven via .squad/config.json (CLI flags override config)
- Circuit breaker + predictive rate limiting for API quota protection
- 30 new tests, blog post, ralph.md rewrite, CLI reference update
- Refactored monolithic watch.ts into watch/ directory structure

Closes #708
Add concurrency blocks with cancel-in-progress to squad-ci, squad-heartbeat,
squad-triage, squad-label-enforce, and squad-issue-assign workflows.

Scope: .github/workflows/ only (squad repo CI).
Template workflows for customer repos are a separate product concern.

Test: 20 assertions covering all 5 workflows.

Refs: diberry#122

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Audited all contributor-facing files on dev branch and identified 8 gaps
in external contributor experience. Proposes 7 deliverables prioritized
by maintainer time savings:

P1: Issue templates, good-first-issue curation, .squad/ explainer
P2: CODE_OF_CONDUCT.md, contributor FAQ, README contributing section
P3: SECURITY.md typo fix

Goal: contributors self-serve from docs instead of asking Brady/Tamir
the same questions repeatedly.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…osal

docs: contributor guide improvements proposal
devops(ci): add concurrency controls to 5 workflows (Phase 3 item A1)
Fixes off-by-N error in nap command's decision archival where newline
separators between entries weren't counted in the byte budget, causing
archives to exceed the target size.

Closes #123

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
fix(nap): account for separator newlines in decision archival budget
- changelog-gate now passes when .changeset/*.md files are present
- New changelog-protection gate blocks non-approved authors from
  editing CHANGELOG.md directly (approved: bradygaster, bots)
- Updated CONTRIBUTING.md with changeset workflow documentation
- Prevents merge conflicts when multiple PRs are open

Closes #745

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- CHANGESET_ADDED: use BASE...HEAD diff with --diff-filter=AM instead of
  hardcoded origin/dev...HEAD; use precise grep patterns and exclude
  .changeset/README.md to avoid false-positives from deleted files or
  repo documentation
- approved-authors: replace grep -qw (regex, [bot] chars unsafe) with
  tr + grep -qxF for exact fixed-string per-line matching
- Align npx changeset -> npx changeset add in error messages

Agent-Logs-Url: https://github.com/bradygaster/squad/sessions/c82281d6-e434-4f43-96d9-2618923e7c9a

Co-authored-by: diberry <41597107+diberry@users.noreply.github.com>
…ngesets

fix(ci): changelog-gate accepts .changeset/ files
The StorageProvider refactor (26047dc) incorrectly converted this
bootstrap utility from raw node:fs to FSStorageProvider. This file
detects .squad/ directories before the SDK is loaded and must not
depend on @bradygaster/squad-sdk.

Adds a regression guard test to prevent future re-conversion.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…dency creep

Prevents future sweeping refactors from converting zero-dependency
bootstrap utilities (like detect-squad-dir.ts) to use SDK imports.
These files run before the SDK is loaded and must stay Node.js-only.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Agent history changes belong on dev, not in feature PRs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds 4 verified zero-dependency bootstrap files to the protected list
(errors.ts, gh-cli.ts, output.ts, history-split.ts). Adds Sweeping
Refactor Rules section and SDK/CLI package boundary guidance.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…written)

Tasks completed:
- Task 0: PRE-CHECK: recorded decisions.md (334KB) and inbox (4 files)
- Task 1: DECISIONS ARCHIVE: triggered Tier 2 (>=50KB), archived 7 entries older than 7 days
- Task 2: DECISION INBOX: merged 4 inbox entries to decisions.md, deleted inbox files
- Task 3: ORCHESTRATION LOG: wrote 5 agent logs (EECOM, Procedures, Flight, FIDO, EECOM-changeset)
- Task 4: SESSION LOG: wrote detect-squad-dir-fix session log
- Task 5: CROSS-AGENT: appended team update to 4 agent history.md files
- Task 6: HISTORY SUMMARIZATION: checked—4 files exceed 15KB (EECOM 28.8KB, FIDO 23.3KB, Flight 23.7KB, Procedures 19.6KB). Deferred detailed archiving.
- Task 7: GIT COMMIT: staged .squad/ changes (15 files), now committing
- Task 8: HEALTH REPORT: decisions.md reduced from 334KB via Tier 2 purge; inbox count 0 (merged and cleared)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ification

- Widen test regex to catch subpath imports (@bradygaster/squad-sdk/*)
- Fix test filename reference in copilot-instructions.md
- Clarify core/ contains a mix of bootstrap and SDK-dependent modules

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Agent state (history, decisions, logs) should not be in feature PR diffs.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ero-deps

fix(cli): revert detect-squad-dir to zero-dependency bootstrap
* feat(cli): split loop command from PR #765 (pre-fix)

* fix(cli): address loop command review findings — lazy storage, adapter safety, gh preflight

- Replace module-level FSStorageProvider with direct node:fs calls (existsSync/readFileSync)
  to eliminate import side-effect
- Replace unsafe type-assertion adapter stub with createNoopAdapter() that implements all
  PlatformAdapter methods with safe no-ops / clear errors
- Add gh copilot preflight check before entering the loop (skipped when agentCmd is set)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(cli): address Copilot review — unused var, timeout validation, shutdown, path.resolve, docs

Closes #765

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(loop): add Scribe hard gate template changes for loop safety

Cherry-pick squad.agent.md.template changes from PR #765 that implement
decisions archiving hard gates (20KB/51KB thresholds) and history
summarization gates (15KB) — needed to prevent runaway file growth
during continuous loop operation.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(loop): address Copilot review — streaming output, worktree CWD, docs default

- Stream stdout/stderr from execFile to terminal in real-time
- Use workTreeRoot for consistent CWD in worktree scenarios
- Align docs description default with code ("Squad Loop")

Closes review comments on #767

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* test(loop): add runLoop() unit tests for Copilot review

- Test configured gate (configured: false returns early)
- Test missing loop.md file handling
- Test empty prompt body fatal error
- Test interval/timeout validation
- Test gh copilot preflight check

Addresses review comment on #767

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(scribe): archive decisions 2026-02-21 through 2026-03-25

- Move 71 dated entries (2026-02-21:2026-03-25) to decisions-archive.md
- Trim decisions.md to foundational directives + current entries (2026-03-26+)
- decisions.md: 12.1KB (from 385KB)
- decisions-archive.md: 373.8KB (append-only preserved)
- Archive gate: PASS (decisions.md now below 20KB threshold)

Archival timestamp: 2026-04-03T03:28:22.5673588Z

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* log(scribe): decisions archival 2026-03-27T21:42Z

- Archive log: decisions.md trimmed 385KB → 11.9KB (96.9% reduction)
- 71 entries (2026-02-21:2026-03-25) moved to append-only archive
- Archive gate: PASS (decisions.md < 20KB threshold)
- Context savings: ~373KB per agent load

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix(loop): address second-round Copilot review

- Derive teamRoot from detectSquadDir() path for worktree consistency
- Read loop scaffold from templates/loop.md instead of hardcoding
- Update docs prerequisites: gh+copilot required, --agent-cmd is escape hatch

Addresses review comments on #767

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: update EECOM history with second-round review learnings

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(skills): add pr-review-response skill for traceable review feedback

Teaches agents to reply to PR review threads after fixing issues,
making resolutions traceable and visible to reviewers.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…rade/init (#762)

* fix(cli,sdk): warn when squad.agent.md template is missing during upgrade/init

Closes #730

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: make InitResult.warnings optional, improve warning messages

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* [Scribe] Post-pipeline memory & decision consolidation

- Archive: 71 decisions (>30d), 10 (7-30d)
- Merge: 13 inbox decisions into canonical log
- Summarize: Flight, EECOM, FIDO histories (kept recent entries)
- Log: Bug-fix-pipeline session recorded
- Deduplicate: 73 unique decisions
- decisions.md: 385.8 KB -> 103.7 KB

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* skill(review): add architectural and security review skills

Add two new PR review skills to .copilot/skills/:
- architectural-review: module boundaries, dependency direction, export surface safety
- security-review: credentials, injection, workflow permissions, supply chain

Link from reviewer-protocol and copilot-instructions.md so Copilot references
them on every PR.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: remove .squad file leakage

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry and others added 28 commits April 7, 2026 08:04
Fixes #712 — docs site search becomes non-functional after navigating via
Astro View Transitions.

Re-initializes DOM element references via the astro:page-load event, which
fires on initial load and after each client-side View Transition. Event
listeners are properly torn down and re-attached to fresh DOM references.

Includes 2 Playwright regression tests for post-navigation search behavior:
- Search works after navigating via search result
- Ctrl+K opens search after View Transition navigation

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Add shared skip-guards.ts with isDockerAvailable() and dockerSkipReason()
- Split Docker-present tests from mocked tests so mocked tests always run
- Guard signal handlers behind SKIP_REASON check
- Stabilize flaky tests with proper cleanup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs: add contributor-to-core-team handoff process in CONTRIBUTING.md

External contributors can't use "Fix with Copilot" on review comments
(requires write access). Document the explicit handoff flow:
- Contributor: CI green + undraft + accept Copilot suggestions
- Core team: address remaining Copilot issues, review, merge

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: clarify changeset CI check is conditional on SDK/CLI source changes

Agent-Logs-Url: https://github.com/bradygaster/squad/sessions/d6374ed4-60de-4839-b33f-0ba5b311ec81

Co-authored-by: diberry <41597107+diberry@users.noreply.github.com>

* docs: fix misleading Copilot suggestion permissions claim

External fork contributors cannot use "Commit suggestion" or "Fix with
Copilot" buttons — both require write access. Updated to say "manually
apply in your fork and push" which is the actual workflow.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Dina Berry <diberry@users.noreply.github.com>
* ci: remove fork-added workflows not in ralph/test/publish categories

Remove 6 workflows added to the fork that don't fall into the
core categories (ralph, test, publish):
- squad-docs-links.yml (weekly link checker)
- squad-impact.yml (PR impact analysis)
- squad-repo-health.yml (multi-check repo health)
- squad-scope-check.yml (scope boundary enforcement)
- squad-pr-nudge.yml (stale PR nudges)
- squad-pr-readiness.yml (PR readiness checks)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: remove orphaned scripts, tests, and doc refs from workflow cleanup

Remove scripts and tests that were only used by the 6 removed workflows:
- scripts/pr-readiness.mjs, repo-health-comment.mjs, analyze-impact.mjs
- scripts/impact-utils/ directory
- test/pr-readiness.test.ts, test/scripts/parse-diff.test.ts, test/scripts/risk-scorer.test.ts
- Update copilot-instructions.md and pr-lifecycle SKILL.md to remove refs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* ci: add scope check to squad-ci.yml + remove orphaned scripts

- Add repo-health scope boundary check to squad-ci.yml (replaces removed squad-scope-check.yml)
- Remove 4 orphaned scripts no longer called by any workflow:
  check-bootstrap-deps.mjs, check-squad-leakage.mjs,
  architectural-review.mjs, security-review.mjs

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: brady gaster <brady.gaster@gmail.com>
Closes #935

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Closes #937

- Add prominent 'Git is mandatory' warning at the top highlighting data loss risks
- Expand Tips section with clear git-first workflow guidance
- Emphasize commits as insurance policy for team state
- Add concrete examples of when state is lost without version control
- Strengthen backup warnings for personal squad directory

Changes focus on making the git-first requirement unmissable and actionable.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Closes #934

Adds three reference documentation pages:
- coordinator-restraint.md: 6 restraint rules to prevent over-managing agents
- result-persistence.md: mandatory archival of agent results to orchestration log
- compaction-recovery.md: session state checkpoint mechanism for context recovery

Addresses all requirements from issue #934 per PR #859.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Closes #936

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
)

* fix: import skills to .copilot/skills/ instead of .ai-team/skills/

Skills canonical location is .copilot/skills/, not .ai-team/skills/.
Import was writing to the wrong path.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Apply suggestion from @Copilot

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* Persist sidebar scroll position across navigation

Implements sessionStorage-based persistence for the docs sidebar scroll position, so users retain their scroll state when navigating between articles. Refactors sidebar event binding for idempotency and adds Playwright E2E tests to verify scroll restoration works as intended.

* Optimize sidebar scroll persistence and test reliability

Refactored sidebar scroll tracking to use requestAnimationFrame, reducing sessionStorage writes during rapid scrolling. Added flushSidebarScroll to persist the last scroll position on navigation events. Updated event listeners to use the new logic. Improved test stability by switching to expect.poll for scroll restoration checks.

---------

Co-authored-by: Sturla Thorvaldsson <sturla@ibeinni.is>
…t CLI (#938)

* docs: deprecate REPL/interactive shell references, redirect to Copilot CLI

Mark \squad shell\ and no-args interactive shell as deprecated across
README.md, README.zh.md, CLI reference, getting-started guide, and
blog archive. All docs now point users to GitHub Copilot CLI as the
primary interface.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs: fix review findings — broken blog link, guide.md deprecation

Fix broken /guide/choose-your-interface/ link in blog archive note
(correct path: /docs/get-started/choose-your-interface/). Add
deprecation markers to guide.md for squad shell references.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Apply suggestions from code review

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* fix: remove deprecated link in choose-your-interface.md

The reference to Interactive Shell Guide is removed as the shell is deprecated.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* fix: inject CURRENT_DATE into all spawn templates (#960)

Agents spawned by the coordinator get a fresh LLM session with no
date context. The platform injects <current_datetime> into the
coordinator's session, but this was never forwarded to sub-agents.

Adds CURRENT_DATE: {current_datetime} to:
- Lightweight spawn template
- Full spawn template
- Scribe spawn template
- Explore agent inline prompt

Closes #960

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address PR review — rename to CURRENT_DATETIME, sync all templates

Addresses review feedback from copilot-pull-request-reviewer:
1. Renamed CURRENT_DATE to CURRENT_DATETIME (value is full ISO timestamp)
2. Fixed explore inline trailing punctuation
3. Synced canonical .squad-templates/ and all 3 .template copies
4. Verified byte-for-byte parity across all 5 files

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: address Q review — coordinator instruction, scribe charter, usage guard

Q found 3 gaps in the CURRENT_DATETIME fix:

1. Added explicit 'pass current datetime' instruction to coordinator's
   'On every session start' block (line 107), parallel to team_root
2. Updated scribe-charter.md to use CURRENT_DATETIME instead of
   'today's date' / '{today}' for decision consolidation headings
3. Added DATES warning to full spawn template: agents must use
   CURRENT_DATETIME, never infer or guess dates

All 9 affected files synced via sync-templates.mjs.
Zero leftover CURRENT_DATE references (verified by grep).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Removes references to non-existent .squad/skills/mcp-tool-discovery/SKILL.md
across all template and configuration files.

Closes #933

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…892)

* fix(cast): pass repo root to LocalAgentSource instead of .squad/ dir

* fix(cast): derive LocalAgentSource base path from paths (local: parent(projectDir), remote: teamDir)

- Local mode: pass path.resolve(paths.projectDir, '..') (repo root) instead of raw cwd
- Remote mode: pass paths.teamDir (team repo root) for correct agent discovery
- Add tests for nested subdirectory invocation and remote mode
- Fix SAMPLE_CHARTER to use ## Identity sections matching parseCharterMetadata()
- Update changeset description for clarity

Agent-Logs-Url: https://github.com/bradygaster/squad/sessions/d90f6c33-1da0-4f17-90f3-9bae6f3650da

Co-authored-by: bradygaster <41929050+bradygaster@users.noreply.github.com>

---------

Co-authored-by: Dina Berry <diberry@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: bradygaster <41929050+bradygaster@users.noreply.github.com>
Co-authored-by: Dina Berry <diberry@users.noreply.github.com>
…ear (#893)

* fix(watch): detect rate-limit errors

* fix(watch): narrow rate-limit detection to 429 and explicit rate-limit strings

Remove broad 403 match that misclassified auth errors as rate limits.
A bare 403 Forbidden (e.g. insufficient token scopes) is a permanent auth
error, not a transient rate limit. Now only matches 429 status codes and
explicit rate-limit message strings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Dina Berry <diberry@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…908)

- Dynamic listSync() scan replaces static STATE_DIRS/STATE_FILES arrays
- Eliminates silent orphaning when new state artifacts are added
- KEEP_LOCAL protects 5 files read from the working tree by runtime code
  that does not go through external-state resolution:
  config.json, manifest.json, workstreams.json, upstream.json,
  squad-registry.json
- Add 6 tests for runExternalize/runInternalize covering basic ops,
  dynamic scan of unknown entries, config preservation, round-trip,
  config cleanup, and empty .squad/ edge case

Closes #863

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…on tests (#883)

Co-authored-by: Dina Berry <diberry@users.noreply.github.com>
…ckend (#916)

Co-authored-by: Dina Berry <diberry@users.noreply.github.com>
…922)

* feat(watch): load external WatchCapabilities from .squad/capabilities/ (#918)

Add loadExternalCapabilities() that scans .squad/capabilities/ for .js
files, validates WatchCapability interface conformance, and registers
them in the CapabilityRegistry after built-in capabilities.

- external-loader.ts: loader with graceful error handling per file
- Wire into runWatch() after createDefaultRegistry()
- Export from watch barrel for downstream consumers
- Sample capability template: issue-pipeline.sample.js
- 6 vitest tests covering all edge cases
- Changeset for minor bump

* fix(watch): track child PIDs and cleanup orphans on exit (#921)

Add PidTracker class that tracks child process PIDs spawned during
watch rounds, kills them on exit/crash, and cleans up stale orphans
from previous crashed runs on startup.

- New pid-tracker.ts with cross-platform process tree kill
- Wire into watch/index.ts for startup cleanup and exit handlers
- Wire into execute.ts to track/untrack copilot session PIDs
- Add pidTracker to WatchContext interface
- Export from barrel for external consumers
- Add .watch-pids to .gitignore (runtime state)
- 11 vitest tests covering track/untrack, cleanup, and stale handling

Closes #921

* fix: address Copilot review comments on PR #922

* security: add startup warning banner + block built-in name hijacking

P0 mitigations from Worf's security review:
1. Print security warning listing all external .js files before importing
2. Block external capabilities from overwriting built-in names
3. New test: hijack attempt is rejected, built-in preserved

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ws shell fix (#946)

- squad init: remove automatic git init when CWD is inside a parent git repo
  (monorepo case). Now shows a warning and advises running from the git root.
  Closes #939

- Azure DevOps adapter: use shell: IS_WINDOWS for all execFileSync('az', ...)
  calls so the .cmd wrapper script resolves correctly on Windows. Also convert
  assertAzCliAvailable from execSync to execFileSync for consistency.
  Closes #941

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…964)

Wraps DOM lookups and event listeners in initSearch() driven by astro:page-load
event. Pagefind instance persists across navigations. Old event listeners torn
down before re-attaching. Global keydown listener registered once via guard flag.
Adds 2 Playwright regression tests for post-navigation search.

Closes #712

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: CarlosSardo <5127825+CarlosSardo@users.noreply.github.com>
* fix: address post-merge review findings (#876, #900, #875)

- Add YAML value escaping helper for skill metadata
- Replace catch(err: any) with catch(err: unknown) + narrowing
- Add type guards to replace unsafe type assertions
- Standardize deprecation messages on `gh copilot`
- Fix unsafe exports type cast in cross-package test

Closes #924, #925, #926

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: add changeset for review findings fix

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: trigger CI

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore(.squad): EECOM history — PR #942 rebase learnings

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: update changeset to accurately reflect PR changes (drop YAML escaping reference)

Agent-Logs-Url: https://github.com/bradygaster/squad/sessions/54f41407-61bf-4977-85b7-572341c47b62

Co-authored-by: bradygaster <41929050+bradygaster@users.noreply.github.com>

---------

Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
* fix(sdk): Teams adapter token security + migration guide

* fix(sdk): add refreshToken validation to loadTokens + fix changeset text

Add typeof refreshToken === 'string' to shape check in loadTokens to prevent
wasted AAD round-trips on incomplete cached tokens. Fix changeset to say
logout() instead of revoke().

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Dina Berry <diberry@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com>
Closes #939

- squad init no longer runs git init in monorepo subfolders
- Agent file placed at git root, .squad/ stays in subfolder
- Workflows skipped in monorepo mode (with warning)
- Path normalization with case-insensitive compare
- 20 tests passing (SDK + CLI level monorepo tests)
- PRD filed as #974 for full monorepo story
)

The Copilot CLI uses -p for non-interactive prompts, not --message.
Switches default invocation from gh copilot to copilot directly
(the standalone binary available on all platforms).

Changes:
- 8 source files: --message to -p, cmd changed to copilot
- loop.ts: aligned preflight to check copilot --version
- comms-teams.ts: fix pre-existing TOKEN_PATH typo from #906
- 2 test files updated (watch-execute + watch-capabilities)
- Changeset added for squad-cli + squad-sdk patch bumps

Fixes #980
Closes #874

Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Closes #986: emphasize human-led productivity in docs

Reframe the docs landing page and README around human-led productivity, strengthen the responsible AI callouts and feature messaging, and fix the garbled docs search UI text.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* docs(landing): revise hero copy per feedback

Replace hero headline with "Your agents bring your ideas to life" and
subhead emphasizing that Squad helps you spend less time prompting,
more time deciding.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* docs(landing): reword Responsible AI callout

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Brady Gaster <41929050+bradygaster@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@bradygaster bradygaster merged commit fe43dc9 into main Apr 17, 2026
8 of 9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

9 participants