Skip to content

docs: add feature pages for link, nap, and scrub-emails commands#1

Closed
diberry wants to merge 42 commits intomainfrom
squad/docs-undocumented-commands
Closed

docs: add feature pages for link, nap, and scrub-emails commands#1
diberry wants to merge 42 commits intomainfrom
squad/docs-undocumented-commands

Conversation

@diberry
Copy link
Copy Markdown
Owner

@diberry diberry commented Mar 14, 2026

Closes the documentation gap for 3 CLI commands that only had brief entries in the README command table and CLI reference.

Changes

  • features/link.md — documents \squad link\ for remote team linking
  • features/nap.md — documents \squad nap\ context hygiene command
  • features/scrub-emails.md — documents \squad scrub-emails\ PII removal
  • navigation.ts — adds all 3 pages to Features nav section
  • docs-build.test.ts — adds expected feature slugs

Context

Audit of README vs docs coverage found these 3 commands lacked dedicated feature pages. All other 12 commands had substantial documentation elsewhere.

bradygaster and others added 30 commits March 9, 2026 06:54
…ntributors roster (bradygaster#300)

- Add PR bradygaster#298 (active nav highlighting, favicon fixes) to blog 028
- Update Squad roster from Usual Suspects to Apollo 13 / Mission Control names
- Credit @tamirdresher PRs bradygaster#272, bradygaster#278-280, bradygaster#283
- Credit @IEvangelist PR bradygaster#298
- Credit @dkirby-ms PR bradygaster#243

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* docs(ai-team): session log and orchestration records

Session: 2026-03-09-docs-push-contributors
Requested by: Brady

Changes:
- Logged PAO orchestration: blog 028 update, CONTRIBUTORS.md refresh
- Logged FIDO orchestration: test baseline verification (22 passing)
- Logged session summary: docs push workflow with PR bradygaster#300 merge
- No decisions inbox entries to merge

* docs: add dedicated Docs Sprint Contributors section

Credit David Pine, Dina Berry, and Tamir Dresher with per-PR
attribution for the docs sprint — same format as v0.8.22 section.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…gaster#307)

* docs(ai-team): session log and orchestration records

Session: 2026-03-09-docs-push-contributors
Requested by: Brady

Changes:
- Logged PAO orchestration: blog 028 update, CONTRIBUTORS.md refresh
- Logged FIDO orchestration: test baseline verification (22 passing)
- Logged session summary: docs push workflow with PR bradygaster#300 merge
- No decisions inbox entries to merge

* docs: credit Pine, Dina, Tamir, Kirby on docs contributor page

- Add David Pine (@IEvangelist) to Code Contributors — PRs bradygaster#293, bradygaster#298
- Add Dina Berry (@diberry) to Code Contributors — PRs bradygaster#286, bradygaster#288, bradygaster#290, bradygaster#292
- Update Tamir Dresher with recent PRs bradygaster#278-280, bradygaster#283
- Add Dale Kirby to Code Contributors — PR bradygaster#243

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
)

Reviewed by Flight (Lead) and PAO (DevRel). Aligns Node.js version references across 4 doc files to match package.json engines (>=20.0.0).

Closes bradygaster#302
…ster#327)

Reviewed by Flight (Lead) and PAO (DevRel). Clean 1-liner adding templates/ explainer.
Closes bradygaster#289
…er#317)

Reviewed by Flight (Lead) and PAO (DevRel). Adds decision framework for human team members.
Closes bradygaster#313
Reviewed by Flight (Lead) and PAO (DevRel). Creates missing .squad/templates/human-members.md coordinator reference.
Closes bradygaster#312
Reviewed by Flight (Lead) and PAO (DevRel). New scenario page for remote Q&A with Squad.
Closes bradygaster#314
Add 4 new docs pages and update 3 existing:
- New: five-minute-start.md (5-minute quickstart)
- New: architecture.md (how Squad works)
- New: choosing-your-path.md (CLI vs SDK vs Copilot)
- New: glossary.md (key terms reference)
- Update: troubleshooting.md (common errors table)
- Update: first-session.md (jargon definitions)
- Update: navigation.ts (sidebar entries)

Closes bradygaster#301

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Root cause: four independent issues combined into a scroll storm:
1. Ink fullscreen clearTerminal path firing every render cycle
2. ~16 unsynchronized animation re-renders/sec from 3 timers
3. Unstable Static component keys causing Ink remounts
4. Layout shift from height toggling between processing states

Changes:
- Patch Ink fullscreen path (disable clearTerminal, incrementalRendering, trailing newline)
- Widen spinner/animation intervals (80->150ms spinner, 500->800ms pulse)
- Share terminal dimension hook with 150ms debounce
- Pin root height to prevent logUpdate cursor drift
- Keep conversation in live viewport (not Static scrollback)
- Stable UUID-based Static keys, responsive maxVisible
- Fix bump-build.mjs to produce valid semver prerelease format
- Fix marketplace test for Windows path compat

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
fix(cli): eliminate terminal scroll flicker and rerender storm
Closes bradygaster#343

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…cs-5

Docs update: comprehensive new-user experience improvements
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Reverts .squad/agents/pao/history.md to upstream/main so it no longer
appears in the PR diff.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Session: 2026-03-10-adoption-tracking
Requested by: Scribe

Changes:
- Merged 4 decisions from inbox to decisions.md: adoption tracking 3-tier architecture, implementation, append-only governance, ampersand style guide
- Updated Flight and EECOM history.md with team cross-agent updates
- Created orchestration logs for PAO (PR bradygaster#303 rebase), Flight (adoption proposal), EECOM (Tier 1 implementation)
- Created session log documenting adoption tracking architecture finalization
- Deleted decision inbox files after merge
New docs pages derived from public blog post analysis:
- scenarios/ralph-operations.md: outer loop deployment, mutex, logging, alerting
- scenarios/proactive-communication.md: two-way Teams webhooks and scanning
- features/issue-templates.md: squad-aware issue templates, routing labels
- features/reviewer-protocol.md: trust levels section (full/selective/self-managing)
- test/docs-build.test.ts: assertions updated for new pages

All content follows Microsoft Style Guide. No individual repo names — aggregate
references only per owner privacy directive.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove ralph-operations.md and proactive-communication.md — both document
infrastructure around Squad (webhooks, WorkIQ, deployment patterns) rather
than Squad itself. Content moves to Squad IRL repo.

Reframe issue-templates.md to clarify GitHub Issue Templates are a platform
feature configured for Squad routing, not a Squad feature.

Litmus test applied: if Squad doesn't ship the code/config, it belongs in IRL.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Created comprehensive documentation for working across GitHub personal
accounts and GitHub Enterprise Managed Users (EMU):

- New scenario page: scenarios/cross-org-auth.md
  - Three solution approaches: gh auth switch, Copilot instructions,
    Squad skill pattern
  - Git credential helper configuration
  - Common error messages and verification steps

- Updated troubleshooting.md with cross-org auth section
- Updated enterprise-platforms.md authentication section with cross-ref
- Added navigation entry for Cross-Org Auth scenario
- Updated test assertions in docs-build.test.ts

Follows Microsoft Style Guide (sentence-case headings, active voice).
Includes practical examples and cross-references to related pages.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Fixed test assertion arrays to match actual files on disk:
- EXPECTED_SCENARIOS: expanded from 7 to 25 entries
- EXPECTED_FEATURES: added new array with 32 entries

This resolves the sync issue identified in PR bradygaster#331 review where
test assertions were out of sync with docs/src/content/docs/ structure.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…ntent triage, remote access proposal

Session: 2026-03-11T01-27-57-post-work-orchestration
Agents: FIDO (Quality Owner), Flight (Lead)

Changes:
- Orchestration logs for FIDO (test assertion sync fix, commit 6599db6) and Flight (content triage skill)
- Merged 6 decisions from inbox to decisions.md
- Consolidated boundary heuristic: "Squad Ships It" (docs vs IRL) across content-triage skill and PR bradygaster#331 review
- Added content-triage workflow for external content integration
- Added phased rollout proposal for remote Squad access (Discussions → Copilot → Chat)
- Added PR trust levels spectrum (full/selective/self-managing)
- Cross-agent updates: FIDO, Flight, PAO history.md sync; boundary heuristic shared

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds a mandatory scannability framework for all content reviews:
- Paragraphs: narrative flow, conceptual explanations (3-4 sentences max)
- Bullet lists: features, options, scannable items (parallel structure)
- Tables: comparisons, structured reference data, attribute grids
- Quotes/indents: warnings, callouts, cited material
- Decision test: hunt-for-one-item = convert to bullets/table

PAO applies this on every PR with documentation impact.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
The coordinator's Acknowledge Immediately section now requires a task
context signal (Continuing/New task/Related pivot) before naming agents.
This helps users understand whether the system recognizes their message
as part of ongoing work or a fresh request.

Closes bradygaster#359

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
When prior conversation history exists, the ThinkingIndicator cycles
through context-aware phrases (e.g. 'Reviewing conversation context',
'Connecting to previous work') instead of generic ones. This gives users
immediate feedback that the system recognizes ongoing conversation.

- Add CONVERSATION_PHRASES array to ThinkingIndicator
- Add hasConversation prop threaded through App -> MessageStream -> ThinkingIndicator
- Derive hasConversation from messages array in App.tsx (true when agent responses exist)

Closes bradygaster#360

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Adds a background update check that runs when the interactive shell starts.
On startup, Squad checks the npm registry for a newer version and displays
a passive notification banner if one is available.

Key design decisions:
- Fire-and-forget: never blocks or delays shell startup
- 24-hour cache: avoids repeated network calls
- 3-second fetch timeout via AbortController
- Opt-out via SQUAD_NO_UPDATE_CHECK=1 env var
- Triple-wrapped error handling: silent on any failure

New file: packages/squad-cli/src/cli/self-update.ts
Modified: packages/squad-cli/src/cli-entry.ts (wired into no-args shell path)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…#368)

Add a curated catalog of 20 base roles that serve as starting points
during team casting, replacing expensive LLM improvisation with
deterministic role selection + lightweight project refinement.

Software Development (12): lead, frontend, backend, fullstack, reviewer,
tester, devops, security, data, docs, ai, designer

Business & Operations (8): marketing-strategist, sales-strategist,
product-manager, project-manager, support-specialist, game-developer,
media-buyer, compliance-legal

New features:
- useRole() SDK builder for squad.config.ts
- squad roles CLI command (--category, --search)
- listRoles(), searchRoles(), getRoleById() API
- generateCharterFromRole() for cast.ts integration
- Updated cast.ts to use catalog before generic fallback
- 148 tests, documentation page

Role content adapted from agency-agents by AgentLand Contributors (MIT)
https://github.com/msitarzewski/agency-agents

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Update coordinator and Init Mode prompts to reference the 20 built-in
base roles during team casting. The LLM now prefers catalog roles
(which have deep charter content) over improvising custom roles.

- coordinator.ts: buildInitModePrompt() includes base role catalog
- squad.agent.md templates: Init Mode Phase 1 step 3 matches to catalog
- Both SDK and CLI template files updated in sync

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add prominent recommendation to use copilot --yolo in step 4 of the
Quick Start guide. Squad sessions involve many tool calls, so --yolo
provides a smoother experience by skipping individual approval prompts.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- Bump minimatch 9.0.6→9.0.9 (ReDoS: GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74)
- Bump rollup 4.58.0→4.59.0 (path traversal: GHSA-mw96-cpmx-2vgc)
- Add --name to squad aspire Docker command to prevent unnamed orphan containers
- Align test and CLI on shared container name (squad-aspire-dashboard)
- Add SIGINT/SIGTERM/exit handlers to aspire integration test for cleanup

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
These three CLI commands were missing dedicated feature pages in the docs.
Each page follows the existing feature doc format with usage examples,
step-by-step explanations, and 'when to use' guidance.

- features/link.md — remote team linking
- features/nap.md — context hygiene and .squad/ compression
- features/scrub-emails.md — PII removal from state files

Also updates navigation.ts and docs-build test assertions.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@diberry diberry closed this Mar 14, 2026
diberry pushed a commit that referenced this pull request Mar 21, 2026
Add 31 tests defining the behavioral contract for the planned
autonomous-pipeline-core module (PRD Recommendation #1). Tests cover:

- Task→tier assignment via selectResponseTier with DEMO_CONFIG
- CostTracker per-agent accumulation across multiple agents/tasks
- Agent state transitions (idle→working→idle→done lifecycle)
- selectResponseTier routing properties (tier, modelTier, maxAgents, timeout)
- Task queue creation, role coverage, and findNextTask assignment logic
- simulateCost model contract (complexity→tokens→cost scaling)
- Core pipeline wiring without telemetry/dashboard/OTel dependencies

All 31 tests pass against current code. After the refactor splits
core logic from telemetry+dashboard, these same assertions verify
the extracted module preserves identical behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 21, 2026
- Standardize all 9 package.json names to @squad-samples/* format (Rec #3)
- Rewrite root samples/README.md as public-facing index with learning path (Rec #9)
- Standardize all 9 per-sample READMEs to consistent template (Rec #8)
- Apply Microsoft Writing Style Guide across all sample documentation
- Add SAMPLE-README-TEMPLATE.md for future sample authors
- Add 31 TDD tests for autonomous-pipeline core split (Rec #1 prep)

17 files modified, 1 new file. All markdownlint and cspell checks pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bradygaster pushed a commit that referenced this pull request Mar 22, 2026
Add 31 tests defining the behavioral contract for the planned
autonomous-pipeline-core module (PRD Recommendation #1). Tests cover:

- Task→tier assignment via selectResponseTier with DEMO_CONFIG
- CostTracker per-agent accumulation across multiple agents/tasks
- Agent state transitions (idle→working→idle→done lifecycle)
- selectResponseTier routing properties (tier, modelTier, maxAgents, timeout)
- Task queue creation, role coverage, and findNextTask assignment logic
- simulateCost model contract (complexity→tokens→cost scaling)
- Core pipeline wiring without telemetry/dashboard/OTel dependencies

All 31 tests pass against current code. After the refactor splits
core logic from telemetry+dashboard, these same assertions verify
the extracted module preserves identical behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bradygaster pushed a commit that referenced this pull request Mar 22, 2026
- Standardize all 9 package.json names to @squad-samples/* format (Rec #3)
- Rewrite root samples/README.md as public-facing index with learning path (Rec #9)
- Standardize all 9 per-sample READMEs to consistent template (Rec #8)
- Apply Microsoft Writing Style Guide across all sample documentation
- Add SAMPLE-README-TEMPLATE.md for future sample authors
- Add 31 TDD tests for autonomous-pipeline core split (Rec #1 prep)

17 files modified, 1 new file. All markdownlint and cspell checks pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry added a commit that referenced this pull request Mar 22, 2026
* test: TDD contract tests for autonomous-pipeline core split

Add 31 tests defining the behavioral contract for the planned
autonomous-pipeline-core module (PRD Recommendation #1). Tests cover:

- Task→tier assignment via selectResponseTier with DEMO_CONFIG
- CostTracker per-agent accumulation across multiple agents/tasks
- Agent state transitions (idle→working→idle→done lifecycle)
- selectResponseTier routing properties (tier, modelTier, maxAgents, timeout)
- Task queue creation, role coverage, and findNextTask assignment logic
- simulateCost model contract (complexity→tokens→cost scaling)
- Core pipeline wiring without telemetry/dashboard/OTel dependencies

All 31 tests pass against current code. After the refactor splits
core logic from telemetry+dashboard, these same assertions verify
the extracted module preserves identical behavior.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* samples: standardize READMEs, naming, and add template

- Standardize all 9 package.json names to @squad-samples/* format (Rec #3)
- Rewrite root samples/README.md as public-facing index with learning path (Rec #9)
- Standardize all 9 per-sample READMEs to consistent template (Rec #8)
- Apply Microsoft Writing Style Guide across all sample documentation
- Add SAMPLE-README-TEMPLATE.md for future sample authors
- Add 31 TDD tests for autonomous-pipeline core split (Rec #1 prep)

17 files modified, 1 new file. All markdownlint and cspell checks pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 22, 2026
…radygaster#506)

* feat: economy mode skill, governance proposals for bradygaster#500 and bradygaster#344

- Add .squad/skills/economy-mode/SKILL.md: Layer 3 cost modifier
  - Economy table shifts code tasks to gpt-4.1/gpt-5-mini, arch to sonnet
  - Activation: session phrase, config.json economyMode:true, or --economy flag
  - Layer 0/1/2 (user intent) always overrides economy mode
  - 💰 indicator in spawn acknowledgments
  - Confidence: low (first implementation)

- Add .squad/decisions/inbox/procedures-economy-mode-governance.md
  - Draft additions to squad.agent.md for Flight review
  - Economy mode paragraph after Layer 0, updated table, 💰 convention
  - Valid models catalog audit findings (claude-sonnet-4.6 missing, etc.)

- Add .squad/decisions/inbox/procedures-personal-squad-governance.md
  - Five gap analysis: Init Mode, consult mode detection, TEAM_ROOT semantics,
    charter templates, missing consult-mode skill
  - Proposed CONSULT_MODE spawn signal and 🧳 acknowledgment format
  - Proposed new consult-mode skill (post-governance-approval)

- Update procedures history.md with learnings

Closes bradygaster#500
References bradygaster#344

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat: economy mode for cost-conscious model selection (bradygaster#500)

Add economy mode that shifts model selection to cheaper alternatives
at Layer 3 (task-aware auto) and Layer 4 (default). Explicit user
preferences at Layers 0-2 are never overridden.

SDK changes:
- Add ECONOMY_MODEL_MAP and applyEconomyMode() to config/models.ts
- Add readEconomyMode() / writeEconomyMode() for config.json persistence
- Update resolveModel() in config/models.ts with economyMode option
- Update resolveModel() in agents/model-selector.ts with economyMode option

CLI changes:
- Add 'squad economy [on|off]' command for persistent toggle
- Add --economy global flag for session-level activation (SQUAD_ECONOMY_MODE=1)

Tests:
- 34 new tests in test/economy-mode.test.ts (all passing)

Economy model table:
  claude-opus-4.6   -> claude-sonnet-4.5 (architecture/review)
  claude-sonnet-4.6 -> gpt-4.1           (code writing)
  claude-haiku-4.5  -> gpt-4.1           (docs/mechanical)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Scribe: Wave 1 decisions merged (bradygaster#329/bradygaster#344/bradygaster#500)

- Merged 9 inbox decisions → decisions.md (personal squad impl plan, economy mode design/governance, persistent model preference, user directives, template sync, ESM fix)
- Deleted inbox files (merge complete)
- Updated agent histories: Flight (personal squad plan), EECOM (economy mode), Procedures (governance proposals)
- Appended team updates to agent contexts

Fleet Status:
- Flight: Personal squad design validated, 19-task plan across 4 PRs (MVP = PR #1+3)
- EECOM: Economy mode complete (34 tests), PR bradygaster#504 open
- Procedures: Economy + consult-mode governance drafted, PR bradygaster#503 open
- Directives: bradygaster#464 rate limit UX (soft dep bradygaster#500), bradygaster#502 bug P1 next-up, triage includes discussions

Ready for execution: EECOM Phase 1, Procedures Phase 3 (concurrent).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* fix: hard-fail on Node <22.5.0 with clear message (bradygaster#502)

node:sqlite (required by the Copilot SDK for session storage) was added
in Node 22.5.0. Previously Squad only warned and continued, leading to
cryptic ERR_UNKNOWN_BUILTIN_MODULE crashes later.

Changes:
- cli-entry.ts: replace soft warn+continue with hard process.exit(1) and
  a clear upgrade message when Node <22.5.0 is detected at startup.
  Remove now-redundant checkNodeSqlite() function and its call site.
- doctor.ts: add checkNodeVersion() check to squad doctor diagnostics
  so users can detect the version gap proactively.
- package.json (root, squad-cli, squad-sdk): correct engines field from
  >=20 to >=22.5.0, enabling npm/npx to warn at install time.
- test/cli/doctor.test.ts: add 5 tests for checkNodeVersion pass/fail
  paths; update check-count assertion.

Closes bradygaster#502

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 22, 2026
- Orchestration: Booster completed whatsnew.md version sync automation (2026-03-22T12:46Z)
- Merged decision: whatsnew auto-sync via prebuild script + Vitest test gate
- Updated PAO history: Docs audit finding #1 (stale version) resolved
- Removed merged inbox decision: booster-whatsnew-sync.md

whatsnew.md heading now syncs on every build (local + CI), keeping release docs current with package.json version.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 23, 2026
…#538)

* feat(sdk): add personal squad resolution and ambient discovery (bradygaster#508)

- Add personalDir to ResolvedSquadPaths
- Add resolvePersonalSquadDir() with SQUAD_NO_PERSONAL kill switch
- Add PersonalAgentMeta/PersonalAgentManifest types
- Add resolvePersonalAgents() for personal agent discovery
- Add mergeSessionCast() to merge personal into project cast
- Add ensureSquadPathTriple() for triple-root path validation
- Export all new functions and types

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* feat(cli): add personal squad commands and cast display (bradygaster#508)

- Add 'squad personal init/list/add/remove' subcommands
- Add 'squad cast' to show merged session cast
- Add --team-root CLI flag for explicit team root override
- Register commands in cli-entry.ts with help text

PR #2 of bradygaster#508 implementation plan.
Depends on: squad/508-sdk-foundation (PR #1)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 23, 2026
- Add preflight job scanning all packages for file: references and
  validating semver versions before any publish work begins
- Add npm pack --dry-run validation step to smoke-test job
- Disable ghost publish-npm.yml workflow via GitHub API
- Add purpose documentation to ci-rerun.yml
- Fix YAML parse issue: quote step names containing 'file:' colon
- Pipeline chain: preflight → smoke-test → publish-sdk → publish-cli

This is the #1 gate that would have prevented the v0.9.1 incident.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 23, 2026
- FSStorageProvider now accepts optional rootDir constructor parameter
- All methods validate resolved paths stay within rootDir when set
- Symlink traversal detected via realpath and blocked
- Added deleteDir() to StorageProvider interface and FSStorageProvider
- All new tests pass; existing 25 tests unaffected

Addresses RETRO findings #1 (path traversal) and #2 (symlink escape),
and Flight blocker (missing deleteDir).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 23, 2026
Non-ENOENT errors from FSStorageProvider now throw StorageError
instead of raw NodeJS.ErrnoException. StorageError strips internal
filesystem paths from the public message, preventing path leakage
to callers and logs.

Addresses Phase 1 backlog item #1 (RETRO finding #4).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 24, 2026
- FSStorageProvider now accepts optional rootDir constructor parameter
- All methods validate resolved paths stay within rootDir when set
- Symlink traversal detected via realpath and blocked
- Added deleteDir() to StorageProvider interface and FSStorageProvider
- All new tests pass; existing 25 tests unaffected

Addresses RETRO findings #1 (path traversal) and #2 (symlink escape),
and Flight blocker (missing deleteDir).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 24, 2026
Non-ENOENT errors from FSStorageProvider now throw StorageError
instead of raw NodeJS.ErrnoException. StorageError strips internal
filesystem paths from the public message, preventing path leakage
to callers and logs.

Addresses Phase 1 backlog item #1 (RETRO finding #4).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 26, 2026
Moves DECISIONS ARCHIVE from Task #5 to Task #1 in Scribe spawn template.
Adds HARD GATE label with exact byte thresholds (20480/51200).
Adds PRE-CHECK (measure before acting) and HEALTH REPORT (observe after).
Corrects history threshold to 15360 bytes (matches nap.ts constant).

Closes #33

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
diberry pushed a commit that referenced this pull request Mar 27, 2026
Adds explicit git staging rules to the spawn template in squad.agent.md
and reinforces staging hygiene in copilot-instructions.md. Prevents agents
from using git add . and committing unintended files.

Implements solutions #1 and #2 from #42.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants