Skip to content

CHANGELOG.md

Latest commit

 

History

History
745 lines (601 loc) · 76.3 KB

CHANGELOG.md

File metadata and controls

745 lines (601 loc) · 76.3 KB
Raw

Changelog

All notable changes to this project will be documented in this file.

[Unreleased]

Stable promotion notes

  • Stable v1.1.0 predates the following fixes; merging them into dev did not publish a fixed stable package. Carry these notes into the next stable release when it is actually promoted. No stable version or publication date is assigned here.
  • squad upgrade --self --dry-run reports the planned upgrade without installing it. squad upgrade --state-backend orphan --dry-run also avoids backend migration, source deletion, config changes and hook installation (#2303, #2295). Available in v2.0.0-preview.2 and later previews, not stable v1.1.0.
  • squad memory and memory.* share the backend-aware governed store (#2317, #2316), so CLI writes and MCP searches use the same storage. Available in v2.0.0-preview.3 and later previews, not stable v1.1.0. Transactional existing-memory backend migration (#2425, #2439) is available in v2.0.0-preview.4.

[2.0.0-preview.4] - 2026-11-09

Fourth Squad 2.0 preview. This release completes the repository migration to github/squad across published npm and NuGet package metadata, runtime links, templates, documentation, and gh-aw workflow package identity, adds transactional governed-memory backend migration with source-branch casting ownership, and includes memory lock coordination and Copilot SDK runtime compatibility fixes. npm continues to use insider as the canonical dist-tag with preview as a compatibility alias; latest remains on 1.1.0.

Added

  • Expose versioned machine-readable runtime and state-backend metadata in health reports (#2384).

Changed

  • Complete the repository move to github/squad: update published npm and NuGet metadata, SDK build and distribution defaults, CLI and SDK user-facing links, squad init templates, documentation links (github.github.com/squad), and the gh-aw-enlistment skill and install verifier for the github/squad/workflows package identity, explicit SQUAD_SHA manifest preflight verification, and legacy bradygaster/squad/workflows migration (#2408, #2410, #2411, #2412, #2432, #2433, #2435).
  • Keep all .squad/casting/ configuration on the normal source branch across every state backend, refresh managed git hooks to remove the obsolete casting staging block, reject runtime casting policy mutations, and align memory and identity safeguards with their actual scope (#2229, #2439).

Fixed

  • Preserve governed memory transactionally when migrating local or worktree storage to orphan or two-layer storage, including decision inbox records, the array index, configuration, audit archives, and tombstones; abort on destination conflicts or transfer errors before switching backend authority and retain source files until the configuration write succeeds (#2425, #2439).
  • Serialize governed-memory index updates across local store instances and processes, and coordinate memory index locks across worktrees with the configured state backend (#2356, #2383).
  • Hold @github/copilot-sdk below 1.0.29 so fresh installs do not fail with ERR_PACKAGE_PATH_NOT_EXPORTED when vscode-jsonrpc 10 breaks the CLI's ESM import patch, and support the Copilot SDK bundled runtime in Squad.Agents.AI (#2373, #2414, #2416).
  • Read legacy ## Role and ## Owns charter sections during team capability advertisement so declared implementers and reviewers are not reported as advisory-only (#2381).
  • Preserve customized squad-ci workflows during squad upgrade (#2382).
  • Return a failing exit status from squad doctor when validation checks fail (#2376).
  • Replace the invalid \Z regex anchor in history-shadow section parsing so terminal sections match without duplicating headers and keep a blank line before the next section (#2374).
  • Bind standalone archive checksums to validation records before release upload and remove deprecated Homebrew cask syntax from generate-packaging.mjs (#2377, #2437).

[2.0.0-preview.3] - 2026-10-29

Third Squad 2.0 preview. npm continues to use insider as the canonical dist-tag with preview as a compatibility alias; latest remains on 1.1.0. Homebrew, WinGet, and stable promotion remain held. Optional built-in roster members remain opt-in through squad roster add, and multi-machine watch claims remain off by default.

Added

  • Add the ADR-002 work-claim contract and the git-ref claim provider. squad watch can opt in with --claims git-ref to coordinate several watchers through fenced, renewable leases; the default none provider adds no cross-watcher exclusion (see Changed for default-path compatibility). Claimed-work prompts, bounded watch runs, stale-before-dispatch renewal, privacy-preserving counters, and process-group fencing make the opt-in path observable and fail closed (#2302, #2337).

Changed

  • Default-path squad watch compatibility: these changes apply even with the default none claim provider. A malformed, empty, or unreadable .squad/config.json now stops squad watch instead of silently falling back to defaults; only an absent file selects defaults. watch.claims is now a reserved key, and an invalid value stops watch with an error instead of being ignored. execute now applies needs:* machine capability routing (with no capabilities manifest, every issue still passes), and one watch round never dispatches the same issue twice across execute and fleet-dispatch, whatever provider is configured (#2337).
  • Point MCP guidance at the configuration files each supported host actually reads, let the Claude coordinator inherit all MCP tools already present in its session, keep Copilot tool permissions independent from MCP injection, and mark the old cross-machine task-file skill as an unimplemented proposal in favor of opt-in watch claims (#2312, #2329, #2331).
  • Scope squad cost to the newest Squad shell session by carrying the shell session id in usage records, while retaining fallback behavior for older ledgers (#2348).
  • Make governed memory class names case-insensitive, reject unknown classes, open the same backend-aware memory store from squad memory and squad_state, degrade safely when an optional host memory adapter is unavailable, and bound registered provider calls with governance checks on recalled data. The memory.promote tool now requires targetClass and refuses FORBIDDEN and TRANSIENT targets. squad memory commands, including squad memory classify, now fail outside a squad instead of creating a stray .squad/; like squad_state, they do not yet support a linked project on the orphan or two-layer backend, tracked in #2320 (#2315, #2317, #2319, #2333).

Fixed

  • Migrate legacy Squad 0.9.x casting registries whose agents and assignments are arrays when identity, role, membership, and timestamp evidence is unambiguous. The migration preserves byte-exact originals and assignments, is idempotent, and performs no writes in dry-run mode. Malformed or ambiguous casting stays unchanged and is reported as still needing repair; it no longer blocks the rest of squad upgrade, including managed bridge rewrites, so the command does not falsely claim a complete casting repair. squad upgrade also rewrites a teamRoot in .squad/config.json that points at the project itself (for example, an absolute path) to "."; --dry-run only reports the change (#2365).
  • Accept CRLF-normalized casting manifests and normalize managed casting JSON to LF without changing its meaning (#2269).
  • Detect missing, untracked, or modified history archives in squad doctor, and refuse squad nap history compaction when an ignored archive would make a tracked history trim uncommittable (#2325, #2350).
  • Preserve draft publication after a best-effort npm staging-tag cleanup returns 403; recovery remains read-only when the package pair is already complete and does not expand credentials or blindly retry the denied mutation (#2353).
  • Increase the Windows import-check allowance without changing shipped runtime behavior (#2352).
  • Correct plugin spawn-path documentation and history compaction documentation (#2324, #2327).

Security

  • Standalone archives now vendor Node.js 22.23.4. The official Node.js October 21, 2026 security advisory identifies fixes for CVE-2026-111497 (Brotli decoder out-of-bounds write with possible remote code execution), CVE-2026-106074 (reused entropy caches in snapshots and SEAs), CVE-2026-105481, CVE-2026-105482, CVE-2026-106069, CVE-2026-106072, and CVE-2026-106073 in the 22.x line; the official Node.js v22.23.4 release notes record the corresponding 22.x fixes, including both Brotli remediation changes. Runtime downloads are bound to Node's signed SHASUMS256 data and fail closed without falling back to an older runtime. Preview.1 and preview.2 standalone archives embedded Node.js 22.20.0; standalone users should download preview.3 again. npm packages do not embed Node, so npm users must run a patched host Node.js version (22.23.4 or a newer patched release). The package engines field remains a compatibility floor, not a security-patch guarantee (#2368).

[2.0.0-preview.2] - 2026-10-25

Second Squad 2.0 preview. Published primarily to the npm insider dist-tag, which powers squad upgrade --self --insider, with preview retained as a compatibility alias; latest stays at 1.1.0. This release focuses on upgrade safety, state-bridge lifecycle, health compatibility, and dogfood fixes discovered after preview.1.

Added

  • Recognize optional charter Examples sections without a noncanonical-section warning and preserve them through structured SDK edits (#2275, #2276).

Fixed

  • Refuse to overwrite external state owned by a different project (#2283).
  • Generate resolvable versioned squad_state bridge declarations, probe them in squad doctor, report bridge identity in health output, and terminate stdio servers when their host transport closes (#2301).
  • Make squad health accept legacy charter identity forms and built-in support agents, ignore routing headers/separators/placeholders, warn rather than fail for missing identity blocks, and report optional Rai/Fact Checker charters absent from team.md as INFO (available but not configured). squad upgrade never modifies team.md; opt in explicitly with squad roster add <rai|fact-checker|all> (#2303; #2298, #2234, #1785).
  • Accept documented legacy routing headers, column orders, and flattened long tables while still failing closed on missing/off-roster targets and zero parseable rules; report duplicate or conflicting work types deterministically (#2307).
  • Fix preview commands and migrations: list configured clients, record the Rai → rai case-only rename, show the project name in upgrade previews, expire update-check caches after 24 hours, route squad_decide to the active workstream inbox without over-truncating slugs, and remove local-mode/Node deprecation diagnostics (#2303; #2299, #2174).
  • Allow backend root aliases only for list-shaped operations; file and destructive operations reject them before accessing or erasing the state tree (#2301).
  • Make squad upgrade --self honor --dry-run, follow the installed prerelease channel through insider, and refuse downgrades unless --force is supplied (#2303; #2295).
  • Parse YAML block-sequence arrays and quoted scalar/inline-array values in skill frontmatter (#2236).
  • Make squad upgrade content-aware and idempotent across managed templates, skills, workflows, mirrors, backups, obsolete files, and line endings, with exact dry-run reporting and verified .local-backup preservation (#2303; #2297, #2266, #2047, #2232).

[2.0.0-preview.1] - 2026-10-23

First Squad 2.0 preview. Published primarily to the npm insider dist-tag, which powers squad upgrade --self --insider, with preview retained as a compatibility alias; latest stays at 1.1.0. Upgrade guidance, the tested old-version × OS upgrade matrix and the full list of breaking changes live in Upgrading to Squad 2.0.

Breaking

  • Personal squads, consult mode and the global squad (--global) were removed. Existing personal-squad/ and global .squad/ directories under the user profile are no longer read or written and may be deleted manually. Squad resolves .squad/ only from the current directory and its parents; squad status, squad doctor, squad cast and squad cost outside a project now fail with "No squad in this directory … run squad init", and squad init / squad upgrade only ever write inside the project .squad/. The SDK exports, CLI subcommands, flags, environment switches, templates and coordinator sections that backed the removed features are gone; resolveGlobalSquadPath() remains only as the base of externalized project state (squad externalize). A retired-symbol gate (test/retired-symbols.test.ts) keeps the removed concepts out of source, templates, skills, docs, help text, schemas and the built package output (#2279).
  • @bradygaster/squad-sdk/clients is now a deprecated alias for the canonical @bradygaster/squad-sdk/client subpath, and @bradygaster/squad-sdk/backend is exported only from the ./backend subpath, not from the root barrel (#2251, #2253).
  • Plain squad init and squad upgrade (without --client) remain Copilot-only and no longer add .claude/worktrees/ or NUL to .gitignore unless --client claude is enabled; .squad/backend/ is added to .gitignore on upgrade (#2251).
  • SQUAD_BACKEND_URL alone no longer enables the squad_backend_* MCP tools (pass --experimental-backend or SQUAD_EXPERIMENTAL_BACKEND=1). createSquadBackend({ kind: 'durable-http', ... }) and DurableHttpSquadBackend require an explicit baseUrl (https://, or http:// only for localhost) and optional token (#2253).
  • Coordinator instructions and squad_state_* tools separate mutable runtime state from static team configuration (team.md, routing.md, config.json, charter.md) and forbid hand-editing .squad/casting/ or killing processes by image name (#2254).
  • Upstream precedence is clarified: earlier entries in upstream.json win conflicts (the 1.x docs said later-wins; the code implemented neither) (#2278).
  • The dangling ./shell/sdk-bridge CLI subpath export, which pointed at a module that does not exist in the package, was removed (#2285).

Added

  • Seven AI hosts via squad init --client <list> and squad upgrade [--dry-run] --client <list>: GitHub Copilot, Claude Code, Kiro, OpenCode, Cursor, OpenAI Codex and Google Antigravity (or all), each receiving a native coordinator projection and squad_state MCP wiring; configured hosts persist as portable slugs in .squad/config.json clients[] (#2251).
  • Shared charters and capability negotiation in @bradygaster/squad-sdk/client (HostProjection, createClientAdapter, installClients, uninstallClients, CAPABILITY_TOKENS_BY_HOST, capabilityFlagsFromTokens, resolveEffectiveCapabilityTokens), with effectiveCapabilities = client ∩ backend ∩ policy (#2251, #2277).
  • Transactional casting repair in @bradygaster/squad-sdk/casting: squad upgrade (including --dry-run) normalizes handwritten .squad/casting/registry.json per record, backfills empty registries from .squad/team.md using provable .squad/agents/<id>/charter.md folder IDs, archives pre-repair originals under .squad/casting/handwritten-archive-<sha256>/, never rolls back a durable commit, and fails closed with an actionable dropped list (#2252).
  • Experimental backend and harness SPI in @bradygaster/squad-sdk/backend (BACKEND_CONTRACT_STAGE = 'experimental'): SquadBackend, createSquadBackend, LocalSquadBackend, DurableHttpSquadBackend, createFileStateStore, createStateBackendStore, HarnessAdapter, DefaultHarnessRegistry, validateExtensions, plus 11 opt-in squad_backend_* tools in squad state-mcp, validated against the squad-protocol-v2.0-rc1 golden conformance trace (G1–G9) (#2253).
  • Runtime upstream inheritance (F1): the squad_state_upstreams tool resolves every declared upstream from its locally synced snapshot with upstream:<name>@<ref> provenance, deterministic precedence, diamond de-duplication, cycle detection and missing / invalid / unavailable / stale diagnostics, never fetching at session start; snapshot reads are confined and race-safe (lstat walk, size budgets, O_NOFOLLOW + fstat verification); git sources are allow-listed to https://, ssh:// and git@host:path with remote helpers and the file protocol disabled; inherited content is labelled UNTRUSTED; squad doctor and squad status report upstream state (#2278).
  • Squad feature × host matrix documentation with live Claude Code and OpenCode runs and bridge tests (#2277).
  • Attested old-version × OS upgrade matrix (0.9.1 through 1.1.0 on Windows and Linux) rendered into the upgrading guide from test-fixtures/spec/suite-v0.2/upgrade-matrix.json (#2282).
  • test/package-exports-targets.test.ts verifies every exports target of both packages exists in the built dist/ (#2285).

Fixed

  • squad_state_health reports State backend: local|orphan|two-layer plus storage class and team squad dir (F6); squad_state_list without dir lists the root on git-backed backends instead of failing (F8); Claude Code declares background-runs in capability-matrix.json and CAPABILITY_TOKENS_BY_HOST (F7) (#2279).
  • Shared JSON, TOML, .gitignore and markdown marker merges preserve existing line endings, indentation and user entries atomically, refuse malformed JSON or commented opencode.jsonc, and restore preexisting files byte-for-byte via uninstallClients (#2251).
  • When a non-local state backend is configured, createStateBackendStore places lock files in a deterministic machine-local directory derived from the shared .git common dir so .squad/backend/ is never materialized in the working tree (#2253).

Known limitations

  • Squad ships the backend interfaces, the local backend and the durable-http client; it does not bundle a remote DurableSquad server. Server-side DurableSquad Phase 2 integration (remote durable approvals and lease-epoch coordination) is pending, and squad state-mcp bundles no execution harness (executionAvailable: false until a HarnessAdapter is registered).
  • Squad 0.9.1's squad upgrade --dry-run is not dry (finding F3 in the upgrade matrix); no older CLI has a newer-version guard, so never run an older CLI against an upgraded repository. There is no supported downgrade.

[1.1.0] - 2026-10-19

Added

  • Add a central, provenance-aware model resolver with explicit precedence across user, config, session, charter, task, and default sources; forward-only availability and cost-policy fallback; platform-default omission; lifecycle telemetry; and stable SDK exports (#1720).
  • Add GA-backed quality-first, balanced, and economy model profiles with task-aware tier selection, persistent configuration, live-model availability handling, and updated public catalog/fallback chains (#1598).
  • Add opt-in HydraFusion model support and a hydrafusion quality profile while keeping preview models out of default chains and GA recommendations; unavailable HydraFusion selections fall forward safely within the active cost ceiling (#2014).
  • Implement persisted squad cast --name <name> --role <role> and squad hire, live rebuilds for squad build --watch, and an explicit unsupported-provider error for squad memory provider --provider copilot (#2191, #2192, #2193).
  • Add the draft squad-charter/v0.1 artifact profile, explicit conformance profile selection, validation-before-runtime compilation, typed diagnostics, operation-exact capability metadata, canonical and lossless extension-preserving serialization, a schema-defined language-neutral conformance manifest, and implementation-independent specification documents (#2069, #2074).
  • Add atomic repository-scoped createIfAbsent operation across all state backends (local, git-notes, orphan-branch, two-layer), StorageProvider implementations, StateBackendStorageAdapter, and the squad_state_create_if_absent MCP tool with StateKeyConflictError and StateBackendUncertaintyError (#1947).
  • Persist runtime turn starts and usage events to a backend-aware JSONL ledger, report telemetry coverage, and make squad cost prefer structured telemetry before falling back to self-reported orchestration logs (#1716, #2063).
  • Track context-window utilization from runtime and estimated token data, publish typed events and OpenTelemetry metrics, warn interactive-shell users at a configurable threshold, and report estimated utilization from squad watch (#1718, #2064).

Changed

  • Add a human-triggered protected-main promotion mode that validates an existing sanitized release branch and opens a bot-authored pull request for independent maintainer approval.
  • Allow automatic economy-profile resolutions to continue into available cheaper tiers after exhausting the initially selected tier.
  • Update squad economy status examples to use the current economy substitution model IDs.
  • Align native Squad workflow installation and bundled enlistment guidance with the exact gh-aw v0.91.5 compiler, preserving strict package ownership and integrity verification, supporting an explicit schedule seed, verifying 24-hour failure-report retention digests, and binding activation App tokens to the full current repository identity (#2195).
  • Make issue-assign the sole Copilot assignment workflow, fail visibly on missing tokens or unconfirmed API responses, dispatch automated auto-assign handoffs explicitly, and disclose deterministic keyword triage provenance (#2156).
  • Clarify Ralph's monitor-only role and reserve pull request merging for humans in the distributed reference templates (#2156).
  • Limit team markdown table parsing to supported roster sections, preserving the legacy Team Roster heading while excluding auxiliary tables (#2079, #2156).
  • Update bundled enlistment guidance for repository-scoped Agentic Research bootstrap proposal titles, including compatible legacy-title recognition and the required package-update-before-rename order.

Fixed

  • Preserve user-authored .github/copilot-instructions.md content during squad init, squad upgrade, and squad copilot by updating only the Squad-managed marker block (#2186, #2221).
  • Spill multiline and oversized Windows squad watch --execute prompts to temporary Markdown files so cmd.exe cannot truncate them at the first newline, and report dispatched issue counts in round summaries (#2070).
  • Automatically migrate supported unversioned casting state before upgrading managed files (including already-current upgrades), support historical assigned_at casting timestamps with conflict detection and preserved original dates, archive original registry/history bytes without overwriting, and fail closed on unsupported or inconsistent state (#2190).
  • Keep standalone squad_state MCP commands portable in shared project configuration while retaining machine-local launch resolution, and preserve existing destination newline style when upgrading managed text files and refreshing coordinator capabilities (#2190).
  • Validate real numeric task and epic issue references and add an explicit activation reader for independently verified current-state-authorized reconciliations, preserving valid legacy activation records while rejecting ambiguous, malformed, or unverified replacements.
  • Bind native review runs whose API metadata identifies the PR head through exact PR base/head linkage while preserving base-controlled workflow provenance, and validate required Coordinator and Coding Agent sections and the disabled auto-assignment marker before publishing a generated Cast.
  • Give the native review safe-output guard read access to same-repository workflow run evidence needed for signed Bootstrap provenance, and correct Cast generation guidance for Scribe's decision-only role and native specialist assignment.
  • Keep automatic bootstrap limited to the Cast PR and linked proposals issue, publish research only on explicit /squad research before triage, and recognize the deterministic bootstrap Cast branch during team-required command gating (#2194).
  • Fix squad init re-run on an existing project leaving the squad.agent.md first-response greeting stamped with a stale version (stampVersion in squad-cli and stampVersionInContent in squad-sdk now update resolved SemVer literals idempotently) (#1995).
  • Allow state tools to append evidence to the exact Rai and Fact Checker audit-trail keys while rejecting writes and deletes, reconcile built-in scaffold charters with the append-only evidence contract, and make orphan-backed state appends compare-and-swap against the exact ref snapshot (#2159).
  • Fix squad-heartbeat.yml's "Repair orphaned squad labels" step returning 403 when a fork PR closes by switching the trigger to pull_request_target across all 5 synced workflow copies (#2155).
  • Support both teamRoot forms for linked teams (the team repository written by squad link and the team's .squad/ directory shown in docs) via teamSquadDir on ResolvedSquadPaths, and export MUTABLE_STATE_PATHS and isMutableStateKey() from @bradygaster/squad-sdk/tools (#2107, #2119).
  • Fix squad init and team casting failing on Windows with EPERM: operation not permitted, fsync and handle Windows directory rename EPERM lock contention in the durable casting registry (#2106, #2114).
  • Validate squad doctor team state files (team.md, routing.md, agents/, casting/registry.json, decisions.md) against the resolved team root in remote (linked) mode instead of the local .squad/ stub (#2056, #2057).

[1.0.1] - 2026-10-03

Fixed

  • squad health now accepts casting registry persistent names as valid routing references alongside registry IDs, avoiding false unknown-agent failures (#2165).
  • The immutable activation action now binds to an approved installer that fails closed on checksum-download failure, invalid checksum entries, or archive tampering, with offline pinned-installer regression coverage (#2167).

Changed

  • Root, SDK, and CLI npm versions advance together to 1.0.1 to satisfy the existing release and npm publication workflows. The CLI SDK dependency floor is now >=1.0.1; SDK source is unchanged from v1.0.0.
  • Agentic Workflow activation installs the latest stable standalone GitHub Release by default, independently of immutable workflow/action source pins, and no longer rewrites a CLI version pin after publication (#2167).
  • Consumed only the CLI health persistent-routing patch changeset. Historical changesets are unchanged; this release does not promote unrelated dev changes or republish Squad.Agents.AI NuGet 1.0.0.

[1.0.0] - 2026-10-02

Squad CLI and SDK (the @bradygaster/squad-cli and @bradygaster/squad-sdk npm packages) graduate to 1.0.0. This is a stabilization release: there are no breaking API or command changes from 0.13.1. It marks the npm packages as stable per the project's independent per-package versioning policy (distinct from the already-stable Squad.Agents.AI NuGet package, which reached 1.0.0 separately in #2143).

Added

  • Add the gh-aw-enlistment skill: an operationalized, safety-gated guide for enlisting a repository into Squad via GitHub Agentic Workflows (gh aw) (#1946).
  • Install Squad's seven agentic workflows (including squad-bootstrap and squad-retro), fifteen runtime resources, and enlistment skill from one isolated native package, with fail-closed manifest, ownership, path, and hosted bootstrap verification (#2005).
  • Publish and validate a versioned producer-owned agent identity provenance contract with stable IDs, rename preservation, retirement tombstones, durable manifest-backed roll-forward transactions, and repository-scoped work-to-agent activation bindings.
  • Automate insider, preview, and stable distribution through npm, standalone archives, Homebrew, and WinGet (#1593).
  • Add .squad/templates/README.md to squad init output explaining which files are runtime inputs vs bootstrap templates (#1494, #1949).

Changed

  • Removed the blanket "Experimental — Squad is alpha software" disclaimer banner from 87 documentation pages under docs/src/content/docs/**. Genuine preview-channel and feature-specific warnings (SDK-first mode, GitLab Issues Mode, the plugin security MVP gate, and preview/insider release channels) are unchanged and still documented.
  • @bradygaster/squad-cli's declared dependency floor on @bradygaster/squad-sdk is now >=1.0.0 (previously >=0.11.0), reflecting the SDK's own stabilization.
  • Require gh-aw v0.89.22 across the Squad workflow package, enlistment guidance, integrity contract, CI, and hosted E2E controller, proving the exact compiler version during enlistment (#2118).
  • Make shipped Squad templates, build inputs, CI policy, and issue-routing automation independent of the repository's current team state, and refresh shipped reskill and template skill scaffolding (#2015, #2025, #2029, #2030).
  • Require coordinators to preserve user-approved scope and prevent directive or reflection capture from falling back to local Markdown proposals (#2110).
  • Use the base-controlled deterministic relay's native Squad Review / review job as the authoritative review result only when it validates the exact trusted automatic workflow run (#2109).

Fixed

  • Harden the Squad GH-AW source contract across command routing, approval relay (squad_approval_relay), review guard (squad-review-guard.mjs), install verification (squad-install-verifier.mjs), and bootstrap-PR-fallback signed provenance attribution (#2116, #2120, #2136, #2141, #2145, #2147, #2148, #2149).
  • Transport automatic bootstrap Cast and research payloads through bounded, integrity-checked chunks (#2043), keep compiled workflow expressions valid at GitHub runtime (#2037), and close installed runtime resources.
  • Require GitHub Issues to be enabled before installing Squad Agentic Workflows, and correct first-install credentials guidance in gh-aw-enlistment (#1973).
  • Standardize the Rai built-in agent on the canonical lowercase directory/template ID rai and migrate legacy .squad/agents/Rai/ directories during squad upgrade (#1990).
  • Reject ambiguous legacy casting generations, revision-bearing snapshot keys in legacy Cast genesis history, and incomplete or malformed casting history before synchronizing team capabilities.

[0.13.1] - 2026-08-26

Fixed

  • Allow runtime state tools to persist the casting policy, registry, and history keys required by the coordinator (casting/policy.json, casting/registry.json, and casting/history.json), while continuing to reject unrelated casting paths (#1876, #1898).
  • Preserve user-supplied env on the squad_state entry in .mcp.json across squad init and squad upgrade runs (#1894).

[0.13.0] - 2026-08-25

This release is focused on hardening the gh-aw (Agentic Workflows) integration shipped in v0.12.0: the install contract, workflow router, plan lifecycle, dispatch reliability, and CI coverage are all tightened. It also adds squad health, fixes squad watch/squad loop externalized-state routing, fixes squad nap archival, and hardens the SDK's state and scheduler paths.

Added

CLI

  • squad health — new readiness diagnostics command; shared workflows can gate on environment readiness before running (#1877).
  • {prompt} token in custom watch/loop agent commands as an unambiguous placement for the generated prompt; the existing -p <prompt> fallback is preserved (#1708).
  • squad doctor now checks that every eol=lf-pinned file is actually LF on disk (not just in the index), names stale files, and points at npm run fix:crlf; closes #1793.
  • Two stop signals for squad watch/squad loop previously parsed but never read — --sentinel-file <path> and .squad/ralph-stop — are now wired to the graceful shutdown path; closes #1711.
  • Workflow files are now backed up before squad upgrade refreshes them (#1709).
  • Shell detection now fails loudly instead of silently skipping when no POSIX shell resolves (#1857).

gh-aw / Agentic Workflows

  • feat(workflows): add advisory Squad reviewer — a lightweight advisory review step added to the gh-aw workflow so plan output is reviewed before activation (#1871).
  • Team Guard Step TG-2 — roster certification emitted into generated workflow output, letting an outer coordinator verify the cast is complete before dispatching (#1837).
  • squad-deps-worker — a new fail-closed dependency-manifest worker that validates and routes dependency-update tasks; Wave 1 protected-files.exclude included (#1882, #1883, #1888).

SDK

  • feat(sdk): advertise real team capabilities in squad.agent.md — a generated Team Capabilities block lists the actual cast, supported task types, and domain-to-agent routing hints; the block is rewritten on init, upgrade, and cast changes (#1881).
  • "max" added to SquadReasoningEffort and VALID_REASONING_EFFORTS to match Copilot SDK 1.0.9 (#1693).

Release / distribution

  • Activation pin drift guard: a daily CI job checks that the Squad CLI activation pin in gh-aw templates matches the latest published release and opens a PR when it drifts (#1855).
  • Activation pin is now automatically updated when a new CLI version publishes (#1858).

Changed

  • (cli) Model catalog tiers and fallback routing updated for GPT-5.6 Sol, Terra, and Luna, and Gemini 3.1 Pro. Terra is the new default standard model for code and prompt tasks; Luna is its economy fallback (#1749, #1750).

Fixed

gh-aw / Agentic Workflows — install and activation

  • fix(gh-aw): preserve Squad CLI install contract — all four gh-aw workflow templates (squad.yml, squad-cast.yml, squad-research.yml, squad-review.yml) now install the Squad CLI before gh aw install, preventing squad from being absent when the gh-aw extension invokes it; this was the root cause of new-repo activation failures (#1887).
  • fix(gh-aw): bump activation CLI pin 0.11.0 → 0.12.0 for new-repo readiness (#1818).
  • ci: pin gh-aw v0.86.2 and add strict compile gate for all four workflows — each workflow file is compiled and validated in CI; the compile job now non-skippably installs the gh-aw extension so the gate cannot be green-washed (#1886, #1775).

gh-aw / Agentic Workflows — router and dispatch

  • fix(gh-aw): fail loudly when /squad parses no command — prevents a no-op silent run when the slash command payload is malformed (#1824, #1832).
  • fix(gh-aw): scan the first non-empty line in PC-0, not record 1 — fixes plan-coordinator step parsing for plans whose first line is blank (#1841).
  • fix(gh-aw): enforce activation agent bindings — agent binding is now validated before an activation step is dispatched (#1865).
  • fix(gh-aw): bind squad:{agent} labels to each issue's own plan row — labels were previously applied to the wrong issue row in multi-issue plans (#1863).
  • fix(gh-aw): stop the validation schema from shipping its own verdict — schema self-reference loop that caused validation to always pass removed (#1853).
  • fix(gh-aw): refill dispatch slots from the root, not the parent epic — epic dispatch slot exhaustion no longer blocks sibling dispatch (#1787).
  • fix(workflows): harden squad router — router hardening pass: improved command parsing, guard conditions, and error reporting (#1868).
  • fix(workflows): harden implement relay provenance — provenance metadata is now correctly threaded through the implement relay step (#1869).
  • fix(workflows): give plan validation adversarial teeth — plan validation now checks for injection-style patterns and structural violations (#1870).
  • fix(dispatch): raise max to 2 and add schema static gate — dispatch parallelism cap raised and enforced by a static schema check (#1772, #1777).
  • fix(gh-aw): refill dispatch slots from root and long-path planning lifecycle defects corrected (#1778).
  • Continuation dispatch inputs interpolated so merge continuation resolves the correct epic (#1741).
  • Nested source files and package-registry egress now allowed in workflow scope (#1744).
  • Protected writes fall back to a review issue instead of failing silently.
  • Dispatch workflow schema probes prevented (#1766).
  • fix(squad.md): stop seeding Owner/Agent binding with the tokens it forbids (#1789).
  • test(gh-aw): enforce dispatcher-first install order — CI test asserts the install ordering contract is maintained (#1879).
  • test(gh-aw): enforce shell input security contract over compiled output — compiled workflow output is scanned for unsafe input expansion patterns (#1834, #1866).
  • fix(ci): lint gh-aw generated workflows instead of skipping them — generated workflow YAML is now included in the actionlint pass (#1854).

CLI

  • fix(cli): route watch/loop capability state through the effective state dir — after squad externalize, all capability state reads/writes (decision hygiene, cleanup, retro, subsquad discovery, ralph-instructions check) now use stateRoot from effectiveSquadDir().stateDir instead of a bare .squad/ join; closes #1490 (#1660).
  • fix(cli): verify process identity before killing tracked watch PIDs — cross-checks the live process's OS start time against spawnedAt before killing, preventing collateral kills after crash + PID reuse (#1641, #1665).
  • fix(squad): make Scribe archival incapable of destroying state — squad nap / archiveDecisions now refuses to run when the destination is untracked and git-ignored, verifies entry count before trimming the source, and uses fence-aware record-boundary scanning. SDK adds archiveEntries(), resolveTrackedDestination(), prepareInboxBodyForMerge(), demoteHeadings(); fixes #1774, #1783, #1760 (#1792).
  • fix(sdk): refuse consult when info/exclude resolves outside the project — setupConsultMode now verifies info/exclude belongs to the repository rooted at projectRoot; prevents hiding .squad/ across the main checkout and all sibling worktrees when called from a linked worktree (#1850).
  • Watch's PID tracker cross-checks a live process's actual OS start time against spawnedAt before killing it, preventing collateral kills after a crash + PID reuse (#1665).

SDK

  • fix(sdk): wire FSStorageProvider rootDir in resolveSquadState — resolveSquadState() now passes rootDir: paths.teamDir to FSStorageProvider so the path-traversal guard validates state writes; also fixes resolveSquadPaths() treating config.teamRoot: "." as remote mode, which pointed teamDir one level above .squad/; fixes #1555 (#1695).
  • fix(sdk): decode URL-encoded segments in Azure DevOps remote parsing — parseAzureDevOpsRemote() decodes percent-encoded characters in org/project/repo segments for all three URL formats (dev.azure.com, SSH, legacy visualstudio.com), fixing az CLI calls for projects with spaces in their names; fixes #1526 (#1637).
  • fix(sdk): support command paths containing spaces in scheduler script tasks — LocalPollingProvider now parses task.ref with quote awareness and longest-match path resolution, fixing scheduler tasks on the default Windows Node.js install path (C:\Program Files\nodejs\node.exe). Adds TaskConfig.argv as the unambiguous alternative. Spawn failures now surface a spawnError code instead of silently producing empty output; fixes #1794 (#1802).
  • Insider tag promotion now split by package so SDK and CLI are promoted independently (#1710).

[0.12.0] - 2026-08-12

Added

  • (cli) Ship GitHub Agentic Workflows (gh-aw): an executable SDLC lifecycle for Squad with /squad research, /squad plan (split into scope/impl/activate phases), /squad cast, and phased plan activation/acceptance, plus program-level planning (initiatives, epics, milestones), a planning policy schema, native dependency edges, and body-metadata sizing (#1649-#1658, #1680, #1685).
  • (cli) Add standalone, npm-free distribution: Homebrew and winget packaging, a native squad.exe, and npm-free squad_state MCP spec generation for standalone bundles (#1593, #1610, #1611).
  • (cli) Ship the ralph-instructions.md template and install pipeline for squad watch --execute (#1314).
  • (sdk+cli) Add category-based model cost policy with a live catalog/pricing refresh and squad models refresh (#1080, #1183, #1445).
  • (cli) Support custom universes and descriptive default naming in casting, and add descriptive run-names to the Squad GitHub Actions workflow (#1635, #1643, #1646).
  • (cli) Assign unique colors to squad member labels via deterministic hashing of slugified names (#1663).
  • (cli) Add squad update-check --json for tooling/CI (#1440).
  • (sdk) Hydrate WorkItem.body via getWorkItem and route the two-pass scan through the platform adapter (#1414).
  • (cli) Default new VS Code chat sessions to Squad on squad init.
  • (sdk+cli) Add Layer A/B/C dispatch-enforcement governance: coordinator tool-profile restriction plus Scribe DispatchGuard audit infrastructure, with an identity lock and routing guard in copilot-instructions.md (#1537).
  • Docs: add Azure hosting guides (Dockerfile contract, ACA, AKS), a production security-hardening guide (threat model, prompt-injection defense, credential hygiene), a production-operations runbook (observability, state-backend selection, troubleshooting), and a Microsoft Agent Framework integration guide (#1574, #1575, #1578, #1579).
  • (cli) Add gh aw init tooling — skills, MCP config, and setup/maintenance workflows — for consuming gh-aw from a project (#1592).
  • (sdk) Expose memory.* tools (classify, write, search, promote, delete, audit) through the squad_state MCP server so agents can manage tiered memory directly.
  • (cli) Add a Squad implementation mode: /squad implement dispatches regular issues and ready epic tasks to an isolated implementation worker workflow, guarding dependency handling, duplicate-PR detection, concurrency, and PR file scope (#1682).
  • (cli) Ship an Auto-Cast pivot for gh-aw: when a repo has no team yet, workflows write a pending-intent marker, dedupe in-flight Cast PRs, and resume the original request once casting completes, so a single issue can guide resumable work end-to-end (#1690).
  • (sdk) Add "max" to SquadReasoningEffort and VALID_REASONING_EFFORTS, matching Copilot SDK 1.0.9's ReasoningEffort = "max" (#1693).

Changed

  • (cli) Harden the Squad coordinator workflow prompt for gh-aw reliability: hard completion gates, atomic task-call contracts, configurable model selection, forward-ported safe-output hardening, and prompt-size compression (135KB → under the 100KB gh-aw limit) (#1669, #1678, #1680, #1683, #1685).
  • (cli) Make the coordinator canary check three-state and add a HEAD canary to catch false positives (#1461, #1517).
  • (cli) Warn before launching 2+ parallel background agents in a shared worktree (#1484).
  • (cli) CI: pin GitHub Actions references to immutable commit SHAs across shipped workflow templates, and fail CI when unreleased changesets accumulate (#1475, #1481).
  • Docs: restructure navigation and do a voice pass across get-started, concepts, and issue-truth content; add the agentic-SDLC demo walkthrough (#1570-#1573).
  • Refresh dependencies across the workspace, including TypeScript, Vitest 4, Ink 7, @github/copilot-sdk, @github/copilot, and OpenTelemetry, plus routine security/patch bumps.
  • Bump @hono/node-server to 2.1.0 and the workspace's minor-patch dependency group (@typescript-eslint/eslint-plugin, @typescript-eslint/parser, eslint, eslint-plugin-n, @types/node, @github/copilot-sdk, ws) (#1692, #1694).

Fixed

  • (cli) Pin the CLI's squad-sdk dependency to the exact published version in publish-cli so installs can no longer resolve a stale SDK (#1638).
  • (cli) squad watch's self-pull capability no longer abandons stashed local changes when git pull --ff-only fails (#1640).
  • (sdk) Normalize dotted ToolRegistry names at the Copilot external-tool boundary.
  • (sdk) Add a recursive deleteDir and rename the external stub to external-stub (#1487).
  • (cli) Fix squad externalize/internalize corrupting non-UTF-8 files under .squad/ (#1492).
  • (sdk+cli) Promote the insider dist-tag when latest is newer (#1495).
  • (cli) Follow externalized state in squad copilot and squad rc (#1464).
  • (cli) Quote GITHUB_OUTPUT/GITHUB_STEP_SUMMARY redirects (SC2086) and add an actionlint CI gate (#1557).
  • (cli) Downgrade the issues permission to read in the gh-aw workflow, and fix the gh-aw guide link in the README.
  • Docs: fix pre-existing broken links, correct platform-specific path examples, and add PATH-fix installation troubleshooting guidance (#1459).
  • (cli) ralph-triage no longer hardcodes api.github.com; it resolves the GitHub API base from GITHUB_API_URL/GITHUB_SERVER_URL so Squad Heartbeat triage works on GitHub Enterprise runners (#1142).
  • (cli) squad export now resolves externalized state: after squad externalize, export reads from the external state directory instead of the stale local .squad/ copy (#1396).

Security

  • (cli) Exclude nested/alumni agent history paths from the unsafe-git scanner so DispatchGuard audits don't false-positive on archived agent state (#1559).

[0.11.0] - 2026-06-29

Added

  • (cli) Add squad preset install <source> for installing shared presets from GitHub URLs or local paths (#1224).
  • (cli) Add squad registry add/list/remove for discovery-only peer squads, plus the bundled cross-squad communication skill.
  • (cli) Add cast terminology across help and docs while keeping hire as a silent compatibility alias (#1394).
  • (sdk+cli) Add Copilot App sub-session spawning for cast members and thread reasoning-effort settings through agent dispatch (#1385).
  • (sdk+cli) Expose memory tools through the squad_state MCP server and improve Fact Checker auto-scaffolding/plumbing.

Changed

  • (sdk+cli) Slim the bundled squad.agent.md by extracting long guidance into satellite skills (#1311).
  • (cli) Move bundled skills from .copilot/skills/ to .github/skills/ so they are visible to all Copilot surfaces.
  • (cli) Rename user-facing ".NET Aspire" references to "Aspire" in CLI help and command output (#1239).
  • (sdk+cli) Refresh the toolchain and integrations, including @github/copilot-sdk 1.0.4, TypeScript 6, Vitest 4, Ink 7, OpenTelemetry 2.x, and Node type updates.

Fixed

  • (cli) Pin CLI-to-SDK workspace resolution so local builds and runtime use the workspace SDK instead of a stale published package (#1406).
  • (sdk+cli) Restore the green test suite by reconciling personal squad paths, stabilizing observer category handling, guarding storage case-insensitivity, and skipping environment-dependent tests when prerequisites are missing (#1416).
  • (sdk+cli) Guard symlink-sensitive tests on Windows or restricted CI filesystems (#1418).
  • (sdk+cli) Harden observer change resolution for directory events, symlinks, and filesystem scan errors.
  • (sdk+cli) Fix state-backend handshake, SQUAD_HOME/SQUAD_PERSONAL_DIR resolution, preset apply wiring, routing example quote stripping, YAML escaping, and MCP config pollution regressions.
  • (cli) Fix Windows command escaping, top-level help coverage for externalize/internalize, slash-command discovery, and upgrade/self-repair flows.
  • (sdk) Export gitignore-state helpers, update OTel resource APIs for 2.x, and align the adapter client with @github/copilot-sdk 1.0.4.

[0.10.0] — 2026-06-07

First stable release since v0.9.4 (April 25). Consumes 97 changesets (sdk: 50, cli: 71).

Security

  • (cli) iter-9: inject --yolo --additional-mcp-config @.mcp.json in all non-interactive copilot spawns; fix path regression from .copilot/mcp-config.json (iter-7) to .mcp.json (iter-8 canonical location); add fallback warning when .mcp.json is absent; add --yolo deduplication guard; document Copilot CLI 1.0.59+ folder-trust security gate

Performance

  • (cli) Add /fleet hybrid dispatch mode for squad watch --execute (#775) — enables parallel issue analysis via Copilot CLI /fleet, 2.9x faster than sequential dispatch for read-heavy work
  • (sdk) perf(agents): parallelize charter discovery with concurrency limit to reduce multi-agent load time
  • (sdk+cli) perf(resolution): memoize squad-dir lookups; deduplicate squads.json reads to reduce filesystem I/O on repeated resolution calls
  • (sdk) perf(scheduler): convert sequential async execution to concurrent with bounded concurrency to improve multi-agent dispatch throughput

Added

  • (sdk) Add rework rate OTEL metrics (#265) — tracks PR revision patterns as the emerging 5th DORA metric
  • (sdk+cli) Add routing.md to squad export/import functionality
  • (sdk) Add SkillScriptLoader, handler types, and applySkillHandlers for executable skill handler scripts
  • (cli) feat: APM integration — squad skill publish/install + apm.yml in init
  • (sdk) feat: Cooperative rate limiting with predictive circuit breaker
  • (sdk+cli) Cross-squad orchestration — discovery, delegation, and manifest (#316). Adds manifest schema, squad discover / squad delegate commands, and runtime module for coordinating work across multiple Squad instances.
  • (cli) Add deprecation warnings for tunnel, rc, and REPL commands. The interactive shell (no-args), squad start, squad start --tunnel, squad rc, and squad rc-tunnel now emit yellow deprecation notices pointing users to the GitHub Copilot CLI. No behavior changes — all commands still work.
  • (cli) docs: add fork contribution workflow to CONTRIBUTING.md
  • (cli) Add user-facing documentation for state backends (local, orphan-branch, two-layer)
  • (sdk) Add dual-mode deployment support for capabilities routing.
  • (sdk+cli) feat: add error-recovery skill for standard agent failure recovery patterns
  • (sdk+cli) Add external state storage — move .squad/ out of the working tree (#792)
  • (sdk+cli) Add fact-checker as a built-in agent role (#789)
  • (cli) Fix squad doctor and upgrade for insiders installs: add .squad/casting/ to ENSURE_DIRECTORIES, scaffold casting defaults from templates with permission-safe fallback, and clarify ESM warnings for global installs.
  • (sdk) Sync squad.agent.md roster when agents added to team.md
  • (cli) fix(ci): fix multiple CI test failures introduced by PR #1035 coordinator slimming
  • (sdk+cli) Warn when squad.agent.md template is missing during upgrade or init instead of silently skipping file creation. Adds warnings field to InitResult for structured error reporting.
  • (sdk+cli) feat(sdk): git-notes + orphan-branch state backends for .squad/
  • (sdk+cli) feat: add iterative-retrieval skill for structured max-3-cycle agent spawning
  • (cli) docs: Add KEDA external scaler template for GitHub issue-driven autoscaling
  • (cli) feat(cli): Add squad loop command — prompt-driven continuous work loop
  • (sdk+cli) feat: Machine capability discovery and needs:* label-based issue routing
  • (sdk+cli) Add squad init --mcp-frontmatter to write MCP server config into the Squad agent frontmatter instead of .copilot/mcp-config.json for compatible agent harnesses.
  • (sdk+cli) feat: add notification-routing skill for pub-sub channel routing
  • (sdk+cli) feat: add declarative plugin behavior context proof
  • (cli) Add --notify-level to control watch round reporting noise (#803)
  • (sdk+cli) Add Rai as Squad's third built-in agent — a Responsible AI (RAI) reviewer
  • (sdk+cli) feat: add reflect skill for in-session learning capture and mistake prevention
  • (sdk+cli) Add --repo and --branch flags to squad export and squad import commands, enabling users to push/pull Squad configuration directly to/from a GitHub repository via the GitHub Contents API.
  • (sdk+cli) Add retro enforcement skill with Test-RetroOverdue and ceremonies template update.
  • (sdk) Add .squad/.scratch/ directory for organized temp file management (#790)
  • (sdk) Add SDK feature parity batch 2 — 64 tests covering manual ceremonies (#27), ceremony cooldown (#28), human team members (#36), constraint budget enforcement (#49 — rate limiter, file-write guards, shell restrictions, PII scrubbing), multi-agent artifact coordination (#50), and builder validation edge cases.
  • (sdk) test: SDK feature parity batch 3 — 46 tests for #31, #47, #45, #46
  • (cli) Add squad upgrade --self to upgrade the CLI package itself (#798)
  • (cli) feat: session init update check with extensible session-init reference
  • (cli) feat: add squad-commands skill for in-chat command discovery
  • (sdk+cli) feat: add SQUAD_HOME env var and preset system
  • (cli) Fix Windows spawn EINVAL in watch capabilities by adding shell: true to execFile() calls in monitor-teams, monitor-email, retro, and decision-hygiene capabilities. Add Copilot CLI preflight check to squad doctor and monitor capabilities so missing gh copilot extension is flagged early. Improve team hire confirmation UX to show member names inline with the prompt. (closes #920, closes #880, closes #1107)
  • (sdk) Bump @github/copilot-sdk from ^0.1.32 to ^0.3.0 to fix ESM module resolution error (ERR_MODULE_NOT_FOUND for vscode-jsonrpc/node). Add explicit GitHub repo config support in .squad/config.json ({ "github": { "owner": "...", "repo": "..." } }) so platform adapter prefers user-specified repo over auto-detection from origin remote. (closes #1062, closes #905)
  • (sdk+cli) Add delete() and append() to StateBackend interface; add resolveSquadState() entry point; add StateBackendStorageAdapter; add git-notes agent protocol templates
  • (sdk) feat(sdk): Add Microsoft Teams communication adapter
  • (sdk+cli) feat: add tiered-memory skill for hot/cold/wiki agent context management
  • (cli) feat(watch): circuit breaker integration for rate limit protection (#515)
  • (cli) feat(watch): health check — show running watch instance status (#808)
  • (cli) Add --verbose flag to squad watch for debugging empty boards and silent failures (#781)

Fixed

  • (sdk+cli) Fix hardcoded "Brady" in template files — LLMs now use actual git username instead of example name (closes #977)
  • (cli) Fix changelog-gate CI to accept .changeset/ files as alternative to direct CHANGELOG.md edits
  • (sdk+cli) fix: bump CLI version to 0.9.7-preview; align E2E skill and policy gate with CONTRIBUTING.md
  • (sdk+cli) fix: context overflow sentinel and coordinator size reduction (retroactive for #1035)
  • (sdk+cli) Fix coordinator and Scribe templates so spawned agents receive and write the resolved current datetime instead of placeholder text.
  • (cli) fix(cli): revert detect-squad-dir to zero-dependency bootstrap
  • (cli) fix: restore CI green on dev — 25 regression fixes + 6 test corrections
  • (cli) Fix export/import producing blank decisions.md and team.md files. Export now includes these files in the manifest, and import restores their content.
  • (cli) Fix runtime commands to correctly resolve externalized state paths
  • (sdk+cli) Fix 5 bugs: dotted repo names, icon spacing, board owner, charter passing, missing playbooks
  • (cli) fix: /init with no args now accepts follow-up message as cast prompt, and createTeam correctly creates team.md/routing.md in fresh projects
  • (cli) fix(nap): account for separator newlines in decision archival budget
  • (cli) fix(cli): wire --team-root / SQUAD_TEAM_ROOT into squad resolution for nap, status, and cost commands (#734)
  • (cli) fix: CLI no longer bails when configured is false; starts onboarding session instead (#843)
  • (cli) fix(coordinator): resolve externalized state, teamRoot, stale work, and cleanup loops
  • (sdk+cli) Fix permission handler to use approve-once instead of deprecated approved kind, aligning with Copilot CLI v1.0.54+ permission contract
  • (cli) Fix post-init message to recommend copilot --agent squad instead of deprecated squad command (closes #1034, closes #1007)
  • (sdk+cli) Fix state-backend and upgrade regressions (#1163, #1185, #1190, #1191, #1194)
  • (cli) Fix squad <command> --help silently running the command instead of showing help (#1201)
  • (cli) Extend SQUAD_TEAM_ROOT to all resolveSquad() call sites for subprocess compatibility
  • (sdk+cli) Fix triage label slug derivation: use slugify() instead of toLowerCase() so multi-word agent names produce valid GitHub labels (e.g. "Steve Rogers" → squad:steve-rogers instead of squad:steve rogers).
  • (cli) fix(watch): Windows shell:true, shared agent-spawn, round-level fetch (#920, #923)
  • (sdk+cli) fix: use TEMPLATE_MANIFEST to drive skill installation instead of wholesale directory copy
  • (sdk) Fix squad-commands skill routing and configuration for Copilot integration
  • (sdk) State backend hardening: retry with exponential backoff for transient git errors, circuit-breaker to prevent cascading failures, read-only startup verification, and observable error surfacing replacing silent swallowing.
  • (cli) fix(watch): 3 UX improvements — round timing output, --log-file tee flag, immediate startup feedback (#2141)
  • (sdk+cli) Fix Windows Azure CLI execution and ADO state mapping in squad watch
  • (sdk) fix(sdk): wire squad_route tool handler to actually create target sessions

Changed

  • Communications: createCommunicationAdapter is now async. Downstream consumers building custom adapters must await the factory call. Not flagged as breaking per pre-1.0 SemVer.
  • (sdk) ADO configurable work item types, area paths, and iteration support (#240)
  • (cli) Ship 8 built-in skills with squad init/upgrade (#788)
  • (cli) Allow memory diagnostics log level to be configured from .squad/config.json.
  • (sdk+cli) Enable persistent Ralph — heartbeat cron + healthCheck timer
  • (sdk+cli) Squad coordinator now scans all 5 project skill directories: Copilot CLI's 3
  • (sdk+cli) Generic, provider-agnostic scheduler for Squad (#296) — unified schedule.json manifest with LocalPolling and GitHubActions provider adapters, CLI commands (list, run, init, status), schema validation, and cron/interval trigger evaluation.
  • (sdk+cli) Harden runtime state tools so write, append, and delete only mutate approved Squad runtime state paths, and refresh prompt templates to require state-tool persistence and literal datetime propagation.
  • (cli) Widen changelog-gate coverage for template and scaffolding paths

Internal / Tests / Docs

  • (cli) docs: point README migration guide links to the published docs site

[0.1.0-preview] - 2026-06-02

Added — Squad.Agents.AI NuGet preview

  • Added Squad.Agents.AI, a net10.0 Microsoft Agent Framework package that exposes a Squad team as an AIAgent.
  • Public surface: SquadAgent, SquadAgentOptions, SquadConnectionFactory, and SquadServiceCollectionExtensions.
  • Added DI registration, PATH/URI connection-string parsing, GitHub token/provider options, and XML documentation for the public preview surface.
  • Added README documentation for the Squad.Agents.AI package in src/Squad.Agents.AI/README.md.

[0.9.0] - 2026-03-23

Added — Personal Squad Governance Layer

  • Personal Squad concept (#508) — isolated developer workspace with own team.md, routing.md, and agent roster
  • Ambient discovery — automatic detection of personal squad at ~/.squad/ via environment variables and fallback paths
  • CLI commands (#508) — squad personal init, squad personal list, squad personal use, squad personal remove
  • Governance integration (#508) — hooks, ceremonies, telemetry isolated per personal squad
  • Unit & integration tests (#508) — full test coverage for personal squad flows

Added — Worktree Spawning & Orchestration

  • Worktree creation (#529) — coordinator spawns managed worktrees for parallel agent work via squad worktree spawn
  • Cross-squad orchestration (#446) — agents coordinate work across multiple squads and worktrees
  • Persistent Ralph — watch + heartbeat (#443) — long-running Ralph daemon with health monitoring
  • Regression guard (#521) — worktree .git detection (file vs directory) with full test coverage

Added — Machine Capability Discovery

  • Capability inference (#514) — automatic detection of available tools, models, and hardware specs at session start
  • needs: Label Routing* (#514) — agents self-route based on discovered capabilities vs work requirements

Added — Cooperative Rate Limiting

  • Predictive circuit breaker (#515) — model token budget forecasting to prevent runtime exhaustion
  • Rate limit recovery (#464) — surface errors with actionable recovery options
  • Circuit breaker for Ralph (#451) — graceful degradation under model quota pressure

Added — Economy Mode

  • Cost-conscious model selection (#500) — automatic selection of cheaper models when quality thresholds permit
  • Economy mode skill (#503) — governance proposals for balanced cost/quality tradeoffs
  • Token usage tracking (#453) — visibility into per-agent token consumption and costs

Added — Auto-Wire Telemetry

  • Auto-wire in initSquadTelemetry() (#281) — telemetry initialization no longer requires manual wiring
  • OpenTelemetry integration — automatic context propagation across squad sessions

Added — Issue Lifecycle Template

  • Template document (#527) — standardized issue lifecycle workflow (creation → triage → assignment → completion)
  • Integrated into squad init — available to all new teams via .squad/templates/issue-lifecycle.md

Added — KEDA External Scaler Template

  • Agent autoscaling template (#516) — KEDA-based horizontal scaling for compute-intensive agent work
  • Documentation (#519) — setup guide for Kubernetes-based squad deployments

Added — GAP Analysis Verification Loop

  • After Agent Work flow (#473) — gap analysis verification loop ensures all requirements are met before task completion
  • Checklist-driven completion — structured validation to prevent incomplete deliverables

Added — Session Recovery Skill

  • Session recovery (#442) — find and resume lost sessions without restarting work
  • Integration — available as a core team skill via .squad/skills/session-recovery/SKILL.md

Added — Token Usage Visibility

  • Per-agent cost tracking (#453) — token consumption and estimated costs per agent
  • Dashboard integration — visible in session UI for cost-conscious workflows

Added — GitHub Auth Isolation Skill

  • Multi-account GitHub workflows (#470) — safely switch GitHub identities within a squad session
  • Integration — available as .squad/skills/gh-auth-isolation/SKILL.md

Added — Docs Site Improvements (Astro)

  • 10 Astro feature items (#524) — implemented search tuning, section badges, test coverage indicators
  • Autonomous agents guide (#492) — comprehensive guide for building autonomous agents with Squad SDK
  • Blog posts (#029) — upgrade cross-testing at scale post
  • Expanded search (#482) — Pagefind tuning with section badges for better discoverability
  • CLI README expansion (#487) — detailed CLI reference with workflow examples
  • Teams MCP integration refresh (#496) — updated Workflows webhook documentation
  • Migration guide updates (#320, #468) — @latest installation instructions and heartbeat config

Added — ESLint Runtime Anti-Pattern Detection

  • ESLint with TypeScript support (#493) — static analysis for common runtime anti-patterns
  • Integration — available in CLI pre-flight checks

Fixed — CLI Terminal Rendering

  • Eliminated scroll-to-top flicker caused by Ink's fullscreen clearTerminal path firing on every render cycle
  • Reduced re-render churn via memoized elapsed-time display (one-second granularity gate) and consolidated animation intervals
  • Stabilized component keys (timestamp-based instead of shifting array indices) to prevent Ink remounts
  • Pinned live viewport height to keep input prompt above fold on all terminal sizes

Fixed — Upgrade Path & Installation

  • P0 upgrade gaps (#544) — context-aware footer and EPERM handling for permission issues
  • Gitignore parent coverage (#549) — .gitignore updates for nested squad directories
  • ADO configurable work item types (#444) — flexible schema for Azure DevOps work items
  • Template directory audit (#461) — all template references aligned with .squad/templates/
  • Package template sync (#462) — monorepo workspace templates now in sync

Fixed — ESM Compatibility

  • Complete exports check — verify all ESM exports before applying patch
  • Dual-layer ESM fix (#449) — Node 22/24 compatibility for vscode-jsonrpc resolution
  • Node 24+ hard-fail (#502) — clear error message for Node <22.5.0 with upgrade guidance

Fixed — Runtime Stability

  • SIGINT/SIGTERM handling (#486) — graceful shutdown with 22+ tests for signal handling
  • Read-modify-write race condition (#480) — fixed history-shadow.ts file access race
  • az CLI timeout (#483) — 2s timeout for getAvailableWorkItemTypes to prevent hangs
  • Memory safety caps (#259) — file watcher filtering and memory limits
  • User model preference persistence (#284) — model selection now persists across sessions
  • Repository auto-detection (#437) — auto-detect repo owner/name at session start

Fixed — GitHub Integration

  • CI hardening — stale lockfile handling, manual rerun workflow, merge ref fixes
  • Casting universe alignment (#459) — align casting universe count with reality

Changed — npm Distribution & Installation

  • npm-only distribution — removed GitHub-native distribution channel
  • Installation: npm install -g @bradygaster/squad-cli (standard npm registry)
  • Verified upgrade path — tested at scale across 100+ projects

Documentation — Guides & References

  • Agent anatomy & hiring checklist (#439) — detailed guide for building team rosters
  • Behavior documentation (#448) — nap, reskill, and compact behavior reference
  • Content gap fill — 7 recent PRs documented
  • PAO external communications (#426) — Phase 1 infrastructure for multi-channel squad updates
  • Casting reference (#814133d) — comprehensive casting configuration guide

By the Numbers

  • 40+ commits merged since v0.8.25
  • 6+ major features (Personal Squad, Worktree Spawning, Capability Discovery, Cooperative Rate Limiting, Economy Mode, Auto-wire Telemetry)
  • 10+ docs site improvements via Astro
  • 15+ stability & compatibility fixes
  • Tested at scale — upgrade process verified across 100+ projects
  • Governance layer — new Personal Squad feature enables distributed developer workflows

[0.8.24] - 2026-03-08

Added — Azure DevOps Platform Adapter

  • PlatformAdapter interface — unified API for GitHub, ADO, and Microsoft Planner
  • AzureDevOpsAdapter — az boards CLI for work items, az repos for PRs
  • GitHubAdapter — gh CLI wrapper implementing PlatformAdapter
  • PlannerAdapter — Microsoft Graph API for hybrid work-item tracking
  • Cross-project ADO config via .squad/config.json — work items can live in a different org/project than the repo

Added — CommunicationAdapter

  • Pluggable agent-human messaging — Scribe/Ralph can post updates through platform-appropriate channels
  • Four adapters: FileLog (zero-config), GitHub Discussions, ADO Work Item Discussions, Teams Webhook (stub)
  • Factory auto-detection — createCommunicationAdapter(repoRoot) selects the right adapter

Added — SubSquads (Community-Voted Rename)

  • Workstreams → SubSquads across CLI, types, and docs
  • CLI: squad subsquads (with workstreams and streams as deprecated aliases)
  • Old names preserved as @deprecated re-exports for backward compatibility

Fixed — Security Hardening

  • execSync → execFileSync (prevents shell injection)
  • escapeWiql() helper (prevents WIQL injection in ADO queries)
  • curl --config stdin (hides bearer tokens from process listing)
  • Case-insensitive URL detection for ADO remotes
  • Cross-platform draft filter (findstr → JMESPath)
  • PR status mapping (active → open for gh CLI)
  • gh issue create fix (parse URL from stdout, not --json)

Fixed — ESM Runtime Patch + Secret Guardrails

  • Runtime Module._resolveFilename intercept for Node 24+ ESM compatibility
  • 5-layer secret defense architecture
  • 59 TDD security hook tests
  • .squad/skills/secret-handling/SKILL.md team reference

Added — Docs Site Improvements

  • Contributor Guide page in docs site Guide section
  • Squad Contributors Guide page (36+ contributors honored)
  • Concepts and Cookbook sections wired into docs build
  • Broken links fixed across docs site

By the Numbers

  • 8 PRs merged (#191, #263, #268, #270, #272, #275, #277, #266)
  • 153 new tests (92 platform + 15 comms + 46 SubSquads)
  • 59 security tests
  • 8 issues closed
  • 3 new docs pages, 6+ broken links fixed

[0.8.23] - 2026-03-12

Fixed — Node 24+ ESM Import Crash

  • Node 24+ squad init crash fix (#XXX) — v0.8.23 resolves ERR_MODULE_NOT_FOUND: Cannot find module 'vscode-jsonrpc/node' crash that occurs on Node.js 24+ and GitHub Codespaces. Root cause: upstream ESM import issue in @github/copilot-sdk. Two-layer defense implemented:
    • Lazy imports — Commands init, build, link, migrate no longer eagerly load copilot-sdk at startup
    • Postinstall patch — Automatically fixes broken ESM import at install time
    • Side benefit: Faster CLI startup for non-session commands

Added — Squad RC Documentation

  • Comprehensive guide for squad rc (Remote Control) covering:
    • ACP (Azure Communication Platform) passthrough architecture
    • 7-layer security model for session isolation and encryption
    • Mobile keyboard shortcuts and accessibility features
    • Troubleshooting guide for common connection issues

By the Numbers

  • 2 issues closed
  • 3 PRs merged
  • 3,811 tests passing (3,840 total, 0 logic failures)
  • 1 critical crash fix (Node 24+ compatibility)

[0.8.22] - 2026-03-11

Added — SDK-First Mode (Phase 1)

  • Builder functions — Type-safe team configuration with runtime validation
    • defineTeam() — Team metadata, project context, member roster
    • defineAgent() — Agent definition with role, model, tools, capabilities
    • defineRouting() — Routing rules with pattern matching and priority
    • defineCeremony() — Ceremony scheduling (standups, retros, etc.)
    • defineHooks() — Governance hooks (write paths, blocked commands, PII scrubbing)
    • defineCasting() — Casting configuration (universe allowlists, overflow strategy)
    • defineTelemetry() — OpenTelemetry configuration
    • defineSquad() — Top-level composition builder
  • squad build command — Compile TypeScript definitions to .squad/ markdown
    • Generates .squad/team.md, .squad/routing.md, agent charters, ceremonies
    • Supports --check (validation), --dry-run (preview), --watch (file monitoring stub)
    • Protected files (decisions.md, history.md) never overwritten
  • SDK Mode Detection — Coordinator prompt includes SDK-First mode awareness
  • Documentation
    • New guide: SDK-First Mode — concepts, builder reference, examples
    • Updated SDK Reference — builder function signatures and types
    • README quick reference for SDK-First teams

Added — Remote Squad Mode (ported from @spboyer's bradygaster/squad#131)

  • resolveSquadPaths() dual-root resolver — project-local vs team identity directories
  • squad doctor command — 9-check setup validation with emoji output
  • squad link <path> command — link a project to a remote team root
  • squad init --mode remote — initialize with remote team root config
  • ensureSquadPathDual() / ensureSquadPathResolved() — dual-root write guards

Fixed — Critical Crash & Stability Issues

  • Installation crash fix (#247) — npx @bradygaster/squad-cli was failing on fresh installs due to hard dependency on @opentelemetry/api that couldn't resolve in isolated npm environments. Created otel-api.ts resilient wrapper with full no-op fallbacks. Moved OTel to optional dependencies. Telemetry now gracefully degrades when absent.
  • CLI command wiring (#244) — Commands rc, copilot-bridge, init-remote, rc-tunnel were implemented but never wired into CLI entry point. Now properly connected and discoverable.
  • Model config round-trip (#245) — AgentDefinition.model now accepts string | ModelPreference for structured model configuration. Charter compiler updated to emit and parse the new format correctly.
  • ExperimentalWarning suppression — Node's ExperimentalWarning for node:sqlite no longer leaks into terminal output. Suppressed via process.emit override in cli-entry.ts.
  • Blankspace fix (#239) — Idle blank space below agent panel removed. Conditional height constraint only active during processing.
  • Windows race condition (EBUSY) — fs.rm with retry logic and exponential backoff. Tests now pass reliably on Windows.
  • Test hardening — Speed gate threshold adjustments for growing CLI codebase. 25 regression tests fixed (PR #221).
  • CI stabilization — GitHub Actions pipeline fixed and green (PRs #232, #228).

Changed — Distribution & Versioning

  • Distribution: npm-only distribution channel. No more GitHub-native distribution (npx github:bradygaster/squad). Users now install via npm install -g @bradygaster/squad-cli or npx @bradygaster/squad-cli from npm registry.
  • Semantic Versioning fix (#692): Version format changed from X.Y.Z.N-preview to X.Y.Z-preview.N to comply with semantic versioning spec (prerelease identifier after patch, build metadata after prerelease). Example: 0.8.6-preview.1 instead of 0.8.6.1-preview.
  • Version transition: Public repo final version was 0.8.5.1. Private repo continues at 0.8.x cadence (next publish after 0.8.17 is 0.8.18), following semver prerelease convention for development.

Community

  • Thanks to Shayne Boyer (@spboyer) for the original remote mode design.
  • PR #199 (migration command) received, reviewed, and feedback captured as issue #231 for future implementation.
  • PR #243 (blankspace fix) — community contribution cherry-picked and credited.

By the Numbers

  • 26 issues closed
  • 16 PRs merged
  • 3,724 tests passing (3,740 total, 13 known Windows timeout flakes, 0 logic failures)
  • 8 builder functions shipped
  • 4 CLI commands wired
  • 1 critical crash fix (OTel dependency)
  • 25 regression tests fixed

[Unreleased]

[0.8.20] - 2025-01-08

Fixed

  • Template path fix (#190): Corrected all references from .squad-templates/ to .squad/templates/ to align with the project's directory structure. This ensures the CLI correctly resolves team member charters and other template resources.
  • Init test templates: Updated initialization tests to reference the corrected .squad/templates/ directory path.

[0.8.18-preview] - TBD

Added — Remote Squad Mode (ported from @spboyer's bradygaster/squad#131)

  • resolveSquadPaths() dual-root resolver — project-local vs team identity directories (#311)
  • squad doctor command — 9-check setup validation with emoji output (#312)
  • squad link <path> command — link a project to a remote team root (#313)
  • squad init --mode remote — initialize with remote team root config (#313)
  • ensureSquadPathDual() / ensureSquadPathResolved() — dual-root write guards (#314)

Changed — npm Distribution & Monorepo Structure

  • Distribution: Migrated from GitHub-native (npx github:bradygaster/squad) to npm packages (npm install -g @bradygaster/squad-cli / npx @bradygaster/squad-cli)
  • Packages: Independent versioning via @changesets/cli — @bradygaster/squad-sdk and @bradygaster/squad-cli evolve on separate cadences
  • Structure: Monorepo layout with workspace packages (SDK + CLI)
  • Directory: .squad/ directory structure (migration from .ai-team/)
  • Semantic Versioning: All versions now comply with semver spec (prerelease format X.Y.Z-preview.N)

Fixed

  • CLI entry point moved from dist/index.js to dist/cli-entry.js. If you reference the binary directly, update your path. npx and npm bin resolution is unchanged. (#187)
  • CRLF normalization: All parsers now normalize line endings before parsing. Windows users with core.autocrlf=true no longer get \r-tainted values. (#220, #221)
  • process.exit() removed from library-consumable functions. VS Code extensions can now safely import CLI functions without risking extension host termination. (#189)
  • Removed .squad branch protection guard (squad-main-guard.yml) — no longer needed with npm workspace files field exclusions

Internal

  • New utility: normalizeEol() in src/utils/normalize-eol.ts
  • New entry point: src/cli-entry.ts (CLI bootstrap separated from library exports)
  • Migrated to npm workspace publishing (@bradygaster/squad-sdk, @bradygaster/squad-cli)
  • Changesets infrastructure for independent package versioning