[SEVERE] upgrade --self --dry-run performs a real @latest install and can downgrade previews #2295

Summary

Squad 2.0.0-preview.1 ignores --dry-run when it is combined with squad upgrade --self. The command proceeds into a real global install of @bradygaster/squad-cli@latest. On the tested preview installation, latest resolved to 1.0.0, so a successful run would both mutate the machine during a dry run and downgrade the preview CLI. Only an unrelated EPERM prevented the mutation.

The default self-upgrade target also ignores the installed channel. A preview/insider install should stay on that channel unless the user explicitly requests another one, and --insider should be honored.

Environment

• Squad CLI 2.0.0-preview.1, installed from the exact published release tarball
• Windows 11
• Node.js 22
• CFS-only npm host (https://packagefeedproxy.microsoft.io/npm/)

Repro

squad --version
npm view @bradygaster/squad-cli dist-tags --json
squad upgrade --self --dry-run
squad --version

Observed

The dry run entered the real install path:

npm install -g @bradygaster/squad-cli@latest
npm error code EPERM
npm error syscall unlink
EPERM: operation not permitted, unlink

Before and after, squad --version returned:

2.0.0-preview.1

The registry mirror exposed only:

latest: 1.0.0

The command exited non-zero only because the global installation could not be unlinked. Had the install succeeded, the preview CLI would have been replaced by 1.0.0.

Expected

• --dry-run must make upgrade --self side-effect-free.
• The output should describe the package/version/channel that would be installed.
• A preview/insider installation should default to its installed channel rather than latest.
• --insider must select the insider/preview channel consistently for self-upgrade.

Impact / Severity

SEVERE. This violates the dry-run safety contract and can silently downgrade or replace a global CLI installation. The observed machine was protected only by an unrelated filesystem error.

Proposed fix

1. Check dryRun before any package-manager spawn in the self-upgrade path.
2. Resolve the installed package version/channel and preserve preview/insider by default.
3. Make --insider override channel resolution explicitly.
4. Add injectable-spawn tests for npm/pnpm/yarn proving all --self --dry-run combinations execute zero mutations and print the resolved target.