[HIGH] upgraded squad_state MCP bridge uses an unavailable dist-tag and cannot detect stale 0.10 bridges #2296

Summary

squad upgrade writes a repo MCP declaration that launches:

npx -y @bradygaster/squad-cli@insider state-mcp

On registry mirrors that do not expose non-latest dist-tags, including Microsoft CFS, this fails with ETARGET, so the repo bridge never starts. squad doctor does not probe the generated bridge.

At the same time, stale hashed entries in the global Copilot MCP config can remain pinned to @bradygaster/squad-cli@0.10.0. Those older bridges satisfy the coordinator handshake because squad_state_health does not report a version, making them indistinguishable from the intended 2.0 bridge.

Environment

• Squad CLI 2.0.0-preview.1, installed from the exact published release tarball
• Windows 11
• Node.js 22
• CFS-only npm host (https://packagefeedproxy.microsoft.io/npm/)

Repro

npm config get registry
npm view @bradygaster/squad-cli dist-tags --json
squad upgrade
npx -y @bradygaster/squad-cli@insider --version
squad doctor

Then start Copilot in the upgraded repository and invoke squad_state_health. Compare the repo .mcp.json declaration with any hashed squad_state_* entries in the global Copilot MCP config.

Observed

The generated repo declaration uses @insider, but the mirror exposes only latest:

npm error code ETARGET
npm error notarget No matching version found for @bradygaster/squad-cli@insider.

doctor still completed without detecting that the generated MCP bridge could not launch:

Summary: 13 passed, 0 failed, 1 warning

The stale 0.10.0 bridge reported only:

State backend storage: FSStorageProvider

A direct local launch of the 2.0 bridge reported:

serverInfo: squad-state 2.0.0-preview.1
State backend: local
State backend storage: FSStorageProvider
Team squad dir: …\.squad

The stale bridge also exposed only seven tools, while the 2.0 bridge exposed fifteen, including memory.*, squad_state_upstreams, and squad_state_create_if_absent.

Expected

• The generated bridge must resolve on mirror-only/offline-friendly hosts.
• squad doctor should launch/probe the exact .mcp.json declaration and validate serverInfo.version plus team root.
• squad_state_health should include the bridge/CLI version and resolved team directory.
• Upgrade should refresh or remove stale hashed global bridge entries.

Impact / Severity

HIGH. A freshly upgraded repo can silently run no repo bridge at all while an obsolete global bridge appears healthy. New 2.0 state/memory functionality is then absent or routed to the wrong runtime without a diagnostic.

Proposed fix

1. Generate an exact version pin such as @bradygaster/squad-cli@2.0.0-preview.1, or use the installed CLI's direct node entry point.
2. Add a bridge spawn/version/team-root probe to squad doctor.
3. Include version and team root in squad_state_health and require them in the coordinator handshake.
4. Migrate/remove stale hashed global MCP declarations during upgrade.