P0: @copilot accidentally deleted 361 source files on dev (commit 1ab2f5c) #631

🔥 P0: @copilot accidentally deleted 361 source files on dev branch

Incident

Commit 1ab2f5c (2026-03-26 01:46 PST) was pushed directly to dev by the @copilot coding agent while fixing a broken docs link (issue #610). The commit message says "fix broken link" but the actual diff is:

• 6 files modified (the intended docs fix)
• 361 files DELETED — the entire SDK and CLI source code

367 files changed, 292 insertions(+), 69,245 deletions(-)

What Was Deleted

• packages/squad-sdk/src/ — entire SDK (storage, config, agents, runtime, coordinator, hooks, etc.)
• packages/squad-cli/src/cli/commands/ — all 26 CLI commands
• packages/squad-cli/src/cli/core/ — all 14 core modules
• packages/squad-cli/src/cli/shell/ — entire shell infrastructure
• packages/squad-sdk/templates/ — all template files including workflows
• Multiple test files

Impact

• dev branch is broken. Any checkout after 1ab2f5c is missing the entire codebase.
• All PRs targeting dev cannot build or test.
• No release artifacts corrupted (npm publish is disabled).
• Parent commit 28ea025 is fully intact — recovery is trivial.

Root Cause

@copilot pushed directly to dev with no PR. The agent likely had an incomplete working tree (missing files appeared as deletions) and used git add . or git commit -a, bundling 361 deletions alongside the 6-file docs fix. No branch protection exists on dev, so there was no gate.

Recovery (one command)

# Option A: Revert
git revert 1ab2f5c --no-edit && git push origin dev

# Option B: Restore from parent
git checkout 28ea025 -- packages/squad-cli/ packages/squad-sdk/ test/ templates/
git commit -m "fix: restore files accidentally deleted in 1ab2f5c"
git push origin dev

Prevention — Recommended Action Items

Immediate

1. Revert dev to restore the 361 deleted files
2. Enable branch protection on dev — require PR + 1 approval before merge
3. Restrict @copilot from direct push — agent should only open PRs, not push to protected branches

Short-term

4. Add file-deletion guard to CI — fail if a commit deletes >50 files without large-deletion-approved label
5. Add source-tree canary check — verify key files (packages/squad-sdk/src/index.ts, etc.) exist before build
6. Update copilot-instructions.md — add: "Never use git add . or git commit -a. Always stage specific files."
7. Move CI on dev from push-trigger to PR-required — CI should gate merges, not observe them after

Medium-term

8. Pre-commit hook warning on >20 file deletions
9. @copilot PR template with checklist: [ ] git status clean, [ ] no unintended deletions
10. Audit Copilot agent permissions — review write-access scope

Analysis

The structural conditions that enabled this:

• dev has zero branch protection (main is protected, dev is not)
• CI runs after push, not as a merge gate
• @copilot has unrestricted write access to dev
• No anomaly detection for large file-count changes

This is an isolated incident (only 1 Copilot commit in recent history), but the conditions remain in place for every future agent action until the branch protection and CI gates are added.

Discovered By

@diberry — while rebasing PR #18 onto upstream/dev and encountering 78 modify/delete conflicts. Investigation traced to commit 1ab2f5c.