chore: promote dev to insider — v0.9.5-insider.1

.changeset/audit-onboarding-skill-guards.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+Add defensive guards from architecture audit: (1) verify roster is populated after team creation before dispatching to coordinator, preventing empty-roster dispatch loops; (2) warn when `squad upgrade` overwrites customized built-in skills

.changeset/docs-state-backends.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+Add user-facing documentation for state backends (git-notes, orphan-branch, worktree)

.changeset/dynamic-state-discovery.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+Replace hardcoded state artifact lists with dynamic directory scanning in externalize/internalize, preventing silent orphaning when new `.squad/` artifacts are added.

.changeset/external-capability-loading.md

@@ -0,0 +1,9 @@
+---
+'@bradygaster/squad-cli': minor
+---
+
+feat(watch): load external WatchCapabilities from .squad/capabilities/
+
+Users can now define custom watch capabilities as .js files in `.squad/capabilities/`.
+Each file default-exports a WatchCapability object (name, phase, preflight, execute).
+Capabilities are loaded at watch startup and participate in the normal phase-based round cycle.

.changeset/fix-cast-base-path.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+Passes repo root to LocalAgentSource instead of .squad/ dir, preventing a double-nested .squad/.squad/agents/ lookup. In remote mode, passes paths.teamDir (team repo root) so agents are discovered from the correct location.

.changeset/fix-copilot-message-flag.md

@@ -0,0 +1,11 @@
+---
+'@bradygaster/squad-cli': patch
+'@bradygaster/squad-sdk': patch
+---
+
+Fix obsolete --message flag in watch and loop commands
+
+Replace `--message` with `-p` across all watch capabilities and loop command.
+Use `copilot` directly on Windows to avoid .cmd console window issues,
+fall back to `gh copilot` on other platforms. Fix TOKEN_PATH typo in
+comms-teams.ts (pre-existing bug from #906).

.changeset/monorepo-subfolder-support.md

@@ -0,0 +1,8 @@
+---
+"@bradygaster/squad-cli": patch
+"@bradygaster/squad-sdk": patch
+---
+
+fix: monorepo subfolder support — never run git init (#939)
+
+When `squad init` runs in a subfolder of a monorepo, place `.github/agents/squad.agent.md` at the git root and `.squad/` in the subfolder. Never run `git init`.

.changeset/pid-tracker-cleanup.md

@@ -0,0 +1,9 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+fix(watch): track child process PIDs and cleanup orphans on exit
+
+Prevents MCP server process leaks during long-running watch sessions.
+Tracks PIDs of spawned copilot sessions, kills them on exit/crash,
+and cleans up stale orphans from previous crashed runs on startup.

.changeset/review-findings-fix.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+fix: address post-merge review findings — catch unknown narrowing and deprecation warnings for start/rc commands

.changeset/shell-injection-fixes.md

@@ -0,0 +1,12 @@
+---
+'@bradygaster/squad-sdk': patch
+---
+
+Eliminate shell injection vectors in scheduler and state backend
+
+- Replace all `execSync` calls with `execFileSync` using explicit argv arrays (no shell interpretation)
+- Refactor git helper functions to accept `string[]` instead of space-delimited strings
+- Add `validateTaskRef()` for scheduler script refs (rejects null bytes, newlines)
+- Add `validateStateKey()` for state backend keys (rejects null bytes, newlines, tabs, path traversal)
+- Validate script task refs at manifest parse time (defense-in-depth)
+- Add security-focused tests for both scheduler and state backend

.changeset/skill-security-scanner.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+Add markdown-aware skill security scanner (Phase 1) to security-review.mjs. Scans .copilot/skills and .squad/skills markdown files for embedded credentials, download-and-execute patterns, and privilege escalation commands. Includes fenced code block suppression, inline code span suppression, and placeholder token detection. Zero false positives on existing 35 skill files.

.changeset/start-tunnel-node-pty.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+Validate node-pty availability before side effects in squad start --tunnel

.changeset/teams-adapter-fixes.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-sdk': patch
+---
+
+Teams adapter: encode channelId in deep-link URL, log warning on icacls failure, add integration tests

.changeset/teams-adapter-security.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-sdk': patch
+---
+
+Teams adapter token security: tenant-scoped token cache (keyed by tenant ID hash), explicit logout() for session teardown, 15-minute device-code timeout guard, stale token cleanup on permanent auth errors, per-instance user ID cache. Migration guide for async createCommunicationAdapter change.

.changeset/watch-p0-p1-fixes.md

@@ -0,0 +1,10 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+fix(watch): wire missing CLI flags to config, validate --state-backend, fix auth stderr parsing (#834)
+
+- Wire --notify-level, --overnight-start, --overnight-end, --sentinel-file to WatchConfig and loadWatchConfig merge
+- Add --state-backend flag with upfront validation against allowed values (worktree, git-notes, orphan, external)
+- Fix probeCurrentGhUser() to use `gh api user -q .login` (stdout) instead of parsing `gh auth status` stderr
+- Also wire authUser through loadWatchConfig merge logic (was accepted but silently dropped)

.changeset/watch-rate-limit-detection.md

@@ -0,0 +1,5 @@
+---
+'@bradygaster/squad-cli': patch
+---
+
+Fix watch reporting "Board is clear" when GitHub API rate limit is hit. Detects rate-limit and other scan errors, shows appropriate warning instead of the misleading idle message, skips subsequent phases on failed scans, and prevents rate-limited rounds from counting as circuit-breaker successes.