bug(cli): standalone doctor checks unrelated application node_modules instead of active runtime #2367

Summary

Windows standalone Squad 2.0.0-preview.2 reports missing dependency/patch warnings based on the application's node_modules, even when the standalone installation's actual runtime dependencies import successfully.

An unrelated application's node_modules changes the advice to "run npm install or check dependencies". Following that advice in the application would not repair the runtime Squad is actually using.

This is distinct from the missing/broken package cases in #449 and #1190: both dependencies are healthy in the standalone runtime here. It also reproduces the confusing installed-user warning pattern previously reported in #565.

Synthetic reproduction

1. Use the Windows standalone 2.0.0-preview.2 distribution.
2. Create a synthetic application directory with an empty node_modules directory and a minimal .squad/team.md. Do not install Squad into that application.
3. Call the installed CLI's exported runDoctor(syntheticApplicationDirectory); inspect these two result records:

[
  {
    "name": "vscode-jsonrpc exports field",
    "status": "warn",
    "message": "not found in node_modules — run npm install or check dependencies"
  },
  {
    "name": "copilot-sdk session.js ESM patch",
    "status": "warn",
    "message": "not found in node_modules — run npm install or check dependencies"
  }
]

4. Separately import vscode-jsonrpc/node resolved relative to the standalone application's package.json, and import that installation's @github/copilot-sdk/dist/session.js.

Observed: both imports succeed. The same warning pair is observable from native standalone squad doctor in an application with unrelated dependencies.

The synthetic probe uses no real team files, credentials, or application data.

Source evidence

packages/squad-cli/src/cli/commands/doctor.ts:

• checkVscodeJsonrpcExports(cwd) checks only <cwd>/node_modules/... and <cwd>/packages/squad-cli/node_modules/....
• checkCopilotSdkSessionPatch(cwd) has the same scope.
• An existing <cwd>/node_modules is treated as a Squad development context, although it can belong entirely to the host application.

These lookups and warning messages are also present in current upstream dev at the time of this report.

Expected

Check or clearly identify the runtime actually used by the invoked Squad installation. Distinguish:

• application-local Squad dependencies genuinely in use;
• standalone/global runtime dependencies;
• an unrelated application dependency directory;
• an unverified runtime.

Do not recommend installing or patching application dependencies solely because the standalone runtime is outside the current checkout. Retain real failures for malformed exports or actual runtime import errors; an unknown lookup should not silently become success.

Suggested coverage: standalone/global installation with healthy dependencies plus an unrelated application's empty node_modules, and a separate genuinely broken runtime case.

Local handling

The warning scope and successful standalone imports are recorded separately. No application dependency was installed and no vendor source or export map was patched to silence diagnostics.