[tamirdresher]

What

Caps @github/copilot-sdk at >=1.0.19 <1.0.29-0 in @bradygaster/squad-sdk, with the matching spec in package-lock.json. Fresh installs then resolve copilot-sdk 1.0.28 instead of 1.0.29. Adds a patch changeset for the SDK and the CLI.

Working as release-engineer (Release Engineer).

Why

copilot-sdk 1.0.29, published 2026-11-06, depends on vscode-jsonrpc 10.0.0. That version exports ./node but not ./node.js. The CLI's ESM import patch (packages/squad-cli/scripts/patch-esm-imports.mjs, the #449 workaround for vscode-jsonrpc 8) rewrites copilot-sdk's vscode-jsonrpc/node import to vscode-jsonrpc/node.js. The rewritten import fails, so Squad's Copilot adapter can't load (ERR_PACKAGE_PATH_NOT_EXPORTED).

• CI: test/cli-packaging-smoke.test.ts fails 2 tests on every PR into dev, in both Squad CI test and Squad Release Verify. test is required, so nothing can merge. In this test the rewrite comes from squad upgrade.
• Users: fresh npm install -g @bradygaster/squad-cli on npm 10/11, where the postinstall does the rewrite, and project installs after squad upgrade.

Closes #2414

How

• Range: with >=1.0.19 <1.0.29-0, npm resolves 1.0.28 (vscode-jsonrpc 8.2.1), the setup that last passed CI. The -0 also excludes 1.0.29-preview.N, which use vscode-jsonrpc 10, in tools that include prereleases.
• Lockfile: only that one spec changed. Repo development still installs copilot-sdk 1.0.19 from the lock.
• Changeset: it lists both packages because each published CLI pins an exact SDK version. CLI users only get the cap through a CLI release.
• No new unit test: the packaging smoke test is the regression guard. It's red before this change and green after, and any range that admits 1.0.29 turns it red again. A range test would need an undeclared semver dependency.
• Root-cause fix: Make the postinstall vscode-jsonrpc rewrite conditional, then lift the copilot-sdk cap #2415 makes the rewrite conditional in the postinstall, squad upgrade, the cli-entry.ts hook and squad doctor, then lifts this cap.
• For maintainers (release): latest (1.1.0) and preview/insider (2.0.0-preview.3) are both affected.
  • preview/insider: release 2.0.0-preview.4 from dev after this merges.
  • latest: open a 1.1.1 hotfix PR into main with the same cap. main also needs the repository metadata fix from fix(release): point package and NuGet metadata at github/squad #2408 before it can publish with provenance.

Validation (on this branch; Windows, Node 27, npm 12):

Command	Result
node scripts/release/workspace-lockfile.mjs check	✅ exit 0
npm ci --ignore-scripts --dry-run on a scratch copy of the manifests and lockfile	✅ in sync (569 packages, same as dev). A deliberately mismatched spec fails with "not in sync"
npx vitest run test/cli-packaging-smoke.test.ts --hookTimeout=120000, with the range reverted to ^1.0.19	❌ as expected: 2 failed, 30 passed, with ERR_PACKAGE_PATH_NOT_EXPORTED, same as CI run 42460059168
The same command with the cap	✅ 32/32 passed
npm run lint	✅ passed
node scripts/release/policy-gates.mjs --mode=ci	✅ 7/7 gates; the changeset validates
node scripts/check-changeset-drift.mjs --mode=fail	✅ no drift
A/B: packed tarballs, fresh global and local installs, patch step, then import @bradygaster/squad-sdk/dist/adapter/client.js	✅ With the cap: copilot-sdk 1.0.28, and the import works. Without it: 1.0.29, and the import fails with ERR_PACKAGE_PATH_NOT_EXPORTED

Local smoke-test runs needed two Windows-only workarounds, and CI runs the test unmodified:

• Temp folder: the runs used a temp folder outside the user profile. A node-pty installed in the profile's node_modules makes the "forced-missing node-pty" test start a real Copilot.
• Hook timeout: --hookTimeout=120000 gives the cleanup step enough time on Windows.

---

⚠️ Quick Check

• If SDK/CLI source files changed: completed the applicable Changeset step below (npx changeset add / .changeset/*.md, direct CHANGELOG.md entry for maintainers, or skip-changelog label for no user-facing changes)

PR Readiness Checklist

The PR readiness bot will validate these automatically after push.
Check each item before requesting review. See CONTRIBUTING.md for full details.

Branch & Commit

• Branch created from dev (not main)
• Branch is up to date with dev (git fetch upstream && git rebase upstream/dev)
• Verified diff contains only intended changes (git diff --cached --stat)
• PR is not in draft mode (mark ready when checks pass)
• Commit history is clean (squash fixups before review)

Build & Test

• npm run build passes: the smoke test builds both the SDK and the CLI; this change is a dependency range only
• npm test passes (all tests green): the targeted suite above; the full suite runs in CI
• npm run lint passes (type check clean)
• npm run lint:eslint passes: not run, no source files changed
• For migration PRs (>20 files): include test output summary in PR description: N/A (3 files)

Changeset

• Changeset added via npx changeset add (if packages/squad-sdk/src/ or packages/squad-cli/src/ changed): .changeset/cap-copilot-sdk-1-0-29.md
• Or direct CHANGELOG.md entry (maintainers only — write-protected for external contributors)
• Or skip-changelog label applied (if no user-facing changes)

Docs

• README section updated (if new feature/module): N/A
• Docs feature page (if new user-facing capability): N/A

Exports

• package.json subpath exports updated (if new module): N/A, no new modules

---

Breaking Changes

None. Consumers that already resolved copilot-sdk 1.0.29 get 1.0.28 on their next install. The repo develops and tests against 1.0.19 (the lockfile version), so nothing depends on 1.0.29.

Waivers

None.

[github-actions]

🛫 PR Readiness Check

ℹ️ This comment updates on each push. Last checked: commit 16f599f

PR Scope: 🔧 Infrastructure

⚠️ 3 item(s) to address before review

Status	Check	Details
✅	Single commit	1 commit — clean history
❌	Not in draft	PR is still in draft — mark as ready for review when done
✅	Branch up to date	Up to date with dev
❌	Copilot review	No Copilot review yet — it may still be processing
✅	Changeset present	Changeset file found
✅	Scope clean	No .squad/ or docs/proposals/ files
✅	No merge conflicts	No merge conflicts
✅	Copilot threads resolved	No Copilot review threads
❌	CI passing	3 check(s) failing: Verify exact SHA and build evidence, github-advanced-security, submit-nuget

Files Changed (3 files, +8 −2)

File	+/−
.changeset/cap-copilot-sdk-1-0-29.md	+6 −0
package-lock.json	+1 −1
packages/squad-sdk/package.json	+1 −1

Total: +8 −2

---

This check runs automatically on every push. Fix any ❌ items and push again.
See CONTRIBUTING.md and PR Requirements for details.

[tamirdresher]

CI status before merge:

• Required checks pass: test and gh-aw strict compile pass on re-run. test/cli-packaging-smoke.test.ts passes 32/32 in both Squad CI and Squad Release Verify. Before this change it failed on every PR into dev.
• First attempt: the first test attempt failed 18 gh-aw strict-compile tests on 5 s timeouts. Those test files ran 10 to 25 times slower than on ci: run PR workflows without pull_request_target #2409 this morning, for example gh-aw-deps-worker-workflow at 4.5 s then and 105 s now. This happened during the GitHub incident "Increase in timeouts for some unauthenticated users". The re-run passed.
• Release Verify (not required): the second attempt still has 2 gh-aw compile timeouts (5 s and 20 s) in gh-aw-command-router-relay and gh-aw-deps-worker-workflow. Nothing else fails.
• Automatic Dependency Submission / submit-nuget: component-detection exited with code 2 on the first attempt and passed on re-run.

This change only touches a dependency range, so I'm merging to unblock dev.

[Copilot]

🟢 Approval recommended

The dependency cap, synchronized lockfile entry, and coordinated changesets address the incompatible SDK release, with no active review issues identified.

No open issues 🎉

What changed in this PR

This pull request caps @github/copilot-sdk below 1.0.29 to avoid the incompatible vscode-jsonrpc ESM import rewrite and adds coordinated patch releases for the SDK and CLI.

Changes:

• Restricts the SDK dependency to >=1.0.19 <1.0.29-0.
• Synchronizes the dependency specification in the workspace lockfile.
• Adds patch changesets for @bradygaster/squad-sdk and the CLI.

File	Description
packages/​squad-sdk/​package.json	Adds the temporary Copilot SDK version cap.
package-lock.json	Synchronizes the workspace dependency specification.
.changeset/​cap-copilot-sdk-1-0-29.md	Documents the mitigation and patch releases for the SDK and CLI.

This pull request is ready to be approved.

_{Review effort: Lite (auto)}