fix(publish): replace file: SDK dependency with >=0.9.0, add publish safety tests

npm workspaces rewrote the CLI's squad-sdk dependency to file:../squad-sdk,
which breaks every global install (ERR_MODULE_NOT_FOUND). Fixed by:

- CLI dependency: file:../squad-sdk -> >=0.9.0
- Added file: dependency guard in publish workflow
- Added publish safety tests in cli-packaging-smoke.test.ts
- Bumped to 0.9.1

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Copilot

.github/workflows/publish.yml

@@ -126,6 +126,15 @@ jobs:
       - name: Install dependencies
         run: npm ci
 
+      - name: Guard against file: dependencies
+        run: |
+          SDK_DEP=$(node -p "require('./packages/squad-cli/package.json').dependencies['@bradygaster/squad-sdk']")
+          if [[ "$SDK_DEP" == file:* ]]; then
+            echo "::error::squad-cli has file: dependency on squad-sdk — this breaks global installs"
+            exit 1
+          fi
+          echo "✅ SDK dependency is safe: $SDK_DEP"
+
       - name: Build squad-sdk (required for CLI project references)
         run: npm -w packages/squad-sdk run build
 

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@bradygaster/squad",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "private": true,
   "description": "Squad — Programmable multi-agent runtime for GitHub Copilot, built on @github/copilot-sdk",
   "type": "module",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bradygaster/squad-cli",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Squad CLI — Command-line interface for the Squad multi-agent runtime",
   "type": "module",
   "bin": {
@@ -173,7 +173,7 @@
     "node": ">=22.5.0"
   },
   "dependencies": {
-    "@bradygaster/squad-sdk": "file:../squad-sdk",
+    "@bradygaster/squad-sdk": ">=0.9.0",
     "ink": "^6.8.0",
     "react": "^19.2.4",
     "vscode-jsonrpc": "^8.2.1"

packages/squad-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bradygaster/squad-sdk",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Squad SDK — Programmable multi-agent runtime for GitHub Copilot",
   "type": "module",
   "main": "./dist/index.js",

packages/squad-sdk/package.json

@@ -188,6 +188,28 @@ describe('CLI packaging smoke test', { timeout: 120_000 }, () => {
     }
   }
 
+  // ============================================================================
+  // PHASE 1.5 — PUBLISH SAFETY CHECKS
+  // These prevent broken packages from reaching npm.
+  // ============================================================================
+
+  it('squad-cli has no file: dependencies (breaks global installs)', () => {
+    const pkgPath = join(tempDir, 'node_modules', '@bradygaster', 'squad-cli', 'package.json');
+    const pkg = JSON.parse(require('fs').readFileSync(pkgPath, 'utf8'));
+    const deps = pkg.dependencies || {};
+    for (const [name, version] of Object.entries(deps)) {
+      expect(String(version), `${name} has file: dependency — will break global installs`)
+        .not.toMatch(/^file:/);
+    }
+  });
+
+  it('squad-sdk resolves as a real package (not a workspace link)', () => {
+    const sdkPkg = join(tempDir, 'node_modules', '@bradygaster', 'squad-sdk', 'package.json');
+    expect(existsSync(sdkPkg), 'squad-sdk not installed as dependency of squad-cli').toBe(true);
+    const pkg = JSON.parse(require('fs').readFileSync(sdkPkg, 'utf8'));
+    expect(pkg.name).toBe('@bradygaster/squad-sdk');
+  });
+
   // ============================================================================
   // PHASE 2 — SMOKE TESTS
   // ============================================================================