fix: address Copilot review comments on PR #1023

- skill.ts: add await to async ghAvailable() call
- skill.ts: add shell: IS_WINDOWS to all execFileAsync('gh') calls
- squad-pr-nudge.yml: fix reversed compareCommits base/head args
- squad-insider-publish.yml: fix nested double-quotes in bash
- watch/health.ts: add timeout to execFileSync call
- apm-integration.md: fix package name to @bradygaster/squad-cli

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: Copilot

.changeset/apm-integration.md

@@ -1,5 +1,5 @@
 ---
-"squad": minor
+"@bradygaster/squad-cli": minor
 ---
 
 feat: APM integration — squad skill publish/install + apm.yml in init

.github/workflows/squad-insider-publish.yml

@@ -119,7 +119,7 @@ jobs:
             pkg.dependencies['@bradygaster/squad-sdk'] = '$SDK_VERSION';
             require('fs').writeFileSync('./package.json', JSON.stringify(pkg, null, 2) + '\n');
           "
-          echo "Verified: $(node -p "require('./package.json').dependencies['@bradygaster/squad-sdk']")"
+          echo "Verified: $(node -p 'require("./package.json").dependencies["@bradygaster/squad-sdk"]')"
 
       - name: Publish squad-sdk with insider tag
         run: npm -w packages/squad-sdk publish --tag insider --access public

.github/workflows/squad-pr-nudge.yml

@@ -143,8 +143,8 @@ jobs:
               const comparison = await github.rest.repos.compareCommits({
                 owner: context.repo.owner,
                 repo: context.repo.repo,
-                base: pr.head.sha,
-                head: pr.base.ref
+                base: pr.base.ref,
+                head: pr.head.sha
               });
               if (comparison.data.ahead_by > 10) {
                 actions.push(`⬇️ **${comparison.data.ahead_by} commits behind ${pr.base.ref}.** Rebase to pick up latest changes.`);

packages/squad-cli/src/cli/commands/skill.ts

@@ -17,6 +17,7 @@ import { fatal } from '../core/errors.js';
 import { detectSquadDir } from '../core/detect-squad-dir.js';
 import { ghAvailable } from '../core/gh-cli.js';
 
+const IS_WINDOWS = process.platform === 'win32';
 const execFileAsync = promisify(execFile);
 
 // ── Types ─────────────────────────────────────────────────────────────────────
@@ -262,7 +263,7 @@ async function install(dest: string, source: string): Promise<void> {
   const repo = parts[1]!;
   const skillFilter = parts.length >= 3 ? parts.slice(2).join('/') : undefined;
 
-  if (!ghAvailable()) {
+  if (!(await ghAvailable())) {
     fatal('GitHub CLI (gh) is required for APM install. Install from https://cli.github.com/');
   }
 
@@ -316,7 +317,7 @@ async function installFromGitHub(
       'api',
       `repos/${owner}/${repo}/contents/apm.yml`,
       '--jq', '.content',
-    ]);
+    ], { shell: IS_WINDOWS });
     apmContent = Buffer.from(stdout.trim(), 'base64').toString('utf8');
   } catch {
     // No apm.yml — fall back to scanning skills directories
@@ -378,7 +379,7 @@ async function installFromGitHub(
         'api',
         `repos/${owner}/${repo}/contents/${skill.path}`,
         '--jq', '.content',
-      ]);
+      ], { shell: IS_WINDOWS });
       const content = Buffer.from(rawContent.trim(), 'base64').toString('utf8');
       const skillDir = join(skillsDir, skill.name);
       await mkdir(skillDir, { recursive: true });
@@ -421,7 +422,7 @@ async function installSkillsFromSquadDir(
         'api',
         `repos/${owner}/${repo}/contents/${candidate}`,
         '--jq', '[.[] | {name: .name, path: .path, type: .type}]',
-      ]);
+      ], { shell: IS_WINDOWS });
       entries = JSON.parse(stdout);
       break;
     } catch {
@@ -453,7 +454,7 @@ async function installSkillsFromSquadDir(
         'api',
         `repos/${owner}/${repo}/contents/${skillFilePath}`,
         '--jq', '.content',
-      ]);
+      ], { shell: IS_WINDOWS });
       const content = Buffer.from(rawContent.trim(), 'base64').toString('utf8');
       const skillDir = join(skillsDir, dir.name);
       await mkdir(skillDir, { recursive: true });

packages/squad-cli/src/cli/commands/watch/health.ts

@@ -85,6 +85,7 @@ function probeCurrentGhUser(): string | undefined {
       encoding: 'utf-8',
       stdio: ['pipe', 'pipe', 'pipe'],
       shell: IS_WINDOWS,
+      timeout: 10_000,
     });
     const match = result.match(/account\s+(\S+)/);
     return match?.[1];