@bhargavvc/sdd-cc 1.35.0 → 1.42.4

package/commands/sdd/thread.md

@@ -1,127 +1,24 @@
 ---
 name: sdd:thread
 description: Manage persistent context threads for cross-session work
-argument-hint: [name | description]
+argument-hint: "[list [--open | --resolved] | close <slug> | status <slug> | name | description]"
 allowed-tools:
   - Read
   - Write
   - Bash
+requires: [phase]
 ---
 
 <objective>
-Create, list, or resume persistent context threads. Threads are lightweight
+Create, list, close, or resume persistent context threads. Threads are lightweight
 cross-session knowledge stores for work that spans multiple sessions but
 doesn't belong to any specific phase.
 </objective>
 
-<process>
-
-**Parse $ARGUMENTS to determine mode:**
-
-<mode_list>
-**If no arguments or $ARGUMENTS is empty:**
-
-List all threads:
-```bash
-ls .planning/threads/*.md 2>/dev/null
-```
-
-For each thread, read the first few lines to show title and status:
-```
-## Active Threads
-
-| Thread | Status | Last Updated |
-|--------|--------|-------------|
-| fix-deploy-key-auth | OPEN | 2026-03-15 |
-| pasta-tcp-timeout | RESOLVED | 2026-03-12 |
-| perf-investigation | IN PROGRESS | 2026-03-17 |
-```
-
-If no threads exist, show:
-```
-No threads found. Create one with: /sdd-thread <description>
-```
-</mode_list>
-
-<mode_resume>
-**If $ARGUMENTS matches an existing thread name (file exists):**
-
-Resume the thread — load its context into the current session:
-```bash
-cat ".planning/threads/${THREAD_NAME}.md"
-```
-
-Display the thread content and ask what the user wants to work on next.
-Update the thread's status to `IN PROGRESS` if it was `OPEN`.
-</mode_resume>
-
-<mode_create>
-**If $ARGUMENTS is a new description (no matching thread file):**
-
-Create a new thread:
-
-1. Generate slug from description:
-   ```bash
-   SLUG=$(node "$HOME/.claude/sdd/bin/sdd-tools.cjs" generate-slug "$ARGUMENTS" --raw)
-   ```
-
-2. Create the threads directory if needed:
-   ```bash
-   mkdir -p .planning/threads
-   ```
-
-3. Write the thread file:
-   ```bash
-   cat > ".planning/threads/${SLUG}.md" << 'EOF'
-   # Thread: {description}
-
-   ## Status: OPEN
-
-   ## Goal
-
-   {description}
-
-   ## Context
-
-   *Created from conversation on {today's date}.*
-
-   ## References
-
-   - *(add links, file paths, or issue numbers)*
-
-   ## Next Steps
-
-   - *(what the next session should do first)*
-   EOF
-   ```
-
-4. If there's relevant context in the current conversation (code snippets,
-   error messages, investigation results), extract and add it to the Context
-   section.
-
-5. Commit:
-   ```bash
-   node "$HOME/.claude/sdd/bin/sdd-tools.cjs" commit "docs: create thread — ${ARGUMENTS}" --files ".planning/threads/${SLUG}.md"
-   ```
-
-6. Report:
-   ```
-   ## 🧵 Thread Created
-
-   Thread: {slug}
-   File: .planning/threads/{slug}.md
-
-   Resume anytime with: /sdd-thread {slug}
-   ```
-</mode_create>
+<execution_context>
+@~/.claude/sdd/workflows/thread.md
+</execution_context>
 
+<process>
+Execute end-to-end.
 </process>
-
-<notes>
-- Threads are NOT phase-scoped — they exist independently of the roadmap
-- Lighter weight than /sdd-pause-work — no phase state, no plan context
-- The value is in Context and Next Steps — a cold-start session can pick up immediately
-- Threads can be promoted to phases or backlog items when they mature:
-  /sdd-add-phase or /sdd-add-backlog with context from the thread
-- Thread files live in .planning/threads/ — no collision with phases or other SDD structures
-</notes>

package/commands/sdd/ui-phase.md

@@ -8,10 +8,11 @@ allowed-tools:
   - Bash
   - Glob
   - Grep
-  - Task
+  - Agent
   - WebFetch
   - AskUserQuestion
   - mcp__context7__*
+requires: [phase]
 ---
 <objective>
 Create a UI design contract (UI-SPEC.md) for a frontend phase.
@@ -29,6 +30,6 @@ Phase number: $ARGUMENTS — optional, auto-detects next unplanned phase if omit
 </context>
 
 <process>
-Execute @~/.claude/sdd/workflows/ui-phase.md end-to-end.
+Execute end-to-end.
 Preserve all workflow gates.
 </process>

package/commands/sdd/ui-review.md

@@ -8,8 +8,9 @@ allowed-tools:
   - Bash
   - Glob
   - Grep
-  - Task
+  - Agent
   - AskUserQuestion
+requires: [phase]
 ---
 <objective>
 Conduct a retroactive 6-pillar visual audit. Produces UI-REVIEW.md with
@@ -27,6 +28,6 @@ Phase: $ARGUMENTS — optional, defaults to last completed phase.
 </context>
 
 <process>
-Execute @~/.claude/sdd/workflows/ui-review.md end-to-end.
+Execute end-to-end.
 Preserve all workflow gates.
 </process>

package/commands/sdd/ultraplan-phase.md

@@ -0,0 +1,34 @@
+---
+name: sdd:ultraplan-phase
+description: "[BETA] Offload plan phase to Claude Code's ultraplan cloud; review in browser and import back."
+argument-hint: "[phase-number]"
+allowed-tools:
+  - Read
+  - Bash
+  - Glob
+  - Grep
+requires: [import, phase, plan-phase]
+---
+
+<objective>
+Offload SDD's plan phase to Claude Code's ultraplan cloud infrastructure.
+
+Ultraplan drafts the plan in a remote cloud session while your terminal stays free.
+Review and comment on the plan in your browser, then import it back via /sdd:import --from.
+
+⚠ BETA: ultraplan is in research preview. Use /sdd:plan-phase for stable local planning.
+Requirements: Claude Code v2.1.91+, claude.ai account, GitHub repository.
+</objective>
+
+<execution_context>
+@~/.claude/sdd/workflows/ultraplan-phase.md
+@~/.claude/sdd/references/ui-brand.md
+</execution_context>
+
+<context>
+$ARGUMENTS
+</context>
+
+<process>
+Execute the ultraplan-phase workflow end-to-end.
+</process>

package/commands/sdd/undo.md

@@ -8,6 +8,7 @@ allowed-tools:
   - Glob
   - Grep
   - AskUserQuestion
+requires: [phase]
 ---
 
 <objective>
@@ -30,5 +31,5 @@ $ARGUMENTS
 </context>
 
 <process>
-Execute the undo workflow from @~/.claude/sdd/workflows/undo.md end-to-end.
+Execute end-to-end.
 </process>

package/commands/sdd/update.md

@@ -1,8 +1,14 @@
 ---
 name: sdd:update
 description: Update SDD to latest version with changelog display
+argument-hint: "[--sync | --reapply]"
 allowed-tools:
+  - Read
+  - Write
+  - Edit
   - Bash
+  - Glob
+  - Grep
   - AskUserQuestion
 ---
 
@@ -22,16 +28,21 @@ Routes to the update workflow which handles:
 @~/.claude/sdd/workflows/update.md
 </execution_context>
 
+<flags>
+- **--sync**: Sync managed SDD skills across runtime roots so multi-runtime users stay aligned after an update. Runs the sync-skills workflow (--from, --to, --dry-run, --apply flags supported).
+- **--reapply**: Reapply local modifications after a SDD update. Uses three-way comparison (pristine baseline, user-modified backup, newly installed version) to merge user customizations back. Runs the reapply-patches workflow.
+- **(no flag)**: Standard update — check for new version, show changelog, install.
+</flags>
+
 <process>
-**Follow the update workflow** from `@~/.claude/sdd/workflows/update.md`.
+Parse the first token of $ARGUMENTS:
+- If it is `--sync`: strip the flag, execute the sync-skills workflow (passing remaining args for --from/--to/--dry-run/--apply).
+- If it is `--reapply`: strip the flag, execute the reapply-patches workflow.
+- Otherwise: execute the update workflow end-to-end.
 
-The workflow handles all logic including:
-1. Installed version detection (local/global)
-2. Latest version checking via npm
-3. Version comparison
-4. Changelog fetching and extraction
-5. Clean install warning display
-6. User confirmation
-7. Update execution
-8. Cache clearing
 </process>
+
+<execution_context_extended>
+@~/.claude/sdd/workflows/sync-skills.md
+@~/.claude/sdd/workflows/reapply-patches.md
+</execution_context_extended>

package/commands/sdd/validate-phase.md

@@ -9,8 +9,9 @@ allowed-tools:
   - Bash
   - Glob
   - Grep
-  - Task
+  - Agent
   - AskUserQuestion
+requires: [phase]
 ---
 <objective>
 Audit Nyquist validation coverage for a completed phase. Three states:
@@ -30,6 +31,6 @@ Phase: $ARGUMENTS — optional, defaults to last completed phase.
 </context>
 
 <process>
-Execute @~/.claude/sdd/workflows/validate-phase.md.
+Execute end-to-end.
 Preserve all workflow gates.
 </process>

package/commands/sdd/verify-work.md

@@ -1,7 +1,7 @@
 ---
 name: sdd:verify-work
 description: Validate built features through conversational UAT
-argument-hint: "[phase number, e.g., '4']"
+argument-hint: "[phase number, e.g., '4'] [--ws <name>]"
 allowed-tools:
   - Read
   - Bash
@@ -9,14 +9,15 @@ allowed-tools:
   - Grep
   - Edit
   - Write
-  - Task
+  - Agent
+requires: [execute-phase, phase]
 ---
 <objective>
 Validate built features through conversational testing with persistent state.
 
 Purpose: Confirm what Claude built actually works from user's perspective. One test at a time, plain text responses, no interrogation. When issues are found, automatically diagnose, plan fixes, and prepare for execution.
 
-Output: {phase_num}-UAT.md tracking all test results. If issues found: diagnosed gaps, verified fix plans ready for /sdd-execute-phase
+Output: {phase_num}-UAT.md tracking all test results. If issues found: diagnosed gaps, verified fix plans ready for /sdd:execute-phase
 </objective>
 
 <execution_context>
@@ -33,6 +34,6 @@ Context files are resolved inside the workflow (`init verify-work`) and delegate
 </context>
 
 <process>
-Execute the verify-work workflow from @~/.claude/sdd/workflows/verify-work.md end-to-end.
+Execute end-to-end.
 Preserve all workflow gates (session management, test presentation, diagnosis, fix planning, routing).
 </process>

package/commands/sdd/workspace.md

@@ -0,0 +1,52 @@
+---
+name: sdd:workspace
+description: Manage SDD workspaces — create, list, or remove isolated workspace environments
+argument-hint: "[--new | --list | --remove] [name]"
+allowed-tools:
+  - Read
+  - Write
+  - Bash
+  - AskUserQuestion
+---
+
+<objective>
+Manage SDD workspaces with a single consolidated command.
+
+Mode routing:
+- **--new**: Create an isolated workspace with repo copies and independent .planning/ → new-workspace workflow
+- **--list**: List active SDD workspaces and their status → list-workspaces workflow
+- **--remove**: Remove a SDD workspace and clean up worktrees → remove-workspace workflow
+</objective>
+
+<routing>
+
+| Flag | Action | Workflow |
+|------|--------|----------|
+| --new | Create workspace with worktree/clone strategy | new-workspace |
+| --list | Scan ~/sdd-workspaces/, show summary table | list-workspaces |
+| --remove | Confirm and remove workspace directory | remove-workspace |
+
+</routing>
+
+<execution_context>
+@~/.claude/sdd/workflows/new-workspace.md
+@~/.claude/sdd/workflows/list-workspaces.md
+@~/.claude/sdd/workflows/remove-workspace.md
+@~/.claude/sdd/references/ui-brand.md
+</execution_context>
+
+<context>
+Arguments: $ARGUMENTS
+
+Parse the first token of $ARGUMENTS:
+- If it is `--new`: strip the flag, pass remainder (--name, --repos, --path, --strategy, --branch, --auto flags) to new-workspace workflow
+- If it is `--list`: execute list-workspaces workflow (no argument needed)
+- If it is `--remove`: strip the flag, pass remainder (workspace-name) to remove-workspace workflow
+- Otherwise (no flag): show usage — one of --new, --list, or --remove is required
+</context>
+
+<process>
+1. Parse the leading flag from $ARGUMENTS.
+2. Load and execute the appropriate workflow end-to-end based on the routing table above.
+3. Preserve all workflow gates from the target workflow (validation, approvals, commits, routing).
+</process>

package/commands/sdd/workstreams.md

@@ -4,15 +4,16 @@ description: Manage parallel workstreams — list, create, switch, status, progr
 allowed-tools:
   - Read
   - Bash
+requires: [new-milestone, phase, progress, resume-work]
 ---
 
-# /sdd-workstreams
+# /sdd:workstreams
 
 Manage parallel workstreams for concurrent milestone work.
 
 ## Usage
 
-`/sdd-workstreams [subcommand] [args]`
+`/sdd:workstreams [subcommand] [args]`
 
 ### Subcommands
 
@@ -34,36 +35,36 @@ If no subcommand given, default to `list`.
 ## Step 2: Execute Operation
 
 ### list
-Run: `node "$HOME/.claude/sdd/bin/sdd-tools.cjs" workstream list --raw --cwd "$CWD"`
+Run: `sdd-sdk query workstream.list --raw --cwd "$CWD"`
 Display the workstreams in a table format showing name, status, current phase, and progress.
 
 ### create
-Run: `node "$HOME/.claude/sdd/bin/sdd-tools.cjs" workstream create <name> --raw --cwd "$CWD"`
+Run: `sdd-sdk query workstream.create <name> --raw --cwd "$CWD"`
 After creation, display the new workstream path and suggest next steps:
-- `/sdd-new-milestone --ws <name>` to set up the milestone
+- `/sdd:new-milestone --ws <name>` to set up the milestone
 
 ### status
-Run: `node "$HOME/.claude/sdd/bin/sdd-tools.cjs" workstream status <name> --raw --cwd "$CWD"`
+Run: `sdd-sdk query workstream.status <name> --raw --cwd "$CWD"`
 Display detailed phase breakdown and state information.
 
 ### switch
-Run: `node "$HOME/.claude/sdd/bin/sdd-tools.cjs" workstream set <name> --raw --cwd "$CWD"`
+Run: `sdd-sdk query workstream.set <name> --raw --cwd "$CWD"`
 Also set `SDD_WORKSTREAM` for the current session when the runtime supports it.
 If the runtime exposes a session identifier, SDD also stores the active workstream
 session-locally so concurrent sessions do not overwrite each other.
 
 ### progress
-Run: `node "$HOME/.claude/sdd/bin/sdd-tools.cjs" workstream progress --raw --cwd "$CWD"`
+Run: `sdd-sdk query workstream.progress --raw --cwd "$CWD"`
 Display a progress overview across all workstreams.
 
 ### complete
-Run: `node "$HOME/.claude/sdd/bin/sdd-tools.cjs" workstream complete <name> --raw --cwd "$CWD"`
+Run: `sdd-sdk query workstream.complete <name> --raw --cwd "$CWD"`
 Archive the workstream to milestones/.
 
 ### resume
-Set the workstream as active and suggest `/sdd-resume-work --ws <name>`.
+Set the workstream as active and suggest `/sdd:resume-work --ws <name>`.
 
 ## Step 3: Display Results
 
-Format the JSON output from sdd-tools into a human-readable display.
+Format the JSON output from sdd-sdk query into a human-readable display.
 Include the `${SDD_WS}` flag in any routing suggestions.

package/hooks/dist/sdd-check-update-worker.js

@@ -0,0 +1,116 @@
+#!/usr/bin/env node
+// sdd-hook-version: {{SDD_VERSION}}
+// Background worker spawned by sdd-check-update.js (SessionStart hook).
+// Checks for SDD updates and stale hooks, writes result to cache file.
+// Receives paths via environment variables set by the parent hook.
+//
+// Using a separate file (rather than node -e '<inline code>') avoids the
+// template-literal regex-escaping problem: regex source is plain JS here.
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const { execFileSync } = require('child_process');
+
+const cacheFile = process.env.SDD_CACHE_FILE;
+const projectVersionFile = process.env.SDD_PROJECT_VERSION_FILE;
+const globalVersionFile = process.env.SDD_GLOBAL_VERSION_FILE;
+
+// Compare semver: true if a > b (a is strictly newer than b)
+// Strips pre-release suffixes (e.g. '3-beta.1' → '3') to avoid NaN from Number()
+function isNewer(a, b) {
+  const pa = (a || '').split('.').map(s => Number(s.replace(/-.*/, '')) || 0);
+  const pb = (b || '').split('.').map(s => Number(s.replace(/-.*/, '')) || 0);
+  for (let i = 0; i < 3; i++) {
+    if (pa[i] > pb[i]) return true;
+    if (pa[i] < pb[i]) return false;
+  }
+  return false;
+}
+
+// Check project directory first (local install), then global
+let installed = '0.0.0';
+let configDir = '';
+try {
+  if (fs.existsSync(projectVersionFile)) {
+    installed = fs.readFileSync(projectVersionFile, 'utf8').trim();
+    configDir = path.dirname(path.dirname(projectVersionFile));
+  } else if (fs.existsSync(globalVersionFile)) {
+    installed = fs.readFileSync(globalVersionFile, 'utf8').trim();
+    configDir = path.dirname(path.dirname(globalVersionFile));
+  }
+} catch (e) {}
+
+// Check for stale hooks — compare hook version headers against installed VERSION
+// Hooks are installed at configDir/hooks/ (e.g. ~/.claude/hooks/) (#1421)
+// Only check hooks that SDD currently ships — orphaned files from removed features
+// (e.g., sdd-intel-*.js) must be ignored to avoid permanent stale warnings (#1750)
+const MANAGED_HOOKS = [
+  'sdd-check-update-worker.js',
+  'sdd-check-update.js',
+  'sdd-context-monitor.js',
+  'sdd-phase-boundary.sh',
+  'sdd-prompt-guard.js',
+  'sdd-read-guard.js',
+  'sdd-read-injection-scanner.js',
+  'sdd-session-state.sh',
+  'sdd-statusline.js',
+  'sdd-update-banner.js',
+  'sdd-validate-commit.sh',
+  'sdd-workflow-guard.js',
+];
+
+let staleHooks = [];
+if (configDir) {
+  const hooksDir = path.join(configDir, 'hooks');
+  try {
+    if (fs.existsSync(hooksDir)) {
+      const hookFiles = fs.readdirSync(hooksDir).filter(f => MANAGED_HOOKS.includes(f));
+      for (const hookFile of hookFiles) {
+        try {
+          const content = fs.readFileSync(path.join(hooksDir, hookFile), 'utf8');
+          // Match both JS (//) and bash (#) comment styles
+          const versionMatch = content.match(/(?:\/\/|#) sdd-hook-version:\s*(.+)/);
+          if (versionMatch) {
+            const hookVersion = versionMatch[1].trim();
+            if (isNewer(installed, hookVersion) && !hookVersion.includes('{{')) {
+              staleHooks.push({ file: hookFile, hookVersion, installedVersion: installed });
+            }
+          } else {
+            // No version header at all — definitely stale (pre-version-tracking)
+            staleHooks.push({ file: hookFile, hookVersion: 'unknown', installedVersion: installed });
+          }
+        } catch (e) {}
+      }
+    }
+  } catch (e) {}
+}
+
+let latest = null;
+try {
+  latest = execFileSync('npm', ['view', '@bhargavvc/sdd-cc', 'version'], {
+    encoding: 'utf8',
+    timeout: 10000,
+    windowsHide: true,
+    // On Windows, 'npm' is distributed as npm.cmd. Node's execFileSync does
+    // not apply PATHEXT resolution and looks for a literal 'npm' binary,
+    // failing with ENOENT. Setting shell:true on Windows routes through
+    // cmd.exe which resolves npm.cmd via PATHEXT.
+    // POSIX (Linux/macOS) is left untouched — no shell spawn, no extra
+    // signal/exit-code semantics, no overhead.
+    shell: process.platform === 'win32',
+  }).trim();
+} catch (e) {}
+
+const result = {
+  update_available: latest && isNewer(latest, installed),
+  installed,
+  latest: latest || 'unknown',
+  checked: Math.floor(Date.now() / 1000),
+  stale_hooks: staleHooks.length > 0 ? staleHooks : undefined,
+};
+
+if (cacheFile) {
+  try { fs.writeFileSync(cacheFile, JSON.stringify(result)); } catch (e) {}
+}

package/hooks/dist/sdd-check-update.js

@@ -44,96 +44,21 @@ if (!fs.existsSync(cacheDir)) {
   fs.mkdirSync(cacheDir, { recursive: true });
 }
 
-// Run check in background (spawn background process, windowsHide prevents console flash)
-const child = spawn(process.execPath, ['-e', `
-  const fs = require('fs');
-  const path = require('path');
-  const { execSync } = require('child_process');
-
-  // Compare semver: true if a > b (a is strictly newer than b)
-  // Strips pre-release suffixes (e.g. '3-beta.1' → '3') to avoid NaN from Number()
-  function isNewer(a, b) {
-    const pa = (a || '').split('.').map(s => Number(s.replace(/-.*/, '')) || 0);
-    const pb = (b || '').split('.').map(s => Number(s.replace(/-.*/, '')) || 0);
-    for (let i = 0; i < 3; i++) {
-      if (pa[i] > pb[i]) return true;
-      if (pa[i] < pb[i]) return false;
-    }
-    return false;
-  }
-
-  const cacheFile = ${JSON.stringify(cacheFile)};
-  const projectVersionFile = ${JSON.stringify(projectVersionFile)};
-  const globalVersionFile = ${JSON.stringify(globalVersionFile)};
-
-  // Check project directory first (local install), then global
-  let installed = '0.0.0';
-  let configDir = '';
-  try {
-    if (fs.existsSync(projectVersionFile)) {
-      installed = fs.readFileSync(projectVersionFile, 'utf8').trim();
-      configDir = path.dirname(path.dirname(projectVersionFile));
-    } else if (fs.existsSync(globalVersionFile)) {
-      installed = fs.readFileSync(globalVersionFile, 'utf8').trim();
-      configDir = path.dirname(path.dirname(globalVersionFile));
-    }
-  } catch (e) {}
-
-  // Check for stale hooks — compare hook version headers against installed VERSION
-  // Hooks are installed at configDir/hooks/ (e.g. ~/.claude/hooks/) (#1421)
-  // Only check hooks that SDD currently ships — orphaned files from removed features
-  // (e.g., sdd-intel-*.js) must be ignored to avoid permanent stale warnings (#1750)
-  const MANAGED_HOOKS = [
-    'sdd-check-update.js',
-    'sdd-context-monitor.js',
-    'sdd-prompt-guard.js',
-    'sdd-read-guard.js',
-    'sdd-statusline.js',
-    'sdd-workflow-guard.js',
-  ];
-  let staleHooks = [];
-  if (configDir) {
-    const hooksDir = path.join(configDir, 'hooks');
-    try {
-      if (fs.existsSync(hooksDir)) {
-        const hookFiles = fs.readdirSync(hooksDir).filter(f => MANAGED_HOOKS.includes(f));
-        for (const hookFile of hookFiles) {
-          try {
-            const content = fs.readFileSync(path.join(hooksDir, hookFile), 'utf8');
-            const versionMatch = content.match(/\\/\\/ sdd-hook-version:\\s*(.+)/);
-            if (versionMatch) {
-              const hookVersion = versionMatch[1].trim();
-              if (isNewer(installed, hookVersion) && !hookVersion.includes('{{')) {
-                staleHooks.push({ file: hookFile, hookVersion, installedVersion: installed });
-              }
-            } else {
-              // No version header at all — definitely stale (pre-version-tracking)
-              staleHooks.push({ file: hookFile, hookVersion: 'unknown', installedVersion: installed });
-            }
-          } catch (e) {}
-        }
-      }
-    } catch (e) {}
-  }
-
-  let latest = null;
-  try {
-    latest = execSync('npm view @bhargavvc/sdd-cc version', { encoding: 'utf8', timeout: 10000, windowsHide: true }).trim();
-  } catch (e) {}
-
-  const result = {
-    update_available: latest && isNewer(latest, installed),
-    installed,
-    latest: latest || 'unknown',
-    checked: Math.floor(Date.now() / 1000),
-    stale_hooks: staleHooks.length > 0 ? staleHooks : undefined
-  };
-
-  fs.writeFileSync(cacheFile, JSON.stringify(result));
-`], {
+// Run check in background via a dedicated worker script.
+// Spawning a file (rather than node -e '<inline code>') keeps the worker logic
+// in plain JS with no template-literal regex-escaping concerns, and makes the
+// worker independently testable.
+const workerPath = path.join(__dirname, 'sdd-check-update-worker.js');
+const child = spawn(process.execPath, [workerPath], {
   stdio: 'ignore',
   windowsHide: true,
-  detached: true  // Required on Windows for proper process detachment
+  detached: true,  // Required on Windows for proper process detachment
+  env: {
+    ...process.env,
+    SDD_CACHE_FILE: cacheFile,
+    SDD_PROJECT_VERSION_FILE: projectVersionFile,
+    SDD_GLOBAL_VERSION_FILE: globalVersionFile,
+  },
 });
 
 child.unref();