superpowers-manager 0.7.2 → 0.7.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -5,8 +5,21 @@ import { validateSource } from "../../selection.js";
5
5
  import { SafetyError } from "../../safety-error.js";
6
6
  import { isOfficialSnapshotSource, requireNoSnapshotDependencies, requireSnapshotBootstrap, snapshotReceiptBinding, } from "../../snapshot-package.js";
7
7
  const BOOTSTRAP = ".opencode/plugins/superpowers.js";
8
- const BOOTSTRAP_SIZE = 5464;
9
- const BOOTSTRAP_SHA256 = "a5c5e1dbb0abfbd6ec3322b724b9a7b3318bbbb3d83f9a661c56ae0ed0a3adb8";
8
+ // Exact-byte allowlist: every upstream bootstrap change needs re-qualification
9
+ // in the native container before its bytes are added here. Revisit the policy
10
+ // if upstream churn makes that a per-release chore.
11
+ const QUALIFIED_BOOTSTRAPS = [
12
+ // obra/superpowers v6.0.0-v6.3.0
13
+ {
14
+ size: 5464,
15
+ sha256: "a5c5e1dbb0abfbd6ec3322b724b9a7b3318bbbb3d83f9a661c56ae0ed0a3adb8",
16
+ },
17
+ // obra/superpowers v6.4.1
18
+ {
19
+ size: 17617,
20
+ sha256: "c979fe5a9fd6fddc9bc9730b34b25989f9d53939eed7d594c4564f6e47495f26",
21
+ },
22
+ ];
10
23
  function isReceiptCompatibility(value) {
11
24
  if (!value || typeof value !== "object" || Array.isArray(value))
12
25
  return false;
@@ -32,7 +45,7 @@ export async function assessOpenCodeCompatibility(root, selection) {
32
45
  throw new Error("package metadata");
33
46
  requireNoSnapshotDependencies(pkg);
34
47
  await validateNativeSkill(root);
35
- await requireSnapshotBootstrap(root, BOOTSTRAP, BOOTSTRAP_SIZE, BOOTSTRAP_SHA256);
48
+ await Promise.any(QUALIFIED_BOOTSTRAPS.map(({ size, sha256 }) => requireSnapshotBootstrap(root, BOOTSTRAP, size, sha256)));
36
49
  const official = isOfficialSnapshotSource(selection.effectiveSource);
37
50
  return {
38
51
  kind: official ? "supported" : "experimental",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "superpowers-manager",
3
- "version": "0.7.2",
3
+ "version": "0.7.3",
4
4
  "description": "Install obra/superpowers directly from upstream for Codex, Pi, and OpenCode. Stay on a known-good release or commit, try a branch, and upgrade when you choose.",
5
5
  "keywords": [
6
6
  "superpowers",