superpowers-mcp 6.0.3 → 6.2.1

package/README.ja.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
 
-[![Version](https://img.shields.io/badge/version-6.0.3-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
+[![Version](https://img.shields.io/badge/version-6.2.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 
 このドキュメントは、オリジナルの Superpowers スキルライブラリを独立した MCP Toolpack にパッケージ化するための情報と使用手順をまとめたものです。
@@ -128,7 +128,20 @@
 
 ## 🆕 最近の更新
 
-### v6.0.3（最新）
+### v6.2.0（最新）
+- **上流 obra/superpowers v6.2.0 との同期**：ローカルのセキュリティ強化と PowerShell ヘルパーを保持したまま、全スキルに上流の改善を同期しました。
+  - **subagent-driven-development 再構築**：プラン単位のワークスペース（`.superpowers/sdd/<plan>/`）を採用し、並行プラン間で成果物の読み書きが干渉しない構造になりました。再開可能な review-fix ループに 5 ラウンドのサーキットブレーカーを内蔵し、修正後の再レビュー専用の `re-review-prompt.md` を追加。
+  - **test-driven-development**：`testing-anti-patterns.md` が上流の `writing-good-tests.md` に置き換わりました。
+  - **finishing-a-development-branch**：上流の書き直し版を採用（ローカルで先行適用していた worktree パス取得の修正と同等の内容を含む。ブランチ破棄は明示的な要求がある場合のみ実行）。
+  - **スキル全体の圧縮**：多くの `SKILL.md` から recap セクションや説得文を削除し、プロンプトのトークン使用量を削減。
+  - **gemini-tools.md**：上流の更新版に復元。`visual-companion.md` に Gemini CLI 起動セクションを追加。
+- **PowerShell パリティ修正**：
+  - すべての SDD `.ps1` スクリプトを新しいプラン単位の `PLAN_FILE` インターフェースに移植。`find-polluter.ps1` に bash 版の `./` プレフィックス対応と `**/` 折りたたみ修正を移植。
+  - **終了コードの一致**：`$ErrorActionPreference = "Stop"` 下で `Write-Error` が終了エラー化し、意図した終了コードが飲み込まれる問題を修正 — 検証失敗は正しく 2、タスク未検出は 3 を返し、bash スクリプトと一致。
+  - **`sdd-workspace.ps1` のスラッグ導出**：任意の拡張子ではなく末尾の `.md` のみを除去（bash の `basename` と一致）。
+- **バージョン統一**：`package.json`、`package-lock.json`、MCP サーバーのハンドシェイクバージョンを 6.2.0 に統一。
+
+### v6.0.3
 - **コマンドインジェクション修正**: `server.cjs` の `BRAINSTORM_OPEN_CMD` 起動パスを `cp.exec()` から `cp.execFile()` に変更。旧コードは環境変数と URL をシェル経由で連結していましたが、新しいコードは argv 配列として引数を渡し、環境変数の内容に関係なくシェルメタキャラクタインジェクションを排除します。
 - **依存関係のセキュリティ（overrides）**: `package.json` に `overrides` ブロックを追加し、推移的依存関係の最低バージョンを強制：
   - `@hono/node-server`: 1.19.14 → **2.0.11** — エンコードされたバックスラッシュを介した serve-static の Windows パストラバーサルを修正（[GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9)）

package/README.ko.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
 
-[![Version](https://img.shields.io/badge/version-6.0.3-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
+[![Version](https://img.shields.io/badge/version-6.2.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 
 이 문서는 원본 Superpowers 스킬 라이브러리를 독립적인 MCP Toolpack으로 패키징하기 위한 정보와 사용 지침을 요약한 것입니다.
@@ -128,7 +128,20 @@
 
 ## 🆕 최근 업데이트
 
-### v6.0.3 (최신)
+### v6.2.0 (최신)
+- **업스트림 obra/superpowers v6.2.0 동기화**: 로컬 보안 강화와 PowerShell 헬퍼를 유지하면서 모든 스킬에 업스트림 개선 사항을 동기화했습니다.
+  - **subagent-driven-development 재구성**: 플랜 단위 워크스페이스(`.superpowers/sdd/<plan>/`)를 도입하여 동시에 실행되는 플랜 간 산출물이 서로를 읽거나 덮어쓰지 않도록 구조적으로 방지합니다. 재개 가능한 review-fix 루프에 5회 서킷 브레이커를 내장하고, 수정 후 재검토 전용 `re-review-prompt.md`를 추가했습니다.
+  - **test-driven-development**: `testing-anti-patterns.md`가 업스트림의 `writing-good-tests.md`로 대체되었습니다.
+  - **finishing-a-development-branch**: 업스트림 재작성 버전 채택(로컬에서 먼저 패치했던 worktree 경로 캡처 수정과 동일한 내용 포함, 브랜치 삭제는 명시적 요청 시에만 수행).
+  - **스킬 전반 압축**: 여러 `SKILL.md`에서 요약(recap) 및 설득 문구를 제거하여 프롬프트 토큰 사용량 절감.
+  - **gemini-tools.md**: 업스트림 업데이트 버전으로 복원, `visual-companion.md`에 Gemini CLI 실행 섹션 추가.
+- **PowerShell 패리티 수정**:
+  - 모든 SDD `.ps1` 스크립트를 새로운 플랜 단위 `PLAN_FILE` 인터페이스로 이식, `find-polluter.ps1`에 bash 버전의 `./` 접두사 및 `**/` 축소 수정 사항 이식.
+  - **종료 코드 일치**: `$ErrorActionPreference = "Stop"` 환경에서 `Write-Error`가 종료 오류가 되어 의도한 종료 코드가 삼켜지던 문제 수정 — 검증 실패 시 정확히 2, 작업을 찾지 못하면 3을 반환하여 bash 스크립트와 일치.
+  - **`sdd-workspace.ps1` 슬러그 도출**: 임의의 확장자가 아닌 끝의 `.md`만 제거(bash `basename`과 일치).
+- **버전 정렬**: `package.json`, `package-lock.json`, MCP 서버 핸드셰이크 버전을 6.2.0으로 통일.
+
+### v6.0.3
 - **명령 삽입 수정**: `server.cjs`의 `BRAINSTORM_OPEN_CMD` 실행 경로를 `cp.exec()`에서 `cp.execFile()`로 변경. 이전 코드는 환경 변수와 URL을 셸을 통해 연결했지만, 새 코드는 argv 배열로 인수를 전달하여 환경 변수 내용에 관계없이 셸 메타문자 삽입을 제거합니다.
 - **의존성 보안 (overrides)**: `package.json`에 `overrides` 블록을 추가하여 전이적 의존성의 최소 버전을 강제:
   - `@hono/node-server`: 1.19.14 → **2.0.11** — 인코딩된 백슬래시를 통한 serve-static의 Windows 경로 탐색 수정 ([GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9))

package/README.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
 
-[![Version](https://img.shields.io/badge/version-6.0.3-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
+[![Version](https://img.shields.io/badge/version-6.2.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
 [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 
 This document summarizes the information and usage instructions for packaging the original Superpowers skills library into an independent MCP Toolpack.
@@ -128,7 +128,26 @@ These skills are designed for orchestrating complex meta-execution patterns with
 
 ## 🆕 Recent Updates
 
-### v6.0.3 (Latest)
+### v6.2.1 (Latest)
+
+- **PowerShell Script Test Suite**: Added `tests/powershell/` with 63 assertions across 5 suites for `sdd-workspace.ps1`, `task-brief.ps1`, `review-package.ps1`, `find-polluter.ps1`, and the brainstorm `start-server.ps1`/`stop-server.ps1` lifecycle. Run with `tests/powershell/run-tests.sh`; it skips gracefully when `pwsh` is unavailable.
+- **stop-server.ps1 Cross-Platform Fix**: `Get-CimInstance Win32_Process` is Windows-only; the script now uses `ps` on Unix so the server-id check works correctly on macOS/Linux.
+- **Cleanup**: Removed `skills/using-superpowers/references/copilot-tools.md`, an orphaned reference file already pruned upstream.
+
+### v6.2.0
+- **Upstream Sync with obra/superpowers v6.2.0**: Synchronized upstream improvements across all skills while preserving local security enhancements and PowerShell helpers.
+  - **subagent-driven-development Restructure**: Plan-scoped workspaces (`.superpowers/sdd/<plan>/`) so concurrent plans can never read or overwrite each other's artifacts. Resume-based review-fix loop with a five-round circuit breaker, plus a new scoped `re-review-prompt.md` for re-reviews after fixes.
+  - **test-driven-development**: `testing-anti-patterns.md` replaced by upstream `writing-good-tests.md`.
+  - **finishing-a-development-branch**: Adopted the upstream rewrite (includes the same worktree-path capture fix previously patched locally; branch discard is now explicit-request-only).
+  - **Skills-wide compression**: Recap and persuasion sections removed across many `SKILL.md` files, reducing prompt token footprint.
+  - **gemini-tools.md**: Restored to the updated upstream version; `visual-companion.md` gains a Gemini CLI launch section.
+- **PowerShell Parity Fixes**:
+  - All SDD `.ps1` scripts ported to the new plan-scoped `PLAN_FILE` interfaces; `find-polluter.ps1` gained the `./`-prefix and `**/` collapse fixes from the bash version.
+  - **Exit-code parity**: Fixed `Write-Error` under `$ErrorActionPreference = "Stop"` swallowing the intended exit codes — validation failures now correctly exit 2 and a missing task exits 3, matching the bash scripts.
+  - **`sdd-workspace.ps1` slug derivation**: Strips only a trailing `.md` (matching bash `basename`), instead of any file extension.
+- **Version Alignment**: `package.json`, `package-lock.json`, and the MCP server handshake version are now consistent at 6.2.0.
+
+### v6.0.3
 - **Command Injection Fix**: Replaced `cp.exec()` with `cp.execFile()` in the brainstorming Visual Companion server (`server.cjs`) for the `BRAINSTORM_OPEN_CMD` launcher path. The old code concatenated the env var with the URL via the shell; the new code passes arguments as an argv array, eliminating shell metacharacter injection regardless of env var content.
 - **Dependency Security (overrides)**: Added `overrides` block in `package.json` enforcing minimum versions for transitive dependencies:
   - `@hono/node-server`: 1.19.14 → **2.0.11** — fixes Windows path traversal in serve-static via encoded backslash ([GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9))

package/README.zh-TW.md

@@ -2,7 +2,7 @@
 
 [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
 
-[![版本](https://img.shields.io/badge/version-6.0.3-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
+[![版本](https://img.shields.io/badge/version-6.2.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
 [![授權](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
 
 本文檔總結了將原始 Superpowers 技能庫打包成獨立 MCP Toolpack 的相關資訊與使用說明。
@@ -62,7 +62,7 @@
 | 技能名稱 | 社群推薦使用情境 | 核心價值 |
 | :--- | :--- | :--- |
 | `brainstorming` | 啟動新功能前，探索需求與設計。 | 防止 AI 直接衝進去寫 code。 |
-| `writing-plans` | 進行多檔案重構或複雜迁移前。 | 建立明確的執行藍圖。 |
+| `writing-plans` | 進行多檔案重構或複雜遷移前。 | 建立明確的執行藍圖。 |
 | `systematic-debugging` | 遇到任何報錯或行為異常時。 | 強制執行「根因分析」而非亂猜。 |
 | `test-driven-development` | 實作具邏輯挑戰的功能時。 | 確保代碼隨附測試，實現 Red-Green-Refactor。 |
 | `verification-before-completion` | 聲稱「修好了」或「做完了」之前。 | 證據導向的完工確認。 |
@@ -128,7 +128,26 @@
 
 ## 🆕 最近更新
 
-### v6.0.3 (最新版)
+### v6.2.1 (最新版)
+
+- **PowerShell 腳本測試套件**：新增 `tests/powershell/`，橫跨 `sdd-workspace.ps1`、`task-brief.ps1`、`review-package.ps1`、`find-polluter.ps1` 與 brainstorm `start-server.ps1`/`stop-server.ps1` 生命週期，共 63 個 assertion。使用 `tests/powershell/run-tests.sh` 執行；未安裝 `pwsh` 時會自動跳過。
+- **`stop-server.ps1` 跨平台修正**：`Get-CimInstance Win32_Process` 僅 Windows 可用，腳本現在在 Unix 上改用 `ps` 以正確檢查 server-id，macOS/Linux 不再出錯。
+- **清理**：移除已無用的 `skills/using-superpowers/references/copilot-tools.md`（上游已在 v6.2.0 中刪除，本地也沒有任何引用）。
+
+### v6.2.0 (最新版)
+- **上游同步 obra/superpowers v6.2.0**：同步上游所有技能的改進，同時保留本地的安全性強化與 PowerShell 輔助腳本。
+  - **subagent-driven-development 重構**：採用計畫範圍工作區（`.superpowers/sdd/<plan>/`），並行計畫之間的產物再也不會互相讀寫。改為可續接的 review-fix 迴圈，內建五輪熔斷機制，並新增修復後複審專用的 `re-review-prompt.md`。
+  - **test-driven-development**：`testing-anti-patterns.md` 由上游的 `writing-good-tests.md` 取代。
+  - **finishing-a-development-branch**：採用上游重寫版（包含與本地先前修補相同的 worktree 路徑捕獲修復；分支丟棄現在需要明確要求才會執行）。
+  - **技能全面精簡**：移除多個 `SKILL.md` 中的回顧與說服性段落，降低 prompt token 佔用。
+  - **gemini-tools.md**：還原為上游更新版；`visual-companion.md` 新增 Gemini CLI 啟動章節。
+- **PowerShell 一致性修復**：
+  - 所有 SDD `.ps1` 腳本移植到新的計畫範圍 `PLAN_FILE` 介面；`find-polluter.ps1` 移植了 bash 版的 `./` 前綴與 `**/` 收縮修復。
+  - **Exit code 一致性**：修復 `$ErrorActionPreference = "Stop"` 下 `Write-Error` 變成終止錯誤、導致預期 exit code 被吞掉的問題 — 驗證失敗現正確回傳 2、找不到任務回傳 3，與 bash 腳本一致。
+  - **`sdd-workspace.ps1` slug 推導**：只剝除尾端的 `.md`（與 bash `basename` 一致），不再剝除任意副檔名。
+- **版本對齊**：`package.json`、`package-lock.json` 與 MCP server 握手版本現統一為 6.2.0。
+
+### v6.0.3
 - **命令注入修復**：將 brainstorming Visual Companion 伺服器 (`server.cjs`) 中 `BRAINSTORM_OPEN_CMD` 的啟動方式從 `cp.exec()` 改為 `cp.execFile()`。舊版程式會將環境變數與 URL 透過 shell 串接執行；新版改以 argv 陣列傳遞參數，徹底消除 shell metacharacter 注入風險。
 - **依賴安全性 (overrides)**：在 `package.json` 中新增 `overrides` 區塊，強制設定間接依賴的最低版本：
   - `@hono/node-server`: 1.19.14 → **2.0.11** — 修復 Windows 上 serve-static 經由編碼反斜線的路徑遍歷漏洞 ([GHSA-frvp-7c67-39w9](https://github.com/advisories/GHSA-frvp-7c67-39w9))

package/out/server.js

@@ -49,7 +49,7 @@ Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.
 `}var hs=class{constructor(t=ff.default.stdin,r=ff.default.stdout){this._stdin=t,this._stdout=r,this._readBuffer=new ms,this._started=!1,this._ondata=n=>{this._readBuffer.append(n),this.processReadBuffer()},this._onerror=n=>{this.onerror?.(n)}}async start(){if(this._started)throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");this._started=!0,this._stdin.on("data",this._ondata),this._stdin.on("error",this._onerror)}processReadBuffer(){for(;;)try{let t=this._readBuffer.readMessage();if(t===null)break;this.onmessage?.(t)}catch(t){this.onerror?.(t)}}async close(){this._stdin.off("data",this._ondata),this._stdin.off("error",this._onerror),this._stdin.listenerCount("data")===0&&this._stdin.pause(),this._readBuffer.clear(),this.onclose?.()}send(t){return new Promise(r=>{let n=T_(t);this._stdout.write(n)?r():this._stdout.once("drain",r)})}};var zr=ir(require("fs/promises")),Ir=ir(require("path")),gs=class{skillsPath;cachedSkills=null;skillMap=new Map;contentCache=new Map;constructor(t){this.skillsPath=t}parseFrontmatter(t){if(!t.startsWith("---"))return{name:"",description:""};let r=t.split(/\r?\n/),n=[],o=!1;for(let c=1;c<r.length;c++){if(r[c].trim()==="---"){o=!0;break}n.push(r[c])}if(!o)return{name:"",description:""};let i="",a="",s=!1;for(let c of n){let u=c.match(/^name:\s*(.+?)\s*$/);if(u){i=u[1].replace(/^["']|["']$/g,"").trim(),s=!1;continue}let l=c.match(/^description:\s*(.+?)\s*$/);if(l){a=l[1].replace(/^["']|["']$/g,"").trim(),s=!0;continue}s&&c.startsWith(" ")?a+=" "+c.trim():s=!1}return{name:i,description:a}}async exists(t){try{return await zr.access(t),!0}catch{return!1}}async listSkills(t=!1){if(this.cachedSkills&&!t)return this.cachedSkills;if(!await this.exists(this.skillsPath))return[];let r=[];this.skillMap.clear();try{let o=(await zr.readdir(this.skillsPath,{withFileTypes:!0})).filter(a=>a.isDirectory()).map(async a=>{let s=Ir.join(this.skillsPath,a.name),c=Ir.join(s,"SKILL.md");if(!await this.exists(c))return null;try{let u=await zr.readFile(c,"utf-8"),{name:l,description:d}=this.parseFrontmatter(u);return{name:l||a.name,description:d,skillPath:c}}catch{return process.stderr.write(`Warning: Failed to read skill file in directory "${a.name}"
 `),null}}),i=await Promise.all(o);for(let a of i)if(a){r.push(a),this.skillMap.set(a.name.toLowerCase(),a);let s=Ir.basename(Ir.dirname(a.skillPath)).toLowerCase();this.skillMap.set(s,a)}}catch(n){return process.stderr.write(`Error reading skills directory: ${String(n)}
 `),[]}return this.cachedSkills=r.sort((n,o)=>n.name.localeCompare(o.name)),this.cachedSkills}async findSkill(t){if(/^[a-zA-Z0-9-_]+$/.test(t))return this.cachedSkills||await this.listSkills(),this.skillMap.get(t.toLowerCase())}async readSkillContent(t,r=!1){if(this.contentCache.has(t)&&!r)return this.contentCache.get(t);try{let o=(await zr.readFile(t,"utf-8")).replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/,"").trim();return this.contentCache.set(t,o),o}catch{throw new Error("Failed to read skill content")}}clearCache(){this.cachedSkills=null,this.skillMap.clear(),this.contentCache.clear()}};function PT(){let e=process.env.SKILLS_PATH;if(e){let r=or.resolve(e);if(["/","/etc","/var","/bin","/sbin","C:\\","C:\\Windows"].includes(r)||r===or.parse(r).root)process.stderr.write(`Warning: Potentially unsafe SKILLS_PATH: "${e}". Fallback to default.
-`);else return r}let t=or.join(__dirname,"..","skills");return j_.existsSync(t)?t:or.join(__dirname,"skills")}var E_=PT(),nr=new gs(E_),Pr=new fs({name:"superpowers-mcp",version:"6.0.2"},{capabilities:{resources:{subscribe:!1},prompts:{},tools:{}}});Pr.setRequestHandler(rd,async()=>({resources:(await nr.listSkills()).map(t=>({uri:`skill://superpowers/${t.name}`,name:t.name,description:t.description,mimeType:"text/markdown"}))}));Pr.setRequestHandler(od,async e=>{let t=e.params.uri,r=t.match(/^skill:\/\/superpowers\/(.+)$/);if(!r)throw new R(L.InvalidRequest,`Invalid skill URI: ${t}`);let n=r[1],o=await nr.findSkill(n);if(!o)throw new R(L.InvalidRequest,`Skill not found: ${n}`);try{let i=await nr.readSkillContent(o.skillPath);return{contents:[{uri:t,mimeType:"text/markdown",text:i}]}}catch{throw new R(L.InternalError,"Failed to read skill content safely.")}});Pr.setRequestHandler(id,async()=>({prompts:[{name:"session-start",description:"Inject the Superpowers context into an AI agent session. Tells the agent it has superpowers and how to use the skill system."}]}));Pr.setRequestHandler(ad,async e=>{if(e.params.name!=="session-start")throw new R(L.InvalidRequest,`Unknown prompt: ${e.params.name}`);let t=or.join(E_,"using-superpowers","SKILL.md"),r="";try{r=await nr.readSkillContent(t)}catch{r=`# Superpowers
+`);else return r}let t=or.join(__dirname,"..","skills");return j_.existsSync(t)?t:or.join(__dirname,"skills")}var E_=PT(),nr=new gs(E_),Pr=new fs({name:"superpowers-mcp",version:"6.2.1"},{capabilities:{resources:{subscribe:!1},prompts:{},tools:{}}});Pr.setRequestHandler(rd,async()=>({resources:(await nr.listSkills()).map(t=>({uri:`skill://superpowers/${t.name}`,name:t.name,description:t.description,mimeType:"text/markdown"}))}));Pr.setRequestHandler(od,async e=>{let t=e.params.uri,r=t.match(/^skill:\/\/superpowers\/(.+)$/);if(!r)throw new R(L.InvalidRequest,`Invalid skill URI: ${t}`);let n=r[1],o=await nr.findSkill(n);if(!o)throw new R(L.InvalidRequest,`Skill not found: ${n}`);try{let i=await nr.readSkillContent(o.skillPath);return{contents:[{uri:t,mimeType:"text/markdown",text:i}]}}catch{throw new R(L.InternalError,"Failed to read skill content safely.")}});Pr.setRequestHandler(id,async()=>({prompts:[{name:"session-start",description:"Inject the Superpowers context into an AI agent session. Tells the agent it has superpowers and how to use the skill system."}]}));Pr.setRequestHandler(ad,async e=>{if(e.params.name!=="session-start")throw new R(L.InvalidRequest,`Unknown prompt: ${e.params.name}`);let t=or.join(E_,"using-superpowers","SKILL.md"),r="";try{r=await nr.readSkillContent(t)}catch{r=`# Superpowers
 
 You have superpowers. Use the read_skill and list_skills tools to discover and load skills.`}return{description:"Superpowers session start context \u2014 establishes how to find and use skills",messages:[{role:"user",content:{type:"text",text:`<EXTREMELY_IMPORTANT>
 You have superpowers.

package/package.json

@@ -2,7 +2,7 @@
   "name": "superpowers-mcp",
   "displayName": "Superpowers MCP",
   "description": "Superpowers skills library (TDD, debugging, collaboration workflows) as an MCP server for VSCode and Antigravity",
-  "version": "6.0.3",
+  "version": "6.2.1",
   "publisher": "superpowers",
   "license": "MIT",
   "repository": {

package/skills/brainstorming/SKILL.md

@@ -77,6 +77,7 @@ digraph brainstorming {
 - Propose 2-3 different approaches with trade-offs
 - Present options conversationally with your recommendation and reasoning
 - Lead with your recommended option and explain why
+- YAGNI ruthlessly - remove unnecessary features from every approach and design
 
 **Presenting the design:**
 
@@ -130,15 +131,6 @@ Wait for the user's response. If they request changes, make them and re-run the
 - Invoke the writing-plans skill to create a detailed implementation plan
 - Do NOT invoke any other skill. writing-plans is the next step.
 
-## Key Principles
-
-- **One question at a time** - Don't overwhelm with multiple questions
-- **Multiple choice preferred** - Easier to answer than open-ended when possible
-- **YAGNI ruthlessly** - Remove unnecessary features from all designs
-- **Explore alternatives** - Always propose 2-3 approaches before settling
-- **Incremental validation** - Present design, get approval before moving on
-- **Be flexible** - Go back and clarify when something doesn't make sense
-
 ## Visual Companion
 
 A browser-based companion for showing mockups, diagrams, and visual options during brainstorming. Available as a tool — not a mode. Accepting the companion means it's available for questions that benefit from visual treatment; it does NOT mean every question goes through the browser.

package/skills/brainstorming/scripts/stop-server.ps1

@@ -34,9 +34,17 @@ function Test-BrainstormServer {
     param([int]$ProcessId)
     $expected = Read-ExpectedServerId
     if (-not $expected) { return $false }
-    $process = Get-CimInstance Win32_Process -Filter "ProcessId = $ProcessId" -ErrorAction SilentlyContinue
-    if (-not $process) { return $false }
-    return ($process.CommandLine -like "*--brainstorm-server-id=$expected*")
+    if ($IsWindows) {
+        $process = Get-CimInstance Win32_Process -Filter "ProcessId = $ProcessId" -ErrorAction SilentlyContinue
+        if (-not $process) { return $false }
+        return ($process.CommandLine -like "*--brainstorm-server-id=$expected*")
+    }
+    # Unix: ps -p prints the full command line, e.g.
+    # node ... server.cjs --brainstorm-server-id=<id>; the id is validated
+    # hex above, so no regex escaping is needed.
+    $cmd = (& ps -p $ProcessId -o command= 2>$null)
+    if (-not $cmd) { return $false }
+    return ($cmd -match "--brainstorm-server-id=$expected")
 }
 
 if (Test-Path -LiteralPath $pidFile) {

package/skills/brainstorming/visual-companion.md

@@ -79,6 +79,13 @@ For native PowerShell, use `scripts/start-server.ps1` with the same flags. It wr
 scripts/start-server.sh --project-dir /path/to/project --open
 ```
 
+**Gemini CLI:**
+```bash
+# Use --foreground and set is_background: true on your shell tool call
+# so the process survives across turns
+scripts/start-server.sh --project-dir /path/to/project --open --foreground
+```
+
 **Copilot CLI:**
 ```bash
 # Use --foreground and start the server via the bash tool with mode: "async"

package/skills/dispatching-parallel-agents/SKILL.md

@@ -158,15 +158,6 @@ Agent 3 → Fix tool-approval-race-conditions.test.ts
 
 **Integration:** All fixes independent, no conflicts, full suite green
 
-**Time saved:** 3 problems solved in parallel vs sequentially
-
-## Key Benefits
-
-1. **Parallelization** - Multiple investigations happen simultaneously
-2. **Focus** - Each agent has narrow scope, less context to track
-3. **Independence** - Agents don't interfere with each other
-4. **Speed** - 3 problems solved in time of 1
-
 ## Verification
 
 After agents return:
@@ -174,12 +165,3 @@ After agents return:
 2. **Check for conflicts** - Did agents edit same code?
 3. **Run full suite** - Verify all fixes work together
 4. **Spot check** - Agents can make systematic errors
-
-## Real-World Impact
-
-From debugging session (2025-10-03):
-- 6 failures across 3 files
-- 3 agents dispatched in parallel
-- All investigations completed concurrently
-- All fixes integrated successfully
-- Zero conflicts between agent changes

package/skills/executing-plans/SKILL.md

@@ -11,15 +11,16 @@ Load plan, review critically, execute all tasks, report when complete.
 
 **Announce at start:** "I'm using the executing-plans skill to implement this plan."
 
-**Note:** Tell your human partner that Superpowers works much better with access to subagents. The quality of its work will be significantly higher if run on a platform with subagent support (Claude Code, Codex CLI, Codex App, and Copilot CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
+**Note:** Tell your human partner that Superpowers works much better with access to subagents (Claude Code, Codex CLI, Codex App, Copilot CLI, and Gemini CLI all qualify; see the per-platform tool refs in `../using-superpowers/references/`). If subagents are available, use superpowers:subagent-driven-development instead of this skill.
 
 ## The Process
 
 ### Step 1: Load and Review Plan
-1. Read plan file
-2. Review critically - identify any questions or concerns about the plan
-3. If concerns: Raise them with your human partner before starting
-4. If no concerns: Create todos for the plan items and proceed
+1. Ensure an isolated workspace: use superpowers:using-git-worktrees to create one or verify the existing one
+2. Read plan file
+3. Review critically - identify any questions or concerns about the plan
+4. If concerns: Raise them with your human partner before starting
+5. If no concerns: Create todos for the plan items and proceed
 
 ### Step 2: Execute Tasks
 
@@ -61,10 +62,3 @@ After all tasks complete and verified:
 - Reference skills when plan says to
 - Stop when blocked, don't guess
 - Never start implementation on main/master branch without explicit user consent
-
-## Integration
-
-**Required workflow skills:**
-- **superpowers:using-git-worktrees** - Ensures isolated workspace (creates one or verifies existing)
-- **superpowers:writing-plans** - Creates the plan this skill executes
-- **superpowers:finishing-a-development-branch** - Complete development after all tasks

package/skills/finishing-a-development-branch/SKILL.md

@@ -1,45 +1,31 @@
 ---
 name: finishing-a-development-branch
-description: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
+description: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work
 ---
 
 # Finishing a Development Branch
 
 ## Overview
 
-Guide completion of development work by presenting clear options and handling chosen workflow.
-
 **Core principle:** Verify tests → Detect environment → Present options → Execute choice → Clean up.
 
 **Announce at start:** "I'm using the finishing-a-development-branch skill to complete this work."
 
-## The Process
-
-### Step 1: Verify Tests
+## Step 1: Verify Tests
 
-**Before presenting options, verify tests pass:**
+Run the project's full test suite (`npm test` / `cargo test` / `pytest` / `go test ./...`).
 
-```bash
-# Run project's test suite
-npm test / cargo test / pytest / go test ./...
-```
+**If tests fail**, report the failures and stop — the menu comes after a green suite:
 
-**If tests fail:**
 ```
 Tests failing (<N> failures). Must fix before completing:
 
 [Show failures]
-
-Cannot proceed with merge/PR until tests pass.
 ```
 
-Stop. Don't proceed to Step 2.
-
-**If tests pass:** Continue to Step 2.
-
-### Step 2: Detect Environment
+**If tests pass:** continue to Step 2.
 
-**Determine workspace state before presenting options:**
+## Step 2: Detect Environment
 
 ```bash
 GIT_DIR=$(cd "$(git rev-parse --git-dir)" 2>/dev/null && pwd -P)
@@ -53,22 +39,20 @@ This determines which menu to show and how cleanup works:
 
 | State | Menu | Cleanup |
 |-------|------|---------|
-| `GIT_DIR == GIT_COMMON` (normal repo) | Standard 4 options | No worktree to clean up |
-| `GIT_DIR != GIT_COMMON`, named branch | Standard 4 options | Provenance-based (see Step 6) |
-| `GIT_DIR != GIT_COMMON`, detached HEAD | Reduced 3 options (no merge) | No cleanup (externally managed) |
+| `GIT_DIR == GIT_COMMON` (normal repo) | Standard 3 options | No worktree to clean up |
+| `GIT_DIR != GIT_COMMON`, named branch | Standard 3 options | Provenance-based (see Step 6) |
+| `GIT_DIR != GIT_COMMON`, detached HEAD | Reduced 2 options (no merge) | Externally managed — leave in place |
 
-### Step 3: Determine Base Branch
+## Step 3: Determine Base Branch
 
-```bash
-# Try common base branches
-git merge-base HEAD main 2>/dev/null || git merge-base HEAD master 2>/dev/null
-```
+The base branch is whatever this work forked from — usually named in the
+plan, the conversation, or the branch's upstream. If it is not already
+known, ask: "This branch split from <your best guess> - is that correct?"
+Confirm before merging: merging into the wrong base is expensive to undo.
 
-Or ask: "This branch split from main - is that correct?"
+## Step 4: Present Options
 
-### Step 4: Present Options
-
-**Normal repo and named-branch worktree — present exactly these 4 options:**
+**Normal repo and named-branch worktree — present exactly these 3 options:**
 
 ```
 Implementation complete. What would you like to do?
@@ -76,28 +60,30 @@ Implementation complete. What would you like to do?
 1. Merge back to <base-branch> locally
 2. Push and create a Pull Request
 3. Keep the branch as-is (I'll handle it later)
-4. Discard this work
 
 Which option?
 ```
 
-**Detached HEAD — present exactly these 3 options:**
+**Detached HEAD — present exactly these 2 options:**
 
 ```
 Implementation complete. You're on a detached HEAD (externally managed workspace).
 
 1. Push as new branch and create a Pull Request
 2. Keep as-is (I'll handle it later)
-3. Discard this work
 
 Which option?
 ```
 
-**Don't add explanation** - keep options concise.
+Present the menu exactly as written — concise, with every option coming
+from the list above. Discarding the work happens only in response to your
+human partner explicitly asking for it (see "If your human partner asks to
+discard the work" below). Wait for their answer; the integration decision
+is theirs.
 
-### Step 5: Execute Choice
+## Step 5: Execute Choice
 
-#### Option 1: Merge Locally
+### Option 1: Merge Locally
 
 ```bash
 # Get main repo root for CWD safety
@@ -111,36 +97,43 @@ git merge <feature-branch>
 
 # Verify tests on merged result
 <test command>
-
-# Only after merge succeeds: cleanup worktree (Step 6), then delete branch
 ```
 
-Then: Cleanup worktree (Step 6), then delete branch:
+If tests fail on the merged result: stop, leave the worktree and branch in
+place, and investigate — nothing has been pushed, so the merge is local
+and recoverable.
+
+Once the merged result is green: clean up the worktree (Step 6), then
+delete the branch:
 
 ```bash
 git branch -d <feature-branch>
 ```
 
-#### Option 2: Push and Create PR
+### Option 2: Push and Create PR
 
 ```bash
-# Push branch
 git push -u origin <feature-branch>
 # From a detached HEAD, name the new branch on the remote:
 # git push origin HEAD:refs/heads/<new-branch>
 ```
 
-**Do NOT clean up worktree** — user needs it alive to iterate on PR feedback.
+Then create the pull/merge request against <base-branch> with the forge's
+tooling — its CLI if one is available, or the creation URL most forges
+print when you push — following the repo's PR template and conventions if
+present, and report the URL to your human partner.
+
+Keep the worktree — your human partner iterates on PR feedback there.
 
-#### Option 3: Keep As-Is
+### Option 3: Keep As-Is
 
 Report: "Keeping branch <name>. Worktree preserved at <path>."
 
-**Don't cleanup worktree.**
+### If your human partner asks to discard the work
 
-#### Option 4: Discard
+This path exists only as a response to an explicit request to throw the
+work away. Confirm first:
 
-**Confirm first:**
 ```
 This will permanently delete:
 - Branch <name>
@@ -150,22 +143,23 @@ This will permanently delete:
 Type 'discard' to confirm.
 ```
 
-Wait for exact confirmation.
+Wait for that exact confirmation. When it arrives:
 
-If confirmed:
 ```bash
 MAIN_ROOT=$(git -C "$(git rev-parse --git-common-dir)/.." rev-parse --show-toplevel)
 cd "$MAIN_ROOT"
 ```
 
-Then: Cleanup worktree (Step 6), then force-delete branch:
+Then clean up the worktree (Step 6) and force-delete the branch:
+
 ```bash
 git branch -D <feature-branch>
 ```
 
-### Step 6: Cleanup Workspace
+## Step 6: Cleanup Workspace
 
-**Only runs for Options 1 and 4.** Options 2 and 3 always preserve the worktree. Both callers have already changed directory to the
+**Runs for Option 1 and confirmed discards.** Options 2 and 3 always
+preserve the worktree. Both callers have already changed directory to the
 main repo root — worktree removal must run from outside the worktree —
 and use the `GIT_DIR`/`GIT_COMMON`/`WORKTREE_PATH` values captured in
 Step 2, from before that directory change.
@@ -180,7 +174,8 @@ git worktree remove "$WORKTREE_PATH"
 git worktree prune  # Self-healing: clean up any stale registrations
 ```
 
-**Otherwise:** The host environment (harness) owns this workspace. Do NOT remove it. If your platform provides a workspace-exit tool, use it. Otherwise, leave the workspace in place.
+**Otherwise:** The host environment owns this workspace — leave it in
+place. If your platform provides a workspace-exit tool, use it.
 
 ## Quick Reference
 
@@ -189,54 +184,18 @@ git worktree prune  # Self-healing: clean up any stale registrations
 | 1. Merge locally | yes | - | - | yes |
 | 2. Create PR | - | yes | yes | - |
 | 3. Keep as-is | - | - | yes | - |
-| 4. Discard | - | - | - | yes (force) |
-
-## Common Mistakes
-
-**Skipping test verification**
-- **Problem:** Merge broken code, create failing PR
-- **Fix:** Always verify tests before offering options
-
-**Open-ended questions**
-- **Problem:** "What should I do next?" is ambiguous
-- **Fix:** Present exactly 4 structured options (or 3 for detached HEAD)
-
-**Cleaning up worktree for Option 2**
-- **Problem:** Remove worktree user needs for PR iteration
-- **Fix:** Only cleanup for Options 1 and 4
-
-**Deleting branch before removing worktree**
-- **Problem:** `git branch -d` fails because worktree still references the branch
-- **Fix:** Merge first, remove worktree, then delete branch
-
-**Running git worktree remove from inside the worktree**
-- **Problem:** Command fails silently when CWD is inside the worktree being removed
-- **Fix:** Always `cd` to main repo root before `git worktree remove`
-
-**Cleaning up harness-owned worktrees**
-- **Problem:** Removing a worktree the harness created causes phantom state
-- **Fix:** Only clean up worktrees under `.worktrees/` or `worktrees/`
-
-**No confirmation for discard**
-- **Problem:** Accidentally delete work
-- **Fix:** Require typed "discard" confirmation
-
-## Red Flags
-
-**Never:**
-- Proceed with failing tests
-- Merge without verifying tests on result
-- Delete work without confirmation
-- Force-push without explicit request
-- Remove a worktree before confirming merge success
-- Clean up worktrees you didn't create (provenance check)
-- Run `git worktree remove` from inside the worktree
-
-**Always:**
-- Verify tests before offering options
-- Detect environment before presenting menu
-- Present exactly 4 options (or 3 for detached HEAD)
-- Get typed confirmation for Option 4
-- Clean up worktree for Options 1 & 4 only
-- `cd` to main repo root before worktree removal
-- Run `git worktree prune` after removal
+| Discard (explicit request only) | - | - | - | yes (force) |
+
+## Common Rationalizations
+
+| Excuse | Reality |
+|--------|---------|
+| "Tests passed earlier this session" | Run the suite on the tree you are about to integrate. A green run only proves the tree it ran on. |
+| "They obviously want it merged" | Integration is your human partner's decision. Present the menu and wait. |
+| "They seem done with this feature — I'll offer to discard it" | The menu is complete as written. Discard happens only when your human partner asks for it in so many words. |
+| "'Yeah, get rid of it' counts as confirmation" | Only the typed word `discard` authorizes deletion. |
+| "The PR is up, so the worktree is clutter now" | PR feedback gets fixed in that worktree. It stays until the work lands. |
+| "This other worktree looks stale — I'll clean it too" | Clean up only worktrees under `.worktrees/` or `worktrees/`. Everything else belongs to the host. |
+| "The merged-result failure is probably flaky" | A failing merged result stops everything. Branch and worktree stay put while you investigate. |
+| "The base branch is obviously main" | Confirm the fork point or ask. Merging into the wrong base is expensive to undo. |
+| "The push was rejected — force-push will fix it" | A rejected push means the remote moved. Investigate; force-push only on your human partner's explicit request. |

package/skills/receiving-code-review/SKILL.md

@@ -203,11 +203,3 @@ You understand 1,2,3,6. Unclear on 4,5.
 ## GitHub Thread Replies
 
 When replying to inline review comments on GitHub, reply in the comment thread (`gh api repos/{owner}/{repo}/pulls/{pr}/comments/{id}/replies`), not as a top-level PR comment.
-
-## The Bottom Line
-
-**External feedback = suggestions to evaluate, not orders to follow.**
-
-Verify. Question. Then implement.
-
-No performative agreement. Technical rigor always.