superpowers-mcp 6.4.1 → 6.4.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (11) hide show
  1. package/README.ja.md +10 -2
  2. package/README.ko.md +10 -2
  3. package/README.md +10 -2
  4. package/README.zh-TW.md +10 -2
  5. package/out/server.js +66 -64
  6. package/out/setup-runner.js +17 -16
  7. package/out/setup.js +17 -16
  8. package/package.json +1 -1
  9. package/scripts/copy-skills.js +101 -26
  10. package/scripts/setup.js +99 -6
  11. package/scripts/upstream-drift.js +40 -5
package/README.ja.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
4
4
 
5
- [![バージョン](https://img.shields.io/badge/version-6.4.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![バージョン](https://img.shields.io/badge/version-6.4.2-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  このドキュメントは、Superpowers スキルライブラリと自律型ワークフローを、独立した高パフォーマンスかつ安全な **Model Context Protocol (MCP)** サーバーにパッケージ化した使用説明書です。
@@ -180,7 +180,15 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
180
180
 
181
181
  ## 🆕 最近の更新
182
182
 
183
- ### v6.4.1（最新）
183
+ ### v6.4.2（最新）
184
+
185
+ - **v6.4.2 セキュリティ監査とコードレビュー（2026-09-24）**:MCP サーバー、セットアップスクリプト、ビルドパイプライン、テストハーネスの監査指摘を是正しました（詳細は [SECURITY.md](SECURITY.md)）。
186
+ - **トラバーサルとエラー処理の修正**: スキル名を許可リスト検証の**前**にデコードし、二重エンコードされた `..%2f` / `%2e%2e` ペイロードは `InvalidParams` で拒否。未知のツール／プロンプトは `MethodNotFound` ではなく具体的な `InvalidParams` を返します。
187
+ - **TOCTOU と破壊的操作の防御**: シンボリックリンク検査後に canonical path を再検証、キャッシュ掃除はコピーマニフェストでゲート（フォーク固有スキルは絶対に削除されない）、drift/coverage レコードは一時ファイル + rename でアトミックに書き込み。
188
+ - **競合しないビルドとソフトフェイル同期**: `out/setup.js` のビルドは排他ロック + mtime 新鮮度の再確認、watch モード出力にも chmod を適用、上流ソース欠損時は偽の drift を出さずに正常終了。
189
+ - **正直なテストハーネス**: watchdog を ref 化し `exit`/`close` ハンドラでハングを検出、drift テストはネットワーク遮断下で実行、権限限定の skip は合格に数えない — 回帰フロアは **365/365** アサーションを維持。
190
+
191
+ ### v6.4.1
184
192
 
185
193
  - **上流 obra/superpowers v6.4.1 への同期**：
186
194
  - **ネイティブなインライン実行**：書き直された `executing-plans` は新しい `task-start` / `task-done` で計画全体を実行し、最後にブランチ全体を一度レビュー（途中チェックインなし）。
package/README.ko.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
4
4
 
5
- [![Version](https://img.shields.io/badge/version-6.4.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![Version](https://img.shields.io/badge/version-6.4.2-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  이 문서는 Superpowers 스킬 라이브러리와 자율 에이전트 워크플로우를 독립적이고 고성능이며 안전한 **Model Context Protocol (MCP)** 서버로 패키징한 사용 지침을 요약한 것입니다.
@@ -178,7 +178,15 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
178
178
 
179
179
  ## 🆕 최근 업데이트
180
180
 
181
- ### v6.4.1 (최신)
181
+ ### v6.4.2 (최신)
182
+
183
+ - **v6.4.2 보안 감사 및 코드 리뷰 (2026-09-24)**: MCP 서버, 설정 스크립트, 빌드 파이프라인, 테스트 하네스의 감사 지적 사항을 수정했습니다(자세한 내용은 [SECURITY.md](SECURITY.md)).
184
+ - **경로 탐색 및 오류 위생**: 스킬 이름을 허용 목록 검증 *전*에 디코드하여 이중 인코딩된 `..%2f` / `%2e%2e` 페이로드를 `InvalidParams`로 거부합니다. 미지의 도구와 프롬프트도 `MethodNotFound` 대신 실행 가능한 `InvalidParams` 오류를 반환합니다.
185
+ - **TOCTOU 및 파괴적 경로 방어**: 심볼릭 링크 검사 후 canonical path 재검증, 캐시 정리를 복사 매니페스트로 게이트(포크 전용 스킬은 절대 삭제되지 않음), drift/coverage 기록은 임시 파일 + rename으로 원자적으로 기록.
186
+ - **경쟁 없는 빌드와 소프트 페일 동기화**: `out/setup.js` 빌드는 배타적 잠금 + mtime 신선도 재확인, watch 모드 출력에 chmod 적용, 업스트림 소스 누락 시 오탐 drift 없이 정상 종료.
187
+ - **정직한 테스트 하네스**: watchdog에 ref와 서버 `exit`/`close` 핸들러로 조용한 종료 차단, drift 테스트는 네트워크 차단 하에 실행, 권한 제한 skip은 합격으로 집계되지 않음 — 회귀 기준선은 **365/365** 어서션 유지.
188
+
189
+ ### v6.4.1
182
190
 
183
191
  - **상류 obra/superpowers v6.4.1 동기화**:
184
192
  - **네이티브 인라인 실행**: 새로 작성된 `executing-plans`가 신규 `task-start` / `task-done`으로 전체 계획을 실행한 뒤 브랜치 전체를 한 번만 리뷰(중간 체크인 없음).
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
4
4
 
5
- [![Version](https://img.shields.io/badge/version-6.4.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![Version](https://img.shields.io/badge/version-6.4.2-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  This document summarizes the information and usage instructions for packaging the Superpowers skills and autonomous workflow system into an independent, high-performance, and secure **Model Context Protocol (MCP)** server.
@@ -179,7 +179,15 @@ To help you choose the right skill, we have structured all 15 skills across the
179
179
 
180
180
  ## 🆕 Recent Updates
181
181
 
182
- ### v6.4.1 (Latest)
182
+ ### v6.4.2 (Latest)
183
+
184
+ - **v6.4.2 security audit & code review (2026-09-24)**: closed the audit findings across the MCP server, setup scripts, build pipeline, and test harness (details in [SECURITY.md](SECURITY.md)).
185
+ - **Traversal & error hygiene**: skill names are decoded *before* allowlist validation, so double-encoded `..%2f` / `%2e%2e` payloads are rejected with `InvalidParams`; unknown tools and prompts now return actionable `InvalidParams` errors instead of `MethodNotFound`.
186
+ - **TOCTOU & destructive-path defense**: canonical paths are re-verified after symlink checks, cache cleanup is gated by the copy manifest (fork-specific skills can never be deleted), and drift/coverage records are written atomically via temp file + rename.
187
+ - **Race-free builds & fail-soft sync**: `out/setup.js` builds take an exclusive lock with an mtime staleness re-check, watch-mode output is chmod-ed executable, and missing upstream sources exit cleanly instead of raising false drift.
188
+ - **Honest test harness**: a ref'd watchdog plus server `exit`/`close` handlers end silent hangs, drift tests run behind a network guard, and privilege-limited skips can no longer count as passes — regression floor holds at **365/365** assertions.
189
+
190
+ ### v6.4.1
183
191
 
184
192
  - **Upstream Sync to obra/superpowers v6.4.1**:
185
193
  - **Native inline plan execution**: rewritten `executing-plans` runs the whole plan via new `task-start` / `task-done` helpers, then one whole-branch review — no mid-plan check-ins.
package/README.zh-TW.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md)
4
4
 
5
- [![版本](https://img.shields.io/badge/version-6.4.1-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![版本](https://img.shields.io/badge/version-6.4.2-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![授權](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  本文檔總結了將 Superpowers 技能庫與自主 Agent 工作流架構打包成獨立、高效能且安全加固的 **Model Context Protocol (MCP)** 伺服器之相關資訊與使用說明。
@@ -178,7 +178,15 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
178
178
 
179
179
  ## 🆕 最近更新
180
180
 
181
- ### v6.4.1 (最新版)
181
+ ### v6.4.2 (最新版)
182
+
183
+ - **v6.4.2 安全審計與程式碼審計（2026-09-24）**：補上 MCP 伺服器、安裝腳本、建置管線與測試工具的審計缺口（詳見 [SECURITY.md](SECURITY.md)）。
184
+ - **路徑穿越與錯誤訊息修正**：技能名稱先解碼再通過白名單驗證，double-encoding 的 `..%2f` / `%2e%2e` 載荷會以 `InvalidParams` 拒絕；未知工具與 Prompt 改回傳具體可操作的 `InvalidParams`，不再誤報 `MethodNotFound`。
185
+ - **TOCTOU 與破壞性路徑防護**：符號連結檢查後重新驗證 canonical path、快取清理須通過 copy manifest 閘門（fork 自有技能絕不會被誤刪）、drift/coverage 記錄改以暫存檔 + rename 原子寫入。
186
+ - **無競態建置與軟失敗同步**：`out/setup.js` 建置加上獨佔鎖與 mtime 新鮮度重查、watch 模式輸出補上 chmod 執行權限、上游來源缺漏時優雅結束而不是誤報 drift。
187
+ - **誠實的測試工具**：watchdog 加 ref、server `exit`/`close` 處理器杜絕靜默掛死、drift 測試加上網路封鎖、特權降級的 skip 不再計為通過 — 回歸基準維持 **365/365** 斷言。
188
+
189
+ ### v6.4.1
182
190
 
183
191
  - **上游同步至 obra/superpowers v6.4.1**：
184
192
  - **原生會話內執行**：重寫的 `executing-plans` 以新版 `task-start` / `task-done` 跑完全部計畫，最後再做一次全分支審查，不再中途停下來確認。