superpowers-mcp 6.4.3 → 6.4.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.es.md +10 -2
- package/README.hi.md +10 -2
- package/README.ja.md +10 -2
- package/README.ko.md +10 -2
- package/README.md +10 -2
- package/README.pt-BR.md +10 -2
- package/README.zh-TW.md +10 -2
- package/out/server.js +53 -52
- package/out/setup-runner.js +21 -20
- package/out/setup.js +21 -20
- package/package.json +1 -1
package/README.es.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/Poseidoncode/superpowers-mcp)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
Este documento resume la información y las instrucciones de uso para empaquetar las habilidades (skills) de Superpowers y el sistema de flujos de trabajo autónomos en un servidor **Model Context Protocol (MCP)** independiente, de alto rendimiento y seguro.
|
|
@@ -179,7 +179,15 @@ Para ayudarte a elegir el skill adecuado, hemos estructurado los 15 skills a lo
|
|
|
179
179
|
|
|
180
180
|
## 🆕 Novedades recientes
|
|
181
181
|
|
|
182
|
-
### v6.4.
|
|
182
|
+
### v6.4.4 (versión actual)
|
|
183
|
+
|
|
184
|
+
- **Corrección CodeQL y parche de seguridad (2026-09-28)**:
|
|
185
|
+
- El análisis de código queda en **0 abiertos / 7 corregidos**: se cerraron las 3 alertas reportadas contra v6.4.3 en `src/setup-runner.ts` (detalles en [SECURITY.md](SECURITY.md)).
|
|
186
|
+
- **Corrección ReDoS en TOML**: las regex de detección de tablas entrecomilladas se sustituyeron por escáneres lineales — las líneas de configuración adversas ya no provocan backtracking polinómico; el comportamiento fail-closed no cambia.
|
|
187
|
+
- **Guardia contra prototype pollution**: los segmentos `serverPath` del JSON anidado (los usa el target `openclaw`) ahora rechazan `__proto__` / `constructor` / `prototype` y claves no identificadoras antes de escribir.
|
|
188
|
+
- Sin cambios para configuraciones válidas; verificación: `npm test` en verde (base **389/389**), `tsc` limpio, `npm audit` 0 vulnerabilidades.
|
|
189
|
+
|
|
190
|
+
### v6.4.3
|
|
183
191
|
|
|
184
192
|
- **Target Codex y limpieza de docs (2026-09-28)**:
|
|
185
193
|
- Nuevo target `codex`: `setup --target codex` escribe `~/.codex/config.toml` (`[mcp_servers.superpowers]`) con fusión TOML sin dependencias; soporta `--dry-run` / `--backup` / `--bun` / `--remove`.
|
package/README.hi.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/Poseidoncode/superpowers-mcp)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
यह दस्तावेज़ Superpowers skills लाइब्रेरी और स्वायत्त वर्कफ़्लो सिस्टम को एक स्वतंत्र, उच्च-प्रदर्शन और सुरक्षित **Model Context Protocol (MCP)** सर्वर के रूप में पैकेज करने की जानकारी और उपयोग निर्देशों का सारांश है।
|
|
@@ -179,7 +179,15 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
|
|
|
179
179
|
|
|
180
180
|
## 🆕 हाल के अपडेट
|
|
181
181
|
|
|
182
|
-
### v6.4.
|
|
182
|
+
### v6.4.4 (नवीनतम)
|
|
183
|
+
|
|
184
|
+
- **CodeQL सुधार व सुरक्षा पैच (2026-09-28)**:
|
|
185
|
+
- कोड स्कैनिंग अब **0 खुले / 7 ठीक**: v6.4.3 के विरुद्ध रिपोर्ट किए गए `src/setup-runner.ts` के 3 अलर्ट बंद (विवरण [SECURITY.md](SECURITY.md) में)।
|
|
186
|
+
- **TOML ReDoS सुधार**: उद्धृत-तालिका पहचान regex को रैखिक स्कैनर से बदला — दुर्भावनापूर्ण कॉन्फ़िग पंक्तियों पर अब बहुपदीय backtracking नहीं; fail-closed व्यवहार अपरिवर्तित।
|
|
187
|
+
- **प्रोटोटाइप-प्रदूषण रक्षा**: नेस्टेड JSON `serverPath` (`openclaw` टारगेट द्वारा प्रयुक्त) लिखने से पहले `__proto__` / `constructor` / `prototype` व गैर-पहचानकर्ता keys अस्वीकार करता है।
|
|
188
|
+
- वैध कॉन्फ़िग हेतु कोई व्यवहार बदलाव नहीं; सत्यापन: `npm test` हरा (आधार **389/389**), `tsc` स्वच्छ, `npm audit` 0 कमज़ोरियाँ।
|
|
189
|
+
|
|
190
|
+
### v6.4.3
|
|
183
191
|
|
|
184
192
|
- **Codex टारगेट व डॉक्स सफ़ाई (2026-09-28)**:
|
|
185
193
|
- नया `codex` वन-क्लिक टारगेट: `setup --target codex`, `~/.codex/config.toml` (`[mcp_servers.superpowers]`) में लिखता है; शून्य-निर्भरता TOML मर्ज, `--dry-run` / `--backup` / `--bun` / `--remove` समर्थित।
|
package/README.ja.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/Poseidoncode/superpowers-mcp)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
このドキュメントは、Superpowers スキルライブラリと自律型ワークフローを、独立した高パフォーマンスかつ安全な **Model Context Protocol (MCP)** サーバーにパッケージ化した使用説明書です。
|
|
@@ -180,7 +180,15 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
|
|
|
180
180
|
|
|
181
181
|
## 🆕 最近の更新
|
|
182
182
|
|
|
183
|
-
### v6.4.
|
|
183
|
+
### v6.4.4（最新）
|
|
184
|
+
|
|
185
|
+
- **CodeQL 是正とセキュリティパッチ（2026-09-28）**：
|
|
186
|
+
- コードスキャンは **未対応 0 件／修正済み 7 件** に：v6.4.3 で報告された `src/setup-runner.ts` の 3 件のアラートを解消（詳細は [SECURITY.md](SECURITY.md)）。
|
|
187
|
+
- **TOML ReDoS 修正**：引用符付きテーブル検出の正規表現を線形スキャナに置換。攻撃的な設定行でも多項式バックトラックが発生しない。fail-closed の動作は不変。
|
|
188
|
+
- **プロトタイプ汚染ガード**：ネスト JSON の `serverPath`（`openclaw` ターゲットが使用）は書込前に `__proto__`／`constructor`／`prototype` と非識別子キーを拒否。
|
|
189
|
+
- 正規の設定の動作に変更なし。検証：`npm test` グリーン（基準 **389/389**）、`tsc` クリーン、`npm audit` 0 脆弱性。
|
|
190
|
+
|
|
191
|
+
### v6.4.3
|
|
184
192
|
|
|
185
193
|
- **Codex 対応とドキュメント整理（2026-09-28）**：
|
|
186
194
|
- 新規 `codex` 一発ターゲット：`setup --target codex` が `~/.codex/config.toml`（`[mcp_servers.superpowers]`）に書込。依存ゼロの TOML マージ、`--dry-run` / `--backup` / `--bun` / `--remove` 対応。
|
package/README.ko.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/Poseidoncode/superpowers-mcp)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
이 문서는 Superpowers 스킬 라이브러리와 자율 에이전트 워크플로우를 독립적이고 고성능이며 안전한 **Model Context Protocol (MCP)** 서버로 패키징한 사용 지침을 요약한 것입니다.
|
|
@@ -178,7 +178,15 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
|
|
|
178
178
|
|
|
179
179
|
## 🆕 최근 업데이트
|
|
180
180
|
|
|
181
|
-
### v6.4.
|
|
181
|
+
### v6.4.4 (최신)
|
|
182
|
+
|
|
183
|
+
- **CodeQL 수정 및 보안 패치 (2026-09-28)**:
|
|
184
|
+
- 코드 스캔 **미해결 0건 / 수정 7건**: v6.4.3에서 보고된 `src/setup-runner.ts` 3건 알림 해소(자세한 내용은 [SECURITY.md](SECURITY.md)).
|
|
185
|
+
- **TOML ReDoS 수정**: 인용 테이블 감지 정규식을 선형 스캐너로 교체. 악성 설정 줄에서도 다항식 백트래킹이 발생하지 않음. fail-closed 동작은 그대로 유지.
|
|
186
|
+
- **프로토타입 오염 가드**: 중첩 JSON `serverPath`(`openclaw` 타겟 사용)는 쓰기 전에 `__proto__` / `constructor` / `prototype` 및 비식별자 키를 거부.
|
|
187
|
+
- 정상 설정의 동작 변경 없음. 검증: `npm test` 그린(기준 **389/389**), `tsc` 클린, `npm audit` 0 취약점.
|
|
188
|
+
|
|
189
|
+
### v6.4.3
|
|
182
190
|
|
|
183
191
|
- **Codex 지원 및 문서 정리 (2026-09-28)**:
|
|
184
192
|
- 신규 `codex` 원클릭 타겟: `setup --target codex`가 `~/.codex/config.toml`(`[mcp_servers.superpowers]`)에 기록. 무의존 TOML 병합, `--dry-run` / `--backup` / `--bun` / `--remove` 지원.
|
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/Poseidoncode/superpowers-mcp)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
This document summarizes the information and usage instructions for packaging the Superpowers skills and autonomous workflow system into an independent, high-performance, and secure **Model Context Protocol (MCP)** server.
|
|
@@ -179,7 +179,15 @@ To help you choose the right skill, we have structured all 15 skills across the
|
|
|
179
179
|
|
|
180
180
|
## 🆕 Recent Updates
|
|
181
181
|
|
|
182
|
-
### v6.4.
|
|
182
|
+
### v6.4.4 (Latest)
|
|
183
|
+
|
|
184
|
+
- **CodeQL remediation & security patch (2026-09-28)**:
|
|
185
|
+
- Code scanning is now **0 open / 7 fixed**: closed the 3 alerts reported against v6.4.3 in `src/setup-runner.ts` (details in [SECURITY.md](SECURITY.md)).
|
|
186
|
+
- **TOML ReDoS fix**: quoted-table detection regexes replaced with linear scanners — adversarial config lines no longer cause polynomial backtracking; fail-closed behavior unchanged.
|
|
187
|
+
- **Prototype-pollution guard**: nested JSON `serverPath` segments (used by the `openclaw` target) now reject `__proto__` / `constructor` / `prototype` and non-identifier keys before any write.
|
|
188
|
+
- No behavior change for valid configs; verification: `npm test` green (regression floor **389/389**), `tsc` clean, `npm audit` 0 vulnerabilities.
|
|
189
|
+
|
|
190
|
+
### v6.4.3
|
|
183
191
|
|
|
184
192
|
- **Codex target & docs cleanup (2026-09-28)**:
|
|
185
193
|
- New `codex` one-click target: `setup --target codex` writes `~/.codex/config.toml` (`[mcp_servers.superpowers]`) via zero-dependency TOML merge; supports `--dry-run` / `--backup` / `--bun` / `--remove`.
|
package/README.pt-BR.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/Poseidoncode/superpowers-mcp)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
Este documento resume as informações e instruções de uso para empacotar as skills do Superpowers e o sistema de fluxos de trabalho autônomos em um servidor **Model Context Protocol (MCP)** independente, de alta performance e seguro.
|
|
@@ -179,7 +179,15 @@ Para ajudar você a escolher a skill certa, estruturamos as 15 skills ao longo d
|
|
|
179
179
|
|
|
180
180
|
## 🆕 Novidades recentes
|
|
181
181
|
|
|
182
|
-
### v6.4.
|
|
182
|
+
### v6.4.4 (atual)
|
|
183
|
+
|
|
184
|
+
- **Correção CodeQL e patch de segurança (2026-09-28)**:
|
|
185
|
+
- O code scanning fica em **0 abertos / 7 corrigidos**: fechados os 3 alertas reportados contra a v6.4.3 em `src/setup-runner.ts` (detalhes em [SECURITY.md](SECURITY.md)).
|
|
186
|
+
- **Correção ReDoS no TOML**: as regex de detecção de tabelas entre aspas foram trocadas por scanners lineares — linhas de configuração adversas não causam mais backtracking polinomial; o comportamento fail-closed não muda.
|
|
187
|
+
- **Guarda contra prototype pollution**: os segmentos `serverPath` do JSON aninhado (usados pelo target `openclaw`) agora rejeitam `__proto__` / `constructor` / `prototype` e chaves não identificadoras antes de gravar.
|
|
188
|
+
- Sem mudança para configurações válidas; verificação: `npm test` verde (base **389/389**), `tsc` limpo, `npm audit` 0 vulnerabilidades.
|
|
189
|
+
|
|
190
|
+
### v6.4.3
|
|
183
191
|
|
|
184
192
|
- **Target Codex e limpeza de docs (2026-09-28)**:
|
|
185
193
|
- Novo target `codex`: `setup --target codex` grava `~/.codex/config.toml` (`[mcp_servers.superpowers]`) com merge TOML sem dependências; suporta `--dry-run` / `--backup` / `--bun` / `--remove`.
|
package/README.zh-TW.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
[English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
|
|
4
4
|
|
|
5
|
-
[](https://github.com/Poseidoncode/superpowers-mcp)
|
|
6
6
|
[](LICENSE)
|
|
7
7
|
|
|
8
8
|
本文檔總結了將 Superpowers 技能庫與自主 Agent 工作流架構打包成獨立、高效能且安全加固的 **Model Context Protocol (MCP)** 伺服器之相關資訊與使用說明。
|
|
@@ -178,7 +178,15 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
|
|
|
178
178
|
|
|
179
179
|
## 🆕 最近更新
|
|
180
180
|
|
|
181
|
-
### v6.4.
|
|
181
|
+
### v6.4.4（最新版）
|
|
182
|
+
|
|
183
|
+
- **CodeQL 修復與安全更新（2026-09-28）**：
|
|
184
|
+
- Code scanning 已 **0 未修復 / 7 已修復**：補上 v6.4.3 通報的 3 個 `src/setup-runner.ts` 警報（詳見 [SECURITY.md](SECURITY.md)）。
|
|
185
|
+
- **TOML ReDoS 修復**：引號表格偵測 regex 改為線性掃描，惡意設定行不再造成多項式回溯；fail-closed 行為不變。
|
|
186
|
+
- **原型污染防護**：巢狀 JSON `serverPath`（`openclaw` 目標使用）寫入前拒絕 `__proto__` / `constructor` / `prototype` 與非識別字 key。
|
|
187
|
+
- 合法設定行為不變；驗證：`npm test` 全綠（基準 **389/389**），`tsc` 乾淨，`npm audit` 0 漏洞。
|
|
188
|
+
|
|
189
|
+
### v6.4.3
|
|
182
190
|
|
|
183
191
|
- **Codex 支援與文件清理（2026-09-28）**：
|
|
184
192
|
- 新增 `codex` 一鍵目標：`setup --target codex` 寫入 `~/.codex/config.toml`（`[mcp_servers.superpowers]`），零依賴 TOML 合併，支援 `--dry-run` / `--backup` / `--bun` / `--remove`。
|