superpowers-mcp 6.4.5 → 6.4.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (12) hide show
  1. package/README.es.md +9 -2
  2. package/README.hi.md +9 -2
  3. package/README.ja.md +9 -2
  4. package/README.ko.md +9 -2
  5. package/README.md +9 -2
  6. package/README.pt-BR.md +9 -2
  7. package/README.zh-TW.md +9 -2
  8. package/out/server.js +77 -73
  9. package/out/setup-runner.js +27 -23
  10. package/out/setup.js +28 -24
  11. package/package.json +3 -2
  12. package/skills/brainstorming/scripts/server.cjs +7 -2
package/README.es.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
4
4
 
5
- [![Versión](https://img.shields.io/badge/version-6.4.5-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![Versión](https://img.shields.io/badge/version-6.4.6-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![Licencia](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  Este documento resume la información y las instrucciones de uso para empaquetar las habilidades (skills) de Superpowers y el sistema de flujos de trabajo autónomos en un servidor **Model Context Protocol (MCP)** independiente, de alto rendimiento y seguro.
@@ -179,7 +179,14 @@ Para ayudarte a elegir el skill adecuado, hemos estructurado los 15 skills a lo
179
179
 
180
180
  ## 🆕 Novedades recientes
181
181
 
182
- ### v6.4.5 (versión actual)
182
+ ### v6.4.6 (versión actual)
183
+
184
+ - **Escaneo completo de seguridad (2026-10-06)**: sin hallazgos nuevos en `src/*.ts`, el servidor companion de brainstorming, `scripts/` y el pipeline de build — 0 `eval` / `new Function` / `innerHTML` / `shell: true` en el código distribuido, procesos hijo solo por argv, nonces temporales con `crypto.randomBytes`, 0 secretos hardcodeados, 0 archivos world-writable (detalles en [SECURITY.md](SECURITY.md)).
185
+ - **Avisos de dependencias corregidos (`npm audit` 2 → 0)**: GHSA-6qxp-vccf-f47h (alta, fuga de credenciales OAuth del SDK MCP) corregido subiendo `@modelcontextprotocol/sdk` a `^1.32.1`; GHSA-jqcg-44mw-7w3h (crítica, suplantación de IP en `proxy-addr` vía `express`) corregido con el nuevo piso `overrides.proxy-addr ^2.0.8`. Ambos solo existen en tiempo de compilación e inalcanzables desde el paquete stdio-only.
186
+ - **Correcciones posteriores a v6.4.5 ya registradas**: la inyección de marcos de brainstorming conserva tokens `$` literales con function replacers; escaneos de skills en single-flight, manejo de claves raíz YAML entrecomilladas (con emisión de mapa vacío y preservación CRLF) y guardias de anexado por clave de placeholder.
187
+ - Verificación: `npm test` en verde (base **409 aserciones**: setup 78/78, edge-cases 12/12, brainstorming 35/35, prompts 18/18), `tsc` limpio, `npm audit` 0 vulnerabilidades.
188
+
189
+ ### v6.4.5
183
190
 
184
191
  - **Sincronización con `obra/superpowers@8ca22db` (v6.4.2, 2026-09-25, PR #2384 "leaner plans")**: `writing-plans` ahora registra las decisiones que necesita quien implementa (firmas, aserciones de prueba, valores del spec) en lugar de transcribir código: nuevo encabezado de plan centrado en el spec con `Spec:` explícito, nueva plantilla `## What a Step Contains`, `## Bite-Sized Task Granularity` renombrado a `## Step Granularity` y `## Self-Review` con siete comprobaciones.
185
192
  - **Contenido del fork preservado en el merge**: la sección propia `## Two Plan Shapes` y `skeleton-first-plans.md` se mantienen intactos; `plan-document-reviewer-prompt.md` permanece en el fork porque `src/server.ts` lo renderiza como prompt MCP `plan-reviewer`.
package/README.hi.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
4
4
 
5
- [![संस्करण](https://img.shields.io/badge/version-6.4.5-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![संस्करण](https://img.shields.io/badge/version-6.4.6-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![लाइसेंस](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  यह दस्तावेज़ Superpowers skills लाइब्रेरी और स्वायत्त वर्कफ़्लो सिस्टम को एक स्वतंत्र, उच्च-प्रदर्शन और सुरक्षित **Model Context Protocol (MCP)** सर्वर के रूप में पैकेज करने की जानकारी और उपयोग निर्देशों का सारांश है।
@@ -179,7 +179,14 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
179
179
 
180
180
  ## 🆕 हाल के अपडेट
181
181
 
182
- ### v6.4.5 (नवीनतम)
182
+ ### v6.4.6 (नवीनतम)
183
+
184
+ - **पूर्ण सुरक्षा स्कैन (2026-10-06)**: `src/*.ts`, brainstorming companion सर्वर, `scripts/` और बिल्ड पाइपलाइन में कोई नई खोज नहीं — वितरित कोड में `eval` / `new Function` / `innerHTML` / `shell: true` 0, चाइल्ड प्रोसेस केवल argv द्वारा, `crypto.randomBytes` अस्थायी nonce, 0 हार्डकोडेड रहस्य, 0 world-writable फ़ाइलें (विवरण [SECURITY.md](SECURITY.md) में)।
185
+ - **निर्भरता परामर्श ठीक (`npm audit` 2 → 0)**: GHSA-6qxp-vccf-f47h (उच्च, MCP SDK OAuth क्रेडेंशियल लीक) `@modelcontextprotocol/sdk` को `^1.32.1` पर बढ़ाकर ठीक; GHSA-jqcg-44mw-7w3h (गंभीर, `express` के माध्यम से `proxy-addr` IP स्पूफिंग) नए `overrides.proxy-addr ^2.0.8` फ्लोर से ठीक। दोनों केवल बिल्ड-समय में हैं और stdio-only पैकेज से अप्राप्य।
186
+ - **v6.4.5 के बाद के स्रोत सुधार दर्ज**: brainstorming फ्रेम इंजेक्शन function replacer से शाब्दिक `$` टोकन सुरक्षित रखता है; single-flight स्किल स्कैन, उद्धृत YAML रूट-कुंजी प्रबंधन (खाली-मैप उत्सर्जन व CRLF संरक्षण सहित), और placeholder-key प्रॉम्प्ट संलग्न रक्षक।
187
+ - सत्यापन: `npm test` हरा (आधार **409 अभिकथन**: setup 78/78, edge-cases 12/12, brainstorming 35/35, prompts 18/18), `tsc` स्वच्छ, `npm audit` 0 कमज़ोरियाँ।
188
+
189
+ ### v6.4.5
183
190
 
184
191
  - **अपस्ट्रीम `obra/superpowers@8ca22db` (v6.4.2, 2026-09-25, PR #2384 "leaner plans") के साथ सिंक**: `writing-plans` अब कोड की प्रतिलिपि के बजाय उन निर्णयों को दर्ज करता है जिन्हें लागू करने वाले को चाहिए (हस्ताक्षर, टेस्ट असर्टन, spec मान) — स्पष्ट `Spec:` पथ वाला नया spec-केंद्रित प्लान हेडर, नया `## What a Step Contains` चरण टेम्पलेट, `## Bite-Sized Task Granularity` से `## Step Granularity` नाम परिवर्तन, और सात-जाँच वाला `## Self-Review`।
185
192
  - **फोर्क सामग्री मर्ज में सुरक्षित**: फोर्क-केवल `## Two Plan Shapes` अनुभाग और `skeleton-first-plans.md` अक्षुण्ण रहते हैं; `plan-document-reviewer-prompt.md` फोर्क में रहता है क्योंकि `src/server.ts` उसे `plan-reviewer` MCP प्रॉम्प्ट के रूप में रेंडर करता है।
package/README.ja.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
4
4
 
5
- [![バージョン](https://img.shields.io/badge/version-6.4.5-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![バージョン](https://img.shields.io/badge/version-6.4.6-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  このドキュメントは、Superpowers スキルライブラリと自律型ワークフローを、独立した高パフォーマンスかつ安全な **Model Context Protocol (MCP)** サーバーにパッケージ化した使用説明書です。
@@ -180,7 +180,14 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
180
180
 
181
181
  ## 🆕 最近の更新
182
182
 
183
- ### v6.4.5（最新）
183
+ ### v6.4.6（最新）
184
+
185
+ - **フルセキュリティスキャン（2026-10-06）**：`src/*.ts`、brainstorming コンパニオンサーバー、`scripts/`、ビルドパイプラインに新たな所見なし——出荷コード中の `eval` / `new Function` / `innerHTML` / `shell: true` は 0、子プロセスは argv のみ、`crypto.randomBytes` による一時ファイル nonce、ハードコードされた秘密情報 0、ワールドライタブルファイル 0（詳細は [SECURITY.md](SECURITY.md)）。
186
+ - **依存関係アドバイザリを解消（`npm audit` 2 → 0）**：GHSA-6qxp-vccf-f47h（高、MCP SDK の OAuth 認証情報漏洩）は `@modelcontextprotocol/sdk` を `^1.32.1` に引き上げて修正；GHSA-jqcg-44mw-7w3h（重大、`express` 経由の `proxy-addr` IP 偽装）は新規 `overrides.proxy-addr ^2.0.8` 下限で修正。いずれもビルド時のみで、stdio 専用の出荷バンドルからは到達不能。
187
+ - **v6.4.5 以降のソース修正を記録**：brainstorming フレーム注入は function replacer でリテラル `$` トークンを保持；シングルフライトのスキルスキャン、クォート付き YAML ルートキー処理（空マップ出力・CRLF 保持付き）、プレースホルダーキー方式のプロンプト追記ガード。
188
+ - 検証：`npm test` グリーン（基準 **409 アサーション**：setup 78/78、edge-cases 12/12、brainstorming 35/35、prompts 18/18）、`tsc` クリーン、`npm audit` 0 脆弱性。
189
+
190
+ ### v6.4.5
184
191
 
185
192
  - **上流 `obra/superpowers@8ca22db`（上流 v6.4.2、2026-09-25、PR #2384「leaner plans」）へ同期**: `writing-plans` はコードの書き写しではなく、実装者が必要とする判断（シグネチャ、テストのアサーション、spec の値）を記録します。明示的な `Spec:` 路を持つ spec 優先の新プランヘッダ、新セクション `## What a Step Contains`、`## Bite-Sized Task Granularity` から `## Step Granularity` への改名、7 項目チェックの `## Self-Review`。
186
193
  - **フォーク固有の内容を保持**: フォーク独自の `## Two Plan Shapes` と `skeleton-first-plans.md` はマージ後も維持されます。`plan-document-reviewer-prompt.md` は `src/server.ts` が `plan-reviewer` MCP プロンプトとして使うため、フォークに残します。
package/README.ko.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
4
4
 
5
- [![Version](https://img.shields.io/badge/version-6.4.5-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![Version](https://img.shields.io/badge/version-6.4.6-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  이 문서는 Superpowers 스킬 라이브러리와 자율 에이전트 워크플로우를 독립적이고 고성능이며 안전한 **Model Context Protocol (MCP)** 서버로 패키징한 사용 지침을 요약한 것입니다.
@@ -178,7 +178,14 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
178
178
 
179
179
  ## 🆕 최근 업데이트
180
180
 
181
- ### v6.4.5 (최신)
181
+ ### v6.4.6 (최신)
182
+
183
+ - **전체 보안 스캔 (2026-10-06)**: `src/*.ts`, brainstorming 컴패니언 서버, `scripts/`, 빌드 파이프라인에서 새로운 발견 없음 — 출하 코드 내 `eval` / `new Function` / `innerHTML` / `shell: true` 0건, 자식 프로세스는 argv 전용, `crypto.randomBytes` 임시 nonce, 하드코딩된 비밀 0건, world-writable 파일 0건 (자세한 내용은 [SECURITY.md](SECURITY.md)).
184
+ - **의존성 권고 해소 (`npm audit` 2 → 0)**: GHSA-6qxp-vccf-f47h (높음, MCP SDK OAuth 자격 증명 유출)는 `@modelcontextprotocol/sdk`를 `^1.32.1`로 올려 수정; GHSA-jqcg-44mw-7w3h (심각, `express` 경유의 `proxy-addr` IP 스푸핑)는 신규 `overrides.proxy-addr ^2.0.8` 하한으로 수정. 둘 다 빌드 시점 전용이며 stdio 전용 출하 번들에서는 도달 불가.
185
+ - **v6.4.5 이후 소스 수정 기록**: brainstorming 프레임 주입은 function replacer로 리터럴 `$` 토큰 보존; single-flight 스킬 스캔, 따옴표 있는 YAML 루트 키 처리 (빈 맵 출력·CRLF 보존 포함), 플레이스홀더 키 방식 프롬프트 추가 가드.
186
+ - 검증: `npm test` 그린 (기준 **409 어서션**: setup 78/78, edge-cases 12/12, brainstorming 35/35, prompts 18/18), `tsc` 클린, `npm audit` 0 취약점.
187
+
188
+ ### v6.4.5
182
189
 
183
190
  - **상류 `obra/superpowers@8ca22db` (상류 v6.4.2, 2026-09-25, PR #2384 "leaner plans") 동기화**: `writing-plans`가 코드를 옮겨 적는 대신 구현에 필요한 결정(시그니처, 테스트 단언, spec 값)을 기록합니다. 명시적 `Spec:` 경로를 가진 spec 우선 플랜 헤더, 새 `## What a Step Contains` 단계 템플릿, `## Bite-Sized Task Granularity` → `## Step Granularity` 개명, 7단계 `## Self-Review`.
184
191
  - **포크 콘텐츠 보존**: 포크 전용 `## Two Plan Shapes` 섹션과 `skeleton-first-plans.md`는 병합 후에도 유지됩니다. `plan-document-reviewer-prompt.md`는 `src/server.ts`가 `plan-reviewer` MCP 프롬프트로 렌더링하므로 포크에 유지합니다.
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
4
4
 
5
- [![Version](https://img.shields.io/badge/version-6.4.5-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![Version](https://img.shields.io/badge/version-6.4.6-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  This document summarizes the information and usage instructions for packaging the Superpowers skills and autonomous workflow system into an independent, high-performance, and secure **Model Context Protocol (MCP)** server.
@@ -179,7 +179,14 @@ To help you choose the right skill, we have structured all 15 skills across the
179
179
 
180
180
  ## 🆕 Recent Updates
181
181
 
182
- ### v6.4.5 (Latest)
182
+ ### v6.4.6 (Latest)
183
+
184
+ - **Full security scan (2026-10-06)**: no new findings across `src/*.ts`, the brainstorming companion server, `scripts/`, and the build pipeline — 0 `eval` / `new Function` / `innerHTML` / `shell: true` in shipped code, argv-only child processes, `crypto.randomBytes` temp nonces, 0 hardcoded secrets, 0 world-writable files (details in [SECURITY.md](SECURITY.md)).
185
+ - **Dependency advisories remediated (`npm audit` 2 → 0)**: GHSA-6qxp-vccf-f47h (high, MCP SDK OAuth credential leak) fixed by raising `@modelcontextprotocol/sdk` to `^1.32.1`; GHSA-jqcg-44mw-7w3h (critical, `proxy-addr` IP spoofing via `express`) fixed with a new `overrides.proxy-addr ^2.0.8` floor. Both are build-time-only and unreachable from the stdio-only shipped bundle.
186
+ - **Post-v6.4.5 fixes now on record**: brainstorming frame injection preserves literal `$` tokens via function replacers; single-flight skill scans, quoted YAML root-key handling with empty-map emission and CRLF preservation, and placeholder-key prompt append guards.
187
+ - Verification: `npm test` green (regression floor **409 assertions**: setup 78/78, edge-cases 12/12, brainstorming 35/35, prompts 18/18), `tsc` clean, `npm audit` 0 vulnerabilities.
188
+
189
+ ### v6.4.5
183
190
 
184
191
  - **Upstream sync to `obra/superpowers@8ca22db` (upstream v6.4.2, 2026-09-25, PR #2384 "leaner plans")**: `writing-plans` now records the decisions an implementer needs (signatures, test assertions, spec values) instead of transcribing code — new spec-first plan header with an explicit `Spec:` path, new `## What a Step Contains` step template, `## Bite-Sized Task Granularity` renamed `## Step Granularity`, and a seven-check `## Self-Review`.
185
192
  - **Fork content preserved through the three-way merge**: the fork-only `## Two Plan Shapes` section and `skeleton-first-plans.md` survive intact; `plan-document-reviewer-prompt.md` stays in the fork because `src/server.ts` renders it as the `plan-reviewer` MCP prompt.
package/README.pt-BR.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
4
4
 
5
- [![Versão](https://img.shields.io/badge/version-6.4.5-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![Versão](https://img.shields.io/badge/version-6.4.6-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![Licença](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  Este documento resume as informações e instruções de uso para empacotar as skills do Superpowers e o sistema de fluxos de trabalho autônomos em um servidor **Model Context Protocol (MCP)** independente, de alta performance e seguro.
@@ -179,7 +179,14 @@ Para ajudar você a escolher a skill certa, estruturamos as 15 skills ao longo d
179
179
 
180
180
  ## 🆕 Novidades recentes
181
181
 
182
- ### v6.4.5 (atual)
182
+ ### v6.4.6 (atual)
183
+
184
+ - **Varredura completa de segurança (2026-10-06)**: nenhuma nova descoberta em `src/*.ts`, no servidor companion de brainstorming, em `scripts/` e no pipeline de build — 0 `eval` / `new Function` / `innerHTML` / `shell: true` no código distribuído, processos filho somente por argv, nonces temporários com `crypto.randomBytes`, 0 segredos hardcodados, 0 arquivos world-writable (detalhes em [SECURITY.md](SECURITY.md)).
185
+ - **Avisos de dependências corrigidos (`npm audit` 2 → 0)**: GHSA-6qxp-vccf-f47h (alta, vazamento de credenciais OAuth do SDK MCP) corrigido elevando `@modelcontextprotocol/sdk` a `^1.32.1`; GHSA-jqcg-44mw-7w3h (crítica, falsificação de IP em `proxy-addr` via `express`) corrigido com o novo piso `overrides.proxy-addr ^2.0.8`. Ambos existem só em tempo de compilação e são inalcançáveis a partir do pacote stdio-only.
186
+ - **Correções pós-v6.4.5 registradas**: a injeção de molduras do brainstorming preserva tokens `$` literais com function replacers; varreduras de skills em single-flight, tratamento de chaves raiz YAML entre aspas (com emissão de mapa vazio e preservação CRLF) e guardas de anexo por chave de placeholder.
187
+ - Verificação: `npm test` verde (base **409 asserções**: setup 78/78, edge-cases 12/12, brainstorming 35/35, prompts 18/18), `tsc` limpo, `npm audit` 0 vulnerabilidades.
188
+
189
+ ### v6.4.5
183
190
 
184
191
  - **Sincronização com `obra/superpowers@8ca22db` (v6.4.2, 2026-09-25, PR #2384 "leaner plans")**: `writing-plans` agora registra as decisões que o implementador precisa (assinaturas, asserções de teste, valores do spec) em vez de transcrever código: novo cabeçalho de plano centrado no spec com `Spec:` explícito, nova plantilha `## What a Step Contains`, `## Bite-Sized Task Granularity` renomeado para `## Step Granularity` e `## Self-Review` com sete verificações.
185
192
  - **Conteúdo do fork preservado no merge**: a seção própria `## Two Plan Shapes` e `skeleton-first-plans.md` permanecem intactos; `plan-document-reviewer-prompt.md` fica no fork porque `src/server.ts` o renderiza como prompt MCP `plan-reviewer`.
package/README.zh-TW.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  [English](README.md) | [繁體中文](README.zh-TW.md) | [日本語](README.ja.md) | [한국어](README.ko.md) | [Español](README.es.md) | [Português (BR)](README.pt-BR.md) | [हिन्दी](README.hi.md)
4
4
 
5
- [![版本](https://img.shields.io/badge/version-6.4.5-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
5
+ [![版本](https://img.shields.io/badge/version-6.4.6-blue.svg)](https://github.com/Poseidoncode/superpowers-mcp)
6
6
  [![授權](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
 
8
8
  本文檔總結了將 Superpowers 技能庫與自主 Agent 工作流架構打包成獨立、高效能且安全加固的 **Model Context Protocol (MCP)** 伺服器之相關資訊與使用說明。
@@ -178,7 +178,14 @@ systematic-debugging ➔ using-git-worktrees ➔ dispatching-parallel-agents ➔
178
178
 
179
179
  ## 🆕 最近更新
180
180
 
181
- ### v6.4.5（最新版）
181
+ ### v6.4.6（最新版）
182
+
183
+ - **完整安全性掃描（2026-10-06）**：`src/*.ts`、brainstorming companion server、`scripts/` 與建置流程皆無新增發現——發佈程式碼中 `eval` / `new Function` / `innerHTML` / `shell: true` 為 0、子程序僅用 argv、`crypto.randomBytes` 暫存檔隨機值、0 硬編碼密鑰、0 全域可寫檔案（詳見 [SECURITY.md](SECURITY.md)）。
184
+ - **依賴安全諮詢已修復（`npm audit` 2 → 0）**：GHSA-6qxp-vccf-f47h（高危，MCP SDK OAuth 憑證外洩）透過升級 `@modelcontextprotocol/sdk` 至 `^1.32.1` 修復；GHSA-jqcg-44mw-7w3h（嚴重，經由 `express` 的 `proxy-addr` IP 偽造）以新增 `overrides.proxy-addr ^2.0.8` 下限修復。兩者皆僅存在於建置期，stdio-only 的發佈包無法觸及。
185
+ - **v6.4.5 之後的原始碼修復正式記錄**：brainstorming frame 注入改用 function replacer 保留字面 `$` token；單飛技能掃描、引號 YAML 根鍵處理（含空映射輸出與 CRLF 保留）、以及 placeholder-key 提示附加守衛。
186
+ - 驗證：`npm test` 全綠（基準 **409 斷言**：setup 78/78、edge-cases 12/12、brainstorming 35/35、prompts 18/18），`tsc` 乾淨，`npm audit` 0 漏洞。
187
+
188
+ ### v6.4.5
182
189
 
183
190
  - **上游同步至 `obra/superpowers@8ca22db`（上游 v6.4.2，2026-09-25，PR #2384「leaner plans」）**：`writing-plans` 改為記錄實作時需要的決策（函式簽章、測試斷言、spec 數值），而非抄寫程式碼——新增明確 `Spec:` 路徑的 spec 優先計畫標頭、新增 `## What a Step Contains` 步驟範本、`## Bite-Sized Task Granularity` 更名為 `## Step Granularity`，以及含七項檢查的 `## Self-Review`。
184
191
  - **三方合併保留 fork 內容**：fork 獨有的 `## Two Plan Shapes` 段落與 `skeleton-first-plans.md` 完整保留；`plan-document-reviewer-prompt.md` 留在 fork，因為 `src/server.ts` 用它產生 `plan-reviewer` MCP prompt。