superpowers-mcp 6.4.5 → 6.4.7

package/skills/brainstorming/scripts/server.cjs

@@ -334,7 +334,10 @@ function isFullDocument(html) {
 }
 
 function wrapInFrame(content) {
-  return renderBranding(frameTemplate).replace('<!-- CONTENT -->', content);
+  // Replacer function, not a string: agent-authored HTML routinely contains
+  // `$&`, `$'`, `$`` or `$$`, which String.replace expands as substitution
+  // tokens, mangling or truncating the rendered screen.
+  return renderBranding(frameTemplate).replace('<!-- CONTENT -->', () => content);
 }
 
 function ensurePrivateDirectory(directory) {
@@ -679,7 +682,9 @@ function handleRequest(req, res) {
     const injection = helperInjection(nonce);
 
     if (html.includes('</body>')) {
-      html = html.replace('</body>', injection + '\n</body>');
+      // Function replacer for the same reason as wrapInFrame: the injected
+      // helper script is substitution-token safe only by convention.
+      html = html.replace('</body>', () => injection + '\n</body>');
     } else {
       html += injection;
     }

package/skills/subagent-driven-development/implementer-prompt.md

@@ -5,11 +5,12 @@ Use this template when dispatching an implementer subagent.
 ```
 Subagent (general-purpose):
   description: "Implement Task N: [task name]"
-  model: [MODEL — REQUIRED: when the brief carries a Tier line, set from it:
-         mechanical → the cheapest model the subagent tool offers; judgment →
-         a standard mid-tier model. Otherwise choose per SKILL.md Model
-         Selection. An omitted model silently inherits the session's most
-         expensive one]
+  model: [MODEL]
+  # Model selection: when the brief carries a Tier line, set from it —
+  # mechanical → the cheapest model the subagent tool offers; judgment →
+  # a standard mid-tier model. Otherwise choose per SKILL.md Model
+  # Selection. An omitted model silently inherits the session's most
+  # expensive one.
   prompt: |
     You are implementing Task N: [task name]
 

package/skills/subagent-driven-development/re-review-prompt.md

@@ -10,8 +10,9 @@ that the fix itself broke nothing.
 ```
 Subagent (general-purpose):
   description: "Re-review Task N fix round R"
-  model: [MODEL — REQUIRED: choose per SKILL.md Model Selection; an omitted
-         model silently inherits the session's most expensive one]
+  model: [MODEL]
+  # Model selection: choose per SKILL.md Model Selection; an omitted model
+  # silently inherits the session's most expensive one.
   prompt: |
     You are re-reviewing one task's fix round. A previous review produced
     findings; an implementer has attempted to fix them. Your job is to

package/skills/subagent-driven-development/task-reviewer-prompt.md

@@ -10,8 +10,9 @@ more, nothing less) and is well-built (clean, tested, maintainable)
 ```
 Subagent (general-purpose):
   description: "Review Task N (spec + quality)"
-  model: [MODEL — REQUIRED: choose per SKILL.md Model Selection; an omitted
-         model silently inherits the session's most expensive one]
+  model: [MODEL]
+  # Model selection: choose per SKILL.md Model Selection; an omitted model
+  # silently inherits the session's most expensive one.
   prompt: |
     You are reviewing one task's implementation: first whether it matches its
     requirements, then whether it is well-built. This is a task-scoped gate,