superpowers-mcp - npm Package Compare versions

Comparing version

+1

-1

package.json

		@@ -5,3 +5,3 @@ {
		"description": "Superpowers skills library (TDD, debugging, collaboration workflows) as an MCP server for VSCode and Antigravity",
		"version": "6.0.0",
		"version": "6.0.1",
		"publisher": "superpowers",
		@@ -8,0 +8,0 @@ "license": "MIT",

+4

-1

README.md

		@@ -131,3 +131,6 @@ # Superpowers MCP Toolpack Usage Guide

		### v6.0.0 (Latest)
		### v6.0.1 (Latest)
		- Security Fix — Reflected XSS (#2): Fixed server-side reflected cross-site scripting in `skills/brainstorming/scripts/server.cjs`. The `bootstrapPage()` function was called with the user-supplied `keyFromQuery` parameter (even though validated via `timingSafeEqualStr`). Changed to use the server-side `TOKEN` constant instead, eliminating user-tainted data from the HTML response sink. Zero behavior change (the validated value is identical).

		### v6.0.0
		- Upstream Sync with obra/superpowers v6.1.1: Major synchronization bringing upstream improvements across all skills.
		@@ -134,0 +137,0 @@ - subagent-driven-development Redesign: Consolidated two-stage review (spec → code quality) into a single "task reviewer" sub-agent, plus added a broad whole-branch final review at completion. New Pre-Flight Plan Review catches task conflicts before execution begins. Added Model Selection Guidance to optimize cost vs. turn count.

+4

-1

README.zh-TW.md

		@@ -131,3 +131,6 @@ # Superpowers MCP Toolpack 使用指南

		### v6.0.0 (最新版)
		### v6.0.1 (最新版)
		- 安全性修復 — Reflected XSS (#2): 修復 `skills/brainstorming/scripts/server.cjs` 中的伺服器端反射型跨站腳本漏洞。原本 `bootstrapPage()` 使用使用者提供的 `keyFromQuery` 參數（雖已通過 `timingSafeEqualStr` 驗證），現改為使用伺服器端 `TOKEN` 常數，徹底消除使用者可控資料進入 HTML 回應的風險。行為完全不變（驗證後的值相同）。

		### v6.0.0
		- 同步上游 obra/superpowers v6.1.1: 大規模同步，引入上游對所有技能的改進。
		@@ -134,0 +137,0 @@ - subagent-driven-development 流程改造: 將原本的兩階段審查（規格 → 程式碼品質）合併為單一 task reviewer 子代理，並在最後增加 whole-branch final review。新增 Pre-Flight Plan Review 在執行前掃描任務衝突。新增 Model Selection Guidance 以最佳化成本與回合數。

+1

-1

skills/brainstorming/scripts/server.cjs

		@@ -383,3 +383,3 @@ const crypto = require('crypto');
		res.writeHead(200, securityHeaders({ 'Content-Type': 'text/html; charset=utf-8' }));
		res.end(bootstrapPage(keyFromQuery));
		res.end(bootstrapPage(TOKEN));
		} else if (req.method === 'GET' && pathname === '/') {
		@@ -386,0 +386,0 @@ const screenFile = getNewestScreen();

New alerts