Release v6.0.3: SDD artifacts move out of the .git/ protected path

Bump all plugin manifests to 6.0.3. This release moves subagent-driven- development's scratch artifacts (task briefs, implementer reports, review diffs, progress ledger) from .git/sdd/ — which Claude Code denies agent writes to — into a self-ignoring working-tree .superpowers/sdd/ dir, and bumps the brainstorm-server test harness's ws dependency to clear two dependabot alerts. See RELEASE-NOTES.md.
test(deps): bump ws to ^8.21.0 in brainstorm-server tests
2026-06-19 09:09:05 +08:00 · 2026-06-18 15:44:22 -07:00 · 2026-06-18 15:44:22 -07:00 · 2026-06-18 15:44:22 -07:00 · 2026-06-18 15:44:22 -07:00 · 2026-06-18 15:44:22 -07:00
12 changed files with 21 additions and 12 deletions
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -9,7 +9,7 @@
    {
      "name": "superpowers",
      "description": "Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques",
-      "version": "6.0.2",
+      "version": "6.0.3",
      "source": "./",
      "author": {
        "name": "Jesse Vincent",
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,7 +1,7 @@
 {
  "name": "superpowers",
  "description": "Core skills library for Claude Code: TDD, debugging, collaboration patterns, and proven techniques",
-  "version": "6.0.2",
+  "version": "6.0.3",
  "author": {
    "name": "Jesse Vincent",
    "email": "jesse@fsck.com"
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "superpowers",
-  "version": "6.0.2",
+  "version": "6.0.3",
  "description": "An agentic skills framework & software development methodology that works: planning, TDD, debugging, and collaboration workflows.",
  "author": {
    "name": "Jesse Vincent",
--- a/.cursor-plugin/plugin.json
+++ b/.cursor-plugin/plugin.json
@@ -2,7 +2,7 @@
  "name": "superpowers",
  "displayName": "Superpowers",
  "description": "Core skills library: TDD, debugging, collaboration patterns, and proven techniques",
-  "version": "6.0.2",
+  "version": "6.0.3",
  "author": {
    "name": "Jesse Vincent",
    "email": "jesse@fsck.com"
--- a/.kimi-plugin/plugin.json
+++ b/.kimi-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
  "name": "superpowers",
-  "version": "6.0.2",
+  "version": "6.0.3",
  "description": "An agentic skills framework and software development methodology.",
  "author": {
    "name": "Jesse Vincent",
--- a/RELEASE-NOTES.md
+++ b/RELEASE-NOTES.md
@@ -1,5 +1,11 @@
 # Superpowers Release Notes

+## v6.0.3 (2026-06-18)
+
+### Subagent-Driven Development
+
+- **SDD scratch files moved out of `.git/`.** Claude Code treats `.git/` as a protected path and denies agent writes there, so an implementer subagent writing its report into `.git/sdd/` got blocked mid-run. Task briefs, implementer reports, review diffs, and the progress ledger now live in a self-ignoring `.superpowers/sdd/` directory in the working tree — kept out of `git status` and out of commits, and resolved per worktree by a shared `sdd-workspace` helper. One caveat: because the workspace is git-ignored working-tree scratch, `git clean -fdx` will delete the progress ledger; recover from `git log` if that happens. (#1780)
+
 ## v6.0.2 (2026-06-16)

 ### Install Fixes
--- a/gemini-extension.json
+++ b/gemini-extension.json
@@ -1,6 +1,6 @@
 {
  "name": "superpowers",
  "description": "Core skills library: TDD, debugging, collaboration patterns, and proven techniques",
-  "version": "6.0.2",
+  "version": "6.0.3",
  "contextFileName": "GEMINI.md"
 }
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
  "name": "superpowers",
-  "version": "6.0.2",
+  "version": "6.0.3",
  "description": "Superpowers skills and runtime bootstrap for coding agents",
  "type": "module",
  "main": ".opencode/plugins/superpowers.js",
--- a/skills/subagent-driven-development/SKILL.md
+++ b/skills/subagent-driven-development/SKILL.md
@@ -260,6 +260,8 @@ a ledger file, not only in todos.
 - The ledger is your recovery map: the commits it names exist in git even
  when your context no longer remembers creating them. After compaction,
  trust the ledger and `git log` over your own recollection.
+- `git clean -fdx` will destroy the ledger (it's git-ignored scratch); if
+  that happens, recover from `git log`.

 ## Prompt Templates

--- a/tests/brainstorm-server/package-lock.json
+++ b/tests/brainstorm-server/package-lock.json
@@ -8,13 +8,13 @@
      "name": "brainstorm-server-tests",
      "version": "1.0.0",
      "dependencies": {
-        "ws": "^8.19.0"
+        "ws": "^8.21.0"
      }
    },
    "node_modules/ws": {
-      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
+      "version": "8.21.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
      "license": "MIT",
      "engines": {
        "node": ">=10.0.0"
--- a/tests/brainstorm-server/package.json
+++ b/tests/brainstorm-server/package.json
@@ -5,6 +5,6 @@
    "test": "node ws-protocol.test.js && node helper.test.js && node browser-launcher.test.js && node auth.test.js && node branding.test.js && node server.test.js && node lifecycle.test.js && bash start-server.test.sh && bash stop-server.test.sh"
  },
  "dependencies": {
-    "ws": "^8.19.0"
+    "ws": "^8.21.0"
  }
 }
--- a/tests/claude-code/run-skill-tests.sh
+++ b/tests/claude-code/run-skill-tests.sh
@@ -74,6 +74,7 @@ done
 # List of skill tests to run (fast unit tests)
 tests=(
    "test-worktree-path-policy.sh"
+    "test-sdd-workspace.sh"
    "test-subagent-driven-development.sh"
 )
Author	SHA1	Message	Date
Jesse Vincent	896224c4b1	Release v6.0.3: SDD artifacts move out of the .git/ protected path Bump all plugin manifests to 6.0.3. This release moves subagent-driven- development's scratch artifacts (task briefs, implementer reports, review diffs, progress ledger) from .git/sdd/ — which Claude Code denies agent writes to — into a self-ignoring working-tree .superpowers/sdd/ dir, and bumps the brainstorm-server test harness's ws dependency to clear two dependabot alerts. See RELEASE-NOTES.md.	2026-06-18 15:44:22 -07:00
Jesse Vincent	549dee6f64	test(deps): bump ws to ^8.21.0 in brainstorm-server tests Clears two dependabot alerts on the test harness's ws dependency: GHSA-96hv-2xvq-fx4p (high, memory-exhaustion DoS, fixed 8.21.0) and GHSA-58qx-3vcg-4xpx (medium, uninitialized memory disclosure, fixed 8.20.1). Test-only — the shipped brainstorm server hand-rolls its WebSocket framing and does not depend on ws. Suite passes (57/57).	2026-06-18 15:44:22 -07:00
Jesse Vincent	4f9bd3131e	docs: add v6.0.3 release notes for the SDD .git/ workspace fix	2026-06-18 15:44:22 -07:00
Jesse Vincent	caf14aac66	test(sdd): wire test-sdd-workspace.sh into the runner; note git clean -fdx The per-worktree workspace test was added but never registered in run-skill-tests.sh, so it only ran when invoked by hand. Add it to the fast unit-test array alongside the other pure-shell test. Also document, in the Durable Progress section, that the ledger now lives in git-ignored working-tree scratch, so `git clean -fdx` deletes it — recover from `git log` if that happens.	2026-06-18 15:44:22 -07:00
Jesse Vincent	667b2c4a2e	test(sdd): lock in per-worktree workspace isolation (#1780 )	2026-06-18 15:44:22 -07:00
Jesse Vincent	93b8444b51	fix(sdd): write artifacts to working-tree .superpowers/sdd, not .git/ (#1780 )	2026-06-18 15:44:22 -07:00
Jesse Vincent	207a12b203	feat(sdd): add sdd-workspace helper for a self-ignoring artifact dir	2026-06-18 15:44:22 -07:00