test(sdd): lock in per-worktree workspace isolation (#1780)

RELEASE-NOTES.md

@@ -1,11 +1,5 @@
 # Superpowers Release Notes
 
-## v6.0.3 (2026-06-18)
-
-### Subagent-Driven Development
-
-- **SDD scratch files moved out of `.git/`.** Claude Code treats `.git/` as a protected path and denies agent writes there, so an implementer subagent writing its report into `.git/sdd/` got blocked mid-run. Task briefs, implementer reports, review diffs, and the progress ledger now live in a self-ignoring `.superpowers/sdd/` directory in the working tree — kept out of `git status` and out of commits, and resolved per worktree by a shared `sdd-workspace` helper. One caveat: because the workspace is git-ignored working-tree scratch, `git clean -fdx` will delete the progress ledger; recover from `git log` if that happens. (#1780)
-
 ## v6.0.2 (2026-06-16)
 
 ### Install Fixes

skills/subagent-driven-development/SKILL.md

@@ -260,8 +260,6 @@ a ledger file, not only in todos.
 - The ledger is your recovery map: the commits it names exist in git even
   when your context no longer remembers creating them. After compaction,
   trust the ledger and `git log` over your own recollection.
-- `git clean -fdx` will destroy the ledger (it's git-ignored scratch); if
-  that happens, recover from `git log`.
 
 ## Prompt Templates
 

skills/writing-skills/render-graphs.js

@@ -15,7 +15,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execFileSync } = require('child_process');
+const { execSync } = require('child_process');
 
 function extractDotBlocks(markdown) {
   const blocks = [];
@@ -69,7 +69,7 @@ ${bodies.join('\n\n')}
 
 function renderToSvg(dotContent) {
   try {
-    return execFileSync('dot', ['-Tsvg'], {
+    return execSync('dot -Tsvg', {
       input: dotContent,
       encoding: 'utf-8',
       maxBuffer: 10 * 1024 * 1024
@@ -107,10 +107,9 @@ function main() {
     process.exit(1);
   }
 
-  // Check if dot is available. Run the binary directly rather than probing
+  // Check if dot is available
-  // with `which`, which is not a command on Windows.
   try {
-    execFileSync('dot', ['-V'], { stdio: 'ignore' });
+    execSync('which dot', { encoding: 'utf-8' });
   } catch {
     console.error('Error: graphviz (dot) not found. Install with:');
     console.error('  brew install graphviz    # macOS');

tests/brainstorm-server/package-lock.json

@@ -8,13 +8,13 @@
       "name": "brainstorm-server-tests",
       "version": "1.0.0",
       "dependencies": {
-        "ws": "^8.21.0"
+        "ws": "^8.19.0"
       }
     },
     "node_modules/ws": {
-      "version": "8.21.0",
+      "version": "8.19.0",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-8.21.0.tgz",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.19.0.tgz",
-      "integrity": "sha512-Vsp28b7DRcimFQvrqu2Wek3z1iYxDCWqHYB8Qsnk/S4RfaCQzPGPyBNuVjJV3cd6UiKtUtp6sNM77gWvzcCH+g==",
+      "integrity": "sha512-blAT2mjOEIi0ZzruJfIhb3nps74PRWTCz1IjglWEEpQl5XS/UNama6u2/rjFkDDouqr4L67ry+1aGIALViWjDg==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

tests/brainstorm-server/package.json

@@ -5,6 +5,6 @@
     "test": "node ws-protocol.test.js && node helper.test.js && node browser-launcher.test.js && node auth.test.js && node branding.test.js && node server.test.js && node lifecycle.test.js && bash start-server.test.sh && bash stop-server.test.sh"
   },
   "dependencies": {
-    "ws": "^8.21.0"
+    "ws": "^8.19.0"
   }
 }

tests/claude-code/run-skill-tests.sh

@@ -74,7 +74,6 @@ done
 # List of skill tests to run (fast unit tests)
 tests=(
     "test-worktree-path-policy.sh"
-    "test-sdd-workspace.sh"
     "test-subagent-driven-development.sh"
 )