sync superpowers v6.0.3 from upstream main @ 896224c4

[arittr]

Automated sync of the superpowers plugin from upstream main @ 896224c4 (v6.0.3), produced by scripts/sync-to-codex-plugin.sh.

This advances the embedded plugin from 5.1.3 (current main) to 6.0.3, so the diff spans a major version bump. It supersedes #336 (the v6.0.1 sync) and #332 (the v6.0.0 sync, now closed); 6.0.2 and 6.0.3 add two more fixes on top of that work.

What changed (5.1.3 → 6.0.3)

SDD scratch files moved out of .git/ (6.0.3)

• Claude Code treats .git/ as a protected path and denies agent writes there, so an implementer subagent writing its report into .git/sdd/ got blocked mid-run. Task briefs, implementer reports, review diffs, and the progress ledger now live in a self-ignoring .superpowers/sdd/ directory in the working tree — kept out of git status and out of commits, and resolved per worktree by a new shared sdd-workspace helper. Caveat: because the workspace is git-ignored working-tree scratch, git clean -fdx will delete the progress ledger; recover from git log if that happens. (#1780)

Install fix (6.0.2)

• The evals submodule is no longer shipped — it broke plugin installs for some users, so the eval harness now lives in its own repo, separate from the published plugin. (#1778, #1774)

Codex fixes (6.0.1)

• The brainstorm visual companion no longer reports its version as "unknown" in packaged Codex plugins — readSuperpowersVersion() now falls back to .codex-plugin/plugin.json when no root package.json is present.
• The sync excludes .gitmodules and .pre-commit-config.yaml, keeping repo metadata out of the packaged plugin.

Subagent-driven development rewrite (6.0.0)

• The two per-task reviewer prompts (spec-reviewer-prompt.md, code-quality-reviewer-prompt.md) are replaced by a single task-reviewer-prompt.md that returns both a spec-compliance and a quality verdict in one pass.
• Task text and review diffs now move as files via two new scripts, task-brief and review-package, instead of being pasted into the most expensive context.
• Every dispatch must name a model; controllers can no longer tell a reviewer what to ignore or pre-rate severity; reviewers are read-only.

Writing plans (6.0.0) — plans now carry a Global Constraints block and per-task Interfaces block, plus right-sizing guidance.

Brainstorming visual companion (6.0.0) — a real security model: a per-session key guards every request and WebSocket, the file server refuses symlinks/dotfiles/path-escape, and it survives restarts and dropped connections.

One set of skills, every harness (6.0.0) — skill prose was rewritten to be vendor-neutral ("dispatch a subagent" rather than "use the Task tool"), backed by a per-harness tool reference under skills/using-superpowers/references/ (Claude Code, Codex, Copilot, Gemini, Pi, Antigravity).

Codex-relevant harness updates (6.0.0) — Codex now bootstraps through its own SessionStart hook (hooks/session-start-codex) rather than shared wiring; the Codex manifest is updated accordingly.

Full release notes: https://github.com/obra/superpowers/blob/896224c4b1879920ab573417e68fd51d2ccc9072/RELEASE-NOTES.md

Scope of the sync

• Synced from upstream: the committed Codex manifest (.codex-plugin/plugin.json), assets/, hooks/, and the skills + bundled skill support files.
• Preserved from this repo: OpenAI-owned marketplace metadata under skills/**/agents/openai.yaml.
• Excluded (source-repo-only, not shipped in the packaged plugin): .github/, docs/, evals/, lib/, scripts/, tests/, root ceremony files (AGENTS.md, CLAUDE.md, GEMINI.md, RELEASE-NOTES.md, package.json, …), .gitmodules, .pre-commit-config.yaml, and other dev-only paths.

Verification

Checked against the actual PR head (4e543a5), which is the result of running the sync at upstream 896224c4:

• Committed Codex manifest reports version: 6.0.3.
• The Codex session-start hook (hooks/session-start-codex) injects the superpowers:using-superpowers bootstrap into session context.
• The reviewer-prompt consolidation and the task-brief / review-package scripts are present, plus the new 6.0.3 sdd-workspace helper.
• OpenAI marketplace metadata (skills/**/agents/openai.yaml) is preserved.

The sync is deterministic: re-running it against the same upstream SHA produces an identical diff.

Tooling

Generated by the sync-to-codex-plugin.sh script in the superpowers repo and reviewed by a human before submission. The PR body was drafted with Claude Code (Opus 4.8).

[howiehu]

@arittr Given that the Codex merge process is so long, is there a way to bypass the official marketplace and install plugins directly into Codex?