feat: oat-brainstorm visual companion — Superpowers v6 security & resilience parity - #125
Open
tkstang wants to merge 23 commits into
Open
feat: oat-brainstorm visual companion — Superpowers v6 security & resilience parity#125tkstang wants to merge 23 commits into
tkstang wants to merge 23 commits into
Conversation
tkstang
added a commit
that referenced
this pull request
Jul 3, 2026
…anion-v6 Capture Superpowers v6.0.3 visual companion parity scope and a 9-task sequential implementation plan for the oat-brainstorm bundled server. Co-authored-by: Cursor <cursoragent@cursor.com>
… restart key-reuse check
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
feat: oat-brainstorm visual companion — Superpowers v6 security & resilience parity
Summary
Brings OAT's
oat-brainstormvisual companion bundle to Superpowers v6.0.3 security, resilience, and lifecycle parity while preserving OAT's persistence paths (.oat/brainstorm/), neutral branding, and conditional-offer skill semantics. The local web companion gains session-key auth on HTTP + WebSocket, a sandboxed/files/server (traversal / dotfile / symlink rejection) with security headers, a resilient reconnecting client, restart-safe port/token reuse, a configurable idle timeout, and an instance-verified stop path. Quick-mode project: 4 phases, 9 tasks, all reviewed (final review passed, 0 Critical / 0 Important).Goals / Non-Goals
Goals (from
discovery.md):.oat/brainstorm/paths, Activation Contract, pack-aware conditional offer, neutral branding.Non-Goals: Superpowers SDD / writing-plans / subagent-driven-development / harness bootstraps; replacing OAT's destination model; live dogfooding (tracked separately as
bl-7d5b).Changes
.agents/skills/oat-brainstorm/scripts/):server.cjs(session-key auth on HTTP+WS,/files/sandbox, security headers, WS max-frame guard,BRAINSTORM_PORT_FILE,BRAINSTORM_IDLE_TIMEOUT_MS,--open);helper.js+frame-template.html(backoff reconnect, status pill, paused/tombstone overlay, keyed reload, "OAT Brainstorm" rebrand);start-server.sh(three-tier OAT persistence,--idle-timeout-minutes→ms,umask 077,server-instance-id);stop-server.sh(instance-ID guard,server-stoppedmarker).references/visual-companion.md+SKILL.mdstep 3 document keyed URL,--open, restart reuse, and 4h idle; SKILL.mdversion1.1.0 → 1.2.0. Activation Contract untouched./files/traversal + dotfile + symlink 4xx, restart port+key reuse, stop-server stale-instance guard);NOTICES.md→ v6.0.3 adapted-port provenance; lockstep bump of all 5 public packages to 0.1.34; provider-view sync (no drift);pnpm release:validatepasses.tool-packs.mdalready defers to the updated reference doc).Deliberate deviation: OAT's
.indicator-barselection-summary UI was retained alongside the new v6 status pill (upstream v6 removed it; the plan only asked to add v6 resilience + rebrand). Details inimplementation.md→ Deviations.Verification
packages/cli/src/integration/visual-companion-smoke.test.ts). The/files/traversal, dotfile, and symlink assertions were RED/GREEN-proven load-bearing during review (they fail when the server guard is removed).pnpm release:validatepasses (5 public packages @ 0.1.34).pnpm oat:validate-skills,pnpm type-check,pnpm lint.Reviews
All reviews ran via fresh-context subagents (Tier 1, ceiling sonnet). From
plan.md## Reviews:Reduced-assurance note
Quick-mode project — no
spec.md/design.md. Requirements are captured indiscovery.md(Success Criteria SC#1–SC#7), which the final review verified as fully implemented.References