A zero-dependency Node.js WebSocket server that provides a visual companion for brainstorming sessions. It serves HTML mockups via local HTTP, handles WebSocket events for real-time collaboration, and implements robust security: per-session secret keys passed as query params and HttpOnly SameSite=Strict cookies, cross-Origin WebSocket rejection, anti-framing headers, and symlink/hardlink escape protection via realpath resolution. Includes idle timeout and owner-PID watchdog. This component is fully self-contained, written in plain Node.js (no npm dependencies), and could be reused as a lightweight local web server for any agent tool that needs a browser-based companion interface.

A polyglot script that is valid as both Windows batch (.cmd) and Unix shell (.sh). It serves as the universal hook runner for session-start injection across all platforms. When executed on Windows, the batch interpreter quickly falls through to a heredoc trick that invokes bash (from Git Bash or MSYS2). When executed on Unix, the shell interpreter runs the bash code directly. This avoids maintaining separate hook files per platform and is a reusable design pattern for any project that needs a cross-platform execution hook. The script also handles graceful fallback if bash is not found on Windows. Minimal coupling to Superpowers internals (only references the session-start script).

A shell script that creates an isolated, plan-scoped workspace directory under .superpowers/sdd/<plan-basename>/. It sets up a self-ignoring .gitignore (containing just '*') so that all artifacts within the workspace are ignored by git by default, preventing accidental commits of agent-generated files. The script also handles detection of existing worktrees to avoid isolation when already in one. This pattern is reusable for any multi-plan agent workflow that needs clean separation of artifacts per task or plan, with minimal git discipline overhead. It is decoupled from the rest of Superpowers and can be copied to new projects with no changes.