Skip to content

fix: session-scope the SDD workspace so concurrent sessions on one checkout stop colliding#1952

Open
mvanhorn wants to merge 11 commits into
obra:mainfrom
mvanhorn:fix/1942-fix-sdd-workspace-session-collision
Open

fix: session-scope the SDD workspace so concurrent sessions on one checkout stop colliding#1952
mvanhorn wants to merge 11 commits into
obra:mainfrom
mvanhorn:fix/1942-fix-sdd-workspace-session-collision

Conversation

@mvanhorn

@mvanhorn mvanhorn commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Summary

Session-scope the SDD workspace so concurrent sessions on one checkout stop colliding.

Why this matters

The v6.1.0 change (#1780) that moved SDD scratch out of .git/ introduced a cross-session data race. The sdd-workspace helper resolves the artifact dir via git rev-parse --show-toplevel -> <working-tree-root>/.superpowers/sdd, and task-brief, review-package, and the progress.md ledger all write into it keyed only by task number (task-N-brief.md, progress.md). That directory is shared by every agent session running against the same checkout, so concurrent sessions silently overwrite each other's files: an implementer subagent can receive another plan's task text (the reporter saw task-3-brief.md holding a different plan's "Deploy the bridge" task) and a controller's `progr

Testing

Changes are scoped to the files named in the fix; added or updated tests where the project has a suite, and matched existing conventions.

AI was used for assistance.

Fixes #1942

arittr and others added 11 commits July 2, 2026 14:53
…s object

Codex auto-discovers a plugin's hooks/hooks.json whenever the Codex
manifest has no `hooks` field: load_plugin_hooks falls back to a
hardcoded DEFAULT_HOOKS_CONFIG_FILE = "hooks/hooks.json" and registers
it. hooks/hooks.json is the Claude Code SessionStart hook, it is tracked
in this repo, and the Codex marketplace installs the whole repo root
(source url "./"), so the fallback re-registered the SessionStart hook
and its install-time trust prompt on Codex.

Removing the Codex hook file and the manifest `hooks` pointer (commit
"Remove Codex hooks") did not disable the hook on Codex — it removed the
explicit declaration that was overriding the fallback, so the fallback
took over and found the Claude hooks/hooks.json.

Declare an empty inline hooks object ({}) in .codex-plugin/plugin.json.
It parses as an empty inline hook set and stops Codex reaching the
auto-discovery fallback. An absent field, an empty array ([]), and an
empty inline list all collapse back to the fallback, so the value must
be exactly {}.

Update the test to assert the manifest declares hooks: {} (and that
hooks/hooks.json exists, which is what makes the declaration necessary),
replacing the prior assertion that the field was absent — which passed
while the hook was still being auto-discovered.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
… docs

hooks/session-start-codex has had no caller since "Remove Codex hooks"
(obra#1845) deleted hooks-codex.json and its manifest registration; the
Codex manifest now declares an empty hooks object so Codex registers no
session-start hook at all. The script is Codex-specific dead code —
nothing executes it on Codex or any other harness.

- Delete hooks/session-start-codex.
- tests/hooks/test-session-start.sh: drop the two Codex cases that are
  redundant with the generic session-start tests (nested-format and the
  legacy-warning omission are already covered by the Claude Code cases).
  Re-point the "wrapper dispatches" case to the live `session-start`
  script so run-hook.cmd dispatch coverage — used by Claude Code and
  Cursor in production — is preserved rather than lost.
- docs/porting-to-a-new-harness.md: Codex is no longer a Shape A
  (shell-hook) harness, so re-anchor that worked example to Cursor (a
  live shell-hook harness that demonstrates the same per-harness field,
  schema, and matcher variance) and mark Codex as native skill discovery
  with no session-start hook. Clears the references to the deleted
  hooks-codex.json.
- docs/windows/polyglot-hooks.md: the "check hooks-codex.json" pointer
  referenced a file deleted in obra#1845; re-point to hooks-cursor.json.

RELEASE-NOTES.md keeps its historical mention of hooks-codex.json (it
accurately records what that release did). The tests/codex-plugin-sync
fixtures build their own synthetic session-start-codex and test the sync
mechanism generically, so they are intentionally left as-is.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SDD workspace (.superpowers/sdd) collides across concurrent sessions sharing a checkout — regression from #1780 (6.1.0)

3 participants