@anht3889/dsh-superpowers

DeepSeek Harness profile plugin that mounts obra Superpowers skills and injects using-superpowers methodology guidance at session start.

What it does

On profile load, this plugin:

1. Mounts skills — resolves the installed Superpowers skills/ directory and registers an isolated dsh-skill-filesystem provider (providerName: superpowers) so the agent can load skills with the skill tool.
2. Injects bootstrap — on agent/session-start, injects the stripped body of using-superpowers/SKILL.md plus a short DeepSeek Harness note about using the skill tool (not Claude Code–only hooks).

Skill bodies are not vendored in this repo; they come from the npm dependency described below.

Install

npx @deepseek-ai/dsh plugin --profile web add @anht3889/dsh-superpowers
npx @deepseek-ai/dsh plugin --profile headless add @anht3889/dsh-superpowers

Superpowers dependency

At install time, npm resolves obra Superpowers from git, pinned to the immutable commit behind the v6.3.0 tag (a moving tag would let upstream silently change what a fixed @anht3889/dsh-superpowers version installs):

"superpowers": "github:obra/superpowers#86babb696875227929e85420f287d6309374b93f"

This installs into node_modules/superpowers. The unrelated registry package superpowers@0.0.2 is never used.

To pick up a newer Superpowers release, bump the pinned commit in this package's package.json and publish a new version of @anht3889/dsh-superpowers — consumers upgrade the plugin, not Superpowers directly.

Two install-time prerequisites: profile installs need reachable codeload.github.com (a registry-only mirror or air-gapped host will fail), and the dependency unpacks ~2.1 MB, of which only the skills/ tree is used.

Local development

Build this package, then add it to a profile with a local path:

pnpm install
pnpm run build
dsh plugin --profile <name> add /path/to/dsh-superpowers

Configuration

In your profile's cordis config (or patch overlay), optional plugin config:

- name: '@anht3889/dsh-superpowers'
  config:
    injectBootstrap: false   # default: true

When injectBootstrap is false, skills still mount but the session-start bootstrap inject is skipped.

Known limitations

Session-start race: bootstrap registers on agent/session-start and injects when a session begins. If the first model request is already in flight when that listener runs, the inject may miss that request (same class of limitation as other session-start hooks). Skills remain available via the skill tool regardless.

Do not mount twice

Install this plugin once per profile. Do not also copy Superpowers skills into ~/.dsh/skills or mount a second skill-filesystem provider for the same content — that duplicates skill names and confuses the catalog.

Publish to npm

CI runs on every push/PR to main. Publishing is manual:

1. Bump "version" in package.json and commit.
2. Add a repository secret NPM_TOKEN (npm automation or publish token with access to @anht3889).
3. Run Actions → Publish npm → Run workflow, or create a GitHub Release.

Use the workflow's dry_run input to pack without uploading. Versions already on the registry are skipped. Pre-release versions (x.y.z-…) publish under the next tag; otherwise latest.