@anht3889/dsh-superpowers

DeepSeek Harness profile plugin that mounts obra Superpowers skills and injects using-superpowers methodology guidance at session start.

What it does

On profile load, this plugin:

1. Mounts skills — resolves the installed Superpowers skills/ directory and registers an isolated dsh-skill-filesystem provider (providerName: superpowers) so the agent can load skills with the skill tool. 2. Registers bootstrap — contributes a durable superpowers:bootstrap system-prompt section from using-superpowers/SKILL.md plus a short DeepSeek Harness note about using the skill tool (not Claude Code–only hooks). The section is present on the first model request.

No skill files are committed to this repository; they are copied from upstream when the npm tarball is built, as described below.

Install

npx @deepseek-ai/dsh plugin --profile web add @anht3889/dsh-superpowers
npx @deepseek-ai/dsh plugin --profile headless add @anht3889/dsh-superpowers

Where the skills come from

Superpowers is a devDependency here, pinned to the immutable commit behind the v6.3.0 tag (a moving tag would let upstream silently change what a fixed @anht3889/dsh-superpowers version ships):

"superpowers": "github:obra/superpowers#86babb696875227929e85420f287d6309374b93f"

The prepack step (scripts/vendor-skills.mjs) copies that checkout's skills/ tree and its MIT LICENSE into vendor/superpowers/, which ships inside the published tarball (~140 kB packed). At runtime the plugin resolves vendor/superpowers/skills first and falls back to an installed superpowers package, which is what local development uses.

This indirection exists because pnpm 11 enables blockExoticSubdeps by default: a git-resolved subdependency fails the install with ERR_PNPM_EXOTIC_SUBDEP, so a published plugin cannot depend on Superpowers by git URL. Shipping the skills in the tarball also means profile installs need only the npm registry — no codeload.github.com access.

To pick up a newer Superpowers release, bump the pinned commit in this package's package.json and publish a new version of @anht3889/dsh-superpowers — consumers upgrade the plugin, not Superpowers directly.

Local development

Build this package, then add it to a profile with a local path:

pnpm install
pnpm run build
pnpm run vendor:skills   # optional; without it the plugin reads node_modules/superpowers
dsh plugin --profile <name> add /path/to/dsh-superpowers

Configuration

In your profile's cordis config (or patch overlay), optional plugin config:

- name: '@anht3889/dsh-superpowers'
  config:
    injectBootstrap: false   # default: true

When injectBootstrap is false, skills still mount but the bootstrap prompt section is skipped.

Do not mount twice

Install this plugin once per profile. Do not also copy Superpowers skills into ~/.dsh/skills or mount a second skill-filesystem provider for the same content — that duplicates skill names and confuses the catalog.