Meteor-system/superpowers-for-dsh

A portable DeepSeek Harness (DSH) adaptation of obra/superpowers: 14 engineering skills, an automatic session bootstrap, DSH-native tool mappings, and Windows sandbox compatibility for same-mode escalation fields.

This is an independent DSH bundle. Its installable host provider follows the useful packaging pattern demonstrated by LayneChai/superpowers-dsh; the preset, bootstrap, and sandbox compatibility layer here are maintained independently.

What is included

• Vendored obra/superpowers v6.3.0 (commit b36e082), with the upstream workflow bodies preserved and a targeted DSH platform-reference link added to using-superpowers.
• A host-layer Cordis skill provider that discovers and loads the packaged skills on demand.
• A copyable SuperPowers for DSH agent preset.
• Automatic using-superpowers bootstrap for fresh sessions.
• Native DSH plan mode, goals, subagents, workflows, ralph, todo, and job tools.
• A sandbox compatibility wrapper for pwsh and filesystem tools when the effective mode is already danger-full-access.

Installation

1. Install the bundle

npx @deepseek-ai/dsh plugin --profile web add github:Meteor-system/superpowers-for-dsh

Or install from a local clone:

git clone https://github.com/Meteor-system/superpowers-for-dsh.git
npx @deepseek-ai/dsh plugin --profile web add C:\path\to\superpowers-for-dsh

2. Install the preset template

From this repository, run:

node scripts/install-preset.mjs

The default destination is:

%USERPROFILE%\.dsh\.agent-presets\superpowers-dsh

The installer refuses to overwrite an existing preset. With --force, it first renames the old preset to a timestamped backup and restores it if installation fails.

3. Restart the profile and start a fresh session

The bundle mounts at profile startup. Restart the DSH profile, refresh the Web page, and select SuperPowers for DSH in a new conversation. Existing sessions retain their original preset generation and are not valid bootstrap tests.

Verify the bundle layer:

dsh --profile web --dump-config

The output should contain a superpowers-for-dsh row.

Skills

brainstorming, writing-plans, executing-plans, subagent-driven-development, dispatching-parallel-agents, systematic-debugging, test-driven-development, verification-before-completion, requesting-code-review, receiving-code-review, finishing-a-development-branch, using-git-worktrees, writing-skills, and using-superpowers.

Sandbox behavior

When the effective mode is already danger-full-access, ordinary pwsh, write, and edit calls should omit sandbox_permissions and justification. The preset wrapper hides those fields from the request schema and removes same-mode or incomplete legacy fields immediately before execution if an older model emits them anyway. Genuine wider requests in a lower mode remain under the normal DSH approval and policy flow.

An ordinary call looks like:

{
  "command": "Get-Location",
  "description": "Confirm the current project directory",
  "workdir": "D:\\Code\\project",
  "run_in_background": false
}

Optional UI/UX Pro Max Phase A

UI/UX Pro Max is exposed through the separate superpowers-dsh-uiux preset; the normal superpowers-dsh preset is unchanged. The Host service is lazy and starts only when an optional capability is first called. Python packages are never auto-installed, and external MCP support arrives in Phase B.

From the repository root:

node scripts/install-preset.mjs --variant uiux
python --version
node scripts/smoke-uiux-core.mjs

Upstream data is pinned to revision e4f45473691e4b389519ee4bc359a3d6df666c26. Search accepts query plus either domain or stack (mutually exclusive), optional max_results (integer 1–20), and diagnostics (boolean). Generation accepts query, optional project_name, format, variance, motion, density, persist, page, and force; page and force require persistence. Search and generation responses carry provenance, bounded source IDs, and the pinned revision. Persistence forbids model-supplied absolute output paths and remains below the trusted workspace. See docs/ui-ux-pro-max.md.

Verification

node scripts/verify.mjs
npm test
npm run verify:uiux

The verifier checks all 14 skill frontmatters, bundle metadata, portable preset paths, bootstrap lifecycle, JavaScript syntax, and the generic sandbox compatibility wrapper smoke test.

The adapter has been exercised in DSH: a fresh danger-full-access agent no longer receives the two escalation fields in its pwsh, write, or edit schemas, and deliberate legacy-field calls still complete without tool errors.

Architecture

• cordis.patch.yml inserts the bundle provider into the host composition.
• lib/index.js discovers SKILL.md bundles and registers a ctx.skills provider.
• preset/agent.cordis.yml is a complete agent-plane template with no machine-specific absolute paths.
• preset/superpowers-bootstrap.mjs registers a system-prompt section and never intercepts agent/pre-step.
• preset/superpowers-pwsh-compat.mjs filters every escalation-bearing tool schema for the effective session mode and cleans legacy same-mode fields.
• skills/using-superpowers/references/dsh-tools.md maps Claude Code concepts to native DSH tools.

Upstream and license

The skill content comes from obra/superpowers v6.3.0, commit b36e082, under its MIT license. See NOTICE.md and docs/upstream.md for attribution and the exact adaptation boundary.

Development

node scripts/verify.mjs
git diff --check

Review the complete diff before committing. In particular, skill files under skills/ should remain faithful to the upstream snapshot.