# SuperPowers for DSH

A portable DeepSeek Harness (DSH) adaptation of obra/superpowers: 14 engineering skills, an automatic session bootstrap, DSH-native tool mappings, and Windows sandbox compatibility for same-mode escalation fields.

This is an independent DSH bundle. Its installable host provider follows the useful packaging pattern demonstrated by LayneChai/superpowers-dsh; the preset, bootstrap, and sandbox compatibility layer here are maintained independently.

## What is included

- Vendored obra/superpowers v6.3.0 (commit b36e082), with the upstream workflow bodies preserved and a targeted DSH platform-reference link added to `using-superpowers`.
- A host-layer Cordis skill provider that discovers and loads the packaged skills on demand.
- A copyable SuperPowers for DSH agent preset.
- Automatic using-superpowers bootstrap for fresh sessions.
- Native DSH plan mode, goals, subagents, workflows, ralph, todo, and job tools.
- A sandbox compatibility wrapper for pwsh and filesystem tools when the effective mode is already danger-full-access.

## Installation

### 1. Install the bundle

~~~powershell
npx @deepseek-ai/dsh plugin --profile web add github:Meteor-system/superpowers-for-dsh
~~~

Or install from a local clone:

~~~powershell
git clone https://github.com/Meteor-system/superpowers-for-dsh.git
npx @deepseek-ai/dsh plugin --profile web add C:\path\to\superpowers-for-dsh
~~~

### 2. Install the preset template

From this repository, run:

~~~powershell
node scripts/install-preset.mjs
~~~

The default destination is:

~~~text
%USERPROFILE%\.dsh\.agent-presets\superpowers-dsh
~~~

The installer refuses to overwrite an existing preset. With `--force`, it first renames the old preset to a timestamped backup and restores it if installation fails.

### 3. Restart the profile and start a fresh session

The bundle mounts at profile startup. Restart the DSH profile, refresh the Web page, and select SuperPowers for DSH in a new conversation. Existing sessions retain their original preset generation and are not valid bootstrap tests.

Verify the bundle layer:

~~~powershell
dsh --profile web --dump-config
~~~

The output should contain a superpowers-for-dsh row.

## Skills

brainstorming, writing-plans, executing-plans, subagent-driven-development, dispatching-parallel-agents, systematic-debugging, test-driven-development, verification-before-completion, requesting-code-review, receiving-code-review, finishing-a-development-branch, using-git-worktrees, writing-skills, and using-superpowers.

## Sandbox behavior

When the effective mode is already danger-full-access, ordinary pwsh, write, and edit calls should omit sandbox_permissions and justification. The preset wrapper hides those fields from the request schema and removes same-mode or incomplete legacy fields immediately before execution if an older model emits them anyway. Genuine wider requests in a lower mode remain under the normal DSH approval and policy flow.

An ordinary call looks like:

~~~json
{
  "command": "Get-Location",
  "description": "Confirm the current project directory",
  "workdir": "D:\\Code\\project",
  "run_in_background": false
}
~~~

## Optional UI/UX Pro Max Phase A

UI/UX Pro Max is exposed through the separate `superpowers-dsh-uiux` preset; the normal `superpowers-dsh` preset is unchanged. The Host service is lazy and starts only when an optional capability is first called. Python packages are never auto-installed, and external MCP support arrives in Phase B.

From the repository root:

~~~powershell
node scripts/install-preset.mjs --variant uiux
python --version
node scripts/smoke-uiux-core.mjs
~~~

Upstream data is pinned to revision `e4f45473691e4b389519ee4bc359a3d6df666c26`. Search accepts `query` plus either `domain` or `stack` (mutually exclusive), optional `max_results` (integer 1–20), and `diagnostics` (boolean). Generation accepts `query`, optional `project_name`, `format`, `variance`, `motion`, `density`, `persist`, `page`, and `force`; `page` and `force` require persistence. Search and generation responses carry provenance, bounded source IDs, and the pinned revision. Persistence forbids model-supplied absolute output paths and remains below the trusted workspace. See [docs/ui-ux-pro-max.md](docs/ui-ux-pro-max.md).

## Verification

~~~powershell
node scripts/verify.mjs
npm test
npm run verify:uiux
~~~

The verifier checks all 14 skill frontmatters, bundle metadata, portable preset paths, bootstrap lifecycle, JavaScript syntax, and the generic sandbox compatibility wrapper smoke test.

The adapter has been exercised in DSH: a fresh danger-full-access agent no longer receives the two escalation fields in its pwsh, write, or edit schemas, and deliberate legacy-field calls still complete without tool errors.

## Architecture

- cordis.patch.yml inserts the bundle provider into the host composition.
- lib/index.js discovers SKILL.md bundles and registers a ctx.skills provider.
- preset/agent.cordis.yml is a complete agent-plane template with no machine-specific absolute paths.
- preset/superpowers-bootstrap.mjs registers a system-prompt section and never intercepts agent/pre-step.
- preset/superpowers-pwsh-compat.mjs filters every escalation-bearing tool schema for the effective session mode and cleans legacy same-mode fields.
- skills/using-superpowers/references/dsh-tools.md maps Claude Code concepts to native DSH tools.

## Upstream and license

The skill content comes from obra/superpowers v6.3.0, commit b36e082, under its MIT license. See NOTICE.md and docs/upstream.md for attribution and the exact adaptation boundary.

## Development

~~~powershell
node scripts/verify.mjs
git diff --check
~~~

Review the complete diff before committing. In particular, skill files under skills/ should remain faithful to the upstream snapshot.