Skip to content

[infra] Re-evaluate superpowers: defeat the auto-injection durably, or stop using it #126

Description

@twistedmelonman

Decision needed

superpowers injects the full using-superpowers SKILL.md into every
session via a SessionStart hook (matcher: startup|clear|compact). That is
a fixed per-session context cost, paid whether or not any superpowers skill
gets used.

This has now been "fixed" twice and come back once. It needs a decision that
survives the next update, not a third patch.

History

When What
2026-01-16 Token-exhaustion research traces hard-stop failures to invisible subagent context cost (docs/research/superpowers-token-consumption/)
2026-07-31 Fork smartwatermelon/superpowers@18821ef deletes hooks/ entirely; marketplace copy repointed at the fork
2026-08-19 Plugin cache updates to upstream v6.3.0 — injection silently returns, fork's fix no longer in effect
2026-09-11 Forks archived; hooks/ deleted directly from the v6.3.0 plugin cache

The 2026-08-19 regression is the important part: the fix was undone by a
routine update and nobody noticed for three weeks. The current fix has exactly
the same exposure.

Why the current fix is fragile

The removal edits ~/.claude/plugins/cache/superpowers-marketplace/superpowers/6.3.0/hooks.

  • A superpowers update or reinstall restores it.
  • The marketplace manifest points at obra/superpowers.git and is refreshed
    on marketplace update, so there is no durable pin there either.
  • Nothing detects the regression — it reappears silently, as it already did
    once.

The two options

A. Keep superpowers, build something that survives updates.

The 14 skills are genuinely useful and are listed on-demand; only the forced
injection is unwanted. Needs a mechanism that reasserts the removal after any
update — a post-update hook, a periodic check, or an upstream change making
the injection opt-in. Cost: building and maintaining that mechanism.

B. Stop using superpowers.

Removes the problem at the root. Cost: lose all 14 skills, several of which
are in active use, plus anything in this environment that assumes them.

What would settle it

Measure the actual per-session cost of the injection (SKILL.md size against a
typical session), and check whether upstream would accept making the hook
opt-in — if so, option A gets much cheaper and stops being a local patch.

Not in scope

Whether the skills themselves are worth their context. This issue is about the
forced injection only.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions