Superpowers 7.0 stops a cloned repo from running its own bash at session start on Windows
Superpowers 7.0, released on October 10, closes a Windows hole. A repository could put a file called bash.cmd or where.bat at its root, and the Superpowers hook ran it the moment a session started.
The session-start hook is what hands your agent its skills
That hook runs on every startup, clear and compact. It injects the using-superpowers skill, which tells the agent to reach for its other skills. When the hook fails, the skills stay installed, but the agent never hears about them.
Windows: a per-user Git install is now found
On Windows, the hook only looked for Git in Program Files. A per-user Git install fell through to the WSL launcher, which fails without a Linux distro and injects nothing. Now it checks the per-user folder and skips those launchers.
Windows: a failing hook now reports its failure
The Windows wrapper also hid failures. A hook that exited with an error code still reported success to the harness. Now the real exit code comes through, so a broken session start shows up as broken.
On any OS, the hook now survives a broken PATH at startup
Claude Code can start this hook with a broken PATH. The hook then couldn't find dirname or cat, and the skills never loaded. It now uses bash builtins, so it needs nothing from PATH.
Who gets the fix: Superpowers 7.0.0 users on Claude Code and Cursor
Superpowers ships this hook for Claude Code and Cursor, and the Windows fixes were tested on Windows 11 with Git Bash. One limit stays: with no bash installed, the hook still exits quietly, without loading the skills.
