Superpowers 7.0 stops a cloned repo from running its own bash at session start on Windows

Superpowers 7.0, released on October 10, closes a Windows hole. A repository could put a file called bash.cmd or where.bat at its root, and the Superpowers hook ran it the moment a session started.

That hook runs on every startup, clear and compact. It injects the using-superpowers skill, which tells the agent to reach for its other skills. When the hook fails, the skills stay installed, but the agent never hears about them.

On Windows, the hook only looked for Git in Program Files. A per-user Git install fell through to the WSL launcher, which fails without a Linux distro and injects nothing. Now it checks the per-user folder and skips those launchers.

The Windows wrapper also hid failures. A hook that exited with an error code still reported success to the harness. Now the real exit code comes through, so a broken session start shows up as broken.

Claude Code can start this hook with a broken PATH. The hook then couldn't find dirname or cat, and the skills never loaded. It now uses bash builtins, so it needs nothing from PATH.

Superpowers ships this hook for Claude Code and Cursor, and the Windows fixes were tested on Windows 11 with Git Bash. One limit stays: with no bash installed, the hook still exits quietly, without loading the skills.