feat(project-bootstrap): recommend superpowers plugin if missing

CLAUDE.md template adds `use superpowers` as a trigger, but that line
is silently dead until the official plugin is installed. New Step 5.6
reads ~/.claude/plugins/installed_plugins.json and, when the
`superpowers@claude-plugins-official` key is absent, prints a chat-only
recommendation with the install command and the upstream link
(github.com/anthropics/claude-plugins-official).

Strict no-auto-install: slash commands aren't callable from a skill,
and silent plugin install would be overreach.

Bumps project-bootstrap 1.0.0 → 1.1.0. Rebuilt dist archive.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.tasks/STATUS.md

@@ -14,6 +14,14 @@ _Updated: 2026-04-28_
     🔵 Blocked    — waiting on external input
 -->
 
+## 🟢 [bootstrap-recommend-superpowers] — project-bootstrap recommends superpowers plugin if missing
+**Status:** done
+**Where I stopped:** Step 5.6 added to `skills/project-bootstrap/SKILL.md` (read `~/.claude/plugins/installed_plugins.json`, print install command + upstream link if `superpowers@claude-plugins-official` key missing); version bumped 1.0.0 → 1.1.0; README workflow numbering updated; skill reinstalled to `~/.claude/skills/project-bootstrap/` and `dist/project-bootstrap.skill` rebuilt; log entry added
+**Next action:** (none — kept until merged)
+**Branch:** master
+
+---
+
 ## 🟢 [mac-support-scripts] — fix install.sh / build.sh for stock macOS
 **Status:** done
 **Where I stopped:** patched both scripts to drop `mapfile` (bash 4+) and `find -printf` (GNU find) — replaced with portable shell glob + `basename` + `sort`; verified on git-bash (16 skills discovered, install dry-run + build smoke-test passed); wiki concept page `install-portability.md` added; index + log updated

.tasks/bootstrap-recommend-superpowers.md

@@ -0,0 +1,34 @@
+# bootstrap-recommend-superpowers
+
+## Goal
+`project-bootstrap` writes `use superpowers` into the new project's `CLAUDE.md` (Step 5 template), but that trigger only fires if the `superpowers@claude-plugins-official` plugin is installed. On a fresh machine the plugin is often absent, so the trigger silently no-ops. Add a Step 5.6 that detects the plugin via `~/.claude/plugins/installed_plugins.json` and, when missing, prints a recommendation with the exact install command + upstream link. Strictly informational — never auto-installs.
+
+## Key files
+- `skills/project-bootstrap/SKILL.md` — add Step 5.6 between 5.5 (manifest) and 6 (commit); bump frontmatter `version: 1.0.0 → 1.1.0`
+- `skills/project-bootstrap/README.md` — extend the steps overview to mention the new check
+- `~/.claude/plugins/installed_plugins.json` — detection source
+
+## Decisions log
+- 2026-04-28: Place check at Step 5.6 (right after manifest, before commit). Reason: CLAUDE.md just got `use superpowers`, so the recommendation lands while context is fresh. Alternative — fold into Step 0 detect — rejected: Step 0 is meant to be quick + read-only summary; threading plugin checks there bloats the no-op happy path.
+- 2026-04-28: Detection by file read, not by `/plugin list`. Reason: slash commands aren't callable from inside a skill; the JSON file is the source of truth Claude Code itself reads. Same approach as `setup-context7` Phase 1.
+- 2026-04-28: Recommendation, not auto-install. Reason: `/plugin install` is interactive and per `setup-context7` we can't drive slash commands from a skill. Even if we could, auto-installing a plugin without consent is overreach.
+- 2026-04-28: Limit scope to `superpowers` only. User explicitly asked for that one. Generic "recommended plugins" framework is feature creep — defer until there's a second item.
+
+## Open questions
+- [ ] None — done.
+
+## Completed steps
+- [x] Confirm plugin install path / JSON shape from local `installed_plugins.json`
+- [x] Pick insertion point (Step 5.6)
+- [x] Pick detection method (file read of `installed_plugins.json`)
+- [x] Patch `SKILL.md` (Step 5.6 + frontmatter `version: 1.1.0`)
+- [x] Update `README.md` workflow numbering
+- [x] Reinstall to `~/.claude/skills/project-bootstrap/`
+- [x] Rebuild `dist/project-bootstrap.skill`
+- [x] Append wiki log entry
+- [x] Commit
+
+## Notes
+- Plugin install command (canonical, from `installed_plugins.json` key): `/plugin install superpowers@claude-plugins-official`
+- Upstream: https://github.com/anthropics/claude-plugins-official
+- Cross-platform path: `~/.claude/plugins/installed_plugins.json` resolves identically on Windows / Linux / macOS.

.wiki/log.md

@@ -28,3 +28,4 @@ Parseable: `grep "^## \[" .wiki/log.md | tail -20`.
 ## [2026-04-28] refactor | this repo's `.tasks/` migrated to canonical layout — flat `## Done`/`## Backlog` replaced by emoji-status board (7 ⚪ Ready blocks); historical Done entries dropped (preserved in git log); `.bak` ignored via .gitignore
 ## [2026-04-28] cleanup | removed stale `~/.claude/skills/{wiki-maintainer,task-status-wiki}/` installs (replaced by `using-wiki`/`using-tasks`); 16 skills installed, no duplicates; context7 plugin (mcp__plugin_context7_context7__*) confirmed live after restart
 ## [2026-04-28] decision | install-portability — `install.sh`/`build.sh` patched to drop `mapfile`+`find -printf`; stock macOS (bash 3.2 + BSD find) now works; verified on git-bash (16 skills discovered, sorted, installed; build.sh produces archive)
+## [2026-04-28] decision | project-bootstrap@1.1.0 — added Step 5.6: detects `superpowers@claude-plugins-official` via `~/.claude/plugins/installed_plugins.json` and prints install command + upstream link if missing; chat-only, never auto-installs (slash commands aren't callable from a skill, and silent plugin install is overreach)

skills/project-bootstrap/README.md

@@ -58,10 +58,14 @@ projects bootstrapped at different times debuggable.
    `.tasks/`, `CLAUDE.md`. Steps 3 and 4 delegate to the setup-skills.
 4. **Step 5.5.** Write `bootstrap-manifest.md` recording the versions of
    `project-bootstrap`, `setup-wiki`, and `setup-tasks` used.
-5. **Commit.** `chore: bootstrap project structure` for fresh repos, or
+5. **Step 5.6.** Detect the official `superpowers@claude-plugins-official`
+   plugin via `~/.claude/plugins/installed_plugins.json`. If absent, print
+   a one-time chat recommendation with the install command and upstream
+   link. Never auto-installs, never modifies project files.
+6. **Commit.** `chore: bootstrap project structure` for fresh repos, or
    `chore: upgrade project structure` adding only the new files for existing
    ones. Pushes only on explicit user request.
-6. **Summary.** Final report — what was created, what was skipped, suggested
+7. **Summary.** Final report — what was created, what was skipped, suggested
    next step.
 
 ## Rules

skills/project-bootstrap/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: project-bootstrap
-version: 1.0.0
+version: 1.1.0
 description: >
   Initializes or upgrades a project in the current folder: git, .gitignore, README.md,
   .wiki/ using Karpathy's method, .tasks/ for task tracking, CLAUDE.md with skill triggers.
@@ -272,6 +272,50 @@ This file is overwritten if `project-bootstrap` is re-run on the same project. F
 
 If a delegated setup-skill is unavailable on this machine (e.g. user installed only a subset), record the missing skill as `unknown` in the version column so the gap is visible.
 
+---
+
+## Step 5.6 — Recommend `superpowers` plugin (chat-only, never auto-install)
+
+The `CLAUDE.md` template just written contains `use superpowers` as a trigger.
+That trigger is a no-op unless the official `superpowers` plugin is installed
+on the host. On a fresh machine the plugin is often absent, and the user
+won't know the trigger is silently dead. Detect and recommend.
+
+Read `~/.claude/plugins/installed_plugins.json`. The path is identical on
+Windows / Linux / macOS — `~` resolves correctly under git-bash too.
+
+Look for the key `superpowers@claude-plugins-official` under `plugins`.
+Two outcomes:
+
+- **Installed** — say nothing. Skip to Step 6.
+- **Missing** (key absent, or the JSON file itself doesn't exist) — print
+  this block in chat exactly once. Do **not** write it into any project file:
+
+  ```
+  ℹ️  Recommended: install the official `superpowers` plugin
+
+  CLAUDE.md now contains `use superpowers`, but that trigger is a no-op
+  until the plugin is installed. With it, every session auto-loads
+  brainstorming, planning, code-review, debugging, and TDD skills.
+
+  Install (run inside Claude Code):
+    /plugin install superpowers@claude-plugins-official
+
+  Source: https://github.com/anthropics/claude-plugins-official
+
+  After install + Claude Code restart, the trigger picks it up.
+  ```
+
+**Hard rule — never auto-install.** Slash commands aren't callable from a
+skill, and silently mutating user-level plugin state without consent is
+overreach. The recommendation is informational. The user can install it
+later, ignore it entirely, or remove the `use superpowers` line from
+`CLAUDE.md` if they prefer a leaner setup.
+
+If the JSON file is malformed (rare), treat as "missing" and print the
+recommendation. Do not crash the bootstrap over a plugin-detection edge
+case — the file isn't ours to fix here.
+
 ## Step 6 — Commit
 
 ```bash