Repository navigation
chore: sync with cursor/plugins — chore(pstack): bump to 0.15.28, sync guide with create-formal-verification-skill (#724) - #60
Merged
Conversation
Adds the Origin Apps plugin with one skill, port-github-app-to-origin, which discovers a GitHub App's surface from its codebase, maps it onto the live Origin OpenAPI spec (x-origin-scopes / x-origin-webhook-events), and writes a porting brief. Planning only; it writes no code. Dual-layout packaging so partners can use it outside Cursor: root plugin.json (Agent Plugins 1.0), .cursor-plugin/plugin.json (Cursor Marketplace), and .claude-plugin/plugin.json (Claude Code). Adds a root .claude-plugin/marketplace.json so `/plugin marketplace add cursor/plugins` works in Claude Code; it lists only this plugin.
origin-api is the general skill for anyone building on the Origin API: it points at the live docs and OpenAPI spec first and carries only the practices that hold across spec versions (credentials and token minting, minimal scopes from x-origin-scopes, webhook subscription, v1ed verification, idempotent handling and delivery behavior, opaque page tokens, TypeIDs, error envelope, rate limits, deliberate differences from GitHub). port-github-app-to-origin now defers to it for fundamentals and keeps only discovery, mapping, brief, and gap cards. Manifests, marketplace entries, README row, and CHANGELOG describe both skills with one identical description string. Co-authored-by: ali.nikseresht <[email protected]>
origin-api becomes a fetch-first source list plus a gotcha checklist (173 -> 80 lines). The porting skill keeps the discover -> fetch -> map -> brief workflow and the gap-card rules; references drop ecosystem grep lists, path examples, calibration examples, and everything that restated the spec or origin-api. origin-isms is now a classification table (GitHub surface -> label -> Origin idiom). 1231 -> 567 prose lines. Co-authored-by: ali.nikseresht <[email protected]>
Wording only. Removes em dashes, connector colons, semicolon chains, and passive voice; replaces "surface" with the concrete noun; one thought per sentence. Rules and content unchanged. Plugin description is one new identical string across the three manifests, both marketplace entries, and the README row. Co-authored-by: ali.nikseresht <[email protected]>
Porting skill gains step 6, a copyable check-and-fix list run before the brief is declared done. Both descriptions are third person. The porting reference table names the origin-api skill instead of a relative path. brief-template gets a contents line. gap-bar drops "today". "PR" becomes "pull request" in prose. Co-authored-by: ali.nikseresht <[email protected]>
index-origin-spec.py drops the ops and scopes modes, which two rg one-liners cover, and keeps events and schema (payload fields with $ref resolution). Constants are named; missing file, invalid YAML, and non-Origin specs exit with a message instead of a traceback. Prose loses process history and internal justifications: the validation run note in step 6, "Cursor owns the shape", the manifests paragraph in the README, and the CHANGELOG iteration notes. Co-authored-by: ali.nikseresht <[email protected]>
origin-api becomes a fetch-first list, a where-to-look table of llms-full.txt anchors, four priority rules, and a short coming-from-GitHub list for facts the docs do not carry yet. origin-isms rows point at docs anchors instead of restating the idiom. spec-mapping drops copied paths and slugs and the x-origin-webhook-resource extension, which the current spec does not have; x-cursor-visibility is corrected to a field badge. brief-template's mirror rule and hello-world mechanics defer to the docs. gap-bar and README drop a feedback address the docs do not name. Co-authored-by: ali.nikseresht <[email protected]>
The docs now carry coming-from-github, ids, preview, and the x-origin-* summary, so the in-skill Coming from GitHub list becomes a pointer, ID form points at #ids, PREVIEW points at #preview without claiming where the badge appears, and the subscription and pageSize rules defer to #events and #pagination. Co-authored-by: ali.nikseresht <[email protected]>
The docs will not carry a coming-from-github section, so origin-api points at the porting skill in one line and origin-isms rows name the Origin answer or its docs anchor directly. The payload-field rule lives in the porting mapping step and points at the per-field notes under #event-payloads. Co-authored-by: ali.nikseresht <[email protected]>
origin-isms rows are reshaped where the docs give a path and not-available where the current spec has nothing; not-available always carries a question and goes through the gap bar. Rows now cite documented limitations instead of asserting intent, and two factual fixes land: reviewer identifiers resolve by email or group slug, and app-level event subscriptions are the documented webhook path. Related sentences in the porting SKILL, gap-bar, brief-template, spec-mapping, README, and origin-api drop "deliberate", "on purpose", and "never a gap". Co-authored-by: ali.nikseresht <[email protected]>
The docs render every webhook payload family and every endpoint's response fields with nested objects expanded to dotted paths, deeper than the script's two-level expansion, so the script and its PyYAML requirement go. spec-mapping points the REST and payload-field steps at the matching llms-full.txt headings. origin-api gains a lookup-order rule (llms.txt first, one section for a narrow question, full files only for broad work); the porting skill inherits it. Co-authored-by: ali.nikseresht <[email protected]>
gap-bar opens with the ask to raise anything that blocks, costs, or would help the team; the bar orders cards versus questions rather than deciding whether to speak up. Drops the product-area examples for undocumented concepts, softens "never about search" and "fails the bar", and closes by encouraging the team to send cards and questions. The same tone sweep touches the porting SKILL, spec-mapping, origin-isms, brief-template, and README. Co-authored-by: ali.nikseresht <[email protected]>
Manifests lose the porting and integration keywords and tags. spec-mapping's payload outcomes now include "present in the envelope" so GitHub's action field maps to event.type instead of falling through to the gap bar, matching the brief template's five How values. The porting skill's out-of-scope line says the team sends the cards. Co-authored-by: ali.nikseresht <[email protected]>
The brief's section is Feedback for Cursor with Feedback: entries; the reference is the feedback bar and format. The gap parity label stays: a gap row produces a feedback entry. Section 7 is scoped to decisions the team must make so it does not duplicate section 6. Co-authored-by: ali.nikseresht <[email protected]>
Feedback for Cursor now carries only the use case and the API gap in Origin terms, with no file paths, module names, framework internals, or repository names; the team strips internals before forwarding. The porting skill states it does not write or change code without an explicit ask, its procedure is guidance with a short self-check, and the brief is a default template whose Feedback section is the part to keep exact. origin-api is a router: docs pointers and five rules, triggered by Origin mentions only. Capability tables and payload maps use neutral "today" framing instead of GitHub-versus-Origin. Co-authored-by: ali.nikseresht <[email protected]>
brief-template.md describes what a good brief does and offers a default outline the agent adapts or skips, with a small app's brief fitting one screen. Fixed question lists, column counts, and boilerplate sections are gone; what remains is what makes the brief trustworthy: evidence for app claims, Origin claims resolved against the fetched docs, feedback free of partner internals. unknown folds into not-available; same and reshaped fold into maps; the four marks are optional vocabulary. Feedback for Cursor stays last and is also written to ORIGIN-FEEDBACK.md when there is at least one entry. Co-authored-by: ali.nikseresht <[email protected]>
Every docs pointer becomes reference/<anchor>.md under the Origin docs base URL. origin-api's lookup rule is llms.txt first, then the one page; llms-full.txt and openapi.yaml stay for broad work. The field-map steps fetch the endpoint's or payload family's own page, with rg over llms-full.txt kept as the broad-run fallback. Co-authored-by: ali.nikseresht <[email protected]>
Pointers become quoted section headings resolved through llms.txt at run time, so the skill does not depend on a docs deploy order and survives renamed anchors. The base URL stays for llms.txt, llms-full.txt, and openapi.yaml. Co-authored-by: ali.nikseresht <[email protected]>
Folds discovery, spec-mapping, gap-bar, origin-isms, and brief-template into the porting SKILL.md plus one reference (brief, feedback bar, crib); the eval scored this shape level with the longer one. Also from the eval: the mirror rule states facts (merging and default-branch changes are native-only; on a GitHub-sourced mirror every event except repository.pushed arrives and calls beyond metadata and contents reads return 403); brevity is structural (list only what does not map straight across, payload fields only when absent or a follow-up read, a word budget by app size); a three-line filter sits before feedback; the stale user-OAuth item points at "Acting on behalf of users" and names the user-token permission probe as a workaround; ORIGIN-FEEDBACK.md carries no license header, repo or product name, or other forge, and docs contradictions go to Cursor. Co-authored-by: ali.nikseresht <[email protected]>
Wording only. "Crib" becomes "Where GitHub features live on Origin"; "the bar", "first-run path", "marks", "provenance", "fan-out", "rows", "call families", and "payload family" become ordinary words; native repositories and stable outbound mirrors are explained once in plain terms; optional table labels are plain words. Rules, eval fixes, and the section-name pointers are unchanged. Co-authored-by: ali.nikseresht <[email protected]>
openapi.yaml and llms-full.txt are about 870 KB and 575 KB, roughly 350k tokens together, more than a context window holds. Both skills now say to curl them to disk and rg them, reading only the matching sections. Narrow questions still go through llms.txt to the one section. Co-authored-by: ali.nikseresht <[email protected]>
Co-authored-by: ali.nikseresht <[email protected]>
…ge targets Co-authored-by: ali.nikseresht <[email protected]>
Replaces the curl and rg commands with tool-neutral intent (save locally, search for the heading or annotation, read the matching part) and keeps the concrete search targets. Saved copies go in a temporary location outside the app's repository, so a download cannot overwrite or litter the working tree. Co-authored-by: ali.nikseresht <[email protected]>
Every row mapped a question to a section whose title in llms.txt says the same thing, or to a section a ranked rule already names. The one mapping the index does not make obvious (stale check-run posts are under "Ordering writes") stays as a single line. Co-authored-by: ali.nikseresht <[email protected]>
Outbound mirrors are not externally shipped, so the skills no longer mention them. Native repositories get full scopes and every write; on a GitHub mirror every event except repository.pushed arrives, calls beyond metadata and contents reads return 403, and merge and default-branch changes are not available. Co-authored-by: ali.nikseresht <[email protected]>
## Why `/poteto-help` loaded from its description, so that description sat in the skill list of every session. This PR makes the skill typed-only, like every other pstack skill except `/setup-pstack`. It reverses the description-loading choice in cursor#502. ## What changed - `pstack/skills/poteto-help/SKILL.md` sets `disable-model-invocation: true`. The description now tells the user to type `/poteto-help` with a question. - The README row and two lines in the skill body said that `/poteto-help` loads by itself. Now the README says that it runs only when typed, and the skill says that only `/setup-pstack` loads from the user's words. - Bump pstack to 0.15.11. ## Scope - `/setup-pstack` still loads from its description. - The rest of the skill body does not change. ## Tradeoffs - A user who asks how to use pstack without the command no longer gets this skill. The README and the guide index still tell new users to type `/poteto-help`. ## Blast Radius The skill list in every session loses one description. cursor#502 measured it at 72 tokens. Typed use does not change. ## Verification - A check script passes 11 of 11 on this branch. On main, it fails the 6 checks that this PR targets. It also runs `quick-validate.mjs`, `lint-skill-frontmatter.mjs`, and `scripts/validate-plugins.mjs`. - In the Cursor CLI, with the skill installed in a scratch project, the old skill loaded on 5 of 7 runs of pstack help questions. The new skill loaded on 0 of 7. A typed `/poteto-help` question still loaded the new skill, and the answer followed its rules.
…ursor#508) * docs(pstack): teach prompting and supervision habits in guide pages 2-4 Page 2 gains what to put in and leave out of a prompt, the restate-first habit for noisy reports, and cloud subagents for parallel work. Page 3 adds the Investigation playbook, /teach on the agent's own trade-offs, and /recall before new input. Page 4 adds prototyping instead of debating, README-first design, and plans written after the design settles. Co-authored-by: lauren <[email protected]> * docs(pstack): teach verification-first habits and /benchmark-checklist Page 1 urges new users to accept the verification skill and adds cost controls. Page 5 links the perf playbooks to /benchmark-checklist and adds the runtime and trace forensics playbooks. Page 6 adds artifacts as proof, a /benchmark-checklist section, verify-skill prompts, the control CLI traits, and daily maintenance. Page 8 links the checklist from Explain the Number and expands Build the Lever. Co-authored-by: lauren <[email protected]> * docs(pstack): add trust-first loops, Projects, and automations to page 7 Adds the four checks a loop must pass before it runs alone, the Pause safely playbook, a section on running many Cursor Projects with cloud subagents and poteto-mode, and loops that start themselves via the dormant benny automation pack. Co-authored-by: lauren <[email protected]> * docs(pstack): teach /correct, skill eval habits, and /make-bot-ui on page 9 Adds the fix-the-environment ranking and a /correct section, start-small advice, the update-and-eval prompt for skill edits, and a short /make-bot-ui section. Page 8 links Encode Lessons in Structure to /correct. Co-authored-by: lauren <[email protected]> * docs(pstack): expand /poteto-help, recipes, and pitfalls The guide index now explains what /poteto-help does and does not do, and the page summaries name the new content. Page 10 adds recipes for restating a report, prototyping, planning, repro with proof, /benchmark-checklist, /correct, and /poteto-help, plus pitfalls for each habit. Co-authored-by: lauren <[email protected]> * docs(pstack): describe Pause safely triggers as the playbook does The playbook fires on any explicit pause, going offline, or a restart, not one exact phrase. Co-authored-by: lauren <[email protected]> * chore(pstack): bump version to 0.15.13 Co-authored-by: lauren <[email protected]> --------- Co-authored-by: Cursor Agent <[email protected]>
* fix(pstack): fail the harness generator when a skill name is not its folder
Cursor runs a skill by its folder name. Claude Code lists it by its
frontmatter `name`, so a skill named `Poteto Mode` shows up as
`/pstack:Poteto Mode`, which parses as the unknown command `/pstack:Poteto`.
The Agent Skills spec requires the two to match and limits them to lowercase
words joined by hyphens, at most 64 characters.
The generator now fails on any pstack skill that breaks that rule. CI runs it
with --check. This commit fails on `make-bot-ui` and `poteto-mode`; the next
commit renames them.
* fix(pstack): name every skill after its folder
`make-bot-ui` and `poteto-mode` had the display names `Make Bot UI` and
`Poteto Mode` in their frontmatter. Claude Code listed them as
`/pstack:Make Bot UI` and `/pstack:Poteto Mode`, which cannot run, and Cursor
warned that the name did not match the folder. The fix is in the source, so
Cursor, Claude Code, and the generated tree all read the same name and the
generator needs no per-harness rewrite.
Every skill was renamed by this script, run from the repository root. It
changes only the two skills whose name differed:
node -e 'const fs=require("fs");for(const d of fs.readdirSync("pstack/skills")){const p=`pstack/skills/${d}/SKILL.md`;if(fs.existsSync(p))fs.writeFileSync(p,fs.readFileSync(p,"utf8").replace(/^(---\n[\s\S]*?^name: ).*$/m,`$1${d}`))}'
node scripts/generate-pstack-harness-trees.mjs
---------
Co-authored-by: Cursor Agent <[email protected]>
* fix(pstack): write Claude Code model choices to ~/.claude/rules Claude Code never read pstack-models.mdc, so /pstack:setup-pstack stopped without writing anything. Claude Code loads every .md file in ~/.claude/rules/ into each new session, so the adapter now maps the model rule to ~/.claude/rules/pstack-models.md, tells setup-pstack how to detect models from the Agent tool and write that file, and maps a role value such as "opus high" to Agent model and effort. * fix(pstack): skip Cursor-only steps in Claude Code with a one-line note A step that needs Cursor Automations, Bugbot, a Cursor cloud agent, or the built-in PR tool now writes "Skipped in Claude Code: <step>. <reason>." and goes on, leaving a named placeholder when a later step needs its output. The adapter maps each feature, and the generator's term list now catches "built-in PR tool" so a skill that names it must have a row. * fix(pstack): ship the guide and README in the Claude Code tree /pstack:poteto-help linked the README and guide on GitHub main, so Claude Code asked for WebFetch permission to answer. The generator now copies pstack/docs/guide and pstack/README.md into the tree, so --check catches drift in them, and their links to each other resolve locally. The adapter maps a GitHub main link to a pstack file to the local copy when the tree ships it. --------- Co-authored-by: Cursor Agent <[email protected]>
* feat(pstack): add a check that diffs the docs against the skill tree scripts/check-pstack-docs.mjs lists pstack's skills, playbooks, and agents from the tree. It checks pstack/README.md and pstack/docs/guide for unknown or renamed slash commands, broken relative links and anchors, whole-set counts, unknown subagent types, model names that setup-pstack does not use, and skills, playbooks, or agents missing from the README tables. * docs(pstack): fix stale claims about autopilot, custom modes, and the harness * pstack docs: plain-language pass on the guide and README Remove idioms, metaphors, comma splices, and mid-sentence colons that the technical-writing and unslop standards flag. No claims change. * docs(pstack): drop an unbacked claim about custom mode turns * docs(pstack): regenerate the Claude Code tree for the docs pass The Claude Code tree now ships pstack/README.md and pstack/docs/guide/, so the docs-pass edits to those files need regenerated copies for --check to pass. * fix(pstack): check links that carry a title in check-pstack-docs The link pattern needed ')' right after the target, so [x](a.md "title") and [x](<a.md>) were never checked and a broken one passed. --------- Co-authored-by: Cursor Agent <[email protected]>
feat(third_party): add Gopuff plugin
Add the Google Ads plugin (Grok Bot, REST MCP)
cursor#692) * fix(pstack): list every waiting item so each ketchup call is decidable The 150-word cap and the two-line action item made the model fold a set of PRs into a count and send the rest of the calls to a linked file. Give each item its own bullet with its link, user change, evidence, risk, and pick, and let the reply grow with the item count. Keep structural diagrams and ban status and action-item diagrams. * fix(pstack): name the PR in every ketchup call and give each item's risk The model named three PRs by title only, asked calls between options without the PR number, and left out the risk on low-risk merges. Ask for the number or link in every call, and for each item's risk even when it is low. * fix(pstack): keep small ketchup replies short while every batch item stays decidable A call about one item is one bullet with the item named once. A call between options takes its risk from the options' costs. Say what waiting costs only when it is more than a delay, and size the reply by item count so a two-call chat stays well under 150 words. * docs(pstack): match the README's ketchup row to the new behavior The row still promised a few plain sentences. Ketchup now lists every waiting item, so a large batch makes a long reply.
… a word count (cursor#708) The old sentence said not to shrink items to fit. Name cutting items as well, and the word count they must not be cut to meet.
* feat(pstack): add /create-formal-verification-skill Generates a project-local skill that formally verifies one property of the code where a bug costs the most and tests reach the least. The skill picks the verification tool from the question instead of prescribing one. * docs(pstack): list /create-formal-verification-skill in the README and poteto-help * chore(pstack): regenerate the Claude Code tree for /create-formal-verification-skill * fix(pstack): let the formal verification handoff proof keep real findings The proof step said everything must pass again after the scratch change is dropped, and to fix the skill or the verification when a step fails. When the current code already breaks the property, that pointed the agent at weakening the check. Accept a baseline that fails only on findings the agent will report, and limit the fix-it fallback to a missed break or a step that does not run.
Removes the sentence "Don't hand back a rewritten prompt." from the sharpen skill and regenerates the Claude Code copy, mirroring everysphere #1147012.
Co-authored-by: Cursor Agent <[email protected]>
…or#715) * feat(pstack): offer /create-formal-verification-skill in /setup-pstack Ask once at the end of setup whether the user wants a formal verification skill, unless the project already has one. On yes, run /create-formal-verification-skill. The offer matches the existing /create-verification-skill offer. Co-authored-by: lauren <[email protected]> * Sync poteto-help and the pstack guide with shipped skills Document /create-formal-verification-skill, the setup-pstack formal verification offer, /ketchup, /sharpen, /in-your-own-words, the Claude Code install, the Opening a PR playbook, the verification skill Helpers section, and Babysit's Origin path. Co-authored-by: lauren <[email protected]> * Regenerate the Claude Code pstack harness tree Co-authored-by: lauren <[email protected]> --------- Co-authored-by: Cursor Agent <[email protected]>
…cret-copy zoom: require Client Secret with Client ID (1.0.2)
[meta-ads] Add Meta Ads plugin
…al-verification-skill (cursor#721) The event-order sentence names TLA+ as the default in any language, and the sentence that recommended TLA+ for concurrent and distributed designs is gone. When no verifier runs on the language, the agent says so and tests the real code with generated inputs, not a hand model of the function. The new paragraph is the exact text that a preregistered eval tested. Co-authored-by: Cursor Agent <[email protected]>
* Record covered code and sync commit in formal verify skills create-formal-verification-skill now writes, into the generated verify skill, which files and functions each check covers and the commit at which the verification was last confirmed to describe them, so a later agent can see when covered code has changed since. Co-authored-by: lauren <[email protected]> * Add maintain-formal-verification-skill Upkeep loop for a formal verify skill: read the commits that touched covered code since the recorded sync commit, update the model, harness, or properties from the code, rerun, prove each updated check can still fail, and report each check as in sync, updated, bug, or blocked. Listed in the README and in the poteto-help routing table. Co-authored-by: lauren <[email protected]> * Find the formal verify skill by what it does, not by name create-formal-verification-skill gives the generated skill no fixed name, and setup finds it by its description. The maintain skill now does the same. Co-authored-by: lauren <[email protected]> * Name maintain-formal-verification-skill in the formal verification docs Adds the skill to the spots that already cover formal verification: the verify-and-ship section, the special-cases sentence on guide page 9, and the poteto-help state check and recipe. Co-authored-by: lauren <[email protected]> * Point the guide page 9 link at the formal verification section Co-authored-by: lauren <[email protected]> * Keep the sync commit in place for a blocked check maintain-formal-verification-skill set the sync commit to the checked commit for every check, including a blocked one. A blocked check was not confirmed to describe the code, so moving its sync commit hides the drift from the next pass. Step 6 now leaves it in place and says so in the report. Step 2 now points at step 5, where a failure is judged. Co-authored-by: lauren <[email protected]> --------- Co-authored-by: Cursor Agent <[email protected]>
…ation-skill (cursor#724) * docs(pstack): match guide page 6 to create-formal-verification-skill's tool choice cursor#721 made TLA+ the default for event-order questions in any language, and added a fallback: when no verifier runs on the language, the agent says so and tests the real code with generated inputs. The guide's tool-choice paragraph still described the old wording. Claude Code harness copy regenerated. Co-authored-by: lauren <[email protected]> * chore(pstack): bump to 0.15.28 Co-authored-by: lauren <[email protected]> --------- Co-authored-by: Cursor Agent <[email protected]>
…ual-2026-10-19 # Conflicts: # .claude-plugin/marketplace.json # .github/workflows/validate-plugins.yml # README.md # scripts/validate-plugins.mjs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream changes
Run by hand: the scheduled sync has failed since Oct 6. #59 fixed the conflict, but this range includes upstream 182f2ce, which changes
.github/workflows/validate-plugins.yml, andGITHUB_TOKENcannot push that. Once this lands, scheduled syncs push again until upstream next changes a workflow file. From then on they need theSYNC_TOKENsecret.Same steps as
sync-upstream.yml: merge, conflict resolution (ours formarketplace.json/README.md, upstream for the rest), sync manifests, rebuild README, update.upstream-base. The gate passed: converter tests 112/112,validate-plugins.mjs,generate-pstack-harness-trees.mjs --check.