Repository navigation
chore(pstack): sync 0.15.15 and fix maintenance gates - #6
Merged
Merged
Conversation
Adds the Origin Apps plugin with one skill, port-github-app-to-origin, which discovers a GitHub App's surface from its codebase, maps it onto the live Origin OpenAPI spec (x-origin-scopes / x-origin-webhook-events), and writes a porting brief. Planning only; it writes no code. Dual-layout packaging so partners can use it outside Cursor: root plugin.json (Agent Plugins 1.0), .cursor-plugin/plugin.json (Cursor Marketplace), and .claude-plugin/plugin.json (Claude Code). Adds a root .claude-plugin/marketplace.json so `/plugin marketplace add cursor/plugins` works in Claude Code; it lists only this plugin.
origin-api is the general skill for anyone building on the Origin API: it points at the live docs and OpenAPI spec first and carries only the practices that hold across spec versions (credentials and token minting, minimal scopes from x-origin-scopes, webhook subscription, v1ed verification, idempotent handling and delivery behavior, opaque page tokens, TypeIDs, error envelope, rate limits, deliberate differences from GitHub). port-github-app-to-origin now defers to it for fundamentals and keeps only discovery, mapping, brief, and gap cards. Manifests, marketplace entries, README row, and CHANGELOG describe both skills with one identical description string. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
origin-api becomes a fetch-first source list plus a gotcha checklist (173 -> 80 lines). The porting skill keeps the discover -> fetch -> map -> brief workflow and the gap-card rules; references drop ecosystem grep lists, path examples, calibration examples, and everything that restated the spec or origin-api. origin-isms is now a classification table (GitHub surface -> label -> Origin idiom). 1231 -> 567 prose lines. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Wording only. Removes em dashes, connector colons, semicolon chains, and passive voice; replaces "surface" with the concrete noun; one thought per sentence. Rules and content unchanged. Plugin description is one new identical string across the three manifests, both marketplace entries, and the README row. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Porting skill gains step 6, a copyable check-and-fix list run before the brief is declared done. Both descriptions are third person. The porting reference table names the origin-api skill instead of a relative path. brief-template gets a contents line. gap-bar drops "today". "PR" becomes "pull request" in prose. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
index-origin-spec.py drops the ops and scopes modes, which two rg one-liners cover, and keeps events and schema (payload fields with $ref resolution). Constants are named; missing file, invalid YAML, and non-Origin specs exit with a message instead of a traceback. Prose loses process history and internal justifications: the validation run note in step 6, "Cursor owns the shape", the manifests paragraph in the README, and the CHANGELOG iteration notes. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
origin-api becomes a fetch-first list, a where-to-look table of llms-full.txt anchors, four priority rules, and a short coming-from-GitHub list for facts the docs do not carry yet. origin-isms rows point at docs anchors instead of restating the idiom. spec-mapping drops copied paths and slugs and the x-origin-webhook-resource extension, which the current spec does not have; x-cursor-visibility is corrected to a field badge. brief-template's mirror rule and hello-world mechanics defer to the docs. gap-bar and README drop a feedback address the docs do not name. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
The docs now carry coming-from-github, ids, preview, and the x-origin-* summary, so the in-skill Coming from GitHub list becomes a pointer, ID form points at #ids, PREVIEW points at #preview without claiming where the badge appears, and the subscription and pageSize rules defer to #events and #pagination. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
The docs will not carry a coming-from-github section, so origin-api points at the porting skill in one line and origin-isms rows name the Origin answer or its docs anchor directly. The payload-field rule lives in the porting mapping step and points at the per-field notes under #event-payloads. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
origin-isms rows are reshaped where the docs give a path and not-available where the current spec has nothing; not-available always carries a question and goes through the gap bar. Rows now cite documented limitations instead of asserting intent, and two factual fixes land: reviewer identifiers resolve by email or group slug, and app-level event subscriptions are the documented webhook path. Related sentences in the porting SKILL, gap-bar, brief-template, spec-mapping, README, and origin-api drop "deliberate", "on purpose", and "never a gap". Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
The docs render every webhook payload family and every endpoint's response fields with nested objects expanded to dotted paths, deeper than the script's two-level expansion, so the script and its PyYAML requirement go. spec-mapping points the REST and payload-field steps at the matching llms-full.txt headings. origin-api gains a lookup-order rule (llms.txt first, one section for a narrow question, full files only for broad work); the porting skill inherits it. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
gap-bar opens with the ask to raise anything that blocks, costs, or would help the team; the bar orders cards versus questions rather than deciding whether to speak up. Drops the product-area examples for undocumented concepts, softens "never about search" and "fails the bar", and closes by encouraging the team to send cards and questions. The same tone sweep touches the porting SKILL, spec-mapping, origin-isms, brief-template, and README. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Manifests lose the porting and integration keywords and tags. spec-mapping's payload outcomes now include "present in the envelope" so GitHub's action field maps to event.type instead of falling through to the gap bar, matching the brief template's five How values. The porting skill's out-of-scope line says the team sends the cards. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
The brief's section is Feedback for Cursor with Feedback: entries; the reference is the feedback bar and format. The gap parity label stays: a gap row produces a feedback entry. Section 7 is scoped to decisions the team must make so it does not duplicate section 6. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Feedback for Cursor now carries only the use case and the API gap in Origin terms, with no file paths, module names, framework internals, or repository names; the team strips internals before forwarding. The porting skill states it does not write or change code without an explicit ask, its procedure is guidance with a short self-check, and the brief is a default template whose Feedback section is the part to keep exact. origin-api is a router: docs pointers and five rules, triggered by Origin mentions only. Capability tables and payload maps use neutral "today" framing instead of GitHub-versus-Origin. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
brief-template.md describes what a good brief does and offers a default outline the agent adapts or skips, with a small app's brief fitting one screen. Fixed question lists, column counts, and boilerplate sections are gone; what remains is what makes the brief trustworthy: evidence for app claims, Origin claims resolved against the fetched docs, feedback free of partner internals. unknown folds into not-available; same and reshaped fold into maps; the four marks are optional vocabulary. Feedback for Cursor stays last and is also written to ORIGIN-FEEDBACK.md when there is at least one entry. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Every docs pointer becomes reference/<anchor>.md under the Origin docs base URL. origin-api's lookup rule is llms.txt first, then the one page; llms-full.txt and openapi.yaml stay for broad work. The field-map steps fetch the endpoint's or payload family's own page, with rg over llms-full.txt kept as the broad-run fallback. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Pointers become quoted section headings resolved through llms.txt at run time, so the skill does not depend on a docs deploy order and survives renamed anchors. The base URL stays for llms.txt, llms-full.txt, and openapi.yaml. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Folds discovery, spec-mapping, gap-bar, origin-isms, and brief-template into the porting SKILL.md plus one reference (brief, feedback bar, crib); the eval scored this shape level with the longer one. Also from the eval: the mirror rule states facts (merging and default-branch changes are native-only; on a GitHub-sourced mirror every event except repository.pushed arrives and calls beyond metadata and contents reads return 403); brevity is structural (list only what does not map straight across, payload fields only when absent or a follow-up read, a word budget by app size); a three-line filter sits before feedback; the stale user-OAuth item points at "Acting on behalf of users" and names the user-token permission probe as a workaround; ORIGIN-FEEDBACK.md carries no license header, repo or product name, or other forge, and docs contradictions go to Cursor. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Wording only. "Crib" becomes "Where GitHub features live on Origin"; "the bar", "first-run path", "marks", "provenance", "fan-out", "rows", "call families", and "payload family" become ordinary words; native repositories and stable outbound mirrors are explained once in plain terms; optional table labels are plain words. Rules, eval fixes, and the section-name pointers are unchanged. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
openapi.yaml and llms-full.txt are about 870 KB and 575 KB, roughly 350k tokens together, more than a context window holds. Both skills now say to curl them to disk and rg them, reading only the matching sections. Narrow questions still go through llms.txt to the one section. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
…ge targets Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Replaces the curl and rg commands with tool-neutral intent (save locally, search for the heading or annotation, read the matching part) and keeps the concrete search targets. Saved copies go in a temporary location outside the app's repository, so a download cannot overwrite or litter the working tree. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Every row mapped a question to a section whose title in llms.txt says the same thing, or to a section a ranked rule already names. The one mapping the index does not make obvious (stale check-run posts are under "Ordering writes") stays as a single line. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
Outbound mirrors are not externally shipped, so the skills no longer mention them. Native repositories get full scopes and every write; on a GitHub mirror every event except repository.pushed arrives, calls beyond metadata and contents reads return 403, and merge and default-branch changes are not available. Co-authored-by: ali.nikseresht <ali.nikseresht@anysphere.co>
## Why `/poteto-help` loaded from its description, so that description sat in the skill list of every session. This PR makes the skill typed-only, like every other pstack skill except `/setup-pstack`. It reverses the description-loading choice in cursor#502. ## What changed - `pstack/skills/poteto-help/SKILL.md` sets `disable-model-invocation: true`. The description now tells the user to type `/poteto-help` with a question. - The README row and two lines in the skill body said that `/poteto-help` loads by itself. Now the README says that it runs only when typed, and the skill says that only `/setup-pstack` loads from the user's words. - Bump pstack to 0.15.11. ## Scope - `/setup-pstack` still loads from its description. - The rest of the skill body does not change. ## Tradeoffs - A user who asks how to use pstack without the command no longer gets this skill. The README and the guide index still tell new users to type `/poteto-help`. ## Blast Radius The skill list in every session loses one description. cursor#502 measured it at 72 tokens. Typed use does not change. ## Verification - A check script passes 11 of 11 on this branch. On main, it fails the 6 checks that this PR targets. It also runs `quick-validate.mjs`, `lint-skill-frontmatter.mjs`, and `scripts/validate-plugins.mjs`. - In the Cursor CLI, with the skill installed in a scratch project, the old skill loaded on 5 of 7 runs of pstack help questions. The new skill loaded on 0 of 7. A typed `/poteto-help` question still loaded the new skill, and the answer followed its rules.
…ursor#508) * docs(pstack): teach prompting and supervision habits in guide pages 2-4 Page 2 gains what to put in and leave out of a prompt, the restate-first habit for noisy reports, and cloud subagents for parallel work. Page 3 adds the Investigation playbook, /teach on the agent's own trade-offs, and /recall before new input. Page 4 adds prototyping instead of debating, README-first design, and plans written after the design settles. Co-authored-by: lauren <poteto@users.noreply.github.com> * docs(pstack): teach verification-first habits and /benchmark-checklist Page 1 urges new users to accept the verification skill and adds cost controls. Page 5 links the perf playbooks to /benchmark-checklist and adds the runtime and trace forensics playbooks. Page 6 adds artifacts as proof, a /benchmark-checklist section, verify-skill prompts, the control CLI traits, and daily maintenance. Page 8 links the checklist from Explain the Number and expands Build the Lever. Co-authored-by: lauren <poteto@users.noreply.github.com> * docs(pstack): add trust-first loops, Projects, and automations to page 7 Adds the four checks a loop must pass before it runs alone, the Pause safely playbook, a section on running many Cursor Projects with cloud subagents and poteto-mode, and loops that start themselves via the dormant benny automation pack. Co-authored-by: lauren <poteto@users.noreply.github.com> * docs(pstack): teach /correct, skill eval habits, and /make-bot-ui on page 9 Adds the fix-the-environment ranking and a /correct section, start-small advice, the update-and-eval prompt for skill edits, and a short /make-bot-ui section. Page 8 links Encode Lessons in Structure to /correct. Co-authored-by: lauren <poteto@users.noreply.github.com> * docs(pstack): expand /poteto-help, recipes, and pitfalls The guide index now explains what /poteto-help does and does not do, and the page summaries name the new content. Page 10 adds recipes for restating a report, prototyping, planning, repro with proof, /benchmark-checklist, /correct, and /poteto-help, plus pitfalls for each habit. Co-authored-by: lauren <poteto@users.noreply.github.com> * docs(pstack): describe Pause safely triggers as the playbook does The playbook fires on any explicit pause, going offline, or a restart, not one exact phrase. Co-authored-by: lauren <poteto@users.noreply.github.com> * chore(pstack): bump version to 0.15.13 Co-authored-by: lauren <poteto@users.noreply.github.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>
…gin-05cb Add origin-apps plugin: build on the Origin API, port a GitHub App
Update Statsig plugin to MCP v3
Adds the opt-in plugin for the Cursor-hosted QuickBooks Online MCP server. Unlike every other connector here, it ships no mcp.json: the server is Cursor-side and the plugin is only the gate that turns it on, so the manifest carries metadata and a logo and nothing else. Logo is QuickBooks' official mark from quickbooks.intuit.com, resized to the repo's 192x192 RGBA convention. Co-authored-by: Cursor <cursoragent@cursor.com>
…-plugin feat(third_party): add QuickBooks Online plugin
feat(third_party): add Workday plugin
Merge cursor/plugins at d0ef80d while keeping upstream source pristine. Preserve explicit poteto-help invocation on Claude Code and Codex, adapt its help guidance, and report blocked upstream updates as failed sync jobs.
yxhta
marked this pull request as ready for review
October 7, 2026 14:30
Owner
Author
|
Independent shipping verification: PASS+NOTES. Verified base 5f83e92 and head 721810a. The published tree matches the reviewed tree, with upstream ancestry intact. Stable patch-id: c09cbafe2b7acd03361bd4d4ad4b2fcd394b7159. Fresh base/head checks passed: 88/93 Python tests, 52 Bun tests each, strict TypeScript, source/generation checks, real Skills CLI installations, Claude validation, and Codex no-inference discovery. Direct execution reproduced the old falsely successful sync and verified the corrected failure behavior without repository or publication changes. Actual model-driven invocation-policy enforcement remains unverified. This verification covers PR #6 only. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Keep the portable fork current and make blocked upstream updates visible. An old open sync PR could make the scheduled job report success before it checked upstream.
What changed
Scope
Includes upstream repository changes and regenerated portable packages. The fork's pstack and Thermos marketplace entries remain intact. Existing PRs #2 and #5 stay separate.
Tradeoffs
Keep the one-open-sync-PR policy. PR #2 still needs a separate decision before a future pending update can proceed. Merge this PR with a merge commit to retain upstream ancestry.
Blast Radius
Updates portable help, upstream workflow defaults, and sync reporting. Mods logic is unchanged. A later integration with #5 requires regenerating its manifest version.
Verification
Authenticated real-model behavior remains unverified.