chore(pstack): sync 0.15.15 and fix maintenance gates

.cursor-plugin/marketplace.json

@@ -63,6 +63,11 @@
       "source": "cursor-sdk",
       "description": "Build apps, scripts, and automations with the TypeScript SDK."
     },
+    {
+      "name": "origin-apps",
+      "source": "origin-apps",
+      "description": "Skills for building on the Cursor Origin API. Fetch the live spec first, then follow the Origin rules for credentials, scopes, webhooks, paging, and errors. Includes a skill that plans the port of an existing GitHub App."
+    },
     {
       "name": "orchestrate",
       "source": "orchestrate",
@@ -502,6 +507,16 @@
       "name": "posthog-mcp",
       "source": "third_party/posthog-mcp",
       "description": "Work with PostHog from chat: query product analytics and run SQL, manage feature flags and experiments, triage error tracking issues, and review session replays, surveys, and dashboards (URL-only connector to PostHog's hosted MCP server)."
+    },
+    {
+      "name": "quickbooks-online",
+      "source": "third_party/quickbooks-online",
+      "description": "Read invoices, bills, expenses, customers, accounts, and financial reports."
+    },
+    {
+      "name": "workday",
+      "source": "third_party/workday",
+      "description": "Look up workers, organizations, time off, payroll, and recruiting data in Workday."
     }
   ]
 }

README.md

@@ -17,6 +17,7 @@ Official Cursor plugins for popular developer tools, frameworks, and SaaS produc
 | `pr-review-canvas` | [PR Review Canvas](pr-review-canvas/) | Cursor | Developer Tools | Render PR diffs as review canvases grouped by importance. |
 | `docs-canvas` | [Docs Canvas](docs-canvas/) | Cursor | Developer Tools | Render documentation as a navigable canvas. |
 | `cursor-sdk` | [Cursor SDK](cursor-sdk/) | Cursor | Developer Tools | Build apps, scripts, and automations with the TypeScript SDK. |
+| `origin-apps` | [Origin Apps](origin-apps/) | Cursor | Developer Tools | Skills for building on the Cursor Origin API. Fetch the live spec first, then follow the Origin rules for credentials, scopes, webhooks, paging, and errors. Includes a skill that plans the port of an existing GitHub App. |
 | `orchestrate` | [Orchestrate](orchestrate/) | Cursor | Developer Tools | Fan large tasks out across parallel cloud agents with planners, workers, verifiers, and structured handoffs. |
 | `pstack` | [pstack](pstack/) | Lauren Tan | Developer Tools | if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence. |
 | `dyl-stack` | [dyl-stack](dyl-stack/) | Dylan Gattey | Developer Tools | Dylan's agent style on top of pstack: root causes over symptom patches, The Algorithm before design, terse verified delivery, a PR review that fits in a paste, and Figma-to-UI with a visual judge. |
@@ -92,6 +93,8 @@ Official Cursor plugins for popular developer tools, frameworks, and SaaS produc
 | `etoro-trading` | [eToro Trading](third_party/etoro-trading/) | Cursor | Integrations | View your eToro portfolio, balances, positions, and watchlists, research instruments and traders, and prepare and place trades. |
 | `x-money` | [X Money](third_party/x-money/) | Cursor | Integrations | Use your X Money Card, send money to users on X, manage your finances, view your balance and browse through your transaction history. |
 | `shopify-store` | [Shopify](third_party/shopify-store/) | Cursor | Integrations | Connect your Shopify store so Grok can answer questions about products, orders, customers, inventory, and sales. |
+| `quickbooks-online` | [QuickBooks Online](third_party/quickbooks-online/) | Cursor | Integrations | Read invoices, bills, expenses, customers, accounts, and financial reports. |
+| `workday` | [Workday](third_party/workday/) | Cursor | Integrations | Look up workers, organizations, time off, payroll, and recruiting data in Workday. |
 Author values match each plugin’s `plugin.json` `author.name` (Cursor lists `plugins@cursor.com` in the manifest).
 
 ## Repository structure

README_PORTABLE.md

@@ -54,7 +54,7 @@ Read [runtime adaptation](tools/portable/assets/skills/poteto-mode/references/ru
 
 ## Runtime parity and limits
 
-The adapter preserves upstream review roles, participant counts, fresh-agent policy, and completion gates. The shared bundle intentionally removes `disable-model-invocation` so poteto-mode can route to other skills. This changes discovery and invocation availability; it does not grant permission for side effects. Capacity limits queue participants in waves. If the host cannot provide an independent reviewer or isolated context, that gate remains unverified. A self-review or a missing transcript does not count as passing evidence.
+The adapter preserves upstream review roles, participant counts, fresh-agent policy, and completion gates. The shared bundle intentionally removes `disable-model-invocation` from workflow skills so poteto-mode can route to them. The new poteto-help entry point retains upstream's explicit-only invocation, including the matching Codex policy. This changes discovery and invocation availability; it does not grant permission for side effects. Capacity limits queue participants in waves. If the host cannot provide an independent reviewer or isolated context, that gate remains unverified. A self-review or a missing transcript does not count as passing evidence.
 
 Portable Comment Sicko is read-only. Its parent applies accepted, scoped comment deletions and checks the resulting diff before completing no-comments. A findings-only report does not complete the edit workflow.
 
@@ -70,7 +70,7 @@ The **Sync pstack upstream** GitHub Actions workflow checks daily and can be run
 
 Enable GitHub Actions in this fork and allow Actions to create pull requests under **Settings → Actions → General**. Scheduled workflows may be disabled by GitHub after prolonged inactivity; run or re-enable the workflow when needed. If Actions is not allowed to create PRs, supply a suitably scoped repository secret `UPSTREAM_SYNC_TOKEN`; do not commit credentials. A PR opened with the default GITHUB_TOKEN does not trigger other PR workflows, so the sync job runs validation itself.
 
-The sync script requires a clean dedicated checkout at the latest `origin` default branch. Only one sync PR is kept open. Review and merge or close it before the next update. A merge conflict or validation failure fails the workflow with logs instead of overwriting the local adaptation. Retries use an unused branch suffix when a closed PR or interrupted run left a branch behind; they never force-push that branch. Resolve the conflicting upstream change on a branch and run the checks below. New upstream skills receive the same adaptation automatically.
+The sync script requires a clean dedicated checkout at the latest `origin` default branch. Only one sync PR is kept open. If an open sync PR blocks a newer upstream revision, the job fails and names both the branch and pending SHA. Review and merge or close that PR before retrying. An already-current fork succeeds even if an old sync PR remains open. A merge conflict or validation failure fails the workflow with logs instead of overwriting the local adaptation. Retries use an unused branch suffix when a closed PR or interrupted run left a branch behind; they never force-push that branch. Resolve the conflicting upstream change on a branch and run the checks below. New upstream skills receive the same adaptation automatically.
 
 ```sh
 python3 tools/portable/prepare.py

origin-apps/.claude-plugin/plugin.json

@@ -0,0 +1,20 @@
+{
+  "name": "origin-apps",
+  "description": "Skills for building on the Cursor Origin API. Fetch the live spec first, then follow the Origin rules for credentials, scopes, webhooks, paging, and errors. Includes a skill that plans the port of an existing GitHub App.",
+  "version": "0.1.0",
+  "author": {
+    "name": "Cursor",
+    "email": "plugins@cursor.com"
+  },
+  "homepage": "https://cursor.com/docs/api/origin",
+  "repository": "https://github.com/cursor/plugins",
+  "license": "MIT",
+  "keywords": [
+    "origin",
+    "origin-api",
+    "origin-app",
+    "webhooks",
+    "github-app"
+  ],
+  "skills": "./skills/"
+}

origin-apps/.cursor-plugin/plugin.json

@@ -0,0 +1,29 @@
+{
+  "name": "origin-apps",
+  "displayName": "Origin Apps",
+  "version": "0.1.0",
+  "description": "Skills for building on the Cursor Origin API. Fetch the live spec first, then follow the Origin rules for credentials, scopes, webhooks, paging, and errors. Includes a skill that plans the port of an existing GitHub App.",
+  "author": {
+    "name": "Cursor",
+    "email": "plugins@cursor.com"
+  },
+  "homepage": "https://cursor.com/docs/api/origin",
+  "repository": "https://github.com/cursor/plugins",
+  "license": "MIT",
+  "keywords": [
+    "cursor-plugin",
+    "origin",
+    "origin-api",
+    "origin-app",
+    "webhooks",
+    "github-app"
+  ],
+  "category": "developer-tools",
+  "tags": [
+    "origin",
+    "origin-api",
+    "webhooks",
+    "github-app"
+  ],
+  "skills": "./skills/"
+}

origin-apps/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## 0.1.0
+
+Initial release with two skills, `origin-api` and `port-github-app-to-origin`.

origin-apps/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cursor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

origin-apps/README.md

@@ -0,0 +1,62 @@
+# Origin Apps
+
+Two skills for building on [Cursor Origin](https://cursor.com/docs/api/origin),
+Cursor's code forge. They cover creating an Origin App, calling the API,
+receiving webhooks, and moving an existing GitHub App over. The plugin is
+skills only, so it runs in Cursor, Claude Code, Codex, and any agent that
+reads [Agent Skills](https://agentskills.io).
+
+## What it includes
+
+`origin-api` sends the agent to the section of the Origin docs that answers
+its question and lists the rules to check first: native versus mirrored
+repositories, event subscriptions, webhook verification, scopes from the
+spec, opaque tokens and IDs. Use it for any Origin work.
+
+`port-github-app-to-origin` plans the move of an existing GitHub App. Run it
+inside the app's repository. It reads what the app uses out of the code,
+maps that onto the live Origin spec, and writes a porting brief with what
+carries over and what does not, the webhook fields your handlers read and
+where each comes from on Origin, the scopes to request, an end-to-end test
+for your app, feedback for Cursor, and the questions your team has to
+decide. It plans. It writes no code unless you ask.
+
+Both skills read the live spec at run time and never name an endpoint from memory.
+
+## When to use
+
+Ask about the Origin API, or ask to port a GitHub App, and the matching skill
+loads. In Cursor you can also run `/origin-api` or
+`/port-github-app-to-origin`.
+
+## Install in Cursor
+
+Search for Origin Apps in the Cursor Marketplace
+([cursor.com/marketplace/origin-apps](https://cursor.com/marketplace/origin-apps)),
+or open Customize, find the plugin, and install it at user or project scope.
+
+## Use outside Cursor
+
+The skills use only portable [Agent Skills](https://agentskills.io)
+frontmatter. In Claude Code: `/plugin marketplace add cursor/plugins` then
+`/plugin install origin-apps@cursor-plugins`. Any other agent: copy
+`origin-apps/skills/*` into its skills folder (copy both; the porting skill
+refers to `origin-api`).
+
+## Requirements
+
+- Network access to `https://cursor.com/docs/api/origin/*` during the run.
+- For the porting skill, read access to the app's source. Writing the brief
+  needs no Origin credentials. You run the brief's end-to-end test
+  afterwards.
+
+## Where the brief goes
+
+The porting skill writes `ORIGIN-PORTING-BRIEF.md` at the repository root and
+prints its path. When there is feedback for Cursor, it also writes that
+section to `ORIGIN-FEEDBACK.md`, ready to send as is; the rest of the brief
+is for your team.
+
+## License
+
+MIT

origin-apps/plugin.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
+  "name": "origin-apps",
+  "version": "0.1.0",
+  "description": "Skills for building on the Cursor Origin API. Fetch the live spec first, then follow the Origin rules for credentials, scopes, webhooks, paging, and errors. Includes a skill that plans the port of an existing GitHub App.",
+  "author": {
+    "name": "Cursor",
+    "email": "plugins@cursor.com"
+  },
+  "homepage": "https://cursor.com/docs/api/origin",
+  "repository": "https://github.com/cursor/plugins",
+  "license": "MIT",
+  "keywords": [
+    "origin",
+    "origin-api",
+    "origin-app",
+    "webhooks",
+    "github-app"
+  ]
+}

origin-apps/skills/origin-api/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: origin-api
+description: >-
+  Routes questions about the Cursor Origin API to the right section of the
+  Origin docs and names the few rules to check first. Use when a task mentions
+  Origin, the Origin API, Origin Apps, or Origin webhooks, including creating
+  an Origin App, authenticating as one, calling Origin endpoints, or handling
+  Origin webhook deliveries.
+license: MIT
+compatibility: >-
+  Needs network access to https://cursor.com/docs/api/origin/* at run time.
+---
+
+# Origin API
+
+The docs are the source of truth. Do not name an endpoint, scope, event slug,
+header, or limit from memory. Where this file and the docs disagree, the docs
+win.
+
+The docs live under `https://cursor.com/docs/api/origin/`. `llms.txt` is
+the index and links every section, endpoint, and webhook payload.
+`openapi.yaml` is the contract, and "Endpoint reference" explains its
+`x-origin-*` extensions. `llms-full.txt` is the whole reference in one file.
+`changelog` says what moved. For one question, start at `llms.txt` and
+fetch only the section that answers it. `llms-full.txt` and `openapi.yaml`
+are each several hundred kilobytes, too large to read into context whole.
+When you need all of them, as a porting brief does, save them locally if you
+can, outside any repository you are working in, search them for the section
+heading or annotation you need, and read only the matching part. Cite
+`operationId`s and section names.
+
+## Rules to check first
+
+1. **Native or mirror.** A repository is either native (created on Origin)
+   or a GitHub mirror. On a native repository an installation has its full
+   scopes and every write. On a GitHub mirror, every event except
+   `repository.pushed` still arrives, every call beyond metadata and
+   contents reads returns `403`, and merging a pull request or changing the
+   default branch is not available ("Mirrored repositories", "Events").
+2. **Subscribe.** Only `installation.*` events arrive without a subscription.
+   A missing subscription produces silence, not an error ("Events").
+3. **Verify, dedupe, acknowledge.** Verify the signature over the raw body
+   before parsing, dedupe on the delivery ID, return `2xx`, then process
+   ("Signature verification", "Retries", "Automatic disable"). Origin signs
+   a digest, which Standard Webhooks does not, so a generic verifier fails.
+4. **Scopes from the spec.** Request the union of `x-origin-scopes.scopes`
+   over the operations the app calls ("Scopes").
+5. **Opaque tokens and IDs.** Do not build or parse page tokens or IDs
+   ("Pagination", "IDs").
+
+One section name the index does not make obvious: what happens to a
+check-run post that arrives out of order is under "Ordering writes".
+
+Porting an existing GitHub App: use `port-github-app-to-origin` in this
+plugin.