release: sync Cursor pstack 0.14.7

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "pstack",
       "source": "./plugins/pstack",
       "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
-      "version": "1.2.1",
+      "version": "1.3.0",
       "author": {
         "name": "Lauren Tan (original)"
       },

CHANGES.md

@@ -2,6 +2,30 @@
 
 This port applies the Cursor → Claude Code substitutions in skill bodies. Earlier drafts left them flagged; this revision resolves them. A later pass added a Codex build that shares the same skills; see [Codex port](#codex-port) below.
 
+## 1.3.0 syncs to Cursor pstack 0.14.7
+
+Open Pstack now tracks Cursor pstack 0.14.7 at `efa2a531985e0a8084d36ff3cf87233be8a9f34b`.
+
+**Forge-neutral pull request playbooks.** Shipping, Babysit, Autopilot-full, Autopilot-stack, Opening a PR, and Multi-phase plan use GitHub CLI by default and Origin when its CLI can resolve the repository. Same-repository base chains and fork stacks land from the bottom one pull request at a time. Stable patch IDs decide when a rewritten head needs a new code verdict. Owners open pull requests early, follow repository draft rules until required evidence exists, keep an uncommitted decision trail, and compare load-bearing behavior and performance at trunk and head. Graphite remains only in the unchanged Orchestrate frontier tooling.
+
+Factory panel review hardened the upstream landing flow. Shipping freezes the stack and clears every pre-existing auto-merge request and native merge-queue entry before verification. On GitHub, it confirms that both `autoMergeRequest` and the separate `mergeQueueEntry` are null. It repeats the check for the current bottom pull request and every descendant before any branch or base mutation. Both autopilots apply the same rule before rewriting an existing pull request, and Opening a PR applies it before an existing child is rebased, force-pushed, or retargeted. Autopilot-stack delivers each bottom pull request through Shipping instead of offering merge-when-ready for descendants. Same-repository heads use a base-branch chain. Fork heads keep local parent ancestry, target trunk in the base repository, and use a frozen bottom-to-top list because a fork-only parent branch cannot be a pull request base. Autopilot-full preserves the same parent ancestry in its short private-stack exception. Owners open pull requests early but leave them draft when repository instructions require live evidence before readiness.
+
+Fork-safe rebases resolve the base fetch remote separately from the head push remote. The playbooks resolve the head push URL before fetching stack parents, worktree refreshes, and live-lane heads. Rebase and publish steps use that exact URL, binding an explicit force-with-lease to the SHA captured before the rewrite. Each verdict records its head, patch base, and stable patch ID separately from the current landing head and base. A patch-equivalent rewrite keeps the verdict, but every merge guard uses the current landing head. After a parent is squash-merged, an explicit `git rebase --onto` moves only the child's commits from its recorded old parent to current trunk. The rebase command terminates option parsing before passing the short branch name. Git then updates the branch instead of leaving a detached HEAD. Fork pull requests use GitHub's pull-request API with the validated head repository name, which also supports organization-owned forks. Every GitHub pull request command names the canonical base repository. The installed-plugin watcher receives its owner, repository, and pull request number explicitly.
+
+Values returned by the forge or repository stay shell data. The imported pull request playbooks pass them as quoted arguments instead of pasting contributor-controlled branch names or other forge values into shell source.
+
+Immediate merges require a server-enforced expected-head guard. The playbook verifies `baseRefName` immediately before the GitHub merge and monitors it until merge. GitHub has no expected-base guard, so Shipping uses the supported head guard and reports a safety failure if the pull request lands in another base. Server-side auto-merge also requires a SHA-scoped independent-verdict check. Without that check, the agent watches until it can issue the guarded immediate merge. Every observed head or base change disarms every pending request and returns to verification. An unarmed frontier returns to the merge step when it becomes ready. Every terminal non-passing required check ends the watch while auto-merge or a merge-queue entry is pending. `UNSTABLE` remains nonterminal by itself. A stale or conflicted frontier returns to the guarded rebase flow.
+
+Origin merge commands omit GitHub's unsupported `--squash` flag and stop when Origin cannot provide atomic expected-head and expected-base guards. Both autopilot playbooks use the same captured-SHA lease rule. Autopilot-full routes owner merges through Shipping's current-head flow.
+
+**TypeScript boundary guidance.** The TypeScript skill scopes Claude Code automatic loading to `.ts` and `.tsx` files, prefers repository-owned runtime schemas over hand-written property guards, and derives types from those schemas with helpers such as `z.infer`. Codex continues to invoke the same shared skill by name.
+
+**Codex presentation.** The exact upstream `assets/logo.png` now ships in the shared plugin. The Codex manifest exposes it through `interface.logo`. The Claude manifest does not add a logo field because Claude Code has no schema for it.
+
+**No-op upstream revisions.** Upstream moved several Fable references to a newer revision slug. Open Pstack already stores rolling `claude:fable` and `claude:opus` aliases, so those edits require no port change.
+
+**Upstream-only exclusions.** `make-bot-ui` from `799151d` and `6fecddb` is not ported because it is built entirely from Cursor routine, webhook, and UI primitives. The `disable-model-invocation` additions from `73f8be4` are not applied to `how`, `why`, `unslop`, or `typescript-best-practices`; the flag would break poteto-mode's named invocation path on Claude Code. The `23a56e2` defaults that move `bug-fix`, `perf-issue`, and `hillclimb` from Sol to Fable are not applied because Fable costs much more for these frequent delegated code roles; all three stay on `codex:gpt-5.6-sol@max`. The Claude manifest logo field from `efa2a53` is also omitted because Claude Code has no schema for it.
+
 ## 1.2.1 keeps Fable and Opus on their latest Claude revisions
 
 Open Pstack now stores `claude:fable@<effort>` and `claude:opus@<effort>` in its model matrix, role defaults, and generated setup sheets. Claude Code resolves those aliases to the latest family revision. Native Claude agents and external runner calls pass the same aliases.

NOTICE.md

@@ -17,6 +17,7 @@ This plugin is a port of upstream MIT-licensed work. All upstream copyright noti
 | `plugins/pstack/skills/what-did-i-get-done/` | [cursor/plugins/cursor-team-kit/skills/what-did-i-get-done @ e46364b](https://github.com/cursor/plugins/tree/e46364b8be46000b7df0f260550cd712afbb8d36/cursor-team-kit/skills/what-did-i-get-done) | (c) 2026 Cursor | MIT | [LICENSE-cursor-team-kit](LICENSE-cursor-team-kit) |
 | `plugins/pstack/skills/teach/`, `plugins/pstack/skills/principle-model-the-domain/`, `plugins/pstack/skills/create-verification-skill/`, `plugins/pstack/skills/maintain-verification-skill/` (v0.11.3 additions) | [cursor/plugins/pstack @ 3fe2823](https://github.com/cursor/plugins/tree/3fe2823ce17c1656c222d4b7c59d3f82fbf20143/pstack) | (c) 2026 Lauren Tan | MIT | [LICENSE](LICENSE) |
 | `plugins/pstack/skills/{swarm,no-comments,technical-writing,bro}/`, `plugins/pstack/agents/comment-sicko.md`, `plugins/pstack/skills/poteto-mode/playbooks/{babysit,shipping,orchestrate,autopilot-full,autopilot-stack,worktree-cleanup,multi-phase-plan}.md`, `plugins/pstack/skills/poteto-mode/references/bugbot-triage.md`, `plugins/pstack/skills/poteto-mode/scripts/`, `plugins/pstack/skills/architect/references/design-red-flags.md`, `plugins/pstack/skills/create-verification-skill/references/feature-map-example/` (v0.14.2 additions, v0.14.3 checklist) | [cursor/plugins/pstack @ bdf7aa3](https://github.com/cursor/plugins/tree/bdf7aa355337897f167153e05069aca505dae17c/pstack) | (c) 2026 Lauren Tan | MIT | [LICENSE](LICENSE) |
+| `plugins/pstack/skills/poteto-mode/playbooks/{shipping,babysit,autopilot-full,autopilot-stack,opening-a-pr,multi-phase-plan}.md`, `plugins/pstack/skills/poteto-mode/references/bugbot-triage.md`, `plugins/pstack/skills/poteto-mode/SKILL.md`, `plugins/pstack/skills/typescript-best-practices/{SKILL.md,references/patterns.md}`, `plugins/pstack/assets/logo.png` (v0.14.6 and v0.14.7 changes) | [cursor/plugins/pstack @ efa2a53](https://github.com/cursor/plugins/tree/efa2a531985e0a8084d36ff3cf87233be8a9f34b/pstack) | (c) 2026 Lauren Tan | MIT | [LICENSE](LICENSE) |
 
 ## What changed in the port
 

README-UPSTREAM.md

@@ -27,7 +27,7 @@ two steps:
 
 new here? the [pstack guide](./docs/guide/README.md) walks you through a first real task, from setup and prompting through verification and overnight runs.
 
-that's it. the other skills are situational; the mode skill uses them for you as needed. out of the box the mode splits work by model strength: precisely-specified code goes to sol, fast mechanical code goes to grok, and prose and judgment go to fable. the default panel is fable / sol / grok / opus 5. [`/setup-pstack`](./skills/setup-pstack/SKILL.md) changes any of it.
+that's it. the other skills are situational; the mode skill uses them for you as needed. out of the box the mode splits work by model strength: precisely-specified code, prose, and judgment go to fable 5.1, while fast mechanical code goes to grok. the default panel is fable 5.1 / sol / grok / opus 5. [`/setup-pstack`](./skills/setup-pstack/SKILL.md) changes any of it.
 
 ## usage
 
@@ -65,11 +65,11 @@ morning.
 | [authoring a skill](./skills/poteto-mode/playbooks/authoring-a-skill.md) | writing or editing a SKILL.md. |
 | [eval](./skills/poteto-mode/playbooks/eval.md) | test how a skill or prompt change affects agent behavior, blinded. |
 | [babysit](./skills/poteto-mode/playbooks/babysit.md) | drive a pr or a stack to merge-ready: conflicts, review threads, ci. |
-| [shipping](./skills/poteto-mode/playbooks/shipping.md) | independently verify a green stack, then land the contiguous verified run with graphite merge-when-ready. |
+| [shipping](./skills/poteto-mode/playbooks/shipping.md) | independently verify a green stack, then land the contiguous verified run bottom-up through github by default or origin when available. |
 | [autonomous run](./skills/poteto-mode/playbooks/autonomous-run.md) | drive a long task to completion without stopping. |
 | [orchestrate](./skills/poteto-mode/playbooks/orchestrate.md) | a standing project handed to one coordinator chat: multi-day, many stacked prs, fleets of subagents. |
 | [autopilot-full](./skills/poteto-mode/playbooks/autopilot-full.md) | run independent prs to merged with one owner per pr and root verification of each merge-ready head. |
-| [autopilot-stack](./skills/poteto-mode/playbooks/autopilot-stack.md) | build and verify one linear graphite stack for the operator to review and land. |
+| [autopilot-stack](./skills/poteto-mode/playbooks/autopilot-stack.md) | build and verify one linear base-branch stack for the operator to review and land. |
 | [session pickup](./skills/poteto-mode/playbooks/session-pickup.md) | resume or take over a prior agent's in-flight work. |
 | [pause safely](./skills/poteto-mode/playbooks/pause-safely.md) | suspend in-flight work cleanly so it can be resumed later. |
 | [multi-phase plan](./skills/poteto-mode/playbooks/multi-phase-plan.md) | work that spans phases or stacked PRs. |
@@ -119,6 +119,7 @@ the full rules and playbooks live in [`skills/poteto-mode/SKILL.md`](./skills/po
 | [`/swarm`](./skills/swarm/SKILL.md) | you want N parallel workers across different slices or races, then one aggregated report. |
 | [`/interrogate`](./skills/interrogate/SKILL.md) | you have a diff and want several different models to try to break it, including a strict code-quality lens. |
 | [`/automate-me`](./skills/automate-me/SKILL.md) | you want your own `-mode` skill, drafted from how you've actually worked. |
+| [`/make-bot-ui`](./skills/make-bot-ui/SKILL.md) | you want a page or dashboard whose buttons wake a Grok Bot over a webhook, including the sender-key handoff and Tailscale. |
 | [`/setup-pstack`](./skills/setup-pstack/SKILL.md) | you want to pick which models pstack uses per role. detects your models and writes a config rule. |
 | [`/reflect`](./skills/reflect/SKILL.md) | a long task landed and you want the recipe captured as a skill edit. |
 | [`/teach`](./skills/teach/SKILL.md) | you want to actually understand a change or subsystem, not just have it summarized. runs how + why and weaves one plain explanation, built up diagram by diagram. |

README.md

@@ -153,7 +153,7 @@ This repository also keeps:
 
 ## Staying close to Lauren's pstack
 
-Open Pstack 1.2.1 tracks pstack 0.14.3 at Cursor commit [`bdf7aa355337897f167153e05069aca505dae17c`](https://github.com/cursor/plugins/commit/bdf7aa355337897f167153e05069aca505dae17c).
+Open Pstack 1.3.0 tracks pstack 0.14.7 at Cursor commit [`efa2a531985e0a8084d36ff3cf87233be8a9f34b`](https://github.com/cursor/plugins/commit/efa2a531985e0a8084d36ff3cf87233be8a9f34b).
 
 The two projects have separate version numbers. The pstack version identifies Lauren's upstream content. The Open Pstack version identifies the Claude Code and Codex package built from it.
 

UPSTREAM.md

@@ -8,11 +8,18 @@ open-pstack tracks [Cursor's pstack](https://github.com/cursor/plugins/tree/main
 | --- | --- |
 | Repository | `https://github.com/cursor/plugins.git` |
 | Path | `pstack/` |
-| Commit | `bdf7aa355337897f167153e05069aca505dae17c` |
-| Upstream version | `0.14.3` |
-| open-pstack version | `1.2.1` |
+| Commit | `efa2a531985e0a8084d36ff3cf87233be8a9f34b` |
+| Upstream version | `0.14.7` |
+| open-pstack version | `1.3.0` |
 
-The table above is the current Cursor sync point. Open Pstack 1.2.1 keeps this 0.14.3 sync. `README-UPSTREAM.md` preserves its pstack README verbatim. `CHANGES.md` and `NOTICE.md` describe the adaptations and provenance.
+The table above is the current Cursor sync point. Open Pstack 1.3.0 keeps this 0.14.7 sync. `README-UPSTREAM.md` preserves its pstack README verbatim. `CHANGES.md` and `NOTICE.md` describe the adaptations and provenance.
+
+## Upstream-only exclusions
+
+- Commits `799151d` and `6fecddb` add and relocate `make-bot-ui`. It depends on Cursor routines, webhook events, and UI primitives that Claude Code and Codex do not share.
+- Four `disable-model-invocation: true` lines from `73f8be4` are not applied to `how`, `why`, `unslop`, or `typescript-best-practices`. Poteto-mode invokes those skills by name, and the flag blocks that route on Claude Code.
+- The `23a56e2` default-model hunks for `bug-fix`, `perf-issue`, and `hillclimb` are not applied. Those frequent code-writing roles stay on `codex:gpt-5.6-sol@max` for cost.
+- The Claude manifest does not take the logo field from `efa2a53` because Claude Code has no schema for it. The shared asset is exposed through the Codex manifest instead.
 
 ## Check for changes
 
@@ -26,8 +33,8 @@ Fetch and inspect only commits that touched pstack after the recorded sync point
 
 ```shell
 git fetch cursor main
-git log --oneline bdf7aa355337897f167153e05069aca505dae17c..cursor/main -- pstack
-git diff --stat bdf7aa355337897f167153e05069aca505dae17c..cursor/main -- pstack
+git log --oneline efa2a531985e0a8084d36ff3cf87233be8a9f34b..cursor/main -- pstack
+git diff --stat efa2a531985e0a8084d36ff3cf87233be8a9f34b..cursor/main -- pstack
 ```
 
 No output means the tracked pstack tree has not changed. This comparison does not need a polling service or generated mirror branch.