port upstream pstack through 0.15.27

[caelaxie]

synced to f9be7aa. upstream main has no later commit that touches pstack/. version is 0.15.27 in plugin.json, .devin-plugin/plugin.json, and the readme marker.

ported:

• 75fabace (#712) drop the rewritten-prompt ban from skills/sharpen/SKILL.md. kept triggers: [user] and the /pstack:sharpen description.
• 0148b78c (#713) bump plugin.json to 0.15.27. the same bump is in .devin-plugin/plugin.json and the readme marker, which is where this repo records the version.
• f9be7aa (#715) offer formal verification in setup, and sync poteto-help, its recipes, and the guide. slash commands keep the /pstack: prefix. .cursor/skills stays .devin/skills. the new setup step is ### 9 because this port already uses ### 8 for the verification offer, after the devin profile steps.

skipped:

• harness/pstack/claude-code/ copies in #712, #713, and #715. this port does not carry the generated claude code tree.
• #713 pstack/.cursor-plugin/plugin.json. cursor packaging. the version bump lands in .devin-plugin/plugin.json instead.
• #715 claude code install paragraph in docs/guide/01-setup.md (/plugin marketplace add cursor/plugins, ~/.claude/rules/pstack-models.md, link to docs/harness/claude-code.md). this port's install section is the devin cli, and that adapter file is not in the repo.
• #715 poteto-help rewrite that adds the claude code install and restates the cursor-only paragraph. this port already replaced that paragraph with the devin wording, and the new text points at the claude code adapter this repo does not carry.

  

[cursor]

harness proof. devin 3000.11.92 (7f4e64980e22). not logged in, so install, list, and the skill run are blocked. validator passed first: Validated 55 skills, 2 agents, and 23 playbooks.

$ devin auth status
Not logged in.
  Credentials path: /home/ubuntu/.local/share/devin/credentials.toml
Run `devin auth login` to authenticate.

$ devin plugins install -y pstack-ports/devin-pstack@cursor/port-pstack-0.15.27-5744
Error: You must be logged in to manage plugins. Run `devin auth login` first.

$ devin plugins install --local -y /workspace
Error: You must be logged in to manage plugins. Run `devin auth login` first.

$ devin plugins list
Error: You must be logged in to manage plugins. Run `devin auth login` first.

$ devin -p -- /pstack:sharpen say hello
Error: Login canceled

/pstack:setup-pstack, /pstack:poteto-help, and /pstack:poteto-mode were not run. the same login block stops a session, and the plugin never installed, so those skills are not loaded. devin skills list only shows the built-in cli skills.

[caelaxie]

content and parity look good for 0.15.27 (#712/#713/#715). setup ### 9 formal offer is the right numbering. skips justified. versions + ci ok. no issue.

changes requested: harness proof is incomplete. comment shows devin auth not logged in, so install/list/skill run all failed. need a real devin plugins install + devin plugins list plus changed skills exercised (sharpen / setup-pstack / poteto-help). offline validator alone is not enough.

re-review on a passing proof comment or body edit.

[caelaxie]

harness proof

Real Devin CLI on a local box (no cloud agent, no git clone). PR head 4f3ab8e (cursor/port-pstack-0.15.27-5744), expected version 0.15.27.

• CLI: devin 3000.11.92 (7f4e64980e22)
• devin auth status → Logged in (via Devin). (Devin Pro, team membership Approved)
• scratch dir: /workspace/devin-harness/scratch
• model used by every run: swe-2-high

#	step	result
1	devin plugins install -y pstack-ports/devin-pstack@cursor/port-pstack-0.15.27-5744	❌ FAIL (CLI has no @branch syntax, see below)
1b	install pinned to the PR head sha (wrapper plugin, see below)	✅ PASS
2	devin plugins list shows pstack v0.15.27	✅ PASS
3	/pstack:sharpen say hello	✅ PASS
4	/pstack:setup-pstack (describe-only)	✅ PASS (first try, with no allowlist, hit a permission rejection)
5	/pstack:poteto-help	✅ PASS
6	installed sharpen SKILL.md	✅ PASS

1. install

$ devin plugins install -y pstack-ports/devin-pstack@cursor/port-pstack-0.15.27-5744
Error: local path sources can't sync to Devin Cloud; run `devin plugins install --local pstack-ports/devin-pstack@cursor/port-pstack-0.15.27-5744` to install on this machine only.

The CLI reads owner/repo@branch as a local path. install only takes owner/repo, a git URL, or a local path, and a /tree/<branch> URL doesn't resolve either. A branch or sha can only be set in the object form inside a manifest. So I installed through a local wrapper plugin that requires pstack pinned to the PR head:

$ cat /workspace/devin-harness/wrap-pr10/.devin-plugin/plugin.json
{ "name": "pstack-harness-pr10", "version": "0.0.0",
  "requiredPlugins": [ { "source": "github", "repo": "pstack-ports/devin-pstack",
                         "sha": "4f3ab8ef851991a546b056b3fb52d584def338a4" } ] }
$ devin plugins install --local -y /workspace/devin-harness/wrap-pr10
  ...
      /pstack:sharpen
      /pstack:poteto-mode
      /pstack:reflect
✓ Installed pstack-harness-pr10.
  auto-installed required plugins: pstack

2. list

$ devin plugins list
Installed plugins

  • pstack-harness-pr10 v0.0.0
  • pstack v0.15.27 (required)

$ devin plugins info pstack | head -3
Plugin: pstack
  version: 0.15.27
  source: https://github.com/pstack-ports/devin-pstack

3. sharpen

$ devin -p --respect-workspace-trust false --export ../logs/pr10-sharpen.export -- '/pstack:sharpen say hello'
Hello! What can I help you with today?
exit=0

In the exported transcript, the user turn is the sharpen skill body followed by the prompt. This is the post-#712 text, without the rewritten-prompt ban:

USER-MSG head: Before starting, ask how a top expert would approach this task (their raw sources, their real methods, an outside check that the result is right), what the user
USER-MSG tail: ... always keep one outside check that the result is right, without narrating the framing, then do the work. say hello

4. setup-pstack (describe-only, nothing written)

The first run used no allowlist and the default auto permission mode. The skill's step-1 devin models list exec got rejected:

warning: rejected a tool call that requires confirmation. Running in non-interactive mode. Use --permission-mode dangerous to auto-approve all tools.

For the rerun I added a read-only allowlist to the scratch project. Writes are denied, and I did not use dangerous/bypass:

$ cat .devin/config.json
{ "permissions": { "allow": ["Read(**)", "Exec(devin models)", "Exec(ls)", "Exec(cat)"],
                   "deny":  ["Write(**)", "Edit(**)"] } }
$ devin -p --respect-workspace-trust false --export ../logs/pr10-setup.export -- '/pstack:setup-pstack DESCRIBE ONLY: do not write, edit, or create any files or config. Run step 1 (detect available models) and list what you detect, then briefly describe the remaining steps you would take.'
TOOL: skill {"skill": "setup-pstack"}
OBS:  Source: ~/.local/share/devin/cli/plugins/cache/github.com_pstack-ports_devin-pstack-816793bb/0.15.27/skills/setup-pstack/SKILL.md
TOOL: exec {"command": "devin models list"}

Step 1 complete — `devin models list` works and reports **54 families / ~848 slugs**.
- **SWE-2**: `swe-2-medium`, `swe-2-high`, `swe-2-max` (plus `-lightning` variants) — all default SWE-2 slugs confirmed.
- **Claude Opus 5.5**: `claude-opus-5-5-{low,medium,high,xhigh,max}` plus `-fast` variants — all default Opus slugs confirmed.
...
Current state: neither `~/.devin/rules/` nor `~/.config/devin/agents/` exists ...
Remaining steps, if you wanted the real run:
1. Load state ... 2. Budget ... 3. Confirm mapping ... 4. Validate ... 5. Write rule `~/.devin/rules/pstack-models.md` ...
6. Write profiles `~/.config/devin/agents/pstack-M.md` / `pstack-M-ro.md` ... 7. Confirm + offers (/pstack:create-verification-skill, /pstack:create-formal-verification-skill)
No files were written.
exit=0

After the run, ~/.devin/rules and ~/.config/devin/agents still do not exist. The run listed the new formal-verification offer from #715.

5. poteto-help

$ devin -p --respect-workspace-trust false --export ../logs/pr10-help.export -- '/pstack:poteto-help what is pstack and which skill should I start with? keep it short'
USER-MSG head: # Poteto help | | Answer the user's question about pstack, hand them a prompt they can send, and link the file the answer came from. ...
TOOL: read {"file_path": ".../devin-pstack-816793bb/0.15.27/README.md"}

pstack is a plugin of skills and subagents that makes Devin work more rigorously — playbooks, review panels, parallel workers, and verification habits. It's already installed here.
Start with `/pstack:poteto-mode` — it matches your task to a playbook and runs the other skills as needed:
    /pstack:poteto-mode <your goal> — done when <a check that can pass or fail>
One note: no `~/.devin/rules/pstack-models.md` exists, so `/pstack:setup-pstack` hasn't run for you ...
Answer from: [README.md](https://github.com/pstack-ports/devin-pstack/blob/main/README.md)
exit=0

6. installed sharpen SKILL.md

$ head -10 ~/.local/share/devin/cli/plugins/cache/github.com_pstack-ports_devin-pstack-816793bb/0.15.27/skills/sharpen/SKILL.md
---
name: sharpen
description: "Sharpen a task before starting: the expert approach, what the user is really after, and the right level of specification. Use for /pstack:sharpen."
triggers: [user]
---

Before starting, ask how a top expert would approach this task (their raw sources, their real methods, an outside check that the result is right), what the user is really after, and whether the task is over- or underspecified. Loosen constraints that don't serve the goal as readily as you add ones that do, and leave choices that are the user's to make open instead of deciding them. Fold in only what makes the work better, not bigger, but always keep one outside check that the result is right, without narrating the framing, then do the work.
$ grep '"version"' .devin-plugin/plugin.json plugin.json   # in the installed cache dir
  "version": "0.15.27",
  "version": "0.15.27",

Notes: the box also has an unrelated always-on rule, ~/.cursor/rules/pstack-models.mdc, that the CLI loads. No code was changed and no secrets appear in this comment.

[caelaxie]

approved at 4f3ab8e (posting as COMMENT since author and reviewer are the same account).

1. minimum changes: unchanged since my last pass at this head. synced to upstream f9be7aa, which is still the newest cursor/plugins commit touching pstack/. claude code tree, .cursor-plugin, and claude code install text skipped. no cursor-team-kit.
2. parity: 0.15.27 in plugin.json, .devin-plugin/plugin.json, and the readme marker, matching upstream #713.
3. harness proof (#10 (comment)): accepted. devin auth status is logged in. devin plugins install --local installed a wrapper whose requiredPlugins pins pstack-ports/devin-pstack at the full head sha 4f3ab8ef…. devin fetched pstack from github into its own plugin cache (github.com_pstack-ports_devin-pstack-…/0.15.27/). that is the whole repo at that sha, not a symlink into a working tree and not a hand-picked subset. devin plugins list shows pstack v0.15.27, a version that exists only on this branch. /pstack:sharpen ran with the post-#712 body. /pstack:setup-pstack (describe-only) loaded from the cache path and listed the new #715 formal-verification offer. /pstack:poteto-help answered from the installed README.
4. no issue linked, which fits a plain upstream sync.

CI Validate plugin is green on 4f3ab8e, and the head has not moved past the proof sha. squash-merging pinned to 4f3ab8ef851991a546b056b3fb52d584def338a4.