[caelaxie]

synced to 88d4751. compared d457567..main for pstack/; later commits on upstream main through 190d287 do not touch pstack/. version is 0.15.29 in plugin.json, .devin-plugin/plugin.json, and the readme marker.

ported:

• 88d4751 (#729) restore /sharpen to the original prompt and return only the rewrite. the four asks are a numbered list. guide pages 2 and 10, poteto-help, and recipes match. slash commands keep the /pstack: prefix. disable-model-invocation: true stays triggers: [user]. the version bumps to 0.15.29. the same bump is in .devin-plugin/plugin.json and the readme marker, which is where this repo records the version.

skipped:

• harness/pstack/claude-code/ copies in #729. this port does not carry the generated claude code tree.
• #729 pstack/.cursor-plugin/plugin.json. cursor packaging. the version bump lands in .devin-plugin/plugin.json instead.
• #729 upstream readme skill-table row for /sharpen. this port's readme is a pointer, not a copy of the upstream catalog. the version marker is bumped. the skill is indexed in poteto-help, the guide, and recipes.

harness proof (install, devin plugins list, exercising /pstack:sharpen) will follow as a comment. the devin cli can't log in from this cloud environment.

  

[caelaxie]

verdict: request changes (posting as comment, same account).

• minimum changes: ok. all 8 files match upstream 88d4751 (#729) verbatim apart from the /pstack: prefix and disable-model-invocation: true -> triggers: [user].
• parity: ok. version 0.15.29 in plugin.json, .devin-plugin/plugin.json, readme. skips (claude-code harness tree, .cursor-plugin, readme catalog row) are fine. no other pstack/ changes through 190d287.
• ci: validate plugin green.
• issue linkage: none needed.
• harness proof: missing. need a comment showing devin plugins install (a --local install pinned to the full head sha 5a47394 is fine) + devin plugins list showing pstack 0.15.29, plus /pstack:sharpen exercised, or if the live turn is auth-blocked, the installed copy of skills/sharpen/SKILL.md from that install. symlink-only proof won't do.

will merge once the proof lands.

[caelaxie]

harness proof

Real Devin CLI on a local box (no cloud agent, no git clone). PR head 5a4739413fd1553800d392fdbc289e29ec61931b (cursor/port-pstack-0.15.29-82c9), expected version 0.15.29. I checked the head with git ls-remote and the PR API right before installing.

• CLI: devin 3000.11.92 (7f4e64980e22)
• devin auth status → Logged in (via Devin).
• model: swe-2-high
• permissions: the same read-only project allowlist as port upstream pstack through 0.15.27 #10–port upstream pstack through 0.15.28 #12. Writes and edits are denied, and I did not use bypass/dangerous.

#	step	result
1	devin plugins list before: only thermos v1.0.0	✅ recorded
2	--local wrapper pinned to the full head sha	✅ PASS
3	devin plugins list shows pstack v0.15.29 (required)	✅ PASS
4	both plugin.json files say 0.15.29	✅ PASS
5	cmp of the installed files vs raw @ head (sharpen SKILL.md, poteto-help SKILL.md, recipes.md, both plugin.json)	✅ PASS (5/5 IDENTICAL)
6	installed sharpen SKILL.md is a regular file in the plugin cache, not a symlink	✅ PASS
7	grep -n installed sharpen: triggers: [user] and the restored rewrite instruction	✅ PASS. ⚠️ The literal phrase "only the rewrite" is not in the file (see note).
8	installed sharpen vs upstream 88d4751 pstack/skills/sharpen/SKILL.md	✅ PASS. The body is identical; only the frontmatter is adapted for this port.
9	live /pstack:sharpen (describe-only): returns a rewritten prompt and does not do the task	✅ PASS

1–3. before list, install, after list

$ devin plugins list          # before
Installed plugins

  • thermos v1.0.0

$ cat /workspace/devin-harness/wrap-pr14/.devin-plugin/plugin.json
{ "name": "pstack-harness-pr14", "version": "0.0.0",
  "requiredPlugins": [ { "source": "github", "repo": "pstack-ports/devin-pstack",
                         "sha": "5a4739413fd1553800d392fdbc289e29ec61931b" } ] }
$ devin plugins install --local -y /workspace/devin-harness/wrap-pr14
✓ Installed pstack-harness-pr14.
  auto-installed required plugins: pstack
$ devin plugins list
Installed plugins

  • thermos v1.0.0
  • pstack-harness-pr14 v0.0.0
  • pstack v0.15.29 (required)

4–7. installed cache copy (a real file, not a symlink)

$ cd ~/.local/share/devin/cli/plugins/cache/github.com_pstack-ports_devin-pstack-816793bb/0.15.29
$ stat -c "%F %n" skills/sharpen skills/sharpen/SKILL.md
directory skills/sharpen
regular file skills/sharpen/SKILL.md
$ readlink -f skills/sharpen/SKILL.md
~/.local/share/devin/cli/plugins/cache/github.com_pstack-ports_devin-pstack-816793bb/0.15.29/skills/sharpen/SKILL.md
$ grep -n "\"version\"" .devin-plugin/plugin.json plugin.json
.devin-plugin/plugin.json:3:  "version": "0.15.29",
plugin.json:4:  "version": "0.15.29",
# byte-for-byte: cmp installed vs raw.githubusercontent @ 5a4739413fd1553800d392fdbc289e29ec61931b
skills/sharpen/SKILL.md  654B  sha256=e88a6a1bfab9624c  head=e88a6a1bfab9624c  IDENTICAL
skills/poteto-help/SKILL.md  15613B  sha256=1344e17802d5dda3  head=1344e17802d5dda3  IDENTICAL
skills/poteto-help/references/recipes.md  3947B  sha256=30aaa9ab742c6706  head=30aaa9ab742c6706  IDENTICAL
.devin-plugin/plugin.json  549B  sha256=b019c405f1ee5284  head=b019c405f1ee5284  IDENTICAL
plugin.json  624B  sha256=57de10a28d9127a8  head=57de10a28d9127a8  IDENTICAL
$ grep -n -E "only the rewrite|rewrite my prompt|triggers: \[user\]|^description" skills/sharpen/SKILL.md
3:description: "Make a task deeper, not bigger, then rewrite the prompt. Use for /pstack:sharpen."
4:triggers: [user]
14:Then rewrite my prompt to ask for exactly that.
$ cat skills/sharpen/SKILL.md
---
name: sharpen
description: "Make a task deeper, not bigger, then rewrite the prompt. Use for /pstack:sharpen."
triggers: [user]
---

I want a deeper version of this task, not a bigger one. Before rewriting it, do four things:

1. Say what a top professional in this field would do here that I'm not asking for.
2. Name the rawest material they would start from instead of what has already been digested for me.
3. Name the specific methods and tools they would use.
4. Say what, other than you or me, would show the result is right.

Then rewrite my prompt to ask for exactly that.

Leave choices that are mine to make open instead of deciding them.

8. vs upstream 88d4751

$ diff <(curl -fsSL https://raw.githubusercontent.com/cursor/plugins/88d4751/pstack/skills/sharpen/SKILL.md) skills/sharpen/SKILL.md
3,4c3,4
< description: "Make a task deeper, not bigger, then rewrite the prompt. Use for /sharpen."
< disable-model-invocation: true
---
> description: "Make a task deeper, not bigger, then rewrite the prompt. Use for /pstack:sharpen."
> triggers: [user]

The only differences are the /pstack: prefix and triggers: [user] in place of disable-model-invocation: true, which are this port's usual adaptations.

Note on "only the rewrite": neither the upstream skill nor this port contains that literal phrase. What was restored is the original prompt: four analysis points, then Then rewrite my prompt to ask for exactly that. (line 14). The "returns the prompt and doesn't do the task" behavior is stated in the installed poteto-help row (line 66) and in the guide docs (02-poteto-mode.md, 10-recipes-and-pitfalls.md).

9. live /pstack:sharpen

$ devin -p --respect-workspace-trust false --export ../logs/pr14-sharpen.export -- '/pstack:sharpen add input validation to the signup form in our web app'
USER-MSG head (skill body injected): I want a deeper version of this task, not a bigger one. Before rewriting it, do four things: ...
USER-MSG tail: ... Then rewrite my prompt to ask for exactly that. | | Leave choices that are mine to make open instead of deciding them. add input validation to the signup form in our web app
tool calls in session: 1 (exec `ls -la /workspace/devin-harness/scratch`, read-only); no writes or edits

This is a prompt-deepening exercise (the workspace is empty scratch), so here's the analysis and rewrite.
## 1. What a top professional would do that you didn't ask for ...
## 2. The rawest material they'd start from ...
## 3. Methods and tools ...
## 4. What would show it's right — independent of you or me ...
## Rewritten prompt

> Add input validation to the signup form in our web app, treating validation as a data contract, not just UI checks.
>
> **First, establish ground truth:** read the users table schema/ORM model and the signup endpoint's current handling to derive the authoritative field constraints. Flag any mismatches you find (e.g., DB allows shorter strings than the form implies) rather than silently picking one — surface them for me to decide.
>
> **Then:**
> - Express the validation rules in a single shared schema/definition (use whatever validation or form library the codebase already uses; if none exists, propose options and let me choose rather than adding a dependency unilaterally).
> - Enforce it client-side for UX **and** server-side as the actual boundary; verify both reject/accept the same inputs.
> - Cover adversarial cases: injection-style strings, unicode/homoglyph tricks, trimming/normalization, over-length input, duplicate email.
> - Error UX: per-field inline messages with sensible timing (blur vs. submit — follow existing patterns in the app if any), accessible via aria-invalid/aria-describedby and focusable.
>
> **Verification:** write table-driven tests over a shared corpus of valid/invalid inputs exercised against *both* client validators and the real endpoint (call the endpoint directly, bypassing the UI). Run the app's existing test/lint/build suite.
>
> **Constraints/questions to surface, not resolve alone:** password policy choice, whether/how to normalize emails before storage, whether duplicate-email errors should be enumerated (account-enumeration risk), and any DB constraint changes needed — list these as open decisions for me before implementing them.

Key difference from the original: it makes validation a *contract derived from ground truth*, puts the server side in scope, and converts ambiguous policy choices into explicit questions back to you instead of silent defaults.
exit=0

The output has the four sections the skill asks for, followed by the rewritten prompt. It does not attempt the task: no code, no edits, just one ls. I counted this as PASS for "returns the rewrite instead of doing the task". Strictly, it is not only the rewrite, because the four analysis sections come first, exactly as the restored SKILL.md instructs.

Afterwards, the scratch dir contains only .devin/, and ~/.devin/rules and ~/.config/devin/agents do not exist. No code was changed and no secrets appear in this comment.

[caelaxie]

verdict: approved (posting as comment, same account).

• head: unchanged at 5a47394, so the earlier diff check against upstream 88d4751 (#729) still holds.
• harness proof (issuecomment-6305788887): ok. the --local wrapper's requiredPlugins pins pstack-ports/devin-pstack to the full head sha, and devin fetched it into its own cache. devin plugins list shows pstack v0.15.29 (required). the installed skills/sharpen/SKILL.md is a regular file in the plugin cache, not a symlink, and is cmp-identical to the head. i checked its content against raw @ head and it matches. a live /pstack:sharpen turn injected the skill body and returned the four-point analysis plus a rewritten prompt, with no edits.
• ci: validate plugin green on the head.

squash-merging pinned to the head sha.