Fix port audit issues 15 and 18-22

docs/guide/05-build-and-clean.md

@@ -56,7 +56,7 @@ In context, that's enough. [`/pstack:tdd`](../../skills/tdd/SKILL.md) writes the
 
 ## Clean before you commit
 
-The [Opening a PR playbook](../../skills/poteto-mode/playbooks/opening-a-pr.md) runs a slop-strip pass on the diff before each commit and applies [`/pstack:unslop`](../../skills/unslop/SKILL.md) to the PR description and commit bodies. `deslop` ships in Cursor's `cursor-team-kit` plugin, not in this port. Ask for the same outcome in plain words: remove narrating comments, unsupported guards, dead compatibility paths, and unrelated edits.
+The [Opening a PR playbook](../../skills/poteto-mode/playbooks/opening-a-pr.md) runs a slop-strip pass on the diff before each commit and applies [`/pstack:unslop`](../../skills/unslop/SKILL.md) to the PR description and commit bodies. `/deslop` ships in the `cursor-team-kit` plugin, not in pstack. If you don't have it, ask for the same outcome in plain words: remove narrating comments, unsupported guards, dead compatibility paths, and unrelated edits.
 
 For prose, `/pstack:unslop` takes a target and any extra rules you have:
 
@@ -76,7 +76,7 @@ Comments need their own pass, and not from the agent that wrote them. An author
 
 [`/pstack:no-comments`](../../skills/no-comments/SKILL.md) spawns [Comment Sicko](../../agents/comment-sicko.md), a read-only reviewer with a short keep list: license headers, doc comments on a public API, links that explain what code can't, behavior forced by an external dependency you can't reshape. Everything else goes. A surprise in your own code gets no such pass. The comment comes back as a refactor flag, and `/pstack:no-comments` fixes the flags it accepts at the root cause. When a comment claims a constraint, "do not remove", the skill offers to encode the claim as a type, test, or lint. Either way, the comment comes out.
 
-The division of labor is worth keeping straight. `/pstack:deslop` cleans slop out of the code, `/pstack:unslop` cleans it out of prose, and `/pstack:no-comments` hands the comments to a reviewer who didn't write them.
+The division of labor is worth keeping straight. `/deslop` cleans slop out of the code, `/pstack:unslop` cleans it out of prose, and `/pstack:no-comments` hands the comments to a reviewer who didn't write them.
 
 **Pitfall:** cleanup is not optional polish. A diff with narrating comments and defensive dead weight reads as unfinished to reviewers, and the extra code is where the next bug hides. If the diff feels padded, say `deslop it` before you commit, not after review calls it out.
 

docs/guide/10-recipes-and-pitfalls.md

@@ -171,7 +171,7 @@ That's the whole prompt. [`/pstack:bro`](../../skills/bro/SKILL.md) restates the
 - **Correcting the same mistake by hand.** A correction in chat helps one run. `/pstack:correct` fixes the repo so no later run repeats it.
 - **Using `/pstack:arena` for coverage.** `/pstack:arena` repeats one design or code brief, then picks a base and grafts the best parts. `/pstack:swarm` partitions slices or declared race arms and aggregates one report.
 - **Accepting every review comment.** Bots and humans both file real catches and noise in one list. `/pstack:interrogate` sorts findings into act-on and dismissed buckets with reasons, and you can override either way.
-- **Treating `auto` as a model slug.** `auto` and `inherit-parent` mean "omit the model field so the subagent inherits the parent chat model." [Setup](./01-setup.md) covers the roles.
+- **Treating `auto` as a model slug.** `auto` and `inherit-parent` mean "spawn the role's subagents with `subagent_general` or `subagent_explore`, so they follow the parent chat model." [Setup](./01-setup.md) covers the roles.
 - **Putting a Fusion model in a role.** A `fusion-*` slug names a lead and sidekick pair for the main chat, so pstack rejects it and falls back to the role's default. Pick the lead's or the sidekick's own slug, like `claude-opus-5-5-max` or `swe-2-high`.
 - **Reporting success off a green build.** A build proves it compiles. Ask for the real command, flow, stored value, or profile, and expect the evidence in the reply.
 - **Writing a `SKILL.md` freehand.** Route it through the [Authoring or modifying a skill playbook](../../skills/poteto-mode/playbooks/authoring-a-skill.md) so validation and review happen.

skills/automate-me/SKILL.md

@@ -26,7 +26,7 @@ Update mode changes the rest of the flow:
 
 ### 1. Mine their history
 
-Locate the active workspace's transcripts before fanning out. `devin list` names this directory's sessions; their data lives under `~/Library/Application Support/Devin/` on macOS (`%APPDATA%\devin` on Windows). Use only this workspace's sessions. Don't sweep unrelated projects' sessions. That crosses workspace boundaries and reads private chats.
+Locate the active workspace's transcripts before fanning out. `devin list --format json` names this directory's sessions. The CLI stores them in `~/.local/share/devin/cli/sessions.db` (`$XDG_DATA_HOME` or `DEVIN_SESSIONS_DIR` when set; `%APPDATA%\devin\cli\` on Windows). Don't read other directories' sessions. Use only this workspace's sessions. Don't sweep unrelated projects' sessions. That crosses workspace boundaries and reads private chats.
 
 Survey recent agent conversations within that scope for recurring patterns. Run multiple parallel subagents across slices of history (e.g. last 2-4 weeks, split into 3 slices so each has enough material). Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section of the **poteto-mode** skill. Each slice mining subagent reads transcripts from the workspace-scoped path the parent provides, looks for the signals below, and returns a short structured list of patterns it saw with evidence pointers. Default signals worth hunting:
 
@@ -93,12 +93,12 @@ Work in a worktree off main. Commit and open a PR. Don't push to main directly.
 
 ## Evaluation
 
-A `-mode` skill is subjective output. A `create-skill`-style test/iterate benchmark loop isn't useful here. Vibe-check with the user: does it read like them? Did it miss anything? Then ship.
+A `-mode` skill is subjective output. An authoring-playbook-style test/iterate benchmark loop isn't useful here. Vibe-check with the user: does it read like them? Did it miss anything? Then ship.
 
 Run a description-optimization loop only if the skill's trigger accuracy turns out to be a problem in practice.
 
 ## When not to use
 
-- User wants a task-specific skill (not working conventions): `create-skill` alone, no mining required.
+- User wants a task-specific skill (not working conventions): run the Authoring or modifying a skill playbook (`skills/poteto-mode/playbooks/authoring-a-skill.md`) alone, no mining required.
 - User wants to capture one narrow workflow (e.g. "how I write commit messages"). That's a regular skill, not a mode skill.
 

skills/poteto-help/SKILL.md

@@ -107,9 +107,9 @@ Close calls:
 
 Not in pstack:
 
-- `deslop`, `control-cli`, and `control-ui` ship in Cursor's `cursor-team-kit` plugin and are not part of this port. Ask for the same outcome in plain words.
+- `/deslop`, `control-cli`, and `control-ui` ship in the `cursor-team-kit` plugin.
 - `/loop` is a Devin built-in.
-- pstack has no `/pstack:orchestrate` skill. Orchestrate is a `/pstack:poteto-mode` playbook.
+- pstack has no `/orchestrate` skill. Orchestrate is a `/pstack:poteto-mode` playbook. If the slash menu shows `/orchestrate`, another plugin provides it.
 
 ## Playbooks and principles
 

skills/poteto-mode/playbooks/eval.md

@@ -19,7 +19,7 @@
 3. **Author one organic prompt.** What a user would type. No leakage of what's being measured.
 4. **Spawn N parallel candidates** on different models per the **arena** skill's Phase B. Each works in its own sanitized dir. Same prompt to each. Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section.
 5. **Spawn one blinded judge** on a different model family per the **arena** skill's Phase C. Judge sees outputs by sanitized label and the rubric, never a model name.
-6. **Verify the chain from transcripts, not self-report.** Read each candidate's local transcript in Devin's session store (`devin list` names this directory's sessions; data lives under `~/Library/Application Support/Devin/` on macOS, `%APPDATA%\devin` on Windows). Do not read unrelated projects' sessions. Look at which files each candidate actually opened. Grade chain-following from the files it really read plus the shape of the code, never from the candidate's own claims.
+6. **Verify the chain from transcripts, not self-report.** Read each candidate's local transcript in Devin's session store. `devin list --format json` names this directory's sessions. The CLI stores them in `~/.local/share/devin/cli/sessions.db` (`$XDG_DATA_HOME` or `DEVIN_SESSIONS_DIR` when set; `%APPDATA%\devin\cli\` on Windows). Don't read other directories' sessions. Do not read unrelated projects' sessions. Look at which files each candidate actually opened. Grade chain-following from the files it really read plus the shape of the code, never from the candidate's own claims.
 7. **Read every candidate output yourself** end to end. Compare to the judge's verdict. Disagreement means a model is biased or the rubric is ambiguous. Synthesize.
 
 **Reply:** variant under test, rubric, per-candidate notes, judge's verdict, your synthesis, and a recommendation for whether to promote the variant.

skills/poteto-mode/playbooks/session-pickup.md

@@ -2,7 +2,7 @@
 
 **You own the resume point. Read the prior trail, don't redo it.**
 
-1. Locate the prior trail. A local transcript in Devin's session store (`devin list` names this directory's sessions; data lives under `~/Library/Application Support/Devin/` on macOS, `%APPDATA%\devin` on Windows — do not read unrelated projects' sessions), a cloud-session URL, or a pushed branch. Read the metadata overview and last messages first, then scan back for the decision points. Parse a long transcript in a subagent and keep the reduced timeline in the main thread (the **principle-guard-the-context-window** skill). Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section.
+1. Locate the prior trail. A local transcript in Devin's session store, a cloud-session URL, or a pushed branch. `devin list --format json` names this directory's sessions. The CLI stores them in `~/.local/share/devin/cli/sessions.db` (`$XDG_DATA_HOME` or `DEVIN_SESSIONS_DIR` when set; `%APPDATA%\devin\cli\` on Windows). Don't read other directories' sessions. Do not read unrelated projects' sessions. Read the metadata overview and last messages first, then scan back for the decision points. Parse a long transcript in a subagent and keep the reduced timeline in the main thread (the **principle-guard-the-context-window** skill). Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section.
 2. Reconstruct operational state. The branch and worktree, what already landed (`git log`, `git diff` against the base), the open todos, the decisions made. The prior trail is authoritative input. Resist the bias to re-derive it.
 3. Diff done vs pending. Compare what shipped against what was planned, name the resume point, do not re-run the prior repro or redo completed work. A "let me verify from scratch" pass means you're treating the trail as untrustworthy when it's authoritative.
 4. Route the remaining work to the matching playbook and pick the verdict: continue the execution, ship a finished recommendation, ratify or override a prior conclusion, or postmortem a failed run. The pickup playbook ends here. The routed playbook owns the rest.

skills/poteto-mode/scripts/worktree-audit.sh

@@ -61,9 +61,9 @@ elif raw=$(gh pr list --author "@me" --state all --limit 1000 \
 fi
 [ -s "$prs" ] || echo "[]" > "$prs"
 
-# Devin session store: per-session data under the app's user dir.
-transcripts="$HOME/Library/Application Support/Devin/User"
-[ "$(uname)" = "Darwin" ] || transcripts="$HOME/.config/devin"
+# CLI session store: ~/.local/share/devin/cli/sessions.db
+# ($XDG_DATA_HOME or DEVIN_SESSIONS_DIR when set). No per-OS branch.
+transcripts="${DEVIN_SESSIONS_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/devin/cli}"
 now=$(date +%s)
 
 echo "# base: $base"

skills/recall/SKILL.md

@@ -12,7 +12,7 @@ Keep it tight and on-topic. Read only what the in-scope threads need, then stop.
 
 Your context lives in two records. Your own chat history holds what you did and decided. The shared record holds everything that happened around the same code under other names: the symptoms users keep reporting, the fixes that shipped and got reverted, the errors still firing in prod. That second record is what the **why** skill searches, across source control, the issue tracker, chat and issue channels, long-form docs, and error tracking. A feature with a long bug tail keeps most of its story there, so don't reconstruct it from your transcripts alone.
 
-Transcripts live in Devin's session store: `devin list` names the sessions for the current directory, and session data lives under `~/Library/Application Support/Devin/` on macOS (`%APPDATA%\devin` on Windows) — per-session message stores under `User/`, ordered by real modification time.
+`devin list --format json` names this directory's sessions. The CLI stores them in `~/.local/share/devin/cli/sessions.db` (`$XDG_DATA_HOME` or `DEVIN_SESSIONS_DIR` when set; `%APPDATA%\devin\cli\` on Windows). Don't read other directories' sessions.
 
 1. Classify, then route. One specific prior chat to resume is the `session-pickup` playbook, not this. Turning habits into a durable skill is `automate-me`. A human-readable summary of your work is a different task. Recall loads working context across recent chats before you act. If the user already gave you a full state capsule (paths, branch, the change), use it and skip the mining.
 2. Lock the scope before searching. Pin the window ("recent" is a real range, default the last 7 days), the topic if named, and the workspace (default the active one. Never read another project's transcripts without being asked). State the scope back. Never quietly turn "all" into "recent N".

skills/reflect/SKILL.md

@@ -12,12 +12,10 @@ Invoke when the user says "reflect" or "/pstack:reflect". Skip when the conversa
 
 ## 1. Locate the active transcript
 
-Before fanning out, find this conversation's transcript in Devin's session store. `devin list --format json` names the sessions for the current directory and gives each one's `id`. The CLI stores transcripts at `~/.local/share/devin/cli/transcripts/<id>.json` (Devin Desktop stores its own under `~/Library/Application Support/Devin/` on macOS, `%APPDATA%\devin` on Windows). Do not read another project's sessions — that crosses workspace boundaries and reads private chats from unrelated projects.
+Before fanning out, find this conversation's transcript in Devin's session store. `devin list --format json` names this directory's sessions. The CLI stores them in `~/.local/share/devin/cli/sessions.db` (`$XDG_DATA_HOME` or `DEVIN_SESSIONS_DIR` when set; `%APPDATA%\devin\cli\` on Windows). Don't read other directories' sessions. Do not read another project's sessions — that crosses workspace boundaries and reads private chats from unrelated projects.
 
 ```bash
 devin list --format json | jq -r '.[].id'
-ls -t "$HOME/.local/share/devin/cli/transcripts"/*.json 2>/dev/null | head -10
-ls -t "$HOME/Library/Application Support/Devin"/User/**/*.jsonl "$HOME/Library/Application Support/Devin"/User/acp-messages/*.db 2>/dev/null | head -10
 ```
 
 Prefer the CLI transcript whose `id` matches this session. Otherwise order candidates by real modification time and take the one whose opening user prompt matches this conversation. If none matches or the store is unreadable, pass a tight digest of the session instead.

skills/show-me-your-work/SKILL.md

@@ -54,7 +54,7 @@ Commit it only when the work is ambitious enough that a reviewer needs the trail
 
 ## Audit the log against the transcript
 
-At the end of the run, before handing back, check the log told the truth. Read this run's transcript in Devin's session store: `devin list` names this directory's sessions and `~/Library/Application Support/Devin/` on macOS (`%APPDATA%\devin` on Windows) holds the per-session data. Don't read unrelated projects' sessions. That reads private chats. Walk this run's rows against what actually happened. Each stretch of them begins at one of this run's `start` rows, or at the first row if this run created the log, and ends at the next `start` row of another run:
+At the end of the run, before handing back, check the log told the truth. Read this run's transcript in Devin's session store. `devin list --format json` names this directory's sessions. The CLI stores them in `~/.local/share/devin/cli/sessions.db` (`$XDG_DATA_HOME` or `DEVIN_SESSIONS_DIR` when set; `%APPDATA%\devin\cli\` on Windows). Don't read other directories' sessions. Don't read unrelated projects' sessions. That reads private chats. Walk this run's rows against what actually happened. Each stretch of them begins at one of this run's `start` rows, or at the first row if this run created the log, and ends at the next `start` row of another run:
 
 - Check that every row maps to a real decision or action.
 - Check that each row's evidence resolves and shows what the row claims.

skills/typescript-best-practices/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: typescript-best-practices
 description: TypeScript best practices. Use when reading or editing any .ts or .tsx file.
-triggers: [user, model]
+triggers: [user]
 ---
 
 # TypeScript best practices