PR #576 - cursor/plugins

Supersedes #257. Credit to @mantrakp04 for the original change (co-author trailer on the commit).

What

Adds pstack/plugin.json, a root manifest for the Agent Plugins 1.0.0 schema. Clients that read that format can find pstack's skills/ through this file. It uses the same pattern as origin-apps (#423): a Cursor manifest in .cursor-plugin/ and a v1 manifest at the root.

Codex already finds pstack's skills without this file, because it falls back to .cursor-plugin/plugin.json. With this file, Codex reads pstack's metadata (name, version, description, and author) from the root manifest. The set of skills does not change, because both manifests point to the same skills/ directory.

The diff is one new file. Name, version, description, author, homepage, repository, license, and keywords are the same as in pstack/.cursor-plugin/plugin.json.

Changes from #257

version is 0.15.19, the same as the current Cursor manifest. #257 had 0.14.2, which is out of date. The schema permits you to omit version. I kept it because Codex shows a v1 plugin with no version as 1.0.0.
Removed the poteto-mode rename in pstack/skills/poteto-mode/SKILL.md. That change reverted #149.
Removed the pstack/README.md change.

Which manifest Cursor reads

When both files exist, Cursor reads .cursor-plugin/plugin.json first and ignores the root plugin.json. Cursor's plugin loader checks .cursor-plugin/plugin.json before the root plugin.json. It stops at the first manifest that declares components or display fields, and it does not merge fields from manifests after that one. pstack's Cursor manifest declares skills, agents, displayName, and logo, so it always wins. The root file is only for Agent Plugins v1 readers. It has no effect on what Cursor shows or loads.

Drift between the two manifests

Nothing stops the two manifests from drifting apart. scripts/validate-plugins.mjs validates only .cursor-plugin/plugin.json (and the marketplace file). It does not read the root plugin.json, does not check it against the v1 schema, and does not compare the two versions. A future pstack version bump must change both files by hand. If the root version becomes stale, Codex and other v1 readers will show the wrong version. This PR does not add a drift check.

Existing behavior: Codex can start slash-only skills automatically

51 of pstack's 52 skills have disable-model-invocation: true, so in Cursor they start only from a slash command. Codex ignores that field. From SKILL.md frontmatter, Codex reads only name, description, and metadata.short-description. It permits implicit invocation unless a skill has an agents/openai.yaml file with policy.allow_implicit_invocation: false (Codex skills docs). Codex has no plugin-level setting for this.

This behavior exists today without this PR. A Codex user who installs pstack now gets it through .cursor-plugin/plugin.json, and Codex can start skills such as poteto-mode, swarm, and arena without a command when it thinks they match the task. This PR does not add or remove that behavior. To keep the 51 skills manual in Codex, each skill would need its own sidecar file. That is out of scope for this PR.

Testing

Agent Plugins 1.0.0 schema: pstack/plugin.json is valid, with 0 errors (Ajv, draft 2020-12, strict mode).
Repo validator: node scripts/validate-plugins.mjs passes.
Cursor CLI: I loaded two copies of pstack/ with agent -p --plugin-dir. One copy had both manifests. The control copy had only .cursor-plugin/plugin.json. I added a probe agent with a unique name to each copy. Both runs loaded the probe agent from agents/ and setup-pstack from skills/ at the local path. Neither run showed a warning or error. The CLI does not display the plugin logo, so this test does not cover it. The logo comes from the logo field in .cursor-plugin/plugin.json, and this PR does not change that file.
Codex CLI (0.162.1): I installed pstack from a local marketplace twice, once without the root manifest and once with it. Without it, Codex read .cursor-plugin/plugin.json. With it, Codex read the root manifest. Both installs offered the same 52 skills for implicit invocation in the model prompt.