Tools
Pstack
By pstack workflows as an installable OpenClaw plugin
Install
npm install --frozen-lockfileConfiguration Example
{
"version": 1,
"presets": {
"implementation": { "model": "provider/model-id", "thinking": "high", "fastMode": true }
},
"roles": { "feature, refactoring": "implementation", "bug-fix": "implementation" }
}README
# openclaw-pstack
Independent MIT-licensed adaptation of **pstack by Lauren Tan** for OpenClaw.
This is **not an official Cursor plugin**, and it does not run the Cursor runtime.
Package: `@fuller-stack-dev/openclaw-pstack` · plugin id: `pstack` · version: `1.2.5`.
Maintenance owner: fuller-stack-dev; report bugs through this repository's issues.
Pstack owns workflow; OpenClaw owns secure execution. The plugin supplies
exact-session opt-in, 17-role model planning, 32 workflow routes, 24 principles
and 23 playbooks. It registers two model-readable guidance skills, 55 manual-only
route skills, `/pstack` and `/poteto_mode` plus 55 literal `pstack-` route
commands, read-only pstack_route, pstack_plan_check and pstack_brief, pstack_workflow,
operator-opt-in pstack_trail and pstack_worktree_audit, and before_prompt_build plus
narrowly matched before_tool_call hooks.
No core patch, provider, credential resolver, separate database or scheduler.
**1.0: native controllers on capable hosts, v1 elsewhere.** On a host that grants
the plugin command runtime (requester-bound native subagents, the requester model
catalog, the owned-children list and scheduled command turns), the architect,
arena, interrogate, swarm, how, why and reflect commands run their workflows as
code. Each child phase resolves roles over the host catalog, spawns real children
with the role's output contract, checks the host selection receipt against the
routing snapshot, and writes deterministic CAS records. `/pstack resume` and
scheduled continuations finish a panel after a short bounded wait, survive
Gateway restarts, and never respawn accepted children. On older hosts the same
commands keep the skill-guided v1 path; see
[native controllers](skills/pstack/native/session-mode.md#native-controllers).
**1.1: controller parity.** New native architect records ground the design in
independent how and why children before the runners (`how-only` or `greenfield`
narrows that); interrogate adds a routed `judgment and prose` lead after both
reviewers. How, why and interrogate end with that child: the command reply quotes
its result verbatim with slot, role, host-reported model, run and artifactDigest,
instead of a parent rewrite. Reflect shows its synthesizer's rows verbatim before
waiting for approval. Swarm workers write where their slice method says, a retry
names the failure, and a second miss is a recorded coverage gap that still reaches
aggregate. Records created by 1.0 keep their stages. `/pstack-poteto-help` and
`/pstack-setup-pstack` now let the agent answer the question read-only. On hosts that
report canonical model families (`requester-model-family-v1`), pools and panels
report `different-family` only when both families are known and differ. Route text
now requires a routed child's result to be delivered verbatim and attributed, a
bounded-wait handoff, ordered commits where authorized, and pstack_route blind
mode for blind trials.
**1.2: corrections and visible handoffs.** A native deliverable (how's explanation, why's
synthesis, interrogate's lead verdict, reflect's rows) that the controller rejects, that
comes back BLOCKED, or that lacks a required section gets one correction child under the
same routing snapshot and profile, briefed with its output and the errors. After delivery,
`/pstack resume <id> correct <what is wrong>` runs one correction of a completed how, why or
interrogate result. A reply that hands off pending children names the owner session, each
pending child's run id and the exact `/pstack resume <id>` command. pstack_brief accepts a
required read named `path#heading`.
Literal prefixed route commands and generated manual discovery guides are included. A reviewed
[upstream rule overlay](skills/pstack/native/semantic-overlay.md) maps every
pinned upstream line that states a MUST, required or never rule to the native
requirement gate or guidance text that carries it, or to a justified exclusion.
The doctor fails on an unmapped rule or on drift from the pinned upstream hashes.
That mapping is reviewed text coverage, not proof that a model follows a rule.
See [ledger behavior and limits](skills/pstack/native/workflow-ledger.md). The supplied-source
[plan adapter](skills/pstack/native/plan-adapter.md) exposes the unchanged complete
plan checker through native tool admission. Its PASS is structure-only, not
route execution, acceptance evidence or approval. The optional
[trail](skills/pstack/native/trail-adapter.md) and
[worktree audit](skills/pstack/native/worktree-audit-adapter.md) adapters replace
the source-only upstream `log.sh` and `worktree-audit.sh`. They are exposed only
after the operator allowlists them in `tools.allow`, refuse sandboxed sessions,
and never verify evidence or authorize deletion. The trail also refuses
workspaceOnly or unknown-policy sessions, because plugin tools are not told when
a session is read-only, unless the operator sets
`plugins.entries.pstack.config.trailInRestrictedSessions=true`. The audit never
runs `git status` or any read that converts file content, so repository config
cannot make it start a filter, diff, fsmonitor, signature or transport program,
even when that config is written during the audit.
[Native agent briefs](skills/pstack/native/agent-briefs.md) port the two
upstream agents as labeled templates rendered by read-only pstack_brief. Every
panel and pool role has a closed output contract that pstack_brief checks,
pstack_workflow enforces at collection, and native controllers pass to the host as
`outputSchema`. On hosts with narrow-only subagent profiles (S5), pstack registers
four [host profiles](skills/pstack/native/agent-briefs.md#host-subagent-profiles) and
spawns the native controllers' read-only roles under them, so the host removes
file-editing, spawning and plugin tools from those children and records the
instructions digest. Agent-driven briefs, and every role on other hosts, stay
prompt-enforced: a brief constraint plus inherited tool policy.
## Requirements and compatibility
- OpenClaw **2026.10.5 or newer and keyed-store V2 support**. Version admission
stays at `>=2026.10.5` so current main builds reporting 2026.10.5 are not excluded.
The stable v2026.10.5 tag lacks `api.runtime.state.openKeyedStoreV2` and is
rejected with an actionable error before any full-mode plugin surface registers.
Host cli-metadata discovery intentionally has no runtime: registration defers
runtime access in that mode and still exposes the pstack CLI root. CLI execution
uses full registration and retains the V2 requirement. Use
OpenClaw 2026.10.10-beta.2 or a current main build exporting that contract.
Qualification pins `v2026.10.10-beta.2` at
`2b85c4c25ea98d72ca1d3e93fb0fd9cac8f0ddab`; retest when upgrading.
- Native controllers need a host that advertises `command-native-subagents-v1` and
`requester-model-catalog-v1`. S4 reconciliation needs `native-subagent-list-v1`;
unattended continuation needs `command-scheduled-turns-v1`, and restart
continuity `command-scheduled-turns-restart-v1`. Host-enforced read-only children
need `native-subagent-profiles-v1` (S5, main at or after `492af55`). These are on
openclaw main only, in no release yet. Without them the plugin keeps v1 behavior,
and read-only roles are prompt-enforced.
- Node **24.16+** (or a supported newer OpenClaw Node runtime; current main needs 24.22.1+).
- Python 3 for `openclaw pstack doctor` and integrity verification.
- Authorized internal/webchat commands with host-exported sender authority and
exact session identity. Other channels are not supported.
- Models and execution tools are supplied/configured by the host, not this plugin.
Reader/reproduction routes additionally need the named installed tools and
authorized access. Missing tools are blockers, not permission to install or log in.
## Install
**Not published yet.** The following registry command is for after the owner
chooses to publish and ClawHub verification makes the release available:
```sh
openclaw plugins install clawhub:@fuller-stack-dev/openclaw-pstack@1.2.5
```
For a reviewed local artifact, install the exact tarball printed by `npm run pack`:
```sh
openclaw plugins install npm-pack:/absolute/path/openclaw-pstack-1.2.5-COMMIT.tgz --force
```
The local-source trust gate requires `--force` **only after reviewing that exact
archive**; it does not grant conversation access. Review the host's separate
capability-consent prompt. Add `pstack` to an existing
`plugins.allow` list if you use one, preserving other entries. Enable the plugin
and explicitly consent to the conversation hook:
```sh
openclaw plugins enable pstack
openclaw config set plugins.entries.pstack.hooks.allowConversationAccess true
openclaw plugins inspect pstack --runtime --json
openclaw pstack doctor
```
Do not set `allowPromptInjection: false` for this plugin if you expect active
routing guidance. Config writes/reload affect host plugin and bundle-MCP runtimes;
schedule them outside long active runs. Use the host's supported lifecycle and
approval flow; installation instructions are not authorization to restart a host.
Inspect should show **before_prompt_build** and **before_tool_call**, never
reply_dispatch. The latter only checks reserved pstack-tagged sessions_spawn calls;
untagged calls pass unchanged and arguments are never rewritten. On a capable host,
installation reviews the manifest's `commandRuntimeCapabilities` (`subagents`,
`scheduledTurns`) and `sessionScheduledTurns` (`requester-command`) contracts.
Doctor is read-only; it checks package integrity (including byte-verified npm
`.gitignore` → `.npmignore` relocation), not model availability or a
live session's active prompt. Verify an ordinary active follow-up separately.
## Commands
| Command | Effect |
| --- | --- |
| `/pstack` or `/pstack on` | Activate for this exact native session/incarnation/workspace |
| `/pstack off` | Deactivate; another activating sender cannot be impersonated |
| `/pstac
... (truncated)
tools
Comments
Sign in to leave a comment