fix(pstack): include licenses and attribution in plugin packages

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "pstack",
       "source": "./plugins/pstack",
       "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
-      "version": "1.9.0",
+      "version": "1.9.1",
       "author": {
         "name": "Lauren Tan (original)"
       },

CHANGELOG.md

@@ -4,6 +4,12 @@ This file records what each version of the Open Pstack package changed. Versions
 
 Entries describe package versions. Published release checkpoints have tag links; installation follows `main` unless pinned. Validation belongs to the linked pull requests. Older reports remain available through immutable links.
 
+## 1.9.1 packages license texts and credits the Open Pstack port
+
+Cursor baseline: [0.15.5](https://github.com/cursor/plugins/tree/12d587dfb20741cafc376c42c696c5f6e2a64487/pstack). [Issue #82](https://github.com/arjitj2/open-pstack/issues/82).
+
+The packaged plugin now ships full copies of `LICENSE`, `NOTICE.md`, and both `LICENSES/` texts alongside the skills, so an installed plugin carries the upstream licenses and attribution record instead of pointing back at the repository root. The included-sources table credits Eric Litman's Open Pstack port alongside the Cursor, Cursor Team Kit, and Superpowers sources, and `tests/skill-collision-repro.sh` fails if the packaged copies drift from the canonical files.
+
 ## 1.9.0 exposes external worker lifecycle progress
 
 Cursor baseline: [0.15.5](https://github.com/cursor/plugins/tree/12d587dfb20741cafc376c42c696c5f6e2a64487/pstack). [PR #71](https://github.com/arjitj2/open-pstack/pull/71).

CONTRIBUTING.md

@@ -22,6 +22,8 @@ To test an unreleased change, use a separate installation or a disposable worksp
 
 Read [AGENTS.md](AGENTS.md) and [UPSTREAM.md](UPSTREAM.md) before editing. Keep one shared skill tree for Codex and Claude Code. Preserve upstream licenses and credit. Record intentional differences from Cursor in the [decision ledger](maintenance/upstream-ledger.json). Each fact has one owner in the [documentation ownership](AGENTS.md#documentation-ownership) map. Update that owner and link to it from other pages.
 
+`main` is protected: changes land through pull requests, the `verify` check from GitHub Actions must be up to date on the head commit (including for the owner), and force pushes and deletion of `main` are blocked. External approvals are not required. The installed-parent evidence under [Validate a change](#validate-a-change) is maintainer policy, not a branch-protection gate.
+
 ## Development tools
 
 [Bun](https://bun.sh) runs the packaged TypeScript tools and tests. Node runs `check-plan.mjs`; Python 3 runs repository maintenance scripts and their tests. Install dependencies with `bun install --frozen-lockfile` in `plugins/pstack/skills/poteto-mode/scripts/`.

NOTICE.md

@@ -1,6 +1,6 @@
 # Attribution
 
-Open Pstack adapts MIT-licensed work for Claude Code and Codex. The complete license texts are preserved in [LICENSE](LICENSE) and [LICENSES/](LICENSES/).
+Open Pstack adapts MIT-licensed work for Claude Code and Codex. The complete license texts are preserved in [LICENSE](LICENSE) and [LICENSES/](LICENSES/). Copies of this notice, `LICENSE`, and `LICENSES/` ship inside the packaged plugin at `plugins/pstack/`; the canonical files live at the repository root.
 
 ## Project lineage
 
@@ -12,16 +12,17 @@ Ted Mader contributed optional Sonnet, Astra, Luna, and Terra model support in [
 
 ## Included sources
 
-| Component | Copyright | License |
+| Component | Copyright / attribution | License |
 | --- | --- | --- |
 | Pstack-derived skills, agents, playbooks, tools, and assets from [cursor/plugins/pstack](https://github.com/cursor/plugins/tree/main/pstack) | (c) 2026 Lauren Tan | [MIT](LICENSE) |
+| Port-authored adaptations for the shared Claude Code and Codex distribution from [Eric Litman's Open Pstack](https://github.com/ericlitman/open-pstack) | Eric Litman | [MIT](LICENSE) |
 | Cursor Team Kit skills `deslop`, `thermo-nuclear-code-quality-review`, `make-pr-easy-to-review`, `fix-ci`, `fix-merge-conflicts`, `get-pr-comments`, and `what-did-i-get-done`, imported at [`e46364b`](https://github.com/cursor/plugins/tree/e46364b8be46000b7df0f260550cd712afbb8d36/cursor-team-kit/skills) | (c) 2026 Cursor | [MIT](LICENSES/LICENSE-cursor-team-kit) |
 | `plugins/pstack/hooks/run-hook.cmd`, adapted near-verbatim from Superpowers 6.1.0 in [anthropics/claude-plugins-official](https://github.com/anthropics/claude-plugins-official/tree/main/plugins/superpowers), originally obra/superpowers | (c) 2025 Jesse Vincent | [MIT](LICENSES/LICENSE-superpowers) |
 
-[UPSTREAM.md](UPSTREAM.md) records the incorporated Pstack revision. The [historical import record](https://github.com/arjitj2/open-pstack/blob/5f0bb42dea46344c2f1961ebeebaeee135b49778/NOTICE.md#upstream-sources) identifies earlier component revisions, including the initial `e46364b` import and subsequent `3fe2823`, `bdf7aa3`, `efa2a53`, `71ed0d1`, `f8abedd`, and `12d587df` updates. Source files retain their upstream notices where present.
+[UPSTREAM.md](https://github.com/arjitj2/open-pstack/blob/main/UPSTREAM.md) records the incorporated Pstack revision. The [historical import record](https://github.com/arjitj2/open-pstack/blob/5f0bb42dea46344c2f1961ebeebaeee135b49778/NOTICE.md#upstream-sources) identifies earlier component revisions, including the initial `e46364b` import and subsequent `3fe2823`, `bdf7aa3`, `efa2a53`, `71ed0d1`, `f8abedd`, and `12d587df` updates. Source files retain their upstream notices where present.
 
 ## Port modifications
 
-The port changes Cursor-specific tools, paths, and harness instructions for Claude Code and Codex. The [upstream maintenance guide](UPSTREAM.md#port-adaptations) describes those adaptations.
+The port changes Cursor-specific tools, paths, and harness instructions for Claude Code and Codex. The [upstream maintenance guide](https://github.com/arjitj2/open-pstack/blob/main/UPSTREAM.md#port-adaptations) describes those adaptations.
 
 Port-authored work includes the plugin and marketplace manifests, Codex tool mapping, native Claude agent definitions, setup and provider integrations, tests, and repository documentation. The standalone `babysit` skill is informed by Cursor's public behavior without copying its implementation or prose. The SessionStart hook is port-authored except for the attributed Superpowers launcher above.

UPSTREAM.md

@@ -12,7 +12,7 @@ This page records the current Cursor baseline and the maintainer procedure for r
 | Path | `pstack/` |
 | Commit | `12d587dfb20741cafc376c42c696c5f6e2a64487` |
 | Upstream version | `0.15.5` |
-| open-pstack version | `1.9.0` |
+| open-pstack version | `1.9.1` |
 
 The table records the packaged version on `main` and the Cursor content it incorporates, minus the exclusions below. Detecting or reviewing a newer Cursor commit does not advance this baseline. Cursor's version identifies the imported content. The open-pstack version identifies the cross-harness package, and its numbers are independent of Cursor and Eric's port.
 

plugins/pstack/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pstack",
   "displayName": "pstack",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence. Ported from cursor/plugins/pstack for Claude Code and Codex.",
   "author": {
     "name": "Lauren Tan"

plugins/pstack/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pstack",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence. Codex port of the Claude Code plugin; skills are shared, tool names resolve via skills/poteto-mode/references/codex-tools.md.",
   "author": {
     "name": "Lauren Tan"

plugins/pstack/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Lauren Tan
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugins/pstack/LICENSES/LICENSE-cursor-team-kit

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cursor
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugins/pstack/LICENSES/LICENSE-superpowers

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jesse Vincent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

plugins/pstack/NOTICE.md

@@ -0,0 +1,28 @@
+# Attribution
+
+Open Pstack adapts MIT-licensed work for Claude Code and Codex. The complete license texts are preserved in [LICENSE](LICENSE) and [LICENSES/](LICENSES/). Copies of this notice, `LICENSE`, and `LICENSES/` ship inside the packaged plugin at `plugins/pstack/`; the canonical files live at the repository root.
+
+## Project lineage
+
+[Lauren Tan](https://github.com/cursor/plugins/tree/main/pstack) created Pstack. [Michael Denyer's pstack-claude](https://github.com/michael-denyer/pstack-claude) port is the origin of this repository's history, through import commit `053ed78732e3b71826933170eafe7f7782dda844`. [Eric Litman's Open Pstack](https://github.com/ericlitman/open-pstack) adapted it for a shared Claude Code and Codex distribution.
+
+Arjit Jaiswal maintains this distribution independently and tracks Cursor's Pstack directly. This does not imply affiliation with or endorsement by Cursor or the maintainers of other ports.
+
+Ted Mader contributed optional Sonnet, Astra, Luna, and Terra model support in [ericlitman/open-pstack#55](https://github.com/ericlitman/open-pstack/pull/55), original commit `ae37a1615d8d45bc6faee6e22130f2f5aa06abfe`. This distribution adapts that work for its provider setup and dispatch.
+
+## Included sources
+
+| Component | Copyright / attribution | License |
+| --- | --- | --- |
+| Pstack-derived skills, agents, playbooks, tools, and assets from [cursor/plugins/pstack](https://github.com/cursor/plugins/tree/main/pstack) | (c) 2026 Lauren Tan | [MIT](LICENSE) |
+| Port-authored adaptations for the shared Claude Code and Codex distribution from [Eric Litman's Open Pstack](https://github.com/ericlitman/open-pstack) | Eric Litman | [MIT](LICENSE) |
+| Cursor Team Kit skills `deslop`, `thermo-nuclear-code-quality-review`, `make-pr-easy-to-review`, `fix-ci`, `fix-merge-conflicts`, `get-pr-comments`, and `what-did-i-get-done`, imported at [`e46364b`](https://github.com/cursor/plugins/tree/e46364b8be46000b7df0f260550cd712afbb8d36/cursor-team-kit/skills) | (c) 2026 Cursor | [MIT](LICENSES/LICENSE-cursor-team-kit) |
+| `plugins/pstack/hooks/run-hook.cmd`, adapted near-verbatim from Superpowers 6.1.0 in [anthropics/claude-plugins-official](https://github.com/anthropics/claude-plugins-official/tree/main/plugins/superpowers), originally obra/superpowers | (c) 2025 Jesse Vincent | [MIT](LICENSES/LICENSE-superpowers) |
+
+[UPSTREAM.md](https://github.com/arjitj2/open-pstack/blob/main/UPSTREAM.md) records the incorporated Pstack revision. The [historical import record](https://github.com/arjitj2/open-pstack/blob/5f0bb42dea46344c2f1961ebeebaeee135b49778/NOTICE.md#upstream-sources) identifies earlier component revisions, including the initial `e46364b` import and subsequent `3fe2823`, `bdf7aa3`, `efa2a53`, `71ed0d1`, `f8abedd`, and `12d587df` updates. Source files retain their upstream notices where present.
+
+## Port modifications
+
+The port changes Cursor-specific tools, paths, and harness instructions for Claude Code and Codex. The [upstream maintenance guide](https://github.com/arjitj2/open-pstack/blob/main/UPSTREAM.md#port-adaptations) describes those adaptations.
+
+Port-authored work includes the plugin and marketplace manifests, Codex tool mapping, native Claude agent definitions, setup and provider integrations, tests, and repository documentation. The standalone `babysit` skill is informed by Cursor's public behavior without copying its implementation or prose. The SessionStart hook is port-authored except for the attributed Superpowers launcher above.

plugins/pstack/hooks/run-hook.cmd

@@ -1,7 +1,8 @@
 : << 'CMDBLOCK'
 @echo off
 REM Cross-platform polyglot wrapper for hook scripts.
-REM Adapted from the superpowers plugin (MIT); see NOTICE.md and LICENSE-superpowers.
+REM Adapted from the superpowers plugin (MIT); see NOTICE.md and LICENSES/LICENSE-superpowers
+REM at the plugin root.
 REM On Windows: cmd.exe runs the batch portion, which finds and calls bash.
 REM On Unix: the shell interprets this as a script (: is a no-op in bash).
 REM

tests/skill-collision-repro.sh

@@ -399,6 +399,23 @@ else
   note "ok: codex logo path resolves"
 fi
 
+license_mirror_bad=""
+for rel in LICENSE NOTICE.md LICENSES/LICENSE-cursor-team-kit LICENSES/LICENSE-superpowers; do
+  packaged="$plugin/$rel"
+  if [ -L "$packaged" ] || [ ! -f "$packaged" ]; then
+    license_mirror_bad="${license_mirror_bad}packaged copy is absent or not a regular file: $packaged"$'\n'
+  elif ! cmp -s "$repo/$rel" "$packaged"; then
+    license_mirror_bad="${license_mirror_bad}packaged copy differs from canonical $rel"$'\n'
+  fi
+done
+if [ -n "$license_mirror_bad" ]; then
+  note "FAIL: packaged license and notice copies drifted from the canonical files:"
+  note "$license_mirror_bad"
+  fail=1
+else
+  note "ok: packaged LICENSE, NOTICE.md, and LICENSES files match the canonical sources"
+fi
+
 if [ "${PSTACK_STATIC_ONLY:-0}" = "1" ]; then
   exit "$fail"
 fi