feat: publish plugin-library as an Agent Bundle

[ScriptedAlchemy]

Summary

• Convert plugin-library into one Agent Bundle project at the repository root. It remains one explorer plugin, not a marketplace of independent plugins.
• Generate only the cursor and portable projections with marketplace: true; remove handwritten Cursor/Claude/Codex/portable manifests and the handwritten installer.
• Publish the validated composite root to the stable agent-bundle-artifact branch after each main update, so Cursor can import the repository and track the generated branch without committing build output to main.
• Move the skill and command under src/, compile the sidecar and launcher as artifact scripts, and add package-bound install/doctor plus a clean-consumer smoke.

Shape and assumption

plugin-library is one sidecar explorer with one skill and one command. Its catalog data describes other plugins, but those rows are data, not separately installable projects in this repository.

The requested Grok Bot path is interpreted as the Agent Plugins 1.0.0 portable projection. The current gbot CLI has roster/messaging commands but no plugin-install verb, so the gate proves the portable plugin.json + skill pack and does not claim remote Grok Bot activation. The Cursor slash command is documented as Cursor-only.

Cursor's documented GitHub route is a Teams/Enterprise Team Marketplace import: import https://github.com/ScriptedAlchemy/plugin-library and select agent-bundle-artifact. Existing imports that tracked main must re-import the generated branch. The publish workflow creates that branch only after this PR lands, so this PR proves the same generated artifact locally; post-merge verification will fetch the branch from GitHub.

Framework version

npm view agent-bundle version returned 0.1.2, not 0.2.1. The lockfile therefore uses the pkg.pr.new revision pinned by cargo-hauler (62ffe403c5af73499fe7f5767c6d60be26e250db).

Verification

npm run check passed on Node 24.15.0:

• agent-bundle validate
• agent-bundle build
• agent-bundle validate --artifact artifact
• tsc -p tsconfig.json --noEmit
• 15 Node unit/integration tests
• packed clean-consumer smoke

The packed smoke installs the generated npm root into a clean prefix/HOME, runs plugin-library-install install cursor, runs framework Doctor, starts the installed sidecar, fetches /api/library, and stops it. Doctor reported:

installed copy: current
lifecycle: registered
Doctor summary: 0 error(s), 0 warning(s), 1 info(s)

The informational finding is Cursor's lack of a non-interactive surface for observing enabled/active state.

Independent Fable review found no remaining material merge risk after follow-up fixes. No changeset is included because this package is private. No Agent Bundle framework issue was required.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 985c90a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR