test: prove generated installer lifecycle

[ScriptedAlchemy]

Context

PR #7 had already squash-merged before the installer-test and foundational-sequencing grounding arrived. Rewriting merged main would add risk and restore the legacy path temporarily, so this proof-only follow-up completes the requested behavior without reintroducing any handwritten installer or host manifest.

Foundational sequence

The resulting tree follows the requested dependency order:

1. Subtract — PR feat: publish plugin-library as an Agent Bundle #7 removed the handwritten install.mjs, INSTALL.md, root plugin.json, .cursor-plugin/, .claude-plugin/, .codex-plugin/, and legacy installer test. No parallel legacy surface remains.
2. Scaffold — PR feat: publish plugin-library as an Agent Bundle #7 added the root Agent Bundle config, TypeScript/build/validation scripts, CI, and artifact-branch publisher. The package is private, so no Changeset check or changeset is applicable.
3. Core loop — PR feat: publish plugin-library as an Agent Bundle #7 moved the command and skill under src/, selected only cursor + the assumed Grok Bot portable path, and compiled the sidecar/launcher into the artifact.
4. Proof — commit 0bb308e in this PR restores test/install.test.js as a behavior-level proof against the generated artifact/install.mjs.

This PR intentionally has one coherent commit: the generated-installer proof. The earlier phases cannot be retroactively split into commits after GitHub created merge commit 67b46416fd7410099e33716232a0b96a2a230c02.

What the proof observes

npm test builds first, then test/install.test.js executes the generated installer in isolated temporary homes and asserts:

• installed files equal the generated manifest inventory exactly;
• the Cursor plugin manifest, command, skill, data, and scripts are present;
• the lifecycle receipt records Cursor local/user installation and a content hash;
• a second identical install reports Already installed;
• uninstall planning does not mutate the install;
• receipt-owned uninstall removes the install.

The packed clean-consumer proof now also clears inherited Agent Bundle state overrides and pins XDG state inside its temporary home.

Verification

npm run check passed:

• Agent Bundle source validation
• TypeScript typecheck
• generated artifact build
• 18 Node tests
• artifact validation
• packed clean-consumer install + framework Doctor + sidecar HTTP smoke

A poisoned AGENT_BUNDLE_STATE_ROOT run also passed, proving the tests do not write outside their temporary homes. Independent Fable review found no remaining material risk.

Scope

The Applier / missing_attach_api wiring is intentionally unchanged. It is a separate coordination capability and would spread special-case behavior across the server, picker, and external Applier rather than deepen the generated install surface.

The old handwritten install.mjs remains deleted. Agent Bundle is the sole owner: agent-bundle build emits artifact/install.mjs, and both install proofs execute that generated file or its package-bound equivalent.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0bb308e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T06:03:32.447219Z	0bb308e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0bb308e119

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Compare the actual installed inventory to the manifest

When the generated installer copies an unexpected or stale file but still populates receipt.files from the manifest, this assertion passes because it compares two metadata lists rather than inspecting the installed directory. Since this test is intended to prove that only manifest files are installed, recursively enumerate the installation tree (excluding the receipt itself) and compare that inventory with the manifest.

Useful? React with 👍 / 👎.