Repository navigation
Feature: emit ready-to-install host packs (and/or an 'agent-bundle install <host>' command) so projects don't hand-maintain install scripts #181
Description
Motivation
Every agent-bundle project today ends up writing and maintaining its own install scripts per host. cargo-conductor ships scripts/install-cursor.sh (~100 lines: builds the Cursor plugin.json + root manifests, copies skills/ and mcp-apps/, wires hook shims with absolute paths) plus documented manual steps for Claude Code (claude plugin install <name>@<marketplace>) and Codex (config.toml edits). The framework already knows everything those scripts encode — targets, manifests, hooks, MCP entry points — so hand-maintained installers are pure drift risk. Issue #126 (now closed) was one instance of that drift; the fix belongs a level up.
Ask
Either (or both) of:
- Installable packs in the artifact:
agent-bundle buildemits, per target, a self-contained directory in the exact on-disk layout the host loads, plus a tiny generatedinstall.sh/manifest describing where it goes (e.g.~/.cursor/plugins/local/<name>for Cursor local plugins). "Install" then degenerates to one copy that the generated script performs. agent-bundle install <host>command: resolves the host's install location (Cursor local plugins dir, Claude marketplace/plugin dirs, Codex config.toml + managed block), places the artifact, and registers MCP servers/hooks — idempotent and reversible (--uninstall). This is where per-host quirks (Cursor's manifest-at-root expectations from Cursor target artifacts don't match how Cursor actually loads local plugins (manifest location, hooks doc collision, root tokens) #126, Codex hook trust, absolute-path shims for hooks) get solved once for all projects.
What our script does that the framework would need to cover (Cursor case)
- generate root
plugin.jsonwith name/version/author and Cursor-shapedmcpServers/hooks entries (artifact layout differs from what Cursor's local loader expects — the subject of Cursor target artifacts don't match how Cursor actually loads local plugins (manifest location, hooks doc collision, root tokens) #126), - copy
skills/andmcp-apps/into the plugin dir, - write hook shims that embed the absolute
node <script>invocation so nothing depends on PATH at hook time, - print the reload instruction.
All of this is derivable from the bundle config; none of it is project-specific.
Context
cargo-conductor (https://github.com/ScriptedAlchemy/cargo-conductor) — see scripts/install-cursor.sh and docs/install.md for the full set of manual steps this would delete.
Activity
ScriptedAlchemy commentedon Sep 1, 2026
Install/discovery contract coverage from host-doc audit (2026-09-01)
Linking this lane to the meta-framework plan: #107, with lifecycle safety in #101.
Please include these documented host outcomes in the emitted
INSTALL.md/ generated installer /agent-bundle install <host>work, or mark them explicitly unavailable with a reason:--plugin-dir/--plugin-url;@skills-dir; reload activation; command/headersHelper trust prompts; managed marketplace/sideload restrictions; cache/data retention and--keep-data..claude-plugin/marketplace.json,codex plugin/codex plugin marketplacecommands, plugin-hook trust-by-hash, per-plugin MCP policy inconfig.toml, andrequirements.tomlrestrictions (features.plugins,features.hooks,allow_managed_hooks_only, marketplace allowed sources).Allow Local Plugin Imports, team marketplace access plus Default Off/Default On/Required modes, reload instructions, and marketplace submission/manual review.Installer output must distinguish files placed, registered, trusted/approved, and active. Generation alone cannot claim installation, and no installer may auto-trust hooks on the user's behalf.
ScriptedAlchemy commentedon Sep 1, 2026
The #195 install machinery now has real-host proof coverage — landed in #242 (merge
9928c3e0b, #100 stage 3):agent-bundle install <host>exercised end-to-end against the real binaries into isolated homes (CLAUDE_CONFIG_DIR/CODEX_HOME); registration observed viaplugin list/plugin details(Claude) andplugin list(Codex). Both hosts materialize the install as a whole-bundle copy underplugins/cache/<marketplace>/<plugin>/<version>.HOME's.cursor/plugins/local/<name>with pinned-schema validation of the installed plugin/hooks/mcp documents and idempotency (already-installedon re-run).INSTALL.md: Claude Code 2.1.257 rejectsclaude plugin marketplace add .— emitted instructions now use./for Claude and Codex (codex accepts both; verified against 0.147.0), with dated notes in the pinned capability evidence.host-installlevel: binary-gated with honest skips locally and in CI (native-host-smoke.yml), Cursor placement in default CI.ScriptedAlchemy commentedon Sep 2, 2026
Core scope delivered — closing with split note
Verified against landed install machinery and real-host proofs. The framework-owned install path from a built bundle directory is complete; npm tarball consumer packaging is tracked separately.
Delivered here
agent-bundle install <host>— idempotent placement + registration1235be1d) — Claude/Codex/Cursor/portable/composite install capabilities, generatedINSTALL.md, Cursorinstall.mjsfallback, marketplace metadata9928c3e0) —host-installproof level; Claude 2.1.257 + Codex 0.147.0 + Cursor placement/idempotency./vs.for Claude marketplace add)Moved to #252
The original motivation included publishable npm plugins whose tarball carries host packs and a package-relative installer (
import.meta.url), so consumers never maintain project-specific install scripts. That distribution boundary was not part of #195/#242:process.cwd()/--from <bundle-dir>, not package-local resolution→ #252 — Package generated host packs into publishable npm plugins
Still on #101 (not blocking this close)
Receipt-backed lifecycle (preview → confirm → backup → journal → verify → receipt), update/repair/uninstall/rollback/recover, format-preserving shared-config merges, and the read-only Doctor — #101 owns those; #195 shipped only the explicit operator install CLI shape G4 approved.
Closing #181 as built-directory install/discovery complete; remaining npm-consumer and managed-lifecycle scope lives in #252 and #101 respectively.
ScriptedAlchemy commentedon Sep 2, 2026
Closing: built-directory install/discovery delivered (#195, #242). Remaining npm-consumer scope → #252; managed lifecycle → #101.
test(install): expect the Codex interface.logo field in the packed ho…
test(install): expect the Codex interface.logo field in the packed ho…
ScriptedAlchemy commentedon Sep 3, 2026
Closed-issue re-verification (lane G2, 2026-09-03) — one regressed proof repaired
Re-checked every delivered item on
origin/main(af1c18551→c94df11ca) with the real binaries on this machine.agent-bundle install <host>— Claude/Codex/Cursor/portable, idempotent Cursor placement (#195)install.test.ts+install-surface.test.tsgreen (unit pool);host-install-proof.test.ts9/9 incl. realclaude plugin list/plugin details(Claude 2.1.x) andcodex plugin list(codex-cli 0.147.0) registration, Cursor isolated-home placement +already-installedidempotency, portable Agent Plugins 1.0.0 placement305161a1c) addedinterface.logoto the Codex manifest; the shared fixture declaresplugin.logo, so the binary-gated Codex proofs failed oninterfaceFields(skipped in default CI, so it landed silently). Built proof repaired by #368; packed proof repaired by #367 (merge307f404ae). Post-fix:packed-host-install-proof.test.ts3/3,host-install-proof.test.ts9/9 with real Claude + CodexINSTALL.md(./not.for Claude marketplace add)src/install/surface.tsclaudeInstructions/codexInstructionsemitmarketplace add ./; validated byinstall-surface.test.tsInstallResult.stateis onlyinstalled | already-installed; Claude/Codex reachinstalledonly after the host CLI's own install verb succeeds (registration implied), Cursor after placement (activation is the documented manual reload). Trust/activation are not modeled as states. Tracked by open #101 ("activation/trust state where observable"; "Doctor distinguishes activation deferred from installed-and-active"). Codex capability table records "installation does not auto-trust non-managed hooks"2655ca58d, package-relative installer bins + prepack inventory gate)--uninstall→ #101Also verified against the current public Cursor docs (2026-09-03):
.cursor-plugin/plugin.jsonis the Cursor Plugin manifest and~/.cursor/plugins/local/<name>the local root, matching the adapter andINSTALL.md.