Consumer test harness: script proof level (runScript) and the re-homed Workbench-surface helpers — #103 remainder

[ScriptedAlchemy]

Why this exists

The closed-issue audit of #103 found two items from the issue text that its staged plan (#151 → #190 → #212 → #225 → #239/#244) never delivered and that no other issue carries:

1. Script proof in the consumer harness. Generate an Agent Bundle framework test harness on top of Rstest #103's proposed public surface lists runScript beside renderRoute / invokeMcpTool / invokeCli, and test level 2 ("projection contract harness") says it "executes plain and rendered scripts". On origin/main (af1c18551) agent-bundle/test exports eight proof levels (route-unit, mcp-in-memory, cli-dispatch, packed-stdio, packed-deleted-source, browser-app, simulated, host-install) and none of them runs a conventional src/scripts/*.{ts,tsx} module. Script output modes are proven only inside the repository (packages/agent-bundle/tests/cli-routes-build.test.ts, Generate CLI, MCPorter, and script projections from the compiled route graph #102 stage 4), so a consumer cannot assert a rendered script's --json / --ndjson / piped-Markdown output without reconstructing the generated executable.
2. Workbench-surface browser helpers. The Generate an Agent Bundle framework test harness on top of Rstest #103 stage-3 landing re-homed "Workbench-surface browser helpers and render-stream presentation" to Add an interactive Agent Workbench with local host discovery and lifecycle replay #105's stages. Add an interactive Agent Workbench with local host discovery and lifecycle replay #105 closed (all five stages) without adding any consumer-facing Workbench helper to agent-bundle/test/browser. If this is intentionally not a consumer surface (the Workbench is the framework's own dev tool, not a route the consumer authors), record that decision here and close; otherwise it needs an owner.

Scope (item 1)

• runScript(name, argv, options) at a new honestly labeled proof level (in-process dispatch through the same render-session contract the generated scripts/<name>.mjs executable uses, mirroring how invokeCli reuses runGeneratedCliEntry): plain .ts scripts execute with ordinary stdout/stderr capture; rendered .tsx scripts expose cliJson / cliNdjson-style accessors plus piped Markdown.
• The test manifest carries script descriptors from the same compiler pass (AgentBundleTestManifest.scripts), collision-checked like cliCommands.
• Provenance stamps the level and prints it in every failure; a pass here is not packed or host evidence.
• Adoption: one rendered-script test in examples/audiobook-curator or the route-harness fixture; packages/agent-bundle/README.md proof-level table row.
• No packed-pool cost (per meta-framework: execution plan and sequencing #107): the packed journey already covers scripts.

Refs: #103 (proposed surface + level 2), #102 stage 4 (#278), #105.

[ScriptedAlchemy]

Landed — #398 merged as d10b60f56. Per-item evidence, all on origin/main:

Item	Status	Evidence
1. runScript proof level (script-dispatch)	Done	agent-bundle/test exports runScript, scriptJson, scriptNdjson; testManifest().scripts (registry v6) lists only the compiled conventional scripts that ship (nested AB4808 / conflicting AB4809 never appear). A rendered .tsx script runs through the real runGeneratedRenderedScript shell — piped Markdown, TTY progress, --json, --ndjson, exit-code mapping, the project's root layout, conventional providers with the script invocation and a fresh process identity per run, render-worker process.exit emulation (Generated render worker exited with code N., exit 1), stream/console capture onto the invocation's stderr. A plain .ts script runs as a Node child process over the source with the main envelope: real process.argv/exit/exitCode/chdir/execArgv, stdin, SIGTERM → SIGKILL reaping on abort, .ts/.tsx/.jsx helpers lowered as the build lowers them, agent-bundle/meta served from the manifest identity. Every failure names script route, execution form (rendered-shell / main-envelope / self-executing), and proof level. Tests: packages/agent-bundle/tests/projection/script-dispatch.test.ts, script-dispatch-state.test.ts, script-dispatch-abort.test.ts (10 fixture scripts under fixtures/route-harness/src/scripts/); template proof: create-agent-bundle/templates/cli-tool/tests/projection/script-dispatch.test.ts + README proof table. Harness section of packages/agent-bundle/README.md updated.
2. Workbench-surface helpers (workbench-surface)	Done	inspectWorkbenchSurface({ root, configPath? }) and workbenchSurfaceFromRouteGraph return the GET /api/routes/manifest body byte for byte, the grouped route catalog, state declaration, lifecycle-replay fixtures, capability counts (artifact-index semantics: per selected target, prebuilt hooks excluded), and page availability/unavailability; prepared exactly as the Workbench server prepares (development mode, dev runtime declaration, selected configPath for both compiler pass and eval discovery); manifest-unavailable with compiler diagnostics (e.g. AB4100) for a project the dev server would refuse. Tests: packages/agent-bundle/tests/workbench-surface.test.ts restates the packages/workbench/tests/examples-real.e2e.test.ts assertions for examples/audiobook-curator (50 routes = 18 MCP + 16 authored + 16 projected CLI, navigation set, counts) over the helper output, plus the configured-only examples, count semantics, preparation parity, and invalid-project cases.
3. #102 migration 6 (cli-tool template → routed CLI)	Done	packages/create-agent-bundle/templates/cli-tool replaces the hand-written src/cli.ts with routed src/cli/greet.ts and conventional src/scripts/hello.ts; README proof table rebased onto the target-aware install lines; scaffolder unit tests and scaffold-packed.e2e updated; generated projection pool proves cli-dispatch + script-dispatch.
Changeset	Done	.changeset/script-dispatch-and-workbench-surface.md — agent-bundle minor (AgentBundleTestManifest.scripts is a new required member), create-agent-bundle patch.

Review: 43 Codex threads over 10 rounds, every one fixed with a test or answered with a reason; CI green on the merged head. Gates read locally before merge: typecheck, lint, unit (the native-claude-contract 5 s timeout reproduces identically on main under this machine's load, #371), route-unit, projection (139), check:release:ci (packed 28).