feat(cursor): validate bundles against pinned schemas and loader contract with honest devtools evidence (#133)

[ScriptedAlchemy]

Summary

Cursor ecosystem validator for #133, mirroring the Claude devtools precedent (#193) under the issue's honesty rules — with the key difference pinned honestly: Cursor publishes no plugin-validate devtools verb (fresh dated evidence: 2026-09-02, cursor-agent 2026.08.31-4057e58, --help/plugin --help expose marketplace management only).

• validateCursorPlugin (new host-contracts/cursor-plugin-validation.ts): bounded cursor-agent --version probe for version evidence (ENOENT is an honest info that never gates local checks), plus local bytes-at-rest validation of the built Cursor bundle against the VENDORED pinned schemas (cursor/plugins@0701892 per PROVENANCE): strict .cursor-plugin/plugin.json, mcp.json, hooks/hooks.json, .cursor-plugin/marketplace.json — each with malformed negative fixtures so a permissive schema cannot pass vacuously.
• Every report carries an info diagnostic naming the pinned commit actually used — no invented host verbs.
• Pinned loader rules, each backed by a capability-evidence line: manifest-candidate precedence (.cursor-plugin/plugin.json first), symlink realpath containment inside the bundle (mirrors the loader's realpath rejection), and ${CURSOR_PLUGIN_ROOT} allowed only where the pinned evidence says the loader substitutes it (MCP command/args/env/cwd/url/headers and hook commands). Symlink findings emit in deterministic path order.
• Diagnostics AB6026–AB6029 registered in docs/diagnostics.md; exported via api.ts (wired into validate({ hostValidation }) for the cursor target, union type now spans Claude/Codex/Cursor) and test/index.ts; frozen reports; injectable command-runner proof seam.

Changeset: minor, agent-bundle.

Test plan (all local, on the rebase over #326's merge)

• pnpm build
• pnpm typecheck
• pnpm lint — 0 errors, 0 warnings (1015 files)
• pnpm test:unit — 2607 passed, 0 failed, 5 skipped
• Focused suite: 13 cases incl. per-schema malformed fixtures, CLI-absent-still-validates, strict unknown-key rejection, manifest precedence, escaping-symlink stable ordering, token allow-list incl. streamable-http url/headers

Tracking

• Advances Adopt pinned schemas and ecosystem validators for generated plugin conformance (build-time + doctor) #133 (Cursor ecosystem validator stage). Real-binary evidence dated 2026-09-02 against cursor-agent 2026.08.31-4057e58.

[changeset-bot]

🦋 Changeset detected

Latest commit: 54311ea

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T22:59:20.655134Z	54311ea	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.