diff --git a/.changeset/cursor-install-mode-hooks-registration.md b/.changeset/cursor-install-mode-hooks-registration.md
new file mode 100644
index 000000000..d5b5484e0
--- /dev/null
+++ b/.changeset/cursor-install-mode-hooks-registration.md
@@ -0,0 +1,5 @@
+---
+"agent-bundle": patch
+---
+
+Add `--mode local|marketplace` to `agent-bundle install cursor`, the generated installer bin, and the emitted `install.mjs`: marketplace mode stages a committed local `.cursor-plugin/marketplace.json` repository under `~/.cursor/agent-bundle/marketplaces/<name>` and prints the Cursor Customize import step, while local mode keeps the safe copy into `~/.cursor/plugins/local/<name>`. Doctor now proves Cursor hook registration from the plugin manifest (`AB7322`), warns about duplicate `~/.cursor/hooks.json` delivery (`AB7323`), and tracks staged marketplaces to imported (`AB7324`). Documents that plugin-scoped hooks fire without user-level registration, closing #407 (#414).
diff --git a/docs/audits/2026-09-03-cursor-plugin-hooks-registration.md b/docs/audits/2026-09-03-cursor-plugin-hooks-registration.md
new file mode 100644
index 000000000..d404e80a6
--- /dev/null
+++ b/docs/audits/2026-09-03-cursor-plugin-hooks-registration.md
@@ -0,0 +1,236 @@
+# Cursor plugin hook registration and marketplace-style install — #407 evidence
+
+Date: 2026-09-03. Observed desktop client: Cursor 3.18.25 stable (Linux x64,
+`/usr/share/cursor`, workbench commit `280eca2911f1774689696e5f1efa5a4f97a87af3`),
+run as an isolated instance (dedicated `HOME=/tmp/cursor-407/iso/home`,
+dedicated `--user-data-dir`, Xvfb display, workspace `/tmp/cursor-407/iso/ws`).
+Observed Agent CLI: `cursor-agent 2026.08.31-4057e58`. Issue #407 was filed
+against Cursor **3.16.21** running from `~/.cursor-server` (the remote-server
+build); that build is not installed on this machine and could not be
+re-observed.
+
+This note is the source of truth behind the `install cursor --mode` change,
+the Doctor `AB7322`–`AB7324` findings, and the #407 closing comment. Every
+claim about Cursor cites the live documentation retrieved on 2026-09-02/03 or
+a recorded observation.
+
+## 1. What the live Cursor documentation says
+
+| Claim | Source | Quote |
+| --- | --- | --- |
+| Hooks are a Cursor Plugin component, not an Agent Plugins one | https://cursor.com/docs/plugins | "**Hooks** \| Cursor Plugins \| Automation scripts triggered by events" and "**Cursor Plugins**: plugins with a `.cursor-plugin/plugin.json` manifest, which add rules, agents, commands, hooks, and variables" |
+| Plugins are one of three hook sources | https://cursor.com/docs/hooks | "Define hooks in `hooks.json` files at the project or user level, or install them through plugins from **Customize**." |
+| User hooks run from `~/.cursor/`, project hooks from the project root; plugin working directory is not documented | https://cursor.com/docs/hooks#configuration | "**Project hooks** (`.cursor/hooks.json` in a repository): Run from the **project root**" / "**User hooks** (`~/.cursor/hooks.json`): Run from `~/.cursor/`" (no plugin row) |
+| Hook precedence and merge | https://cursor.com/docs/hooks#configuration | "All matching hooks from every source run; when responses conflict, higher-priority sources take precedence during merge" / "Priority order (highest to lowest): Enterprise → Team → Project → User" |
+| `${CURSOR_PLUGIN_ROOT}` is expanded in plugin-delivered commands | https://cursor.com/docs/hooks (beforeMCPExecution) | "`command` is the launch string from the server's config and can differ between installs: relative paths, `${CURSOR_PLUGIN_ROOT}` expansion, or an HTTP transport" |
+| Cloud agents ignore user-level hooks | https://cursor.com/docs/hooks | "User-level hooks (`~/.cursor/hooks.json`) are not available in cloud agents." |
+| Local plugin test location and the load condition | https://cursor.com/docs/plugins#test-plugins-locally | "Before you publish, put either plugin format in `~/.cursor/plugins/local`" … "After a reload, Cursor discovers plugins in this folder if local plugin imports are allowed." … "If a marketplace plugin with the same name is already installed, that install takes precedence over the local copy." |
+| Marketplace plugins are Git repositories; the install surface is Customize | https://cursor.com/docs/plugins#installing-plugins | "Plugins are distributed as Git repositories and submitted through the Cursor team." … "1. Open **Customize** in the sidebar. 2. Find the plugin you want to use. 3. Select **Install** and choose a project or user scope." |
+| Team marketplaces are a paid feature and import from GitHub | https://cursor.com/docs/plugins#add-a-team-marketplace | "Team marketplaces are available on Teams and Enterprise plans." … "3. Follow the instructions to create a marketplace from scratch, or use "Import from Repo" if importing from GitHub." |
+| Install modes | https://cursor.com/docs/plugins#plugin-installation-modes | "**Default Off**: Developers can find the plugin and choose whether to install it." / "**Default On**: The plugin is installed by default, but developers can opt out." / "**Required**: The plugin is always installed and cannot be uninstalled." |
+| Multi-plugin repository manifest | https://cursor.com/docs/reference/plugins#cursor-multi-plugin-repositories | "A single Git repository can contain multiple plugins using a **marketplace manifest**. Place it at `.cursor-plugin/marketplace.json` in the repository root." Required fields: `name` "(kebab-case)", `owner` "`name` (required), `email` (optional)", `plugins` "(max 500)"; resolution: "The parser looks for `my-plugin/.cursor-plugin/plugin.json`". |
+| The only documented install deeplink is for MCP servers | https://cursor.com/docs/plugins#mcp-apps-deeplinks, https://cursor.com/docs/reference/deeplinks | "`cursor://anysphere.cursor-deeplink/mcp/install?name=$NAME&config=$BASE64_ENCODED_CONFIG`"; the deeplinks reference lists only `prompt`, `command`, and `rule` deeplinks — no plugin or marketplace install deeplink exists. |
+| Agent CLI loads local plugin directories and now runs their hooks | https://cursor.com/docs/cli/reference/parameters, https://cursor.com/docs/cli/changelog (August 11, 2026 release) | "`--plugin-dir <path>` \| Load a local plugin directory (can be specified multiple times)" and "**Plugin hooks run from installed plugins.** Hooks defined by installed plugins, including those loaded with `--plugin-dir`, now execute and refresh when plugins reload." |
+| Agent CLI marketplace verbs | `cursor-agent plugin marketplace --help` (2026.08.31-4057e58) | "add [options] <gitUrl>  Add a plugin marketplace from a git repository URL" / "list" / "remove" / "update"; there is no `plugin install` verb. |
+| Desktop changelog | https://cursor.com/changelog (rendered 2026-09-03) | The rendered page lists Aug 13 – Sep 2, 2026 entries (Builds, Origin, Cloud Agents, Self-hosted machines) and contains no plugin or hooks entry; older entries are not server-rendered and were not reachable through the fetch tool. |
+
+The CLI changelog entry dated **August 11, 2026** ("Plugin hooks run from
+installed plugins … now execute") is the one dated vendor statement that
+plugin-delivered hooks had been a Cursor-side gap that was fixed after the
+3.16 timeframe reported in #407.
+
+## 2. Ground truth: tracedecay (local, works) versus the emitted pack
+
+Both plugins were read-only inputs. `~/.cursor/hooks.json` does not exist on
+this machine.
+
+| Aspect | `~/.cursor/plugins/local/tracedecay` (known working) | `cursor` target emitted by agent-bundle (`/tmp/cursor-407/probe-pack`, built from `examples/hooks-and-scripts`-style config) | Delta |
+| --- | --- | --- | --- |
+| Manifest | `.cursor-plugin/plugin.json` with `"hooks": "hooks/hooks.json"`, `"mcpServers": "mcp.json"`, `rules`, `skills`, `agents`, `commands`, `version: 0.1.0-beta.37` | `.cursor-plugin/plugin.json` with `"hooks": "./hooks/hooks.json"`, `name`, `displayName`, `description`, `version` | `./` prefix only; both resolve to `hooks/hooks.json` |
+| Hooks envelope | `{ "version": 1, "hooks": { … } }` | `{ "version": 1, "hooks": { … } }` | none |
+| Events | `afterFileEdit`, `afterShellExecution`, `postToolUse`, `preCompact`, `sessionEnd`, `sessionStart`, `stop`, `workspaceOpen` | `preToolUse`, `postToolUse`, `sessionStart`, `stop` | subset; same names |
+| Command form | absolute binary: `'/home/zack/.local/bin/tracedecay' hook-cursor-post-tool-use` | `node "${CURSOR_PLUGIN_ROOT}/hooks/after-tool-log-6bd3fb25.mjs"` | ours relies on `${CURSOR_PLUGIN_ROOT}` expansion |
+| Matchers | none | `"matcher": "^Shell$"` on pre/postToolUse | ours adds matchers |
+| `timeout` | 5 / 30 s | none | none needed |
+| `loop_limit` | none | none | none |
+| Script executable bit / shebang | n/a (binary) | `.mjs` files, mode 0664, no shebang, invoked through `node` | not required because the command names the interpreter |
+| MCP | `mcp.json` `{ command: "/home/zack/.local/bin/tracedecay", args: ["serve", "--path", "${workspaceFolder}"], type: "stdio" }` | `mcp.json` with `${CURSOR_PLUGIN_ROOT}` in args/env | equivalent |
+
+Conclusion: there is no structural difference that Cursor's documented or
+observed loader treats differently. Both shapes fired on 3.18.25 (section 3),
+so the emitter was **not** changed to a different hooks shape. The
+`hooks/hooks.json` document, `version: 1`, `${CURSOR_PLUGIN_ROOT}` commands,
+and `^Shell$` matchers stay the primary emitted contract.
+
+## 3. Evidence matrix — isolated Cursor 3.18.25 desktop instance
+
+Setup (`/tmp/cursor-407/iso-setup.sh`): the same marker-logging script was
+registered at three locations for the same events — `~/.cursor/hooks.json`
+(user), `<ws>/.cursor/hooks.json` (project, trusted workspace), and a
+plugin-scoped `~/.cursor/plugins/local/hooks-probe/hooks/hooks.json` using
+`"${CURSOR_PLUGIN_ROOT}/hooks/hook-log.sh"` — plus the agent-bundle emitted
+pack installed as `~/.cursor/plugins/local/ab-hooks-probe`. An agent chat in
+the Agents window ran a shell tool call (`cat probe.txt`) and finished; markers
+were appended to `/tmp/cursor-407/iso/markers/events.jsonl` (51 lines).
+
+| Format | Hook location | Surface | Event | Fired? | Recorded `cwd` |
+| --- | --- | --- | --- | --- | --- |
+| user `hooks.json` | `~/.cursor/hooks.json` | IDE Agents window | workspaceOpen | yes (1) | `~/.cursor` |
+| user `hooks.json` | `~/.cursor/hooks.json` | IDE Agents window | preToolUse / beforeShellExecution / afterShellExecution / postToolUse | yes (3 each) | `~/.cursor` |
+| user `hooks.json` | `~/.cursor/hooks.json` | IDE Agents window | stop | yes (2) | `~/.cursor` |
+| project `hooks.json` | `<ws>/.cursor/hooks.json` | IDE Agents window | preToolUse / beforeShellExecution / afterShellExecution / postToolUse | yes (3 each) | `<ws>` |
+| project `hooks.json` | `<ws>/.cursor/hooks.json` | IDE Agents window | stop | yes (2) | `<ws>` |
+| Cursor Plugin (hand-written probe) | `~/.cursor/plugins/local/hooks-probe` manifest hooks | IDE Agents window | preToolUse / beforeShellExecution / afterShellExecution / postToolUse | yes (3 each) | plugin root |
+| Cursor Plugin (hand-written probe) | plugin manifest hooks | IDE Agents window | stop | yes (2) | `<ws>` |
+| **Cursor Plugin (agent-bundle emitted `cursor` target)** | `~/.cursor/plugins/local/ab-hooks-probe` manifest hooks, `node "${CURSOR_PLUGIN_ROOT}/hooks/*.mjs"` | IDE Agents window | preToolUse (`^Shell$`) | **yes** (`CURSOR_PLUGIN_ROOT` = plugin root) | plugin root |
+| **Cursor Plugin (agent-bundle emitted)** | same | IDE Agents window | postToolUse (`^Shell$`) | **yes** | plugin root |
+| **Cursor Plugin (agent-bundle emitted)** | same | IDE Agents window | stop | **yes** | `<ws>` |
+| Cursor Plugin (both) | plugin manifest hooks | IDE Agents window | sessionStart | not observed in this run (the chat session pre-dated the plugin reload; user/project sessionStart were also not observed in the same window) | — |
+| Cursor Plugin, `tracedecay` | `~/.cursor/plugins/local/tracedecay` | host IDE (maintainer's daily instance) | afterShellExecution, postToolUse, stop, sessionStart, … | works per maintainer statement (ground truth) | — |
+| Agent Plugins (`portable` target, root `plugin.json`) | n/a | any | any | no — the format has no hooks component (docs §1) | — |
+| any | any | Agent CLI (`cursor-agent`) | any | not observed: the CLI required Cursor authentication unavailable to the isolated run; the vendor CLI changelog (Aug 11, 2026) states plugin hooks now execute in the CLI | — |
+
+Read-out: on Cursor 3.18.25 the emitted pack's plugin-scoped hooks fire for
+tool events and `stop` exactly like the hand-written probe and tracedecay,
+without any `~/.cursor/hooks.json` entry. Plugin hook commands execute with
+`cwd` = the plugin root and `${CURSOR_PLUGIN_ROOT}` substituted, so
+`${CURSOR_PLUGIN_ROOT}`-relative commands are the correct form (and the one
+also used by official marketplace plugins such as `cursor-public/continual-learning`:
+`"command": "bun run ${CURSOR_PLUGIN_ROOT}/hooks/continual-learning-stop.ts"`).
+
+### Root-cause assessment for #407
+
+The report is not reproducible on the current stable desktop build. The
+evidence points to a Cursor-side, build-specific gap rather than the emitted
+shape:
+
+- #407 observed the gap on **3.16.21 in `~/.cursor-server`** (remote server
+  build) and saw the same gap on tracedecay ("only `sessionStart` … every other
+  declared event: 0"), which today fires normally on the same machine.
+- Cursor's own CLI changelog (August 11, 2026) records "Plugin hooks run from
+  installed plugins … now execute", i.e. plugin hook execution was fixed
+  vendor-side in that window.
+- In the 3.18.25 workbench bundle, plugin hooks are gated by
+  `thirdPartyExtensibilityEnabled` and the `enable_cc_plugin_import` flag
+  (`/tmp/cursor-407/glass-pluginhooks.txt`); both default to enabled on this
+  build. A build or account where either was off would load the plugin (rules,
+  skills, MCP) yet deliver no plugin hooks — matching the #407 symptom.
+
+Because the emitted shape is correct and now proven, the framework does **not**
+write `~/.cursor/hooks.json`. Doing so would run every hook twice on fixed
+builds ("All matching hooks from every source run"), is unavailable to cloud
+agents, and would have to hard-code absolute plugin paths. Instead Doctor
+proves registration (`AB7322`) and flags duplicate delivery (`AB7323`) so the
+silent-failure mode #407 describes is detectable.
+
+## 4. Marketplace layout study (read-only, this machine)
+
+Sources: `~/.cursor/plugins/marketplaces/**`, `~/.cursor/plugins/cache/**`,
+and a copied `state.vscdb` from the real user-data-dir.
+
+- Marketplace repositories are cloned under
+  `~/.cursor/plugins/marketplaces/<host>/<owner>/<repo>/<commit-sha>/`
+  (e.g. `github.com/anthropics/claude-plugins-official/1a2f18b0…`); a
+  `_staging` directory sits alongside.
+- Installed plugin bytes live under
+  `~/.cursor/plugins/cache/<marketplace-slug>/<plugin-id>/<commit-sha>/` with an
+  empty `.cache-complete` receipt next to `.cursor-plugin/`, e.g.
+  `cache/cursor-public/continual-learning/45c66fde…/.cache-complete`. The
+  agent-worker bundle confirms the layout constants (`plugins/cache`,
+  `.cache-complete`, path = `[root, sanitize(marketplaceSlug), sanitize(pluginId), version]`).
+- The install registry is not a file: `state.vscdb` holds
+  `cursor.plugins.installedIds.no-team|<workspace-uri>` and
+  `…|no-workspace` values containing **server-assigned numeric plugin ids**
+  (`[{"id":"677","sources":["user"]}, …]`). Which plugins are enabled is
+  resolved against the account's dashboard state; the local cache is a
+  projection of that server decision. There is no local manifest or receipt
+  that can be written to make Cursor treat a directory as marketplace-installed.
+- Official plugins on this machine use exactly the emitted shape:
+  `.cursor-plugin/plugin.json` with `"hooks": "./hooks/hooks.json"` and
+  `${CURSOR_PLUGIN_ROOT}` commands.
+
+## 5. Install strategies evaluated (maintainer's preference order)
+
+| # | Strategy | Result |
+| --- | --- | --- |
+| 1 | Official deeplink or CLI that installs a plugin from a marketplace/Git URL | No plugin/marketplace install deeplink is documented (§1). `cursor-agent plugin marketplace add <gitUrl>` requires a **hosted** Git URL and CLI authentication: `add /tmp/cursor-407/mkt-repo` and `add file:///tmp/cursor-407/mkt-repo` both failed with `Failed to resolve git ref "HEAD" for https:///tmp/cursor-407.git … Could not resolve host: tmp` (`/tmp/cursor-407/cli-mkt-add.txt`). Usable only for published packs. |
+| 2 | Register the pack in a marketplace Cursor can consume | A local Git repository with `.cursor-plugin/marketplace.json` is the exact input of Customize → Plugins → **"Add Plugins from Local Repository"** (workbench `importLocalMarketplace` / `parseGitHubRepoForPluginsLocally`). The flow is a native folder picker plus an Install click and could not be driven unattended under Xvfb (GTK dialog did not accept synthesized input). This is the marketplace-style path the installer now prepares. |
+| 3 | Replicate marketplace-installed state directly | Not viable: enabled-plugin identity is server-side (§4); writing `plugins/cache/**` + `.cache-complete` without a matching server id is not honoured and would be undone by the next dashboard sync. |
+
+Decision implemented in this change:
+
+- `agent-bundle install cursor --mode marketplace`, the generated installer
+  bin, and the emitted `install.mjs --mode marketplace` stage a committed Git
+  repository at `~/.cursor/agent-bundle/marketplaces/<name>` (marketplace
+  `<name>-marketplace`, plugin source `plugins/<name>`), print the commit and
+  the exact Customize step, and are idempotent (`already-installed` with the
+  same commit). They fail closed with `AB7002` when `git` is missing,
+  `AB7003` for bundles without `.cursor-plugin/plugin.json` or with nested
+  `.git` metadata (which `git add` would record as an empty gitlink), and
+  `AB7005` on version/content collisions (plugin copy or the generated
+  `marketplace.json` differing, or a working tree that is not what HEAD
+  commits — checked with `git status --porcelain --untracked-files=all
+  --ignored=matching`). The commit is made byte-faithful: the repository is
+  initialised with `--object-format=sha1` (Git ≥ 2.29), `.git/info/attributes`
+  disables `text`/`eol`/`filter`/`ident`/`working-tree-encoding` for every
+  path (a bundle-shipped `.gitattributes` or global `core.autocrlf` would
+  otherwise rewrite bytes into the index while `git status` stayed clean),
+  `git add` runs with `core.autocrlf=false`, and after the commit every blob
+  id from `git ls-tree -r -z HEAD` is compared with `sha1("blob <len>\0" +
+  bytes)` of the staged file — any drift fails closed with `AB7004` and the
+  staging directory is discarded. The manifest's plugin entry carries only the
+  pinned `marketplace.schema.json` fields (`name`, `source`, `description`;
+  `additionalProperties: false`) — the version lives in the copied
+  `plugins/<name>/.cursor-plugin/plugin.json`. Cursor then owns the install
+  (cached under `plugins/cache/<marketplace>/<name>/<version>`, managed in
+  Customize, not badged `Local`); Doctor treats only that marketplace's cache
+  partition as proof of import.
+- `--mode local` (default) keeps the proven safe copy into
+  `~/.cursor/plugins/local/<name>`. It remains the default because it is the
+  only path that loads without a UI step and its hooks are proven to fire (§3);
+  marketplace mode is one Customize click away from the same outcome and is
+  the recommended distribution shape once a pack is published.
+- `agent-bundle doctor --host cursor` reports `AB7322` (hook registration
+  `registered`/`stale`/`missing`), `AB7323` (duplicate or unparsable
+  `~/.cursor/hooks.json`), and `AB7324` (staged marketplace imported or still
+  awaiting the Customize step; `doctor --from` resolves a marketplace-mode
+  bundle to its staged copy). Import proof requires Cursor's `.cache-complete`
+  receipt for the staged HEAD commit in that marketplace's cache partition,
+  and the staged repository itself is verified read-only through `git
+  cat-file -e <HEAD>^{commit}` and `git --no-optional-locks status` (a missing
+  commit object or a dirty tree is `corrupt`, never `registered`).
+
+## 6. Automated proof added
+
+- `tests/install.test.ts`: marketplace staging layout and git call sequence,
+  idempotent re-run with real `git`, content and version collisions,
+  missing-`git` fail-closed, mode rejection for non-Cursor hosts, CLI
+  `--mode` pass-through and human output.
+- `tests/doctor.test.ts`: `AB7322` registered → duplicate (`AB7323`) →
+  unparsable user hooks → stale → missing (quoted paths, interpreter script
+  operands, non-script plugin-relative arguments); plugins without hooks;
+  `AB7324` unregistered → registered (receipted cache match for the staged
+  commit) → drifted → corrupt (manifest/plugin schema, unlisted or misnamed
+  plugin, bad HEAD, missing commit object, dirty tree, missing `.git`), with
+  stray files in the staging or cache roots ignored.
+- `tests/host-install-proof.test.ts` / `packed-host-install-proof.test.ts`
+  (`pnpm test:host-install:build`): the built fixture installed into an
+  isolated Cursor home now also asserts `hooksRegistration:
+  { events: ['sessionStart'], state: 'registered', userHooksJson: 'absent' }`
+  and runs the emitted `install.mjs --mode marketplace` twice (`Staged`, then
+  `Already staged` with the same commit) and Doctor's `AB7324` guidance.
+
+## 7. Product feedback recorded for Cursor
+
+Text filed as the #407 discrepancy note (URL: https://cursor.com/docs/hooks):
+"The hooks documentation lists working directories for project, user,
+enterprise, and team hooks but not for plugin-delivered hooks; observed on
+3.18.25 they run from the plugin root with `${CURSOR_PLUGIN_ROOT}` expanded.
+On 3.16.21 (remote server build) plugin-declared `preToolUse`/`postToolUse`/
+`stop` hooks did not execute while the same commands in `~/.cursor/hooks.json`
+did; the CLI changelog of August 11, 2026 records a fix for plugin hooks in
+the CLI. Please document the plugin hook working directory and the minimum
+build that delivers plugin hooks for tool events, and expose a
+non-interactive `cursor-agent plugin marketplace add` for local repositories
+(`file://`) so packs can be marketplace-installed without the Customize
+folder picker."
diff --git a/docs/diagnostics.md b/docs/diagnostics.md
index f9d8e6ca3..546a7657b 100644
--- a/docs/diagnostics.md
+++ b/docs/diagnostics.md
@@ -36,7 +36,7 @@ even when no error diagnostic was reported.
 | `AB7010`–`AB7013` | npm prepack inventory, artifact freshness, package bin targets, and release-version agreement. |
 | `AB7200`–`AB7202`, `AB7210`–`AB7211` | Development rebuilds and live host surfaces: rebuild admission and phase failures, development host install sync, and the dev-epoch contract gate (see below). |
 | `AB7xxx` | Project preparation and development rebuilds. |
-| `AB7300`–`AB7321` | Read-only install Doctor: host probes, installed inventory, bundle comparison and registration proof, runtime endpoint health and identity, durable-state inventory, static bytes-at-rest validation, and foreign-install detection (`AB7321`; see below). |
+| `AB7300`–`AB7324` | Read-only install Doctor: host probes, installed inventory, bundle comparison and registration proof, runtime endpoint health and identity, durable-state inventory, static bytes-at-rest validation, foreign-install detection (`AB7321`; see below), and Cursor plugin hook registration / marketplace staging (`AB7322`–`AB7324`; see below). |
 | `AB8200`–`AB8209` | Workbench development runtime routes (`/api/runtime/**`): `AB8200` development runtime provider configuration, load, or lifecycle failure, `AB8201` runtime/session/run not available, `AB8202` invalid route path, `AB8203` invalid request shape, `AB8204` stale runtime generation or MCP session revision (409), `AB8205` runtime request could not be completed, `AB8206` Workbench runtime client failure, `AB8207` Agent Document decoding needs the optional `@agent-bundle/runtime` peer (503), `AB8208` stored Flight could not be decoded as an Agent Document (409), `AB8209` decoded Agent Document over the 16 MiB budget (413) or an invalid document response. |
 | `AB8210`–`AB8214` | Workbench semantic lifecycle replay routes (`/api/lifecycles`, `/api/lifecycles/replays`): `AB8210` invalid path, `AB8211` malformed replay request or native envelope (400, carries the shared validator message), `AB8212` replay unavailable or could not be completed, `AB8213` stale manifest binding (409; the page repairs it with refresh → explicit re-run), `AB8214` replay over the 16 MiB budget (413). |
 | `AB8215`–`AB8218` | Workbench read-only host discovery route. |
@@ -779,3 +779,28 @@ artifact epochs. A package build failure never invalidates the artifact epoch
 that already committed; it surfaces as one `AB7103` **warning** on the
 succeeded build attempt, and the package build retries on the next
 invalidation. See `docs/entry-conventions.md` for the dev-watch contract.
+
+## Read-only Doctor Cursor hook registration and marketplace staging (`AB7322`–`AB7324`)
+
+Cursor delivers a plugin's hooks from its `.cursor-plugin/plugin.json` `hooks`
+declaration (observed 2026-09-03 on Cursor 3.18.25; see
+`docs/audits/2026-09-03-cursor-plugin-hooks-registration.md`). Doctor proves
+that registration statically and never writes `~/.cursor/hooks.json`.
+
+| Code | Severity | Meaning | Recovery |
+| --- | --- | --- | --- |
+| `AB7322` | info / error | Info: an installed `.cursor-plugin/plugin.json` plugin registers plugin-scoped hooks (events and command count listed) and the script each command executes — `${CURSOR_PLUGIN_ROOT}/…` or any relative path, including an interpreter's entry operand — exists under the plugin root (`hooks.state = registered`). Error: the declared hooks file is missing (`missing`), is not a regular file or not a `{ version, hooks: { <event>: [{ command }] } }` document, or an executed script is absent (`stale`). Documents and scripts are probed with `stat` before any read, so a FIFO cannot stall Doctor. | Reinstall the plugin from a bundle whose emitted hooks document and scripts are intact. |
+| `AB7323` | warning | `~/.cursor/hooks.json` registers a command whose executed file (after leading `NAME=value` assignments, `env`, and interpreter options) points into an installed plugin directory — compared on path-component boundaries, case-folded on Windows — so Cursor would deliver that hook twice; or the file is not a valid hooks document. | Remove the plugin-pointing entries or repair the file; manifest registration alone is sufficient. |
+| `AB7324` | info / warning / error | A staged marketplace repository under `~/.cursor/agent-bundle/marketplaces/<name>` (from `install cursor --mode marketplace`) is imported by Cursor (matching plugin under `~/.cursor/plugins/cache`; info, `registered`), still awaiting the Customize "Add Plugins from Local Repository" step (warning, `unregistered`), or incomplete (error, `corrupt`: manifests missing or failing the pinned schemas, no resolvable Git HEAD, HEAD naming a commit object that does not exist, or a working tree that differs from committed HEAD — verified read-only through `git cat-file -e` / `git --no-optional-locks status` when `git` is available). | Complete the Customize import, use `--mode local`, or remove the staged directory and rerun the installer. |
+
+The installer side reuses the `AB700x` codes: `AB7002` when `git` is missing
+in marketplace mode, `AB7003` when a mode is passed for a non-Cursor host, when
+marketplace mode is requested for a bundle without `.cursor-plugin/plugin.json`,
+or when the bundle contains nested Git metadata (`.git`, which `git add` would
+record as an empty gitlink), `AB7004` when a `git` step fails or the committed
+tree does not hold the staged bundle bytes (the installer disables `text`,
+`eol`, `filter`, `ident` and `working-tree-encoding` attributes through
+`.git/info/attributes`, adds with `core.autocrlf=false`, and proves every
+blob id in `git ls-tree -r HEAD` against the staged files; requires Git ≥ 2.29
+for `git init --object-format=sha1`), and `AB7005` for staged version or
+content collisions (including a working tree that differs from committed HEAD).
diff --git a/docs/framework-mode.md b/docs/framework-mode.md
index 169f345d4..f46abcb7a 100644
--- a/docs/framework-mode.md
+++ b/docs/framework-mode.md
@@ -422,3 +422,37 @@ comparison. It never invokes sudo or changes PATH. `agent-bundle install <host>
 `version-mismatch`, `foreign`, or `not-installed` (see the package README's
 "Reinstall after a same-version rebuild"). Artifact validation rejects a
 built-in target whose required install surface is missing.
+
+### Cursor delivery modes and hook registration (#407)
+
+`agent-bundle install cursor` and the emitted `install.mjs` accept
+`--mode local` (default) or `--mode marketplace`:
+
+- **local** safe-copies the bundle into `~/.cursor/plugins/local/<name>`.
+  Cursor loads the `.cursor-plugin/plugin.json` manifest, its `hooks/hooks.json`,
+  `mcp.json`, rules, and skills after a reload. Plugin hooks are registered by
+  the manifest alone: Cursor runs each command from the plugin root with
+  `${CURSOR_PLUGIN_ROOT}` substituted, and no `~/.cursor/hooks.json` entry is
+  written or required (observed 2026-09-03 on Cursor 3.18.25 for `preToolUse`,
+  `postToolUse`, and `stop`; see
+  `docs/audits/2026-09-03-cursor-plugin-hooks-registration.md`). Customize
+  shows the plugin with a `Local` badge.
+- **marketplace** stages a committed Git repository at
+  `~/.cursor/agent-bundle/marketplaces/<name>` whose
+  `.cursor-plugin/marketplace.json` lists the plugin, prints its commit, and
+  prints the one Cursor-owned step the framework cannot perform
+  non-interactively: Customize -> Plugins -> "Add Plugins from Local
+  Repository" -> select that directory -> Install. Cursor then treats the
+  plugin as marketplace-installed (cached under `~/.cursor/plugins/cache`,
+  managed from Customize, not badged `Local`). `git` must be on PATH; the
+  installer fails closed with `AB7002` otherwise and re-runs are idempotent
+  (`already-installed` with the same commit). The result state is `staged`
+  until Cursor imports it.
+
+`agent-bundle doctor --host cursor` proves both: `AB7322` reports each local
+plugin's manifest hook registration as `registered`, `stale` (a
+`${CURSOR_PLUGIN_ROOT}` script is missing), or `missing`; `AB7323` warns when
+`~/.cursor/hooks.json` also points into a plugin (duplicate delivery) or is
+unparsable; `AB7324` reports a staged marketplace as imported or still
+awaiting the Customize step, and `doctor --from` resolves a marketplace-mode
+bundle to that staged copy instead of reporting it missing.
diff --git a/packages/agent-bundle/README.md b/packages/agent-bundle/README.md
index ac689e173..2aff8d66b 100644
--- a/packages/agent-bundle/README.md
+++ b/packages/agent-bundle/README.md
@@ -117,7 +117,7 @@ manifests at files inside those payloads without compiling them. Payload files c
 | --- | --- |
 | `agent-bundle build` | Build a validated artifact from source, plus the declared `dist/` package build. |
 | `agent-bundle prepack` | Run the release build, dry-run npm packing without scripts, and verify packaged outputs, artifact hashes, bins, and versions (`--output` and `--json` supported). |
-| `agent-bundle install <host>` | Install a built bundle into Claude, Codex, or Cursor (`--from`, `--scope`, `--replace`/`--force`, and `--json` supported). Same-version content drift of an agent-bundle-managed install is replaced automatically; identical reruns are a no-op. |
+| `agent-bundle install <host>` | Install a built bundle into Claude, Codex, or Cursor (`--from`, `--scope`, `--replace`/`--force`, `--mode local\|marketplace` for Cursor, and `--json` supported). Same-version content drift of an agent-bundle-managed install is replaced automatically; identical reruns are a no-op. |
 | `agent-bundle doctor` | Read-only host inspection: host probes, installed inventory, and, with `--from`, the installed copy compared against the built artifact by version and content hash (`current`, `stale`, `version-mismatch`, `foreign`, `not-installed`). |
 | `agent-bundle validate` | Validate project source, or an artifact with `--artifact`. |
 | `agent-bundle inspect` | Inspect normalized targets and adapter plans from source, with per-target component accounting: which skills, commands, rules, hooks, MCP surfaces, and scripts each host emits and, for every omission, whether the author excluded it or the host's pinned capability judgment (`degraded`/`unavailable`/`prohibited`, with reason) ruled it out. |
@@ -175,6 +175,16 @@ agent-bundle install cursor --from artifact/cursor
 node ./install.mjs
 ```
 
+Cursor loads the copied `.cursor-plugin/plugin.json` and its manifest-declared
+`hooks/hooks.json` from that directory; plugin hooks run from the plugin root
+with `${CURSOR_PLUGIN_ROOT}` substituted and need no `~/.cursor/hooks.json`
+entry. `--mode marketplace` instead stages a committed local marketplace
+repository at `~/.cursor/agent-bundle/marketplaces/<name>` and prints the
+Customize -> Plugins -> "Add Plugins from Local Repository" step that makes
+Cursor manage the plugin as a marketplace install; `agent-bundle doctor --host
+cursor` reports hook registration (`AB7322`), duplicate user-level delivery
+(`AB7323`), and marketplace import state (`AB7324`).
+
 Cursor installation is user-scoped. Claude also accepts `--scope project` and
 `--scope local`; Codex is user-scoped. A source-free artifact root is accepted
 by `--from` when it contains the selected host target directory.
diff --git a/packages/agent-bundle/src/adapters/capabilities/cursor-2026-08-28.json b/packages/agent-bundle/src/adapters/capabilities/cursor-2026-08-28.json
index d6542c6ca..adc2d27ed 100644
--- a/packages/agent-bundle/src/adapters/capabilities/cursor-2026-08-28.json
+++ b/packages/agent-bundle/src/adapters/capabilities/cursor-2026-08-28.json
@@ -533,7 +533,9 @@
       "retrieved 2026-09-02: https://cursor.com/docs/hooks documents subagentStop input as subagent_type, status (completed|error|aborted), task, description, summary, duration_ms, message_count, tool_call_count, loop_count, modified_files, and agent_transcript_path (string|null), with output { followup_message } consumed only when status is completed and capped by loop_limit (default 5). The canonical agent/stop deny lowers to followup_message with the reason, mirroring the stop family; no additional-context channel is documented, so Agent.Context fails closed.",
       "retrieved 2026-09-02: https://cursor.com/docs/hooks documents the common input envelope (conversation_id, generation_id, model, model_id?, model_params?, hook_event_name, cursor_version, workspace_roots, user_email, transcript_path) for every agent hook; generated wrappers require session_id or conversation_id plus the per-event fields and reject anything else only when documented types are violated.",
       "retrieved 2026-09-02: https://cursor.com/docs/hooks documents preToolUse output permission allow|deny (ask accepted by the schema but not enforced), user_message, agent_message, and updated_input; postToolUse output updated_mcp_tool_output (MCP tools only) and additional_context; sessionStart output env and additional_context (continue/user_message accepted but unenforced); stop output followup_message. The Cursor projections emit exactly those channels.",
-      "2026-09-02: local cursor-agent 2026.08.31-4057e58 capture attempts for subagentStart and subagentStop could not dispatch because the binary required unavailable authentication; the pinned official contract plus the wrapper fixture replay in tests are the evidence source for the subagent lifecycle envelopes."
+      "2026-09-02: local cursor-agent 2026.08.31-4057e58 capture attempts for subagentStart and subagentStop could not dispatch because the binary required unavailable authentication; the pinned official contract plus the wrapper fixture replay in tests are the evidence source for the subagent lifecycle envelopes.",
+      "2026-09-03 (#407): hooks registration is plugin-scoped via .cursor-plugin/plugin.json `hooks` -> hooks/hooks.json; no ~/.cursor/hooks.json entry is emitted or required. Observed on Cursor 3.18.25 (isolated HOME, Agents window, shell tool call): the emitted pack's preToolUse (matcher ^Shell$), postToolUse, and stop hooks fired with CURSOR_PLUGIN_ROOT substituted and cwd = plugin root, identical to the known-loading ~/.cursor/plugins/local/tracedecay and to official marketplace plugins (cursor-public/continual-learning uses `bun run ${CURSOR_PLUGIN_ROOT}/hooks/...`). https://cursor.com/docs/hooks: 'All matching hooks from every source run', so a user-level duplicate would double-fire; Doctor reports it (AB7323). See docs/audits/2026-09-03-cursor-plugin-hooks-registration.md.",
+      "2026-09-03 (#407): the #407 report (Cursor 3.16.21, ~/.cursor-server) is not reproducible on 3.18.25; https://cursor.com/docs/cli/changelog (August 11, 2026 release) records 'Plugin hooks run from installed plugins ... now execute and refresh when plugins reload', a vendor-side fix in that window. Installation: `install cursor --mode local` copies to ~/.cursor/plugins/local/<name> (https://cursor.com/docs/plugins#test-plugins-locally); `--mode marketplace` stages a committed .cursor-plugin/marketplace.json repository (https://cursor.com/docs/reference/plugins#cursor-multi-plugin-repositories) for Customize -> 'Add Plugins from Local Repository', because no plugin install deeplink exists and `cursor-agent plugin marketplace add` accepts hosted git URLs only."
     ]
   }
 }
diff --git a/packages/agent-bundle/src/adapters/cursor.ts b/packages/agent-bundle/src/adapters/cursor.ts
index eb1569f5b..ca80570aa 100644
--- a/packages/agent-bundle/src/adapters/cursor.ts
+++ b/packages/agent-bundle/src/adapters/cursor.ts
@@ -462,7 +462,7 @@ export const cursorManifest = (
 });
 
 const metadata = Object.freeze({
-  adapterRevision: '1.10.0',
+  adapterRevision: '1.11.0',
   observedVersion: capabilityTable.observedCliVersion,
   schemas: schemaDescriptorsFrom(schemaProvenance, schemaProvenance.observedCliVersion),
 });
diff --git a/packages/agent-bundle/src/adapters/plugin.ts b/packages/agent-bundle/src/adapters/plugin.ts
index 88b2693e9..2e93a7377 100644
--- a/packages/agent-bundle/src/adapters/plugin.ts
+++ b/packages/agent-bundle/src/adapters/plugin.ts
@@ -235,7 +235,7 @@ const artifactValidation = deepFreeze({
 });
 
 const metadata = Object.freeze({
-  adapterRevision: '1.26.0',
+  adapterRevision: '1.27.0',
   observedVersion: `${claudeAdapter.metadata.observedVersion}+${codexAdapter.metadata.observedVersion}+${cursorAdapter.metadata.observedVersion}`,
   // Metadata schemas must exactly match the validation contract: each host's
   // documents, with one shared Claude-format hook schema (the pinned Codex
diff --git a/packages/agent-bundle/src/adapters/portable.ts b/packages/agent-bundle/src/adapters/portable.ts
index a14122f4e..eb5a50b49 100644
--- a/packages/agent-bundle/src/adapters/portable.ts
+++ b/packages/agent-bundle/src/adapters/portable.ts
@@ -92,7 +92,7 @@ const schemaValidator = createAdapterValidator();
 const validatePlugin = schemaValidator.compile(pluginSchema);
 const validateMcp = schemaValidator.compile(mcpSchema);
 const metadata = Object.freeze({
-  adapterRevision: '1.7.0',
+  adapterRevision: '1.8.0',
   observedVersion: capabilityTable.observedSpecificationVersion,
   schemas: schemaDescriptorsFrom(schemaProvenance, schemaProvenance.version),
 });
diff --git a/packages/agent-bundle/src/cli.ts b/packages/agent-bundle/src/cli.ts
index 4550f7cde..cb22992de 100644
--- a/packages/agent-bundle/src/cli.ts
+++ b/packages/agent-bundle/src/cli.ts
@@ -23,6 +23,7 @@ import type {
 import type {
   installBundle,
   InstallHost,
+  InstallMode,
   InstallResult,
   InstallScope,
 } from './install/install.ts';
@@ -36,6 +37,7 @@ import type {
 import type { runHostMcpProxy } from './dev/host-mcp-proxy.ts';
 import { DiagnosticError, type Diagnostic } from './core/diagnostics.ts';
 import { errorMessage } from './core/errors.ts';
+import { formatInstallResult } from './install/format.ts';
 import { projectVersionLabel } from './core/project-context.ts';
 import { stableJson } from './core/digest.ts';
 import type { EvalComparisonDelta, EvalConditionMetrics } from './eval/compare.ts';
@@ -87,6 +89,7 @@ interface InstallCommandOptions {
   readonly from: string;
   readonly json?: boolean;
   readonly replace?: boolean;
+  readonly mode?: InstallMode;
   readonly scope: string;
 }
 
@@ -169,6 +172,11 @@ const installHost = (value: string): InstallHost => {
 const collectInstallHost = (value: string, previous: readonly InstallHost[]): readonly InstallHost[] =>
   [...previous, installHost(value)];
 
+const installMode = (value: string): InstallMode => {
+  if (value === 'local' || value === 'marketplace') return value;
+  throw new TypeError('Install mode must be local or marketplace.');
+};
+
 const installScope = (value: string): InstallScope => {
   if (value === 'user' || value === 'project' || value === 'local') return value;
   throw new TypeError('Install scope must be user, project, or local.');
@@ -277,35 +285,10 @@ const writeHumanPrepack = (output: Output, result: Awaited<ReturnType<typeof pre
   );
 };
 
-const installStateLabel = (state: InstallResult['state']): string => {
-  switch (state) {
-    case 'adopted':
-      return 'Adopted';
-    case 'already-installed':
-      return 'Already installed';
-    case 'installed':
-      return 'Installed';
-    case 'replaced':
-      return 'Replaced';
-    default: {
-      const exhaustive: never = state;
-      throw new TypeError(`Unknown install state ${String(exhaustive)}.`);
-    }
-  }
-};
-
 const shortContentHash = (hash: string): string => hash.slice(0, 12);
 
 const writeHumanInstall = (output: Output, result: InstallResult): void => {
-  const destination = result.destination ?? result.bundleRoot;
-  const content = result.previousContentHash !== undefined && result.contentHash !== undefined
-    ? ` (content ${shortContentHash(result.previousContentHash)} -> ${shortContentHash(result.contentHash)})`
-    : result.contentHash === undefined
-      ? ''
-      : ` (content ${shortContentHash(result.contentHash)})`;
-  output.write(
-    `${installStateLabel(result.state)} ${result.plugin}@${result.version} for ${result.host} at ${destination}${content}\n`,
-  );
+  output.write(formatInstallResult(result));
 };
 
 const describeInstallComparison = (comparison: DoctorInstallComparison): string => {
@@ -640,6 +623,7 @@ export const runCli = async (
         'same-version content drift is replaced automatically and foreign installs are always refused',
     )
     .option('--force', 'Alias for --replace')
+    .option('--mode <mode>', 'Cursor delivery mode: local (default) or marketplace', installMode)
     .option('--json', 'Write one machine-readable JSON document');
   installCommand.action(async (
     host: InstallHost,
@@ -650,6 +634,7 @@ export const runCli = async (
       from: options.from,
       host,
       replace: options.replace === true || options.force === true,
+      ...(options.mode === undefined ? {} : { mode: options.mode }),
       scope: installScope(options.scope),
     });
     if (options.json === true) writeMachine(stdout, result);
diff --git a/packages/agent-bundle/src/host-contracts/cursor-plugin-validation.ts b/packages/agent-bundle/src/host-contracts/cursor-plugin-validation.ts
index ebaa55fc1..fd3affeb9 100644
--- a/packages/agent-bundle/src/host-contracts/cursor-plugin-validation.ts
+++ b/packages/agent-bundle/src/host-contracts/cursor-plugin-validation.ts
@@ -1,4 +1,4 @@
-import { lstat, readdir, readFile, realpath } from 'node:fs/promises';
+import { lstat, readdir, readFile, realpath, stat } from 'node:fs/promises';
 import { dirname, join, relative, resolve } from 'node:path';
 
 import { Ajv, type ErrorObject } from 'ajv/dist/ajv.js';
@@ -224,6 +224,8 @@ const readDocuments = async (
     const file = join(pluginDirectory, contract.path);
     let source: string;
     try {
+      // `stat` first: `readFile` on a FIFO or device would block until a writer appears.
+      if (!(await stat(file)).isFile()) throw new Error(`${contract.path} is not a regular file`);
       source = await readFile(file, 'utf8');
     } catch (error) {
       if (isErrno(error, 'ENOENT')) {
diff --git a/packages/agent-bundle/src/install-entry.ts b/packages/agent-bundle/src/install-entry.ts
index 157e80982..b8f3350ed 100644
--- a/packages/agent-bundle/src/install-entry.ts
+++ b/packages/agent-bundle/src/install-entry.ts
@@ -3,9 +3,11 @@ import { fileURLToPath } from 'node:url';
 
 import { stableJson } from './core/digest.ts';
 import { DiagnosticError, type Diagnostic } from './core/diagnostics.ts';
+import { formatInstallResult } from './install/format.ts';
 import {
   installBundle,
   type InstallHost,
+  type InstallMode,
   type InstallResult,
   type InstallScope,
 } from './install/install.ts';
@@ -17,7 +19,7 @@ export interface GeneratedInstallProcessOptions {
 }
 
 const usage = (options: GeneratedInstallProcessOptions): string => [
-  `Usage: ${options.name} install <host> [--scope <scope>] [--replace|--force] [--json]`,
+  `Usage: ${options.name} install <host> [--scope <scope>] [--mode local|marketplace] [--replace|--force] [--json]`,
   '',
   `Built hosts: ${options.hosts.join(', ')}`,
   '',
@@ -36,33 +38,8 @@ const diagnosticsFor = (error: unknown): readonly Diagnostic[] =>
       severity: 'error' as const,
     })]);
 
-const stateLabel = (state: InstallResult['state']): string => {
-  switch (state) {
-    case 'adopted':
-      return 'Adopted';
-    case 'already-installed':
-      return 'Already installed';
-    case 'installed':
-      return 'Installed';
-    case 'replaced':
-      return 'Replaced';
-    default: {
-      const exhaustive: never = state;
-      throw new TypeError(`Unknown install state ${String(exhaustive)}.`);
-    }
-  }
-};
-
 const writeHuman = (result: InstallResult): void => {
-  const destination = result.destination ?? result.bundleRoot;
-  const content = result.previousContentHash !== undefined && result.contentHash !== undefined
-    ? ` (content ${result.previousContentHash.slice(0, 12)} -> ${result.contentHash.slice(0, 12)})`
-    : result.contentHash === undefined
-      ? ''
-      : ` (content ${result.contentHash.slice(0, 12)})`;
-  process.stdout.write(
-    `${stateLabel(result.state)} ${result.plugin}@${result.version} for ${result.host} at ${destination}${content}\n`,
-  );
+  process.stdout.write(formatInstallResult(result));
 };
 
 const isHost = (value: string): value is InstallHost =>
@@ -71,10 +48,14 @@ const isHost = (value: string): value is InstallHost =>
 const isScope = (value: string): value is InstallScope =>
   value === 'local' || value === 'project' || value === 'user';
 
+const isMode = (value: string): value is InstallMode =>
+  value === 'local' || value === 'marketplace';
+
 interface ParsedInstallArguments {
   readonly host: InstallHost;
   readonly json: boolean;
   readonly replace: boolean;
+  readonly mode?: InstallMode;
   readonly scope: InstallScope;
 }
 
@@ -94,6 +75,7 @@ const parseArguments = (
   let json = false;
   let replace = false;
   let scope: InstallScope = 'user';
+  let mode: InstallMode | undefined;
   for (let index = 2; index < argv.length; index += 1) {
     const argument = argv[index];
     if (argument === '--json') {
@@ -104,6 +86,15 @@ const parseArguments = (
       replace = true;
       continue;
     }
+    if (argument === '--mode') {
+      const value = argv[index + 1];
+      if (value === undefined || !isMode(value)) {
+        throw new TypeError('Install mode must be local or marketplace.');
+      }
+      mode = value;
+      index += 1;
+      continue;
+    }
     if (argument === '--scope') {
       const value = argv[index + 1];
       if (value === undefined || !isScope(value)) {
@@ -115,7 +106,7 @@ const parseArguments = (
     }
     throw new TypeError(`Unknown installer argument ${JSON.stringify(argument)}.`);
   }
-  return Object.freeze({ host: candidate, json, replace, scope });
+  return Object.freeze({ host: candidate, json, ...(mode === undefined ? {} : { mode }), replace, scope });
 };
 
 export const runGeneratedInstallProcess = async (
@@ -143,6 +134,7 @@ export const runGeneratedInstallProcess = async (
       from: artifactRoot,
       host: parsed.host,
       replace: parsed.replace,
+      ...(parsed.mode === undefined ? {} : { mode: parsed.mode }),
       scope: parsed.scope,
     });
     if (parsed.json) process.stdout.write(`${stableJson(result)}\n`);
diff --git a/packages/agent-bundle/src/install/cursor-hooks-registration.ts b/packages/agent-bundle/src/install/cursor-hooks-registration.ts
new file mode 100644
index 000000000..b355c9008
--- /dev/null
+++ b/packages/agent-bundle/src/install/cursor-hooks-registration.ts
@@ -0,0 +1,627 @@
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { isAbsolute, join, resolve } from 'node:path';
+
+import { Ajv } from 'ajv/dist/ajv.js';
+import addFormats from 'ajv-formats';
+import { Predicate } from 'effect';
+
+import hooksSchema from '../adapters/schemas/cursor/hooks.schema.json' with { type: 'json' };
+import marketplaceSchema from '../adapters/schemas/cursor/marketplace.schema.json' with { type: 'json' };
+import pluginSchema from '../adapters/schemas/cursor/plugin.schema.json' with { type: 'json' };
+import type { Diagnostic } from '../core/diagnostics.ts';
+import { isErrno } from '../core/errors.ts';
+import {
+  cursorMarketplacePluginPath,
+  cursorMarketplaceRoot,
+} from './cursor-marketplace.ts';
+
+/**
+ * Read-only Doctor proof for Cursor hook registration (#407).
+ *
+ * Cursor delivers plugin hooks from the plugin manifest (`.cursor-plugin/plugin.json`
+ * `hooks` -> `hooks/hooks.json`), substituting `${CURSOR_PLUGIN_ROOT}` and running
+ * each command from the plugin root (observed 2026-09-03, Cursor 3.18.25, isolated
+ * HOME: preToolUse/postToolUse/stop fired for the emitted pack exactly like the
+ * known-working ~/.cursor/plugins/local/tracedecay). `~/.cursor/hooks.json` is a
+ * separate user-level registry; entries there that point into a plugin would run
+ * the same hook twice, so Doctor reports them as duplicate delivery.
+ */
+
+export type CursorHooksRegistrationState = 'missing' | 'none' | 'registered' | 'stale';
+
+export interface CursorHooksRegistration {
+  readonly commands: number;
+  readonly duplicates: readonly string[];
+  readonly events: readonly string[];
+  readonly source?: string;
+  readonly state: CursorHooksRegistrationState;
+}
+
+const finding = (
+  code: `AB73${number}`,
+  message: string,
+  recovery: string,
+  severity: Diagnostic['severity'],
+): Diagnostic => Object.freeze({ code, message, recovery, severity, target: 'cursor' });
+
+const pluginRootToken = '${CURSOR_PLUGIN_ROOT}';
+
+interface ParsedHooksDocument {
+  readonly commands: readonly string[];
+  readonly events: readonly string[];
+  readonly prompts: number;
+}
+
+const schemaValidator = new Ajv({ allErrors: true, allowUnionTypes: true, strict: true });
+(addFormats as unknown as (target: Ajv) => void)(schemaValidator);
+const validateHooksDocument = schemaValidator.compile(hooksSchema);
+const validateMarketplaceDocument = schemaValidator.compile(marketplaceSchema);
+const validatePluginDocument = schemaValidator.compile(pluginSchema);
+
+/**
+ * Accepts exactly what the pinned hooks.schema.json accepts (documented events, command hooks
+ * `{ "command": string }` / `{ "type": "command", ... }`, prompt hooks `{ "type": "prompt", "prompt": string }`),
+ * so AB7322 never reports `registered` for a document the static contract validator rejects.
+ * Only command hooks have a script path to verify.
+ */
+const parseHooksDocument = (value: unknown): ParsedHooksDocument | undefined => {
+  if (!validateHooksDocument(value) || !Predicate.isObject(value)) return undefined;
+  const hooks = value.hooks;
+  if (!Predicate.isObject(hooks)) return undefined;
+  const events: string[] = [];
+  const commands: string[] = [];
+  let prompts = 0;
+  for (const [event, entries] of Object.entries(hooks)) {
+    if (!Array.isArray(entries)) return undefined;
+    events.push(event);
+    for (const entry of entries) {
+      if (!Predicate.isObject(entry)) return undefined;
+      if (entry.type === 'prompt') {
+        prompts += 1;
+        continue;
+      }
+      if (typeof entry.command !== 'string') return undefined;
+      commands.push(entry.command);
+    }
+  }
+  return { commands, events: events.sort((left, right) => left.localeCompare(right)), prompts };
+};
+
+/**
+ * Minimal POSIX-ish word splitter: whitespace separates words, single/double quotes group (quotes removed),
+ * and a backslash escapes only a following quote, backslash, or whitespace so Windows paths such as
+ * `.\plugins\local\foo` survive intact. Enough to keep `"hooks/my hook.mjs"` one token.
+ */
+const escapable = (char: string | undefined): boolean => char !== undefined && /[\s"'\\]/u.test(char);
+const shellWords = (command: string): readonly string[] => {
+  const words: string[] = [];
+  let current = '';
+  let quote: '"' | "'" | undefined;
+  let hasWord = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const char = command[index] ?? '';
+    if (quote !== undefined) {
+      if (char === quote) {
+        quote = undefined;
+      } else if (char === '\\' && quote === '"' && escapable(command[index + 1])) {
+        index += 1;
+        current += command[index] ?? '';
+      } else {
+        current += char;
+      }
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      hasWord = true;
+    } else if (char === '\\' && escapable(command[index + 1])) {
+      index += 1;
+      current += command[index] ?? '';
+      hasWord = true;
+    } else if (/\s/u.test(char)) {
+      if (hasWord) words.push(current);
+      current = '';
+      hasWord = false;
+    } else {
+      current += char;
+      hasWord = true;
+    }
+  }
+  if (hasWord) words.push(current);
+  return words;
+};
+
+/** Interpreters whose first operand is the script Cursor must find under the plugin root. */
+const scriptInterpreters = new Set([
+  'bash', 'bun', 'dash', 'deno', 'node', 'nodejs', 'perl', 'powershell', 'pwsh', 'python', 'python3', 'ruby', 'sh', 'tsx', 'zsh',
+]);
+
+/** Interpreters whose `run` subcommand precedes the script (`bun run ./x.ts`, `deno run -A ./x.ts`). */
+const runSubcommandInterpreters = new Set(['bun', 'deno']);
+
+/**
+ * Interpreter options whose operand is inline source or a module name: the command runs no script file at all.
+ * PowerShell entries are lower-case because its parameters are case-insensitive and are lower-cased before lookup.
+ */
+const inlineSourceOptions = new Set(['--eval', '--print', '-c', '-command', '-e', '-ec', '-encodedcommand', '-m', '-p']);
+
+/** Interpreter options that consume the next token (a path or value), which is therefore not the entry script. */
+const valueOptions = new Set([
+  '--conditions', '--define', '--env-file', '--experimental-loader', '--import', '--input-type', '--loader',
+  '--preload', '--require', '--stack-trace-limit', '--title', '-C', '-I', '-W', '-X', '-d', '-o', '-r',
+  '-configurationname', '-ep', '-ex', '-executionpolicy', '-inputformat', '-outputformat', '-psconsolefile',
+  '-settingsfile', '-wd', '-workingdirectory',
+]);
+
+const powerShell = new Set(['powershell', 'pwsh']);
+
+const shellAssignment = /^[A-Za-z_][A-Za-z0-9_]*=/u;
+
+/** `env [NAME=VALUE]... [OPTION]... COMMAND [ARG]...`: strips the assignments and options ahead of COMMAND. */
+const unwrapEnv = (operands: readonly string[]): readonly string[] | undefined => {
+  for (let index = 0; index < operands.length; index += 1) {
+    const token = operands[index] ?? '';
+    if (shellAssignment.test(token)) continue;
+    if (token === '-u' || token === '--unset' || token === '-C' || token === '--chdir') {
+      index += 1;
+      continue;
+    }
+    if (token === '-S' || token === '--split-string') return undefined;
+    if (token.startsWith('-') && token !== '-') continue;
+    return operands.slice(index);
+  }
+  return undefined;
+};
+
+interface ExecutedPath {
+  /** `executable` is the command word itself (PATH lookup unless it names a path); `operand` is a script argument. */
+  readonly kind: 'executable' | 'operand';
+  readonly token: string;
+}
+
+/**
+ * The file a hook command executes: the executable token itself, or, for a known interpreter, the entry-script
+ * operand after skipping options (value-taking options consume their operand; `--opt=value` consumes nothing;
+ * PowerShell's `-File <path>` selects the script). `undefined` when the interpreter runs inline source
+ * (`node -e`, `sh -c`, `python -m`) or has no operand. Other arguments (`--output ./state/result.json`) are
+ * runtime inputs/outputs, never the executed file.
+ */
+const executedPath = (words: readonly string[]): ExecutedPath | undefined => {
+  // Leading `NAME=value` words are shell assignments (`NODE_ENV=production node ./x.mjs`), not the command.
+  const tokens = words.slice(words.findIndex((word) => !shellAssignment.test(word)));
+  const [executable, ...operands] = tokens;
+  if (executable === undefined || shellAssignment.test(executable)) return undefined;
+  // Interpreter basenames are matched case-insensitively (`PowerShell.EXE`, `Node.exe` on Windows).
+  const interpreter = executable.replace(/^.*[\\/]/u, '').replace(/\.exe$/iu, '').toLowerCase();
+  if (interpreter === 'env') {
+    const wrapped = unwrapEnv(operands);
+    return wrapped === undefined ? undefined : executedPath(wrapped);
+  }
+  if (!scriptInterpreters.has(interpreter)) return { kind: 'executable', token: executable };
+  const operand = (token: string | undefined): ExecutedPath | undefined =>
+    token === undefined ? undefined : { kind: 'operand', token };
+  const isPowerShell = powerShell.has(interpreter);
+  let runSubcommandSeen = false;
+  for (let index = 0; index < operands.length; index += 1) {
+    const token = operands[index] ?? '';
+    // `bun run <script>` / `deno run [permissions] <script>`: the subcommand is not the script.
+    if (!runSubcommandSeen && token === 'run' && runSubcommandInterpreters.has(interpreter)) {
+      runSubcommandSeen = true;
+      continue;
+    }
+    if (!token.startsWith('-') || token === '-') return operand(token);
+    // PowerShell parameters are case-insensitive; other interpreters' options are exact.
+    const option = isPowerShell ? token.toLowerCase() : token;
+    if (isPowerShell && (option === '-f' || option === '-file')) return operand(operands[index + 1]);
+    if (inlineSourceOptions.has(option)) return undefined;
+    if (valueOptions.has(option) && !option.includes('=')) index += 1;
+  }
+  return undefined;
+};
+
+/**
+ * Where a hook's executed file lives under the plugin root: `${CURSOR_PLUGIN_ROOT}/...` spellings, and any other
+ * non-absolute path (plugin hooks run from the plugin root, and the pinned schema resolves relative paths against
+ * the hook source root). A bare executable word without a separator is a PATH lookup, not a plugin file.
+ */
+const pluginRelativePath = (executed: ExecutedPath, pluginDirectory: string): string | undefined => {
+  const { kind, token } = executed;
+  if (token.startsWith(`${pluginRootToken}/`) || token.startsWith(`${pluginRootToken}\\`)) {
+    return join(pluginDirectory, token.slice(pluginRootToken.length + 1).replaceAll('\\', '/'));
+  }
+  if (token.startsWith('${') || token.startsWith('~') || isAbsolute(token) || /^[A-Za-z]:[\\/]/u.test(token)) return undefined;
+  if (kind === 'executable' && !/[\\/]/u.test(token)) return undefined;
+  return join(pluginDirectory, token.replaceAll('\\', '/'));
+};
+
+/**
+ * The plugin-root file a hook command executes; empty when the executed file lives elsewhere (absolute, `~`, or a
+ * PATH lookup) or the command runs inline source.
+ */
+const pluginRelativeScripts = (command: string, pluginDirectory: string): readonly string[] => {
+  const executed = executedPath(shellWords(command));
+  const script = executed === undefined ? undefined : pluginRelativePath(executed, pluginDirectory);
+  return script === undefined ? [] : [script];
+};
+
+/**
+ * Tolerant probe for a regular file (symlinks followed): `stat` never blocks on a FIFO the way `open`/`readFile`
+ * would, and any inspection failure (ENOENT, ENOTDIR, EACCES) reads as absent instead of aborting Doctor.
+ */
+const regularFile = async (path: string): Promise<boolean> => {
+  try {
+    return (await stat(path)).isFile();
+  } catch {
+    return false;
+  }
+};
+
+/** Tolerant directory probe with the same failure semantics as `regularFile`. */
+const directory = async (path: string): Promise<boolean> => {
+  try {
+    return (await stat(path)).isDirectory();
+  } catch {
+    return false;
+  }
+};
+
+/**
+ * Read a JSON document only after `stat` confirms a regular file: opening a FIFO (or a device) with `readFile`
+ * would block Doctor until a writer appears. Anything that is not a regular file reads as `invalid`.
+ */
+const readJson = async (path: string): Promise<{ readonly value?: unknown; readonly error?: 'missing' | 'invalid' }> => {
+  try {
+    if (!(await stat(path)).isFile()) return { error: 'invalid' };
+    return { value: JSON.parse(await readFile(path, 'utf8')) as unknown };
+  } catch (error) {
+    if (isErrno(error, 'ENOENT')) return { error: 'missing' };
+    return { error: 'invalid' };
+  }
+};
+
+/** Windows paths are case-insensitive, so containment checks there fold case (Cursor itself runs the same file). */
+const caseInsensitivePaths = process.platform === 'win32';
+
+const userHookDuplicates = async (
+  home: string,
+  pluginDirectory: string,
+  foldCase: boolean,
+): Promise<{ readonly diagnostics: readonly Diagnostic[]; readonly duplicates: readonly string[] }> => {
+  const userHooksPath = join(home, '.cursor', 'hooks.json');
+  const document = await readJson(userHooksPath);
+  if (document.error === 'missing') return { diagnostics: Object.freeze([]), duplicates: Object.freeze([]) };
+  const parsed = document.error === undefined ? parseHooksDocument(document.value) : undefined;
+  if (parsed === undefined) {
+    return {
+      diagnostics: Object.freeze([finding(
+        'AB7323',
+        `User hooks file ${JSON.stringify(userHooksPath)} is not a valid Cursor hooks document; Cursor ignores it and Doctor cannot check it for duplicate plugin hook delivery.`,
+        'Repair or remove ~/.cursor/hooks.json; plugin hooks do not require it.',
+        'warning',
+      )]),
+      duplicates: Object.freeze([]),
+    };
+  }
+  const fold = (path: string): string => (foldCase ? path.toLowerCase() : path);
+  const resolvedPlugin = resolve(pluginDirectory);
+  const foldedPlugin = fold(resolvedPlugin);
+  // User hooks run from ~/.cursor (https://cursor.com/docs/hooks), so relative command tokens resolve there.
+  const userHookCwd = join(home, '.cursor');
+  const insidePlugin = (resolvedCandidate: string): boolean => {
+    const candidate = fold(resolvedCandidate);
+    return candidate === foldedPlugin || candidate.startsWith(`${foldedPlugin}/`) || candidate.startsWith(`${foldedPlugin}\\`);
+  };
+  // Only the file the user hook executes counts: a plugin-local path passed as data (`--output
+  // ./plugins/local/foo/state.json`) does not deliver that plugin's hook. `insidePlugin` matches on a path
+  // component boundary so `plugins/local/foo` does not claim hooks aimed at `plugins/local/foo-tools`.
+  const pointsIntoPlugin = (command: string): boolean => {
+    const executed = executedPath(shellWords(command));
+    if (executed === undefined || executed.token.length === 0) return false;
+    const { kind, token } = executed;
+    if (token.startsWith('~/')) return insidePlugin(resolve(home, token.slice(2)));
+    if (isAbsolute(token)) return insidePlugin(resolve(token));
+    // A bare executable word is a PATH lookup; any other relative spelling (either separator, e.g.
+    // `.\plugins\local\foo` on Windows) resolves against ~/.cursor.
+    if (kind === 'executable' && !/[\\/]/u.test(token)) return false;
+    return insidePlugin(resolve(userHookCwd, token.replaceAll('\\', '/')));
+  };
+  const duplicates = parsed.commands.filter(pointsIntoPlugin);
+  if (duplicates.length === 0) return { diagnostics: Object.freeze([]), duplicates: Object.freeze([]) };
+  return {
+    diagnostics: Object.freeze([finding(
+      'AB7323',
+      `User hooks file ${JSON.stringify(userHooksPath)} registers ${duplicates.length} command(s) that point into ` +
+        `${JSON.stringify(resolvedPlugin)}; Cursor already delivers that plugin's manifest hooks, so each event would run twice.`,
+      'Remove the plugin-pointing entries from ~/.cursor/hooks.json; the plugin manifest registration is sufficient.',
+      'warning',
+    )]),
+    duplicates: Object.freeze(duplicates),
+  };
+};
+
+/**
+ * Inspect the hooks registration of one installed Cursor plugin directory
+ * whose loader manifest is `.cursor-plugin/plugin.json`.
+ */
+export const inspectCursorPluginHooks = async (
+  pluginDirectory: string,
+  home: string,
+  options: { readonly caseInsensitivePaths?: boolean } = {},
+): Promise<{ readonly diagnostics: readonly Diagnostic[]; readonly registration: CursorHooksRegistration }> => {
+  const none: CursorHooksRegistration = Object.freeze({ commands: 0, duplicates: Object.freeze([]), events: Object.freeze([]), state: 'none' });
+  const manifest = await readJson(join(pluginDirectory, '.cursor-plugin/plugin.json'));
+  if (manifest.error !== undefined || !Predicate.isObject(manifest.value)) {
+    return { diagnostics: Object.freeze([]), registration: none };
+  }
+  const declared = manifest.value.hooks;
+  if (declared === undefined) return { diagnostics: Object.freeze([]), registration: none };
+  let parsed: ParsedHooksDocument | undefined;
+  let source: string;
+  if (typeof declared === 'string') {
+    source = isAbsolute(declared) ? declared : join(pluginDirectory, declared);
+    const document = await readJson(source);
+    if (document.error === 'missing') {
+      return {
+        diagnostics: Object.freeze([finding(
+          'AB7322',
+          `Cursor plugin ${JSON.stringify(pluginDirectory)} declares hooks at ${JSON.stringify(declared)} but that file is missing; Cursor loads no hooks for it.`,
+          'Reinstall the plugin from a bundle whose hooks document exists.',
+          'error',
+        )]),
+        registration: Object.freeze({ ...none, source, state: 'missing' }),
+      };
+    }
+    parsed = document.error === undefined ? parseHooksDocument(document.value) : undefined;
+  } else {
+    source = '.cursor-plugin/plugin.json#hooks';
+    parsed = parseHooksDocument(declared);
+  }
+  if (parsed === undefined) {
+    return {
+      diagnostics: Object.freeze([finding(
+        'AB7322',
+        `Cursor plugin ${JSON.stringify(pluginDirectory)} hooks document ${JSON.stringify(source)} is not a valid ` +
+          '`{ "version": 1, "hooks": { <event>: [{ "command": ... } | { "type": "prompt", "prompt": ... }] } }` document; Cursor loads no hooks for it.',
+        'Rebuild and reinstall the plugin; the emitted hooks/hooks.json must follow the pinned Cursor hooks schema.',
+        'error',
+      )]),
+      registration: Object.freeze({ ...none, source, state: 'stale' }),
+    };
+  }
+  const missingScripts: string[] = [];
+  for (const command of parsed.commands) {
+    for (const script of pluginRelativeScripts(command, pluginDirectory)) {
+      if (!(await regularFile(script))) missingScripts.push(script);
+    }
+  }
+  const duplicates = await userHookDuplicates(home, pluginDirectory, options.caseInsensitivePaths ?? caseInsensitivePaths);
+  const registration: CursorHooksRegistration = Object.freeze({
+    commands: parsed.commands.length,
+    duplicates: duplicates.duplicates,
+    events: Object.freeze(parsed.events),
+    source,
+    state: missingScripts.length > 0 ? 'stale' : 'registered',
+  });
+  const diagnostics: Diagnostic[] = [];
+  if (missingScripts.length > 0) {
+    diagnostics.push(finding(
+      'AB7322',
+      `Cursor plugin ${JSON.stringify(pluginDirectory)} registers ${parsed.commands.length} hook command(s) but ` +
+        `${missingScripts.length} target script(s) are missing under the plugin root (${missingScripts.map((path) => JSON.stringify(path)).join(', ')}).`,
+      'Reinstall the plugin so every ${CURSOR_PLUGIN_ROOT}-relative hook script exists.',
+      'error',
+    ));
+  } else if (parsed.events.length > 0) {
+    const shape = parsed.prompts > 0
+      ? `${parsed.commands.length} command(s), ${parsed.prompts} prompt hook(s)`
+      : `${parsed.commands.length} command(s)`;
+    diagnostics.push(finding(
+      'AB7322',
+      `Cursor plugin ${JSON.stringify(pluginDirectory)} registers plugin-scoped hooks for ${parsed.events.join(', ')} ` +
+        `(${shape}) through its manifest; Cursor runs them from the plugin root with ${pluginRootToken} substituted.`,
+      'No action needed; Cursor delivers manifest hooks without a ~/.cursor/hooks.json entry.',
+      'info',
+    ));
+  }
+  diagnostics.push(...duplicates.diagnostics);
+  return { diagnostics: Object.freeze(diagnostics), registration };
+};
+
+export interface CursorMarketplaceStagingFinding {
+  readonly commit?: string;
+  readonly entry: string;
+  readonly marketplace?: string;
+  readonly name: string;
+  readonly path: string;
+  readonly state: 'corrupt' | 'registered' | 'unregistered';
+  readonly version?: string;
+}
+
+/**
+ * Cursor's cache is partitioned per marketplace: `plugins/cache/<sanitize(marketplaceSlug)>/<pluginId>/<version>`
+ * (observed 2026-09-03; e.g. `cache/cursor-public/continual-learning/<sha>/`), and Cursor writes an empty
+ * `.cache-complete` receipt beside `.cursor-plugin/` once the copy finished. The `<version>` segment observed
+ * for Git-backed marketplaces is the marketplace commit SHA. Only a receipted entry in the staged
+ * marketplace's partition whose segment equals the staged HEAD commit (the plugin version is used only when
+ * no commit is known) proves that *this* staged repository was imported; the same plugin cached from another
+ * marketplace, a receipt from an earlier staging commit, or a half-written cache directory, does not.
+ * Malformed cache entries are skipped rather than aborting Doctor.
+ */
+const sanitizeCacheSegment = (segment: string): string => segment.replaceAll(/[^A-Za-z0-9._-]/gu, '-');
+
+const cacheHasPlugin = async (
+  home: string,
+  marketplace: string,
+  name: string,
+  version: string | undefined,
+  commit: string | undefined,
+): Promise<boolean> => {
+  const pluginRoot = join(home, '.cursor', 'plugins', 'cache', sanitizeCacheSegment(marketplace), sanitizeCacheSegment(name));
+  let segments: readonly string[];
+  try {
+    segments = await readdir(pluginRoot);
+  } catch {
+    return false;
+  }
+  // The staged commit is the only segment that proves *this* staging was imported; the plugin version is
+  // a fallback solely when no commit is known.
+  const expectedSegment = commit ?? version;
+  for (const segment of segments) {
+    if (expectedSegment !== undefined && segment !== sanitizeCacheSegment(expectedSegment)) continue;
+    if (!(await regularFile(join(pluginRoot, segment, '.cache-complete')))) continue;
+    const installed = await readJson(join(pluginRoot, segment, '.cursor-plugin', 'plugin.json'));
+    if (installed.error !== undefined || !Predicate.isObject(installed.value)) continue;
+    if (installed.value.name !== name) continue;
+    if (version === undefined || installed.value.version === version) return true;
+  }
+  return false;
+};
+
+const isCommitSha = (value: string | undefined): value is string => value !== undefined && /^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(value);
+
+/** Resolves HEAD to a commit SHA; `undefined` when HEAD is missing, unreadable, malformed, or unborn. */
+const readHeadCommit = async (repoRoot: string): Promise<string | undefined> => {
+  try {
+    const head = (await readFile(join(repoRoot, '.git', 'HEAD'), 'utf8')).trim();
+    if (!head.startsWith('ref: ')) return isCommitSha(head) ? head : undefined;
+    const ref = head.slice('ref: '.length);
+    let resolved: string | undefined;
+    try {
+      resolved = (await readFile(join(repoRoot, '.git', ref), 'utf8')).trim();
+    } catch {
+      const packed = await readFile(join(repoRoot, '.git', 'packed-refs'), 'utf8');
+      resolved = packed.split('\n').find((candidate) => candidate.endsWith(` ${ref}`))?.split(' ')[0];
+    }
+    return isCommitSha(resolved) ? resolved : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Runs `git <args>` in `cwd` for read-only verification; resolves `undefined` when git is not installed,
+ * in which case object-level checks are skipped and only the ref text is validated.
+ */
+export type CursorStagingGit = (
+  args: readonly string[],
+  cwd: string,
+) => Promise<{ readonly exitCode: number | null; readonly stdout: string } | undefined>;
+
+type StagedRepositoryIntegrity = 'dirty' | 'missing-object' | 'ok' | 'unverified';
+
+/**
+ * Cursor imports the commit HEAD names, not the working tree and not the ref text. A syntactically valid SHA whose
+ * object is absent (`git cat-file -e <sha>^{commit}`) cannot be imported, and a working tree that differs from HEAD
+ * (`git status --porcelain`, including ignored files) means the bytes Doctor hashed are not the bytes Cursor holds.
+ * `--no-optional-locks` keeps the probe read-only (no index refresh).
+ */
+const verifyStagedRepository = async (
+  git: CursorStagingGit | undefined,
+  repoRoot: string,
+  commit: string,
+): Promise<StagedRepositoryIntegrity> => {
+  if (git === undefined) return 'unverified';
+  const object = await git(['cat-file', '-e', `${commit}^{commit}`], repoRoot);
+  if (object === undefined) return 'unverified';
+  if (object.exitCode !== 0) return 'missing-object';
+  const status = await git(['--no-optional-locks', 'status', '--porcelain', '--untracked-files=all', '--ignored=matching'], repoRoot);
+  if (status === undefined) return 'unverified';
+  if (status.exitCode !== 0 || status.stdout.trim() !== '') return 'dirty';
+  return 'ok';
+};
+
+/** Inventory the Agent Bundle-owned staged Cursor marketplaces and whether Cursor has imported them. */
+export const inspectCursorMarketplaceStaging = async (
+  home: string,
+  git?: CursorStagingGit,
+): Promise<{ readonly diagnostics: readonly Diagnostic[]; readonly findings: readonly CursorMarketplaceStagingFinding[] }> => {
+  const root = cursorMarketplaceRoot(join(home, '.cursor'));
+  let entries: readonly string[];
+  try {
+    entries = (await readdir(root)).sort((left, right) => left.localeCompare(right));
+  } catch (error) {
+    if (isErrno(error, 'ENOENT')) return { diagnostics: Object.freeze([]), findings: Object.freeze([]) };
+    return {
+      diagnostics: Object.freeze([finding(
+        'AB7324',
+        `Staged Cursor marketplaces at ${JSON.stringify(root)} could not be read; Doctor cannot tell whether a marketplace-mode install awaits import.`,
+        'Repair permissions for the Agent Bundle marketplace staging directory or remove it and rerun `agent-bundle install cursor --mode marketplace`.',
+        'error',
+      )]),
+      findings: Object.freeze([]),
+    };
+  }
+  const diagnostics: Diagnostic[] = [];
+  const findings: CursorMarketplaceStagingFinding[] = [];
+  for (const entry of entries) {
+    if (entry.startsWith('.')) continue;
+    const path = join(root, entry);
+    // Only directories can be staged repositories; a stray file in the staging root is not a finding.
+    if (!(await directory(path))) continue;
+    const manifest = await readJson(join(path, '.cursor-plugin', 'marketplace.json'));
+    const plugin = await readJson(join(cursorMarketplacePluginPath(path, entry), '.cursor-plugin', 'plugin.json'));
+    const marketplace = manifest.error === undefined && Predicate.isObject(manifest.value) && typeof manifest.value.name === 'string'
+      ? manifest.value.name
+      : undefined;
+    const version = plugin.error === undefined && Predicate.isObject(plugin.value) && typeof plugin.value.version === 'string'
+      ? plugin.value.version
+      : undefined;
+    // The whole manifest must satisfy the pinned closed marketplace schema; Cursor rejects imports that do not.
+    const manifestValid = manifest.error === undefined && validateMarketplaceDocument(manifest.value);
+    const listsPlugin = manifestValid && Predicate.isObject(manifest.value) && Array.isArray(manifest.value.plugins) &&
+      manifest.value.plugins.some((candidate: unknown) =>
+        Predicate.isObject(candidate) && candidate.name === entry && candidate.source === `plugins/${entry}`);
+    const pluginNamed = plugin.error === undefined && validatePluginDocument(plugin.value) &&
+      Predicate.isObject(plugin.value) && plugin.value.name === entry;
+    const commit = (await directory(join(path, '.git'))) ? await readHeadCommit(path) : undefined;
+    if (marketplace === undefined || !listsPlugin || !pluginNamed || commit === undefined) {
+      findings.push({ entry, name: entry, path, state: 'corrupt', ...(marketplace === undefined ? {} : { marketplace }) });
+      diagnostics.push(finding(
+        'AB7324',
+        `Staged Cursor marketplace ${JSON.stringify(path)} is incomplete (marketplace.json missing, failing the pinned ` +
+          `marketplace schema, or not listing ${entry} at plugins/${entry}; plugins/${entry}/.cursor-plugin/plugin.json ` +
+          `missing, failing the pinned plugin schema, or not named ${entry}; or no committed Git HEAD).`,
+        'Remove the staged directory and rerun `agent-bundle install cursor --mode marketplace`.',
+        'error',
+      ));
+      continue;
+    }
+    const integrity = await verifyStagedRepository(git, path, commit);
+    if (integrity === 'missing-object' || integrity === 'dirty') {
+      findings.push({ commit, entry, marketplace, name: entry, path, state: 'corrupt', ...(version === undefined ? {} : { version }) });
+      diagnostics.push(finding(
+        'AB7324',
+        integrity === 'missing-object'
+          ? `Staged Cursor marketplace ${JSON.stringify(path)} names HEAD ${commit} but that commit object does not exist in the repository; Cursor cannot import it.`
+          : `Staged Cursor marketplace ${JSON.stringify(path)} has a working tree that differs from committed HEAD ${commit}; Cursor imports the commit, so the staged files are not what Cursor would install.`,
+        'Remove the staged directory and rerun `agent-bundle install cursor --mode marketplace`.',
+        'error',
+      ));
+      continue;
+    }
+    const registered = await cacheHasPlugin(home, marketplace, entry, version, commit);
+    findings.push({
+      commit,
+      entry,
+      marketplace,
+      name: entry,
+      path,
+      state: registered ? 'registered' : 'unregistered',
+      ...(version === undefined ? {} : { version }),
+    });
+    diagnostics.push(registered
+      ? finding(
+        'AB7324',
+        `Staged Cursor marketplace ${marketplace} (${entry}@${version ?? 'unknown'}) is imported: Cursor holds a completed (.cache-complete) copy under ~/.cursor/plugins/cache/${marketplace}.`,
+        'No action needed.',
+        'info',
+      )
+      : finding(
+        'AB7324',
+        `Staged Cursor marketplace ${marketplace} at ${JSON.stringify(path)} is not yet imported by Cursor (no completed ${entry}@${version ?? 'unknown'} copy under ~/.cursor/plugins/cache/${marketplace}).`,
+        `In Cursor open Customize -> Plugins -> "Add Plugins from Local Repository", select ${path}, then install ${entry}; or use \`agent-bundle install cursor --mode local\`.`,
+        'warning',
+      ));
+  }
+  return { diagnostics: Object.freeze(diagnostics), findings: Object.freeze(findings) };
+};
diff --git a/packages/agent-bundle/src/install/cursor-marketplace.ts b/packages/agent-bundle/src/install/cursor-marketplace.ts
new file mode 100644
index 000000000..6f5126414
--- /dev/null
+++ b/packages/agent-bundle/src/install/cursor-marketplace.ts
@@ -0,0 +1,318 @@
+import { createHash } from 'node:crypto';
+import { cp, lstat, mkdir, mkdtemp, readdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import { Predicate } from 'effect';
+
+import { DiagnosticError } from '../core/diagnostics.ts';
+import { isErrno } from '../core/errors.ts';
+import { exists } from '../core/paths.ts';
+
+/**
+ * Marketplace-style Cursor installation (#407).
+ *
+ * Cursor installs marketplace plugins from Git repositories that carry a
+ * `.cursor-plugin/marketplace.json` (https://cursor.com/docs/reference/plugins,
+ * "Cursor multi-plugin repositories"). Observed 2026-09-03 on Cursor 3.18.25:
+ * the only surfaces that register such a repository are the Customize UI
+ * ("Add Plugins from Local Repository", a native folder picker) and the
+ * Dashboard "Import from Repo" flow for hosted GitHub URLs; `cursor-agent
+ * plugin marketplace add` rejects `file://` and filesystem paths, and the
+ * installed-plugin registry (`state.vscdb` `cursor.plugins.installedIds.*`)
+ * holds server-assigned numeric ids that cannot be minted locally. The
+ * installer therefore stages a committed local marketplace repository that
+ * those official surfaces accept verbatim and prints the exact UI step.
+ */
+
+export interface CursorMarketplaceIdentity {
+  readonly bundleRoot: string;
+  readonly plugin: string;
+  readonly version: string;
+}
+
+export interface CursorMarketplaceCommandRunner {
+  run(
+    command: string,
+    args: readonly string[],
+    options: { readonly cwd: string },
+  ): Promise<{ readonly code: number; readonly stderr: string; readonly stdout: string }>;
+}
+
+export interface CursorMarketplaceStageResult {
+  readonly commit?: string;
+  readonly destination: string;
+  readonly marketplace: string;
+  readonly nextSteps: readonly string[];
+  readonly state: 'already-installed' | 'staged';
+}
+
+/** Agent Bundle-owned staging root; never inside Cursor's own `plugins/{local,cache,marketplaces}`. */
+export const cursorMarketplaceRoot = (cursorRoot: string): string =>
+  join(cursorRoot, 'agent-bundle', 'marketplaces');
+
+export const cursorMarketplaceName = (plugin: string): string => `${plugin}-marketplace`;
+
+export const cursorMarketplacePluginPath = (repoRoot: string, plugin: string): string =>
+  join(repoRoot, 'plugins', plugin);
+
+const marketplaceManifestPath = '.cursor-plugin/marketplace.json';
+
+export const cursorMarketplaceNextSteps = (
+  repoRoot: string,
+  plugin: string,
+): readonly string[] => Object.freeze([
+  `Open Cursor, then Customize -> Plugins -> "Add Plugins from Local Repository" and select ${repoRoot}.`,
+  `Choose "${plugin}" in the imported marketplace and select Install (user scope).`,
+  'Verify with `agent-bundle doctor --host cursor`: the plugin must appear under ~/.cursor/plugins/cache once Cursor has installed it.',
+  'To publish instead, push this repository to GitHub and run `cursor-agent plugin marketplace add <git-url>`.',
+]);
+
+const failure = (code: string, message: string): DiagnosticError =>
+  new DiagnosticError([{ code, message, severity: 'error', target: 'cursor' }]);
+
+const readMarketplacePluginVersion = async (pluginDirectory: string): Promise<string | undefined> => {
+  try {
+    const document = JSON.parse(await readFile(join(pluginDirectory, '.cursor-plugin/plugin.json'), 'utf8')) as unknown;
+    return Predicate.isObject(document) && typeof document.version === 'string' ? document.version : undefined;
+  } catch (error) {
+    if (isErrno(error, 'ENOENT')) return undefined;
+    throw error;
+  }
+};
+
+const readManifestField = async (
+  bundleRoot: string,
+  key: 'author' | 'description',
+): Promise<unknown> => {
+  const document = JSON.parse(await readFile(join(bundleRoot, '.cursor-plugin/plugin.json'), 'utf8')) as unknown;
+  return Predicate.isObject(document) ? document[key] : undefined;
+};
+
+export const cursorMarketplaceManifest = async (
+  identity: CursorMarketplaceIdentity,
+): Promise<Record<string, unknown>> => {
+  const [author, description] = await Promise.all([
+    readManifestField(identity.bundleRoot, 'author'),
+    readManifestField(identity.bundleRoot, 'description'),
+  ]);
+  const ownerName = Predicate.isObject(author) && typeof author.name === 'string' ? author.name : identity.plugin;
+  return {
+    metadata: {
+      description: `Agent Bundle local marketplace for ${identity.plugin}@${identity.version}.`,
+    },
+    name: cursorMarketplaceName(identity.plugin),
+    owner: { name: ownerName },
+    // Only the pinned marketplace schema's entry fields (name/source/description);
+    // the plugin version lives in plugins/<name>/.cursor-plugin/plugin.json.
+    plugins: [{
+      ...(typeof description === 'string' ? { description } : {}),
+      name: identity.plugin,
+      source: `plugins/${identity.plugin}`,
+    }],
+  };
+};
+
+const serializeManifest = (manifest: Record<string, unknown>): string => `${JSON.stringify(manifest, null, 2)}\n`;
+
+const stagedManifestMatches = async (repoRoot: string, expected: string): Promise<boolean> => {
+  try {
+    return await readFile(join(repoRoot, marketplaceManifestPath), 'utf8') === expected;
+  } catch (error) {
+    if (isErrno(error, 'ENOENT')) return false;
+    throw error;
+  }
+};
+
+const runGit = async (
+  runner: CursorMarketplaceCommandRunner,
+  cwd: string,
+  args: readonly string[],
+): Promise<string> => {
+  let result: Awaited<ReturnType<CursorMarketplaceCommandRunner['run']>>;
+  try {
+    result = await runner.run('git', args, { cwd });
+  } catch (error) {
+    if (isErrno(error, 'ENOENT')) {
+      throw failure(
+        'AB7002',
+        'git is required for `--mode marketplace` (Cursor imports marketplaces from Git repositories); install git or use `--mode local`.',
+      );
+    }
+    throw error;
+  }
+  if (result.code !== 0) {
+    const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`;
+    throw failure('AB7004', `Cursor marketplace staging failed: git ${args[0]}: ${detail}`);
+  }
+  return result.stdout.trim();
+};
+
+const gitIdentity = Object.freeze([
+  '-c', 'user.name=agent-bundle',
+  '-c', 'user.email=agent-bundle@localhost',
+  '-c', 'commit.gpgsign=false',
+]);
+
+/**
+ * First `.git` entry (directory or gitlink file) inside a bundle, relative to its root. `git add` records a
+ * nested repository as a `160000` gitlink instead of committing its files, so the staged marketplace would
+ * import an empty plugin; symlinks are not followed (treeHash refuses them anyway).
+ */
+const findNestedGit = async (root: string, relative = ''): Promise<string | undefined> => {
+  for (const name of (await readdir(join(root, relative))).sort((left, right) => left.localeCompare(right))) {
+    const child = relative === '' ? name : join(relative, name);
+    if (name === '.git') return child;
+    const metadata = await lstat(join(root, child));
+    if (!metadata.isSymbolicLink() && metadata.isDirectory()) {
+      const nested = await findNestedGit(root, child);
+      if (nested !== undefined) return nested;
+    }
+  }
+  return undefined;
+};
+
+/**
+ * Git attributes (`text`, `eol`, `filter`, `ident`, `working-tree-encoding`) rewrite file contents on the way into
+ * the index while leaving the working tree — and therefore `git status` — clean, so Cursor would import different
+ * bytes than the ones `treeHash` verified. `$GIT_DIR/info/attributes` has the highest precedence and disables them
+ * for every path; the commit is then proven byte-for-byte against the staged files via blob ids (SHA-1 object format).
+ */
+const stagingAttributes = '* -text -eol -filter -ident -working-tree-encoding -export-ignore -export-subst\n';
+const stagingGitConfig = Object.freeze(['-c', 'core.autocrlf=false', '-c', 'core.safecrlf=false']);
+
+const blobId = (bytes: Buffer): string => createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
+
+/** `<relative '/'-separated path> -> blob id` for every regular file under `root`, skipping the top-level `.git`. */
+const blobIndex = async (root: string, relative = ''): Promise<Map<string, string>> => {
+  const index = new Map<string, string>();
+  for (const name of await readdir(join(root, relative))) {
+    if (relative === '' && name === '.git') continue;
+    const child = relative === '' ? name : `${relative}/${name}`;
+    const metadata = await lstat(join(root, child));
+    if (metadata.isDirectory()) {
+      for (const [path, id] of await blobIndex(root, child)) index.set(path, id);
+    } else if (metadata.isFile()) {
+      index.set(child, blobId(await readFile(join(root, child))));
+    }
+  }
+  return index;
+};
+
+const parseTree = (listing: string): Map<string, string> => {
+  const tree = new Map<string, string>();
+  for (const entry of listing.split('\0')) {
+    if (entry === '') continue;
+    const tab = entry.indexOf('\t');
+    const [, , id] = entry.slice(0, tab).split(' ');
+    if (id !== undefined) tree.set(entry.slice(tab + 1), id);
+  }
+  return tree;
+};
+
+const assertCommittedBytes = async (
+  runner: CursorMarketplaceCommandRunner,
+  stage: string,
+): Promise<void> => {
+  const [expected, committed] = await Promise.all([
+    blobIndex(stage),
+    runGit(runner, stage, ['ls-tree', '-r', '-z', 'HEAD']).then(parseTree),
+  ]);
+  const drifted = [...expected].filter(([path, id]) => committed.get(path) !== id).map(([path]) => path);
+  const extra = [...committed.keys()].filter((path) => !expected.has(path));
+  if (drifted.length > 0 || extra.length > 0) {
+    throw failure(
+      'AB7004',
+      'Cursor marketplace staging failed: the committed tree differs from the staged bundle bytes ' +
+        `(${[...drifted, ...extra].map((path) => JSON.stringify(path)).join(', ')}); a Git attribute or filter transformed them.`,
+    );
+  }
+};
+
+export const stageCursorMarketplace = async (options: {
+  readonly cursorRoot: string;
+  readonly identity: CursorMarketplaceIdentity;
+  readonly runner: CursorMarketplaceCommandRunner;
+  readonly treeHash: (root: string) => Promise<string>;
+}): Promise<CursorMarketplaceStageResult> => {
+  const { cursorRoot, identity, runner } = options;
+  const root = cursorMarketplaceRoot(cursorRoot);
+  const repoRoot = join(root, identity.plugin);
+  const pluginDirectory = cursorMarketplacePluginPath(repoRoot, identity.plugin);
+  const marketplace = cursorMarketplaceName(identity.plugin);
+  const nextSteps = cursorMarketplaceNextSteps(repoRoot, identity.plugin);
+  await options.treeHash(identity.bundleRoot);
+  if (!(await exists(join(identity.bundleRoot, '.cursor-plugin', 'plugin.json')))) {
+    throw failure(
+      'AB7003',
+      '`--mode marketplace` requires a Cursor Plugin bundle (`.cursor-plugin/plugin.json`): Cursor marketplaces resolve ' +
+        '`plugins/<name>/.cursor-plugin/plugin.json`. Agent Plugins (root `plugin.json`) packs install with `--mode local`.',
+    );
+  }
+  const nestedGit = await findNestedGit(identity.bundleRoot);
+  if (nestedGit !== undefined) {
+    throw failure(
+      'AB7003',
+      `\`--mode marketplace\` refuses bundle-internal Git metadata at ${JSON.stringify(nestedGit)}: git would record it as an ` +
+        'empty gitlink and Cursor would import a plugin without files. Stage from a built bundle directory without `.git`, or use `--mode local`.',
+    );
+  }
+  const manifest = serializeManifest(await cursorMarketplaceManifest(identity));
+  await mkdir(root, { recursive: true });
+  if (await exists(repoRoot)) {
+    const currentVersion = await readMarketplacePluginVersion(pluginDirectory);
+    if (currentVersion !== undefined && currentVersion !== identity.version) {
+      throw failure(
+        'AB7005',
+        `Refusing version collision at ${repoRoot}: found ${currentVersion}, requested ${identity.version}.`,
+      );
+    }
+    if (
+      await exists(pluginDirectory) &&
+      await exists(join(repoRoot, '.git')) &&
+      await options.treeHash(identity.bundleRoot) === await options.treeHash(pluginDirectory)
+    ) {
+      if (!(await stagedManifestMatches(repoRoot, manifest))) {
+        throw failure(
+          'AB7005',
+          `Refusing content collision at ${repoRoot}: ${marketplaceManifestPath} differs from the generated marketplace manifest; remove the staged repository and rerun.`,
+        );
+      }
+      // Cursor imports the commit, not the working tree: the verified bytes must be what HEAD records.
+      const dirty = await runGit(runner, repoRoot, ['status', '--porcelain', '--untracked-files=all', '--ignored=matching']);
+      if (dirty !== '') {
+        throw failure(
+          'AB7005',
+          `Refusing content collision at ${repoRoot}: the working tree differs from the committed HEAD Cursor would import; remove the staged repository and rerun.`,
+        );
+      }
+      const commit = await runGit(runner, repoRoot, ['rev-parse', 'HEAD']);
+      return { ...(commit === '' ? {} : { commit }), destination: repoRoot, marketplace, nextSteps, state: 'already-installed' };
+    }
+    throw failure('AB7005', `Refusing content collision at ${repoRoot}.`);
+  }
+  const stageParent = await mkdtemp(join(root, `.${identity.plugin}.stage-`));
+  const stage = join(stageParent, 'repo');
+  try {
+    await mkdir(join(stage, '.cursor-plugin'), { recursive: true });
+    await cp(identity.bundleRoot, cursorMarketplacePluginPath(stage, identity.plugin), {
+      errorOnExist: true,
+      force: false,
+      recursive: true,
+      verbatimSymlinks: true,
+    });
+    await writeFile(join(stage, marketplaceManifestPath), manifest);
+    await options.treeHash(cursorMarketplacePluginPath(stage, identity.plugin));
+    await runGit(runner, stage, ['init', '-q', '--object-format=sha1']);
+    await mkdir(join(stage, '.git', 'info'), { recursive: true });
+    await writeFile(join(stage, '.git', 'info', 'attributes'), stagingAttributes);
+    // --force: bundle-internal .gitignore or global excludes must not drop files Cursor needs from the commit.
+    await runGit(runner, stage, [...stagingGitConfig, 'add', '--all', '--force']);
+    await runGit(runner, stage, [...gitIdentity, 'commit', '-q', '-m', `${identity.plugin}@${identity.version}`]);
+    await assertCommittedBytes(runner, stage);
+    const commit = await runGit(runner, stage, ['rev-parse', 'HEAD']);
+    await rename(stage, repoRoot);
+    return { ...(commit === '' ? {} : { commit }), destination: repoRoot, marketplace, nextSteps, state: 'staged' };
+  } finally {
+    await rm(stageParent, { force: true, recursive: true });
+  }
+};
diff --git a/packages/agent-bundle/src/install/doctor.ts b/packages/agent-bundle/src/install/doctor.ts
index 006ec174d..672dcd8f8 100644
--- a/packages/agent-bundle/src/install/doctor.ts
+++ b/packages/agent-bundle/src/install/doctor.ts
@@ -27,6 +27,7 @@ import { requestEventRuntimeStatus } from '../events/ipc.ts';
 import {
   parsePublicHostInventory,
   publicHostCacheRoot,
+  treeHash,
   type InstallHost,
   type PublicHostInventory,
 } from './install.ts';
@@ -38,6 +39,13 @@ import {
   type InstalledTreeOwnership,
   type TreeInventory,
 } from './receipt.ts';
+import {
+  type CursorHooksRegistration,
+  type CursorStagingGit,
+  inspectCursorMarketplaceStaging,
+  inspectCursorPluginHooks,
+} from './cursor-hooks-registration.ts';
+import { cursorMarketplacePluginPath, cursorMarketplaceRoot } from './cursor-marketplace.ts';
 
 export type DoctorHost = InstallHost;
 export type DoctorHostProbeStatus = 'available' | 'failed' | 'unavailable';
@@ -82,8 +90,13 @@ export interface DoctorHostProbe {
 }
 
 export interface DoctorFinding {
+  /** Git commit of a staged Cursor marketplace repository. */
+  readonly commit?: string;
   readonly durableState?: DoctorDurableStateReport;
   readonly entry?: string;
+  /** Cursor plugin hook registration proof (`.cursor-plugin/plugin.json` installs only). */
+  readonly hooks?: CursorHooksRegistration;
+  readonly marketplace?: string;
   readonly manifest?: string;
   readonly name?: string;
   readonly path?: string;
@@ -619,9 +632,25 @@ const readInstalledManifest = async (
   return undefined;
 };
 
+/**
+ * Read-only git verification for staged marketplaces through the Doctor command runner;
+ * `undefined` when git is not installed so the inspection degrades to ref-text checks.
+ */
+const stagingGit = (run: DoctorCommandRunner): CursorStagingGit => async (args, cwd) => {
+  try {
+    const result = await run(Object.freeze({ args: Object.freeze([...args]), cwd, executable: 'git' }));
+    return { exitCode: result.termination === undefined ? result.exitCode : null, stdout: result.stdout };
+  } catch (error) {
+    if (isErrno(error, 'ENOENT')) return undefined;
+    throw error;
+  }
+};
+
 const cursorInventory = async (
   home: string,
   available: boolean,
+  git: CursorStagingGit,
+  platform: NodeJS.Platform,
 ): Promise<{ readonly diagnostics: readonly Diagnostic[]; readonly inventory: DoctorInventory }> => {
   if (!available) return { diagnostics: Object.freeze([]), inventory: freezeInventory('skipped') };
   const installRoot = join(home, '.cursor', 'plugins', 'local');
@@ -630,18 +659,19 @@ const cursorInventory = async (
     entries = (await readdir(installRoot)).sort((left, right) => left.localeCompare(right));
   } catch (error) {
     if (isErrno(error, 'ENOENT')) {
-      return { diagnostics: Object.freeze([]), inventory: freezeInventory('known') };
+      entries = Object.freeze([]);
+    } else {
+      return {
+        diagnostics: freezeDiagnostics([diagnostic(
+          'AB7304',
+          `Cursor local plugins at ${JSON.stringify(installRoot)} could not be read.`,
+          'Repair permissions for the Cursor local plugin directory or reinstall the affected plugin.',
+          'error',
+          'cursor',
+        )]),
+        inventory: freezeInventory('unknown'),
+      };
     }
-    return {
-      diagnostics: freezeDiagnostics([diagnostic(
-        'AB7304',
-        `Cursor local plugins at ${JSON.stringify(installRoot)} could not be read.`,
-        'Repair permissions for the Cursor local plugin directory or reinstall the affected plugin.',
-        'error',
-        'cursor',
-      )]),
-      inventory: freezeInventory('unknown'),
-    };
   }
   const findings: DoctorFinding[] = [];
   const diagnostics: Diagnostic[] = [];
@@ -742,9 +772,14 @@ const cursorInventory = async (
     diagnostics.push(...staticDiagnostics);
     const durableState = await inspectDurableState(path, 'cursor');
     if (durableState !== undefined) diagnostics.push(...durableState.diagnostics);
+    const hooks = manifest.manifest === cursorManifestCandidates[0]
+      ? await inspectCursorPluginHooks(path, home, { caseInsensitivePaths: platform === 'win32' })
+      : undefined;
+    if (hooks !== undefined) diagnostics.push(...hooks.diagnostics);
     findings.push({
       ...(durableState === undefined ? {} : { durableState }),
       entry,
+      ...(hooks === undefined ? {} : { hooks: hooks.registration }),
       manifest: manifest.manifest,
       name: manifest.name,
       path,
@@ -752,6 +787,20 @@ const cursorInventory = async (
       ...(manifest.version === undefined ? {} : { version: manifest.version }),
     });
   }
+  const staging = await inspectCursorMarketplaceStaging(home, git);
+  diagnostics.push(...staging.diagnostics);
+  for (const staged of staging.findings) {
+    findings.push({
+      ...(staged.commit === undefined ? {} : { commit: staged.commit }),
+      entry: staged.entry,
+      manifest: '.cursor-plugin/marketplace.json',
+      ...(staged.marketplace === undefined ? {} : { marketplace: staged.marketplace }),
+      name: staged.name,
+      path: staged.path,
+      state: staged.state,
+      ...(staged.version === undefined ? {} : { version: staged.version }),
+    });
+  }
   return {
     diagnostics: freezeDiagnostics(diagnostics),
     inventory: freezeInventory('known', findings),
@@ -1039,9 +1088,69 @@ const publicHostInstallComparison = async (
   return { comparison: worst, diagnostics: freezeDiagnostics(diagnostics) };
 };
 
+/**
+ * A bundle delivered with `install cursor --mode marketplace` lives in the
+ * staged marketplace repository rather than `plugins/local`; report whether
+ * Cursor has imported it (matching copy under `plugins/cache`) or the UI step
+ * is still pending.
+ */
+const cursorStagedBundle = async (
+  identity: PluginIdentity,
+  home: string,
+  base: { readonly bundleRoot: string; readonly name: string; readonly path: string; readonly version: string },
+  git: CursorStagingGit,
+): Promise<{ readonly diagnostics: readonly Diagnostic[]; readonly finding: DoctorHostReport['bundle'] } | undefined> => {
+  const repoRoot = join(cursorMarketplaceRoot(join(home, '.cursor')), identity.name);
+  const pluginDirectory = cursorMarketplacePluginPath(repoRoot, identity.name);
+  if (!await exists(repoRoot)) return undefined;
+  if (!await exists(pluginDirectory)) {
+    // The staged repository is present but its plugin copy is gone: surface the staging inventory's
+    // corrupt finding (and its repair step) instead of AB7307 "not installed".
+    const staging = await inspectCursorMarketplaceStaging(home, git);
+    const entry = staging.findings.find((candidate) => candidate.name === identity.name);
+    return {
+      diagnostics: freezeDiagnostics(staging.diagnostics.filter((candidate) => candidate.message.includes(repoRoot))),
+      finding: Object.freeze({
+        ...base,
+        ...(entry?.marketplace === undefined ? {} : { marketplace: entry.marketplace }),
+        path: repoRoot,
+        state: 'corrupt',
+      }),
+    };
+  }
+  const [sourceHash, stagedHash] = await Promise.all([treeHash(identity.bundleRoot), treeHash(pluginDirectory)]);
+  if (sourceHash !== stagedHash) {
+    return {
+      diagnostics: freezeDiagnostics([diagnostic(
+        'AB7308',
+        `Staged Cursor marketplace copy of ${identity.name}@${identity.version} at ${repoRoot} differs from the current bundle.`,
+        'Remove the staged marketplace directory and rerun `agent-bundle install cursor --mode marketplace`.',
+        'warning',
+        'cursor',
+      )]),
+      finding: Object.freeze({ ...base, path: repoRoot, state: 'drifted' }),
+    };
+  }
+  // The staging inspection also proves the working tree equals committed HEAD, so a source-matching but
+  // uncommitted tree cannot be reported as imported.
+  const staging = await inspectCursorMarketplaceStaging(home, git);
+  const entry = staging.findings.find((candidate) => candidate.name === identity.name);
+  return {
+    diagnostics: freezeDiagnostics(staging.diagnostics.filter((candidate) => candidate.message.includes(repoRoot) || candidate.message.includes(`${identity.name}@`))),
+    finding: Object.freeze({
+      ...base,
+      ...(entry?.commit === undefined ? {} : { commit: entry.commit }),
+      ...(entry?.marketplace === undefined ? {} : { marketplace: entry.marketplace }),
+      path: repoRoot,
+      state: entry === undefined ? 'unregistered' : entry.state,
+    }),
+  };
+};
+
 const cursorBundle = async (
   identity: PluginIdentity,
   home: string,
+  git: CursorStagingGit,
 ): Promise<{ readonly diagnostics: readonly Diagnostic[]; readonly finding: DoctorHostReport['bundle'] }> => {
   const destination = join(home, '.cursor', 'plugins', 'local', identity.name);
   const base = {
@@ -1053,6 +1162,8 @@ const cursorBundle = async (
   try {
     const artifact = await treeInventory(identity.bundleRoot);
     if (!await exists(destination)) {
+      const staged = await cursorStagedBundle(identity, home, base, git);
+      if (staged !== undefined) return staged;
       return {
         diagnostics: freezeDiagnostics([diagnostic(
           'AB7307',
@@ -1673,11 +1784,12 @@ const doctorHost = async (
     ? await probeCursor(home)
     : await probeBinary(host, home, run);
   const environment = options.environment ?? process.env;
+  const git = stagingGit(run);
   const listing: PublicHostListing = host === 'cursor' || probed.probe.status !== 'available'
     ? { detail: `${host} is not available`, status: 'unavailable' }
     : await readPublicHostListing(host, run, options.from === undefined ? home : resolve(options.from));
   const inventoried = host === 'cursor'
-    ? await cursorInventory(home, probed.probe.status === 'available')
+    ? await cursorInventory(home, probed.probe.status === 'available', git, options.platform ?? process.platform)
     : probed.probe.status !== 'available'
       ? { diagnostics: Object.freeze([]), inventory: freezeInventory('skipped') }
       : publicHostInventory(host, listing, environment, home);
@@ -1694,7 +1806,7 @@ const doctorHost = async (
       );
       const context: PublicHostContext = { environment, home, listing, run };
       const checked = host === 'cursor'
-        ? await cursorBundle(identity, home)
+        ? await cursorBundle(identity, home, git)
         : host === 'claude'
           ? await claudeBundle(identity, probed.probe, context)
           : await codexBundle(identity, probed.probe, context);
diff --git a/packages/agent-bundle/src/install/format.ts b/packages/agent-bundle/src/install/format.ts
new file mode 100644
index 000000000..6f9f909b0
--- /dev/null
+++ b/packages/agent-bundle/src/install/format.ts
@@ -0,0 +1,45 @@
+import type { InstallResult } from './install.ts';
+
+const shortContentHash = (hash: string): string => hash.slice(0, 12);
+
+const installVerb = (state: InstallResult['state'], mode: InstallResult['mode']): string => {
+  switch (state) {
+    case 'adopted':
+      return 'Adopted';
+    case 'replaced':
+      return 'Replaced';
+    case 'already-installed':
+      // Marketplace mode has not installed anything into Cursor yet; the Customize step is still pending.
+      return mode === 'marketplace' ? 'Already staged' : 'Already installed';
+    case 'installed':
+      return 'Installed';
+    case 'staged':
+      return 'Staged';
+    default: {
+      const exhaustive: never = state;
+      throw new TypeError(`Unknown install state ${String(exhaustive)}.`);
+    }
+  }
+};
+
+/** Human-readable install summary shared by the CLI and generated installer bins. */
+export const formatInstallResult = (result: InstallResult): string => {
+  const destination = result.destination ?? result.bundleRoot;
+  const mode = result.mode === undefined ? '' : ` (${result.mode} mode)`;
+  const content = result.previousContentHash !== undefined && result.contentHash !== undefined
+    ? ` (content ${shortContentHash(result.previousContentHash)} -> ${shortContentHash(result.contentHash)})`
+    : result.contentHash === undefined
+      ? ''
+      : ` (content ${shortContentHash(result.contentHash)})`;
+  const lines = [
+    `${installVerb(result.state, result.mode)} ${result.plugin}@${result.version} for ${result.host}${mode} at ${destination}${content}`,
+  ];
+  if (result.marketplace !== undefined && result.host === 'cursor') {
+    lines.push(`Marketplace: ${result.marketplace}${result.commit === undefined ? '' : ` @ ${result.commit}`}`);
+  }
+  if (result.nextSteps !== undefined && result.nextSteps.length > 0) {
+    lines.push('Next steps:');
+    lines.push(...result.nextSteps.map((step, index) => `  ${index + 1}. ${step}`));
+  }
+  return `${lines.join('\n')}\n`;
+};
diff --git a/packages/agent-bundle/src/install/install.ts b/packages/agent-bundle/src/install/install.ts
index 023c64b51..0b13a0d7e 100644
--- a/packages/agent-bundle/src/install/install.ts
+++ b/packages/agent-bundle/src/install/install.ts
@@ -10,6 +10,7 @@ import { errorMessage, isErrno } from '../core/errors.ts';
 import { exists } from '../core/paths.ts';
 import { runPromise } from '../effect/boundary.ts';
 import { liftPromise } from '../effect/lift.ts';
+import { stageCursorMarketplace } from './cursor-marketplace.ts';
 import {
   compareInstalledTree,
   createInstallReceipt,
@@ -29,7 +30,15 @@ export type InstallScope = 'local' | 'project' | 'user';
  * `adopted`: a byte-identical pre-receipt Cursor copy gained its receipt under
  * `--replace`; no plugin file changed.
  */
-export type InstallResultState = 'adopted' | 'already-installed' | 'installed' | 'replaced';
+export type InstallResultState = 'adopted' | 'already-installed' | 'installed' | 'replaced' | 'staged';
+
+/**
+ * Cursor delivery mode: `local` copies into `~/.cursor/plugins/local/<name>`
+ * (loads on reload, shown as a local plugin); `marketplace` stages a committed
+ * local marketplace repository that Cursor's Customize import registers as a
+ * marketplace-installed plugin. See install/cursor-marketplace.ts.
+ */
+export type InstallMode = 'local' | 'marketplace';
 
 export interface InstallCommandResult {
   readonly code: number;
@@ -58,6 +67,8 @@ export interface InstallBundleOptions {
    * replaced automatically; foreign directories are always refused.
    */
   readonly replace?: boolean;
+  /** Cursor only; defaults to `local`. Other hosts reject an explicit mode. */
+  readonly mode?: InstallMode;
   readonly scope?: InstallScope;
 }
 
@@ -65,12 +76,21 @@ export interface InstallResult {
   readonly bundleRoot: string;
   /** sha256 over the artifact tree that was installed or found already installed. */
   readonly contentHash?: string;
+  /** Git commit of the staged marketplace repository (`mode: 'marketplace'`). */
+  readonly commit?: string;
   readonly destination?: string;
   readonly host: InstallHost;
   readonly marketplace?: string;
+  readonly mode?: InstallMode;
+  /** Remaining host-owned steps the installer cannot perform non-interactively. */
+  readonly nextSteps?: readonly string[];
   readonly plugin: string;
   /** Content hash of the copy a `replaced` install superseded. */
   readonly previousContentHash?: string;
+  /**
+   * `staged` means the marketplace repository is ready and Cursor's import step is still pending
+   * (`mode: 'marketplace'`).
+   */
   readonly state: InstallResultState;
   readonly version: string;
 }
@@ -508,14 +528,7 @@ const collisionMessage = (
   }
 };
 
-const installCursor = async (
-  options: InstallBundleOptions,
-  identity: PluginIdentity,
-  scope: InstallScope,
-): Promise<InstallResult> => {
-  if (scope !== 'user') {
-    throw failure('AB7003', `Cursor local plugin installation supports only user scope, not ${scope}.`, 'cursor');
-  }
+const resolveCursorRoot = async (options: InstallBundleOptions): Promise<string> => {
   const cursorRoot = join(options.home ?? homedir(), '.cursor');
   let cursorMetadata: Awaited<ReturnType<typeof lstat>>;
   try {
@@ -529,12 +542,56 @@ const installCursor = async (
   if (!cursorMetadata.isDirectory()) {
     throw failure('AB7002', `Cursor home ${JSON.stringify(cursorRoot)} is not a directory.`, 'cursor');
   }
+  return cursorRoot;
+};
+
+const installCursorMarketplace = async (
+  options: InstallBundleOptions,
+  identity: PluginIdentity,
+): Promise<InstallResult> => {
+  const cursorRoot = await resolveCursorRoot(options);
+  try {
+    const staged = await stageCursorMarketplace({
+      cursorRoot,
+      identity,
+      runner: options.commandRunner ?? defaultCommandRunner,
+      treeHash,
+    });
+    return {
+      bundleRoot: identity.bundleRoot,
+      ...(staged.commit === undefined ? {} : { commit: staged.commit }),
+      destination: staged.destination,
+      host: 'cursor',
+      marketplace: staged.marketplace,
+      mode: 'marketplace',
+      nextSteps: staged.nextSteps,
+      plugin: identity.plugin,
+      state: staged.state,
+      version: identity.version,
+    };
+  } catch (error) {
+    if (error instanceof DiagnosticError) throw error;
+    throw failure('AB7004', errorMessage(error), 'cursor');
+  }
+};
+
+const installCursor = async (
+  options: InstallBundleOptions,
+  identity: PluginIdentity,
+  scope: InstallScope,
+): Promise<InstallResult> => {
+  if (scope !== 'user') {
+    throw failure('AB7003', `Cursor plugin installation supports only user scope, not ${scope}.`, 'cursor');
+  }
+  if (options.mode === 'marketplace') return installCursorMarketplace(options, identity);
+  const cursorRoot = await resolveCursorRoot(options);
   const installRoot = join(cursorRoot, 'plugins', 'local');
   const destination = join(installRoot, identity.plugin);
   const base = {
     bundleRoot: identity.bundleRoot,
     destination,
     host: 'cursor',
+    mode: 'local',
     plugin: identity.plugin,
     version: identity.version,
   } as const;
@@ -607,6 +664,13 @@ const installProgram = Effect.fnUntraced(function*(
   options: InstallBundleOptions,
 ): Effect.fn.Return<InstallResult, unknown> {
   const scope = options.scope ?? 'user';
+  if (options.mode !== undefined && options.host !== 'cursor') {
+    return yield* Effect.fail(failure(
+      'AB7003',
+      `Install mode ${JSON.stringify(options.mode)} applies to the cursor host only.`,
+      options.host,
+    ));
+  }
   const identity = yield* liftPromise(() => readIdentity(options.from, options.host));
   switch (options.host) {
     case 'claude':
diff --git a/packages/agent-bundle/src/install/surface.ts b/packages/agent-bundle/src/install/surface.ts
index ad56d5b63..fdeb33c95 100644
--- a/packages/agent-bundle/src/install/surface.ts
+++ b/packages/agent-bundle/src/install/surface.ts
@@ -87,14 +87,18 @@ const codexInstructions = (model: NormalizedPlugin): string[] => [
 const cursorInstructions = (model: NormalizedPlugin): string[] => [
   '## Cursor',
   '',
-  'Cursor has no non-interactive plugin install command. Use the bundled safe-copy installer:',
+  'Cursor has no non-interactive plugin install command. The bundled installer supports two delivery modes.',
+  '',
+  '### Local plugin (default)',
   '',
   '```sh',
   'node ./install.mjs',
   '```',
   '',
-  `It installs to \`~/.cursor/plugins/local/${model.metadata.name}\`. Restart Cursor or run`,
-  '`Developer: Reload Window` after installation.',
+  `It safe-copies the bundle to \`~/.cursor/plugins/local/${model.metadata.name}\`. Restart Cursor or run`,
+  '`Developer: Reload Window` after installation. Cursor loads rules, skills, MCP servers, and the',
+  'manifest-declared `hooks/hooks.json` from that directory; plugin hooks run from the plugin root with',
+  '`${CURSOR_PLUGIN_ROOT}` substituted and need no `~/.cursor/hooks.json` entry.',
   '',
   '### Reinstall after a same-version rebuild',
   '',
@@ -112,6 +116,18 @@ const cursorInstructions = (model: NormalizedPlugin): string[] => [
   'plugin is always refused with an installed-versus-artifact content-hash comparison; remove it',
   'manually. `agent-bundle install cursor --from ./ [--replace]` applies the same policy.',
   '',
+  '### Marketplace plugin',
+  '',
+  '```sh',
+  'node ./install.mjs --mode marketplace',
+  '```',
+  '',
+  `It stages a committed Git repository at \`~/.cursor/agent-bundle/marketplaces/${model.metadata.name}\` whose`,
+  `\`.cursor-plugin/marketplace.json\` lists this plugin, then prints the exact Cursor step: Customize -> Plugins ->`,
+  '"Add Plugins from Local Repository" -> select that directory -> Install. Cursor then shows the plugin as a',
+  'marketplace install (not "local") and manages it from Customize. `git` must be on PATH. Verify with',
+  '`agent-bundle doctor --host cursor`.',
+  '',
 ];
 
 const portableInstructions = (): string[] => [
@@ -173,6 +189,7 @@ const cursorInstallerSource = (model: NormalizedPlugin): string => {
   const version = JSON.stringify(model.metadata.version);
   return [
     '#!/usr/bin/env node',
+    "import { execFile } from 'node:child_process';",
     "import { createHash, randomUUID } from 'node:crypto';",
     "import { cp, lstat, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, rmdir, writeFile } from 'node:fs/promises';",
     "import { homedir } from 'node:os';",
@@ -191,11 +208,23 @@ const cursorInstallerSource = (model: NormalizedPlugin): string => {
     "const cursorRoot = join(homedir(), '.cursor');",
     "const installRoot = join(cursorRoot, 'plugins', 'local');",
     'const destination = join(installRoot, pluginName);',
-    "const usage = 'Usage: node install.mjs [--replace|--force] [--help]';",
+    "const marketplaceRoot = join(cursorRoot, 'agent-bundle', 'marketplaces');",
+    'const marketplaceRepo = join(marketplaceRoot, pluginName);',
+    "const marketplacePlugin = join(marketplaceRepo, 'plugins', pluginName);",
+    "const usage = 'Usage: node install.mjs [--mode local|marketplace] [--replace|--force] [--help]';",
     '',
     'let replace = false;',
-    'for (const argument of process.argv.slice(2)) {',
+    "let mode = 'local';",
+    'const argv = process.argv.slice(2);',
+    'for (let index = 0; index < argv.length; index += 1) {',
+    '  const argument = argv[index];',
     "  if (argument === '--replace' || argument === '--force') { replace = true; continue; }",
+    "  if (argument === '--mode') {",
+    '    mode = argv[index + 1];',
+    "    if (mode !== 'local' && mode !== 'marketplace') { console.error(`Install mode must be local or marketplace.\\n${usage}`); process.exit(2); }",
+    '    index += 1;',
+    '    continue;',
+    '  }',
     "  if (argument === '--help' || argument === '-h') { console.log(usage); process.exit(0); }",
     '  console.error(`Unknown installer argument ${JSON.stringify(argument)}.\\n${usage}`);',
     '  process.exit(2);',
@@ -263,6 +292,8 @@ const cursorInstallerSource = (model: NormalizedPlugin): string => {
     "  return { files, hash: hash.digest('hex') };",
     '};',
     '',
+    'const treeHash = async (root) => (await inventory(root)).hash;',
+    '',
     '// An existing entry is one of ours when its exact name is owned, or when the filesystem proves it a case',
     '// alias of an owned name (both spellings realpath to the same on-disk path). Inode equality is not used.',
     'const isOwnedEntry = async (root, owned, relative) => {',
@@ -421,6 +452,137 @@ const cursorInstallerSource = (model: NormalizedPlugin): string => {
     'if (!(await exists(cursorRoot)) || !(await lstat(cursorRoot)).isDirectory()) {',
     '  throw new Error(`Cursor is not installed in ${cursorRoot}.`);',
     '}',
+    '',
+    'const git = (cwd, args) => new Promise((resolvePromise, reject) => {',
+    "  execFile('git', args, { cwd }, (error, stdout, stderr) => {",
+    "    if (error?.code === 'ENOENT') {",
+    "      reject(new Error('git is required for --mode marketplace; install git or use the default local mode.'));",
+    '      return;',
+    '    }',
+    '    if (error) { reject(new Error(`git ${args[0]} failed: ${(stderr || stdout || error.message).trim()}`)); return; }',
+    '    resolvePromise(stdout.trim());',
+    '  });',
+    '});',
+    '',
+    'const printMarketplaceSteps = (state, commit) => {',
+    '  console.log(`${state} ${pluginName}@${pluginVersion} for cursor (marketplace mode) at ${marketplaceRepo}`);',
+    "  console.log(`Marketplace: ${pluginName}-marketplace${commit ? ` @ ${commit}` : ''}`);",
+    "  console.log('Next steps:');",
+    '  console.log(`  1. Open Cursor, then Customize -> Plugins -> "Add Plugins from Local Repository" and select ${marketplaceRepo}.`);',
+    '  console.log(`  2. Choose "${pluginName}" in the imported marketplace and select Install (user scope).`);',
+    "  console.log('  3. Verify with `agent-bundle doctor --host cursor`: the plugin must appear under ~/.cursor/plugins/cache once Cursor has installed it.');",
+    '};',
+    '',
+    "const marketplaceManifestPath = join(marketplaceRepo, '.cursor-plugin', 'marketplace.json');",
+    '',
+    "if (mode === 'marketplace' && !(await exists(join(source, '.cursor-plugin', 'plugin.json')))) {",
+    "  throw new Error('--mode marketplace requires a Cursor Plugin (.cursor-plugin/plugin.json); Cursor marketplaces resolve plugins/<name>/.cursor-plugin/plugin.json. This bundle is an Agent Plugins (root plugin.json) pack: use the default local mode.');",
+    '}',
+    '// Owner and description come from the emitted .cursor-plugin/plugin.json, exactly as `agent-bundle install',
+    '// cursor --mode marketplace` derives them, so both entry points stage byte-identical marketplace manifests.',
+    'const marketplaceManifestFor = async () => {',
+    "  const manifest = JSON.parse(await readFile(join(source, '.cursor-plugin', 'plugin.json'), 'utf8'));",
+    "  const owner = typeof manifest?.author?.name === 'string' ? manifest.author.name : pluginName;",
+    "  const description = typeof manifest?.description === 'string' ? { description: manifest.description } : {};",
+    '  // Entry fields are limited to the pinned Cursor marketplace schema (name/source/description).',
+    '  return `${JSON.stringify({',
+    '    metadata: { description: `Agent Bundle local marketplace for ${pluginName}@${pluginVersion}.` },',
+    '    name: `${pluginName}-marketplace`,',
+    '    owner: { name: owner },',
+    '    plugins: [{ ...description, name: pluginName, source: `plugins/${pluginName}` }],',
+    '  }, null, 2)}\\n`;',
+    '};',
+    'const blobIndex = async (root, relative = \'\') => {',
+    '  const index = new Map();',
+    '  for (const name of await readdir(join(root, relative))) {',
+    "    if (relative === '' && name === '.git') continue;",
+    "    const child = relative === '' ? name : `${relative}/${name}`;",
+    '    const metadata = await lstat(join(root, child));',
+    '    if (metadata.isDirectory()) {',
+    '      for (const [path, id] of await blobIndex(root, child)) index.set(path, id);',
+    '    } else if (metadata.isFile()) {',
+    '      const bytes = await readFile(join(root, child));',
+    "      index.set(child, createHash('sha1').update(`blob ${bytes.length}\\0`).update(bytes).digest('hex'));",
+    '    }',
+    '  }',
+    '  return index;',
+    '};',
+    'const findNestedGit = async (root, relative = \'\') => {',
+    '  for (const name of (await readdir(join(root, relative))).sort()) {',
+    "    const child = relative === '' ? name : join(relative, name);",
+    "    if (name === '.git') return child;",
+    '    const metadata = await lstat(join(root, child));',
+    '    if (!metadata.isSymbolicLink() && metadata.isDirectory()) {',
+    '      const nested = await findNestedGit(root, child);',
+    '      if (nested !== undefined) return nested;',
+    '    }',
+    '  }',
+    '  return undefined;',
+    '};',
+    "if (mode === 'marketplace') {",
+    '  const marketplaceManifest = await marketplaceManifestFor();',
+    '  const nestedGit = await findNestedGit(source);',
+    '  if (nestedGit !== undefined) {',
+    '    throw new Error(`--mode marketplace refuses bundle-internal Git metadata at ${JSON.stringify(nestedGit)}: git would record it as an empty gitlink and Cursor would import a plugin without files. Stage from a built bundle directory without .git, or use the default local mode.`);',
+    '  }',
+    '  await mkdir(marketplaceRoot, { recursive: true });',
+    '  if (await exists(marketplaceRepo)) {',
+    '    let stagedVersion;',
+    "    try { stagedVersion = JSON.parse(await readFile(join(marketplacePlugin, '.cursor-plugin/plugin.json'), 'utf8')).version; }",
+    "    catch (error) { if (error?.code !== 'ENOENT') throw error; }",
+    '    if (stagedVersion !== undefined && stagedVersion !== pluginVersion) {',
+    '      throw new Error(`Refusing version collision at ${marketplaceRepo}: found ${stagedVersion}, requested ${pluginVersion}.`);',
+    '    }',
+    "    if (await exists(marketplacePlugin) && await exists(join(marketplaceRepo, '.git')) && await treeHash(source) === await treeHash(marketplacePlugin)) {",
+    '      let stagedManifest;',
+    "      try { stagedManifest = await readFile(marketplaceManifestPath, 'utf8'); }",
+    "      catch (error) { if (error?.code !== 'ENOENT') throw error; }",
+    '      if (stagedManifest !== marketplaceManifest) {',
+    '        throw new Error(`Refusing content collision at ${marketplaceRepo}: .cursor-plugin/marketplace.json differs from the generated marketplace manifest; remove the staged repository and rerun.`);',
+    '      }',
+    "      if (await git(marketplaceRepo, ['status', '--porcelain', '--untracked-files=all', '--ignored=matching']) !== '') {",
+    '        throw new Error(`Refusing content collision at ${marketplaceRepo}: the working tree differs from the committed HEAD Cursor would import; remove the staged repository and rerun.`);',
+    '      }',
+    "      printMarketplaceSteps('Already staged', await git(marketplaceRepo, ['rev-parse', 'HEAD']));",
+    '      process.exit(0);',
+    '    }',
+    '    throw new Error(`Refusing content collision at ${marketplaceRepo}.`);',
+    '  }',
+    '  const stageParent = await mkdtemp(join(marketplaceRoot, `.${pluginName}.stage-`));',
+    "  const stage = join(stageParent, 'repo');",
+    '  try {',
+    "    await mkdir(join(stage, '.cursor-plugin'), { recursive: true });",
+    "    await cp(source, join(stage, 'plugins', pluginName), { errorOnExist: true, force: false, recursive: true, verbatimSymlinks: true });",
+    "    await writeFile(join(stage, '.cursor-plugin', 'marketplace.json'), marketplaceManifest);",
+    "    await treeHash(join(stage, 'plugins', pluginName));",
+    "    await git(stage, ['init', '-q', '--object-format=sha1']);",
+    "    // Attributes (text/eol/filter/ident) would rewrite bytes in the index while leaving the tree clean; disable them.",
+    "    await mkdir(join(stage, '.git', 'info'), { recursive: true });",
+    "    await writeFile(join(stage, '.git', 'info', 'attributes'), '* -text -eol -filter -ident -working-tree-encoding -export-ignore -export-subst\\n');",
+    "    await git(stage, ['-c', 'core.autocrlf=false', '-c', 'core.safecrlf=false', 'add', '--all', '--force']);",
+    "    await git(stage, ['-c', 'user.name=agent-bundle', '-c', 'user.email=agent-bundle@localhost', '-c', 'commit.gpgsign=false', 'commit', '-q', '-m', `${pluginName}@${pluginVersion}`]);",
+    '    // Prove the commit holds the staged bytes: every blob id must equal sha1("blob <len>\\0" + bytes).',
+    '    const expected = await blobIndex(stage);',
+    '    const committed = new Map();',
+    "    for (const entry of (await git(stage, ['ls-tree', '-r', '-z', 'HEAD'])).split('\\0')) {",
+    "      if (entry === '') continue;",
+    "      const tab = entry.indexOf('\\t');",
+    "      committed.set(entry.slice(tab + 1), entry.slice(0, tab).split(' ')[2]);",
+    '    }',
+    '    const drifted = [...expected].filter(([path, id]) => committed.get(path) !== id).map(([path]) => path);',
+    '    const extra = [...committed.keys()].filter((path) => !expected.has(path));',
+    '    if (drifted.length > 0 || extra.length > 0) {',
+    '      throw new Error(`Cursor marketplace staging failed: the committed tree differs from the staged bundle bytes (${[...drifted, ...extra].map((path) => JSON.stringify(path)).join(\', \')}); a Git attribute or filter transformed them.`);',
+    '    }',
+    "    const commit = await git(stage, ['rev-parse', 'HEAD']);",
+    '    await rename(stage, marketplaceRepo);',
+    "    printMarketplaceSteps('Staged', commit);",
+    '  } finally {',
+    '    await rm(stageParent, { force: true, recursive: true });',
+    '  }',
+    '  process.exit(0);',
+    '}',
+    '',
     'await mkdir(installRoot, { recursive: true });',
     'const artifact = await inventory(source);',
     '',
diff --git a/packages/agent-bundle/tests/adapter-metadata.test.ts b/packages/agent-bundle/tests/adapter-metadata.test.ts
index bc2a0e864..b6231e5b9 100644
--- a/packages/agent-bundle/tests/adapter-metadata.test.ts
+++ b/packages/agent-bundle/tests/adapter-metadata.test.ts
@@ -52,7 +52,7 @@ it('records exact immutable metadata for every built-in target', () => {
   const registry = createDefaultRegistry();
 
   expect(registryMetadata(registry, 'portable')).toEqual({
-    adapterRevision: '1.7.0',
+    adapterRevision: '1.8.0',
     observedVersion: '1.0.0',
     schemas: [
       {
@@ -145,7 +145,7 @@ it('records exact immutable metadata for every built-in target', () => {
     ],
   });
   expect(registryMetadata(registry, 'cursor')).toEqual({
-    adapterRevision: '1.10.0',
+    adapterRevision: '1.11.0',
     observedVersion: '2026-08-28',
     schemas: [
       {
@@ -170,7 +170,7 @@ it('records exact immutable metadata for every built-in target', () => {
       },
     ],
   });
-  expect(registryMetadata(registry, 'plugin').adapterRevision).toBe('1.26.0');
+  expect(registryMetadata(registry, 'plugin').adapterRevision).toBe('1.27.0');
 });
 
 it('records observed capability versions and rehashes schema snapshots against pinned provenance', async () => {
diff --git a/packages/agent-bundle/tests/doctor.test.ts b/packages/agent-bundle/tests/doctor.test.ts
index 19f29c3d1..b6173a3e4 100644
--- a/packages/agent-bundle/tests/doctor.test.ts
+++ b/packages/agent-bundle/tests/doctor.test.ts
@@ -1,4 +1,4 @@
-import { cp, mkdir, mkdtemp, rm, symlink, writeFile } from 'node:fs/promises';
+import { cp, mkdir, mkdtemp, readFile, rm, symlink, writeFile } from 'node:fs/promises';
 import { spawn, type ChildProcess } from 'node:child_process';
 import { createServer, type Server, type Socket } from 'node:net';
 import { tmpdir } from 'node:os';
@@ -781,6 +781,26 @@ it('reports unreadable Cursor local plugin directory as unknown inventory', asyn
   }
 });
 
+it('reports an unreadable Cursor marketplace staging root as an AB7324 finding instead of aborting', async () => {
+  const fixture = await temporaryDoctor();
+  const stagingRoot = join(fixture.home, '.cursor', 'agent-bundle', 'marketplaces');
+  try {
+    await mkdir(dirname(stagingRoot), { recursive: true });
+    await writeFile(stagingRoot, 'not a directory');
+    const report = await runDoctor({
+      endpointDirectory: fixture.endpointDirectory,
+      home: fixture.home,
+      hosts: ['cursor'],
+    });
+    expect(hostReport(report, 'cursor').inventory.findings).toEqual([]);
+    const staging = report.diagnostics.filter((entry) => entry.code === 'AB7324');
+    expect(staging).toEqual([expect.objectContaining({ severity: 'error' })]);
+    expect(staging[0]?.message).toContain('could not be read');
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
 it('reports Claude and Codex inventories as honestly unknown when plugin list --json is unusable', async () => {
   const fixture = await temporaryDoctor();
   try {
@@ -1723,3 +1743,468 @@ it('rejects an invalid Doctor host as a usage error', async () => {
   expect(code).toBe(2);
   expect(stderr.join('')).toContain('Doctor host must be claude, codex, or cursor.');
 });
+
+const writeHookedCursorPlugin = async (pluginRoot: string, version = '1.2.3'): Promise<void> => {
+  await writeJson(join(pluginRoot, '.cursor-plugin/plugin.json'), {
+    description: 'Hooked doctor fixture.',
+    hooks: './hooks/hooks.json',
+    name: 'hooked-fixture',
+    version,
+  });
+  await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+    hooks: {
+      postToolUse: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/after-tool.mjs"', matcher: '^Shell$' }],
+      preToolUse: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/before-tool.mjs"', matcher: '^Shell$' }],
+      stop: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/stop.mjs"' }],
+    },
+    version: 1,
+  });
+  await mkdir(join(pluginRoot, 'hooks'), { recursive: true });
+  for (const script of ['after-tool.mjs', 'before-tool.mjs', 'stop.mjs']) {
+    await writeFile(join(pluginRoot, 'hooks', script), 'export {};\n');
+  }
+};
+
+it('proves plugin-scoped Cursor hook registration and flags stale, missing, and duplicate delivery', async () => {
+  const fixture = await temporaryDoctor();
+  const pluginRoot = join(fixture.home, '.cursor', 'plugins', 'local', 'hooked-fixture');
+  const doctor = (options: { readonly platform?: NodeJS.Platform } = {}) =>
+    runDoctor({ ...options, endpointDirectory: fixture.endpointDirectory, home: fixture.home, hosts: ['cursor'] });
+  const hookDiagnostics = (report: DoctorReport) => report.diagnostics.filter((entry) => entry.code === 'AB7322' || entry.code === 'AB7323');
+  try {
+    await writeHookedCursorPlugin(pluginRoot);
+
+    const registered = await doctor();
+    expect(hostReport(registered, 'cursor').inventory.findings).toEqual([expect.objectContaining({
+      entry: 'hooked-fixture',
+      hooks: {
+        commands: 3,
+        duplicates: [],
+        events: ['postToolUse', 'preToolUse', 'stop'],
+        source: join(pluginRoot, 'hooks/hooks.json'),
+        state: 'registered',
+      },
+      state: 'installed',
+    })]);
+    expect(hookDiagnostics(registered)).toEqual([expect.objectContaining({ code: 'AB7322', severity: 'info' })]);
+    expect(hookDiagnostics(registered)[0]?.message).toContain('postToolUse, preToolUse, stop');
+
+    // Prompt hooks are a valid pinned-schema shape; they register without a script-path check.
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: {
+        postToolUse: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/after-tool.mjs"', matcher: '^Shell$' }],
+        preToolUse: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/before-tool.mjs"', matcher: '^Shell$', type: 'command' }],
+        stop: [{ prompt: 'Did the agent finish every task?', type: 'prompt' }],
+      },
+      version: 1,
+    });
+    const prompted = await doctor();
+    expect(hostReport(prompted, 'cursor').inventory.findings[0]?.hooks).toMatchObject({
+      commands: 2,
+      events: ['postToolUse', 'preToolUse', 'stop'],
+      state: 'registered',
+    });
+    expect(hookDiagnostics(prompted)).toEqual([expect.objectContaining({ code: 'AB7322', severity: 'info' })]);
+    expect(hookDiagnostics(prompted)[0]?.message).toContain('2 command(s), 1 prompt hook(s)');
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { stop: [{ type: 'prompt' }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+    // Shapes the pinned hooks.schema.json rejects (unknown event, extra entry property) never count as registered.
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { onToolUse: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/after-tool.mjs"' }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { stop: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/stop.mjs"', unexpected: true }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+    await writeHookedCursorPlugin(pluginRoot);
+
+    // A sibling plugin whose path shares this plugin's path as a prefix must not count as duplicate delivery.
+    await writeJson(join(fixture.home, '.cursor', 'hooks.json'), {
+      hooks: { preToolUse: [{ command: `node ${pluginRoot}-tools/hooks/before-tool.mjs` }] },
+      version: 1,
+    });
+    const sibling = await doctor();
+    expect(hostReport(sibling, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ duplicates: [], state: 'registered' });
+    expect(hookDiagnostics(sibling).map((entry) => entry.code)).toEqual(['AB7322']);
+
+    // User hooks run from ~/.cursor, so a relative command that lands inside the plugin is duplicate delivery too.
+    await writeJson(join(fixture.home, '.cursor', 'hooks.json'), {
+      hooks: { stop: [{ command: 'node ./plugins/local/hooked-fixture/hooks/stop.mjs' }] },
+      version: 1,
+    });
+    const relative = await doctor();
+    expect(hostReport(relative, 'cursor').inventory.findings[0]?.hooks).toMatchObject({
+      duplicates: ['node ./plugins/local/hooked-fixture/hooks/stop.mjs'],
+    });
+    expect(hookDiagnostics(relative).map((entry) => entry.code)).toEqual(['AB7322', 'AB7323']);
+    // Windows-relative spellings resolve the same way.
+    await writeJson(join(fixture.home, '.cursor', 'hooks.json'), {
+      hooks: { stop: [{ command: 'node .\\plugins\\local\\hooked-fixture\\hooks\\stop.mjs' }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({
+      duplicates: ['node .\\plugins\\local\\hooked-fixture\\hooks\\stop.mjs'],
+    });
+    // A leading shell assignment is not the command word.
+    await writeJson(join(fixture.home, '.cursor', 'hooks.json'), {
+      hooks: { stop: [{ command: 'NODE_ENV=production node ./plugins/local/hooked-fixture/hooks/stop.mjs' }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({
+      duplicates: ['NODE_ENV=production node ./plugins/local/hooked-fixture/hooks/stop.mjs'],
+    });
+    // On Windows the filesystem is case-insensitive, so a differently cased spelling still runs the plugin's file.
+    const upperCased = `node ${join(pluginRoot, 'hooks/before-tool.mjs').toUpperCase()}`;
+    await writeJson(join(fixture.home, '.cursor', 'hooks.json'), {
+      hooks: { preToolUse: [{ command: upperCased }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor({ platform: 'win32' }), 'cursor').inventory.findings[0]?.hooks).toMatchObject({
+      duplicates: [upperCased],
+    });
+    expect(hostReport(await doctor({ platform: 'linux' }), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ duplicates: [] });
+    // A plugin-local path passed as data to an unrelated script is not duplicate delivery.
+    await writeJson(join(fixture.home, '.cursor', 'hooks.json'), {
+      hooks: { stop: [{ command: 'node ./hooks/audit.mjs --output ./plugins/local/hooked-fixture/state/result.json' }] },
+      version: 1,
+    });
+    const dataArgument = await doctor();
+    expect(hostReport(dataArgument, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ duplicates: [], state: 'registered' });
+    expect(hookDiagnostics(dataArgument).map((entry) => entry.code)).toEqual(['AB7322']);
+
+    await writeJson(join(fixture.home, '.cursor', 'hooks.json'), {
+      hooks: { preToolUse: [{ command: `node ${join(pluginRoot, 'hooks/before-tool.mjs')}` }] },
+      version: 1,
+    });
+    const duplicated = await doctor();
+    expect(hostReport(duplicated, 'cursor').inventory.findings[0]?.hooks).toMatchObject({
+      duplicates: [`node ${join(pluginRoot, 'hooks/before-tool.mjs')}`],
+      state: 'registered',
+    });
+    expect(hookDiagnostics(duplicated).map((entry) => [entry.code, entry.severity])).toEqual([
+      ['AB7322', 'info'],
+      ['AB7323', 'warning'],
+    ]);
+    expect(hookDiagnostics(duplicated)[1]?.message).toContain('would run twice');
+
+    await writeFile(join(fixture.home, '.cursor', 'hooks.json'), '{ not json');
+    const unparsable = await doctor();
+    expect(hookDiagnostics(unparsable)[1]).toMatchObject({ code: 'AB7323', severity: 'warning' });
+    expect(hookDiagnostics(unparsable)[1]?.message).toContain('not a valid Cursor hooks document');
+    await rm(join(fixture.home, '.cursor', 'hooks.json'));
+
+    // Quoted paths containing whitespace stay one token.
+    await mkdir(join(pluginRoot, 'hooks'), { recursive: true });
+    await writeFile(join(pluginRoot, 'hooks', 'my hook.mjs'), 'export {};\n');
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { stop: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/my hook.mjs" --quiet' }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ commands: 1, state: 'registered' });
+
+    // Relative scripts passed to an interpreter resolve against the plugin root and are checked too.
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { stop: [{ command: 'node ./hooks/gone.mjs --flag' }] },
+      version: 1,
+    });
+    const relativeArgument = await doctor();
+    expect(hostReport(relativeArgument, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+    expect(hookDiagnostics(relativeArgument)[0]?.message).toContain(join(pluginRoot, 'hooks/gone.mjs'));
+
+    // Only the executed script is probed: other plugin-relative operands (outputs, config) may not exist yet.
+    await writeFile(join(pluginRoot, 'hooks', 'run.mjs'), 'export {};\n');
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { stop: [{ command: 'node --no-warnings ./hooks/run.mjs --output ./state/result.json' }] },
+      version: 1,
+    });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ commands: 1, state: 'registered' });
+
+    // Value-taking interpreter options do not hide the entry script: the preload exists, the script does not.
+    await writeFile(join(pluginRoot, 'hooks', 'preload.cjs'), 'module.exports = {};\n');
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { stop: [{ command: 'node --require ./hooks/preload.cjs --title=hook ./hooks/gone.mjs' }] },
+      version: 1,
+    });
+    const optionOperand = await doctor();
+    expect(hostReport(optionOperand, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+    expect(hookDiagnostics(optionOperand)[0]?.message).toContain(join(pluginRoot, 'hooks/gone.mjs'));
+
+    // Bare relative operands resolve against the plugin root too (pinned schema: relative to the hook source root),
+    // and PowerShell's -File operand is the entry script.
+    for (const command of [
+      'node hooks/gone.mjs',
+      'pwsh -NoProfile -File hooks/gone.mjs',
+      'PowerShell.EXE -NoProfile -EXECUTIONPOLICY Bypass -File hooks/gone.mjs',
+      '/usr/bin/env node ./hooks/gone.mjs',
+      'NODE_ENV=production node hooks/gone.mjs',
+      'A=1 B=2 /usr/bin/env node ./hooks/gone.mjs',
+      'bun run "${CURSOR_PLUGIN_ROOT}/hooks/gone.mjs"',
+      'deno run -A ./hooks/gone.mjs',
+      'env FOO=1 -u BAR node hooks/gone.mjs',
+      'Node.exe "${CURSOR_PLUGIN_ROOT}\\hooks\\gone.mjs"',
+      'hooks/gone.mjs --flag',
+    ]) {
+      await writeJson(join(pluginRoot, 'hooks/hooks.json'), { hooks: { stop: [{ command }] }, version: 1 });
+      const bareRelative = await doctor();
+      expect(hostReport(bareRelative, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+      expect(hookDiagnostics(bareRelative)[0]?.message).toContain(join(pluginRoot, 'hooks/gone.mjs'));
+    }
+    // A bare executable word is a PATH lookup, not a plugin file.
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), { hooks: { stop: [{ command: 'gone-tool --flag hooks/gone.mjs' }] }, version: 1 });
+    expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ commands: 1, state: 'registered' });
+
+    // Inline source runs no script file, so there is nothing under the plugin root to probe.
+    for (const command of ['node -e "process.exit(0)" ./hooks/gone.mjs', 'PowerShell.EXE -COMMAND "Write-Output ok"']) {
+      await writeJson(join(pluginRoot, 'hooks/hooks.json'), { hooks: { stop: [{ command }] }, version: 1 });
+      expect(hostReport(await doctor(), 'cursor').inventory.findings[0]?.hooks).toMatchObject({ commands: 1, state: 'registered' });
+    }
+
+    // A hook target that traverses a regular file (ENOTDIR) is reported stale rather than aborting Doctor.
+    await writeJson(join(pluginRoot, 'hooks/hooks.json'), {
+      hooks: { stop: [{ command: 'node "${CURSOR_PLUGIN_ROOT}/hooks/stop.mjs/child.mjs"' }] },
+      version: 1,
+    });
+    const traversesFile = await doctor();
+    expect(hostReport(traversesFile, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+    expect(hookDiagnostics(traversesFile)[0]?.message).toContain('stop.mjs/child.mjs');
+    await writeHookedCursorPlugin(pluginRoot);
+
+    await rm(join(pluginRoot, 'hooks', 'stop.mjs'));
+    const stale = await doctor();
+    expect(hostReport(stale, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ state: 'stale' });
+    expect(hookDiagnostics(stale)).toEqual([expect.objectContaining({ code: 'AB7322', severity: 'error' })]);
+    expect(hookDiagnostics(stale)[0]?.message).toContain('stop.mjs');
+
+    await rm(join(pluginRoot, 'hooks', 'hooks.json'));
+    const missing = await doctor();
+    expect(hostReport(missing, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ commands: 0, events: [], state: 'missing' });
+    expect(hookDiagnostics(missing)).toEqual([expect.objectContaining({ code: 'AB7322', severity: 'error' })]);
+    expect(hookDiagnostics(missing)[0]?.message).toContain('is missing');
+
+    // A hooks document that is not a regular file (a FIFO would block `readFile` forever) is stale, not a hang —
+    // both at the pinned `hooks/hooks.json` path and at a manifest-declared custom path.
+    if (process.platform !== 'win32') {
+      const mkfifo = (path: string) => new Promise<void>((resolvePromise, reject) => {
+        const child = spawn('mkfifo', [path], { stdio: 'ignore' });
+        child.on('error', reject);
+        child.on('exit', (code) => (code === 0 ? resolvePromise() : reject(new Error(`mkfifo exited ${code}`))));
+      });
+      await mkfifo(join(pluginRoot, 'hooks', 'hooks.json'));
+      const fifo = await doctor();
+      expect(hostReport(fifo, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ commands: 0, state: 'stale' });
+      expect(hookDiagnostics(fifo)).toEqual([expect.objectContaining({ code: 'AB7322', severity: 'error' })]);
+      await rm(join(pluginRoot, 'hooks', 'hooks.json'));
+      await writeJson(join(pluginRoot, '.cursor-plugin/plugin.json'), {
+        description: 'Hooked doctor fixture.',
+        hooks: 'custom-hooks.json',
+        name: 'hooked-fixture',
+        version: '1.2.3',
+      });
+      await mkfifo(join(pluginRoot, 'custom-hooks.json'));
+      const customFifo = await doctor();
+      expect(hostReport(customFifo, 'cursor').inventory.findings[0]?.hooks).toMatchObject({ commands: 0, state: 'stale' });
+      expect(hookDiagnostics(customFifo)).toEqual([expect.objectContaining({ code: 'AB7322', severity: 'error' })]);
+    }
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+it('reports a plugin without declared hooks as having no hook registration', async () => {
+  const fixture = await temporaryDoctor();
+  try {
+    const bundle = await createBundle(fixture.root, 'cursor');
+    await cp(bundle, join(fixture.home, '.cursor', 'plugins', 'local', 'doctor-fixture'), { recursive: true });
+
+    const report = await runDoctor({ endpointDirectory: fixture.endpointDirectory, home: fixture.home, hosts: ['cursor'] });
+
+    expect(hostReport(report, 'cursor').inventory.findings[0]?.hooks).toEqual({
+      commands: 0,
+      duplicates: [],
+      events: [],
+      state: 'none',
+    });
+    expect(report.diagnostics.filter((entry) => entry.code === 'AB7322')).toEqual([]);
+  } finally {
+    await fixture.cleanup();
+  }
+});
+
+it('tracks staged Cursor marketplaces from staged to imported', async () => {
+  const fixture = await temporaryDoctor();
+  const repo = join(fixture.home, '.cursor', 'agent-bundle', 'marketplaces', 'doctor-fixture');
+  const commit = 'a'.repeat(40);
+  try {
+    const bundle = await createBundle(fixture.root, 'cursor');
+    await cp(bundle, join(repo, 'plugins', 'doctor-fixture'), { recursive: true });
+    await writeJson(join(repo, '.cursor-plugin/marketplace.json'), {
+      name: 'doctor-fixture-marketplace',
+      owner: { name: 'doctor-fixture' },
+      plugins: [{ name: 'doctor-fixture', source: 'plugins/doctor-fixture' }],
+    });
+    await mkdir(join(repo, '.git', 'refs', 'heads'), { recursive: true });
+    await writeFile(join(repo, '.git', 'HEAD'), 'ref: refs/heads/main\n');
+    await writeFile(join(repo, '.git', 'refs', 'heads', 'main'), `${commit}\n`);
+    // Doctor verifies the staged repository through git (object exists, tree clean); the fixture is not a
+    // real repository, so answer those read-only probes here.
+    const gitState = { dirty: false, object: true };
+    const gitCalls: string[][] = [];
+    const fakeGit: DoctorCommandRunner = async (request) => {
+      expect(request.executable).toBe('git');
+      expect(request.cwd).toBe(repo);
+      gitCalls.push([...request.args]);
+      if (request.args[0] === 'cat-file') {
+        expect(request.args).toEqual(['cat-file', '-e', `${commit}^{commit}`]);
+        return commandResult(gitState.object ? {} : { exitCode: 128, stderr: 'fatal: Not a valid object name' });
+      }
+      expect(request.args).toEqual(['--no-optional-locks', 'status', '--porcelain', '--untracked-files=all', '--ignored=matching']);
+      return commandResult({ stdout: gitState.dirty ? '?? plugins/doctor-fixture/extra.txt\n' : '' });
+    };
+    const doctor = () => runDoctor({ commandRunner: fakeGit, endpointDirectory: fixture.endpointDirectory, from: bundle, home: fixture.home, hosts: ['cursor'] });
+
+    const staged = await doctor();
+    expect(gitCalls.map((args) => args.includes('cat-file') ? 'cat-file' : 'status')).toEqual(['cat-file', 'status', 'cat-file', 'status']);
+    const stagedFinding = {
+      commit,
+      entry: 'doctor-fixture',
+      manifest: '.cursor-plugin/marketplace.json',
+      marketplace: 'doctor-fixture-marketplace',
+      name: 'doctor-fixture',
+      path: repo,
+      version: '1.2.3',
+    };
+    expect(hostReport(staged, 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'unregistered' }]);
+    expect(hostReport(staged, 'cursor').bundle).toMatchObject({ commit, marketplace: 'doctor-fixture-marketplace', path: repo, state: 'unregistered' });
+    const stagedDiagnostics = staged.diagnostics.filter((entry) => entry.code === 'AB7324');
+    expect(stagedDiagnostics.map((entry) => entry.severity)).toEqual(['warning', 'warning']);
+    expect(stagedDiagnostics[0]?.recovery).toContain('Add Plugins from Local Repository');
+    expect(staged.diagnostics.filter((entry) => entry.code === 'AB7307')).toEqual([]);
+
+    // The same plugin cached from a different marketplace does not prove this staged repository was imported.
+    await writeJson(
+      join(fixture.home, '.cursor', 'plugins', 'cache', 'some-other-marketplace', 'doctor-fixture', commit, '.cursor-plugin', 'plugin.json'),
+      { name: 'doctor-fixture', version: '1.2.3' },
+    );
+    const foreign = await doctor();
+    expect(hostReport(foreign, 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'unregistered' }]);
+
+    // A cache directory without Cursor's `.cache-complete` receipt is a half-written copy, not an import.
+    const cacheRoot = join(fixture.home, '.cursor', 'plugins', 'cache', 'doctor-fixture-marketplace', 'doctor-fixture');
+    const cached = join(cacheRoot, commit);
+    await writeJson(join(cached, '.cursor-plugin', 'plugin.json'), { name: 'doctor-fixture', version: '1.2.3' });
+    const incomplete = await doctor();
+    expect(hostReport(incomplete, 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'unregistered' }]);
+
+    // A receipted copy from an earlier staging commit, or a malformed cache entry, does not prove this commit was imported.
+    const previous = join(cacheRoot, 'b'.repeat(40));
+    await writeJson(join(previous, '.cursor-plugin', 'plugin.json'), { name: 'doctor-fixture', version: '1.2.3' });
+    await writeFile(join(previous, '.cache-complete'), '');
+    await writeFile(join(cacheRoot, 'not-a-directory'), 'stray');
+    const staleReceipt = await doctor();
+    expect(hostReport(staleReceipt, 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'unregistered' }]);
+
+    await writeFile(join(cached, '.cache-complete'), '');
+    const imported = await doctor();
+    expect(hostReport(imported, 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'registered' }]);
+    expect(hostReport(imported, 'cursor').bundle?.state).toBe('registered');
+    expect(imported.diagnostics.filter((entry) => entry.code === 'AB7324').map((entry) => entry.severity)).toEqual(['info', 'info']);
+
+    // A stray regular file in the staging root is not a staged marketplace and must not abort Doctor.
+    await writeFile(join(fixture.home, '.cursor', 'agent-bundle', 'marketplaces', 'README.txt'), 'notes\n');
+    expect(hostReport(await doctor(), 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'registered' }]);
+
+    // Cursor imports the commit: a working tree that differs from HEAD (even when it matches the source bundle)
+    // is corrupt for both the inventory and `--from`, never "registered".
+    gitState.dirty = true;
+    const dirty = await doctor();
+    expect(hostReport(dirty, 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'corrupt' }]);
+    expect(hostReport(dirty, 'cursor').bundle).toMatchObject({ path: repo, state: 'corrupt' });
+    expect(dirty.diagnostics.filter((entry) => entry.code === 'AB7324')[0]?.message).toContain('differs from committed HEAD');
+    gitState.dirty = false;
+
+    // A well-formed HEAD SHA whose commit object is absent cannot be imported either.
+    gitState.object = false;
+    const missingObject = await doctor();
+    expect(hostReport(missingObject, 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'corrupt' }]);
+    expect(missingObject.diagnostics.filter((entry) => entry.code === 'AB7324')[0]?.message).toContain('commit object does not exist');
+    gitState.object = true;
+    expect(hostReport(await doctor(), 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'registered' }]);
+
+    await writeFile(join(repo, 'plugins', 'doctor-fixture', 'payload.txt'), 'changed\n');
+    const drifted = await doctor();
+    expect(hostReport(drifted, 'cursor').bundle?.state).toBe('drifted');
+    expect(drifted.diagnostics.filter((entry) => entry.code === 'AB7308')[0]?.message).toContain('Staged Cursor marketplace copy');
+
+    // A parseable manifest that no longer lists the staged plugin is corrupt even when the cache matches.
+    await writeJson(join(repo, '.cursor-plugin/marketplace.json'), {
+      name: 'doctor-fixture-marketplace',
+      owner: { name: 'doctor-fixture' },
+      plugins: [{ name: 'other-plugin', source: 'plugins/other-plugin' }],
+    });
+    const unlisted = await doctor();
+    expect(hostReport(unlisted, 'cursor').inventory.findings).toEqual([expect.objectContaining({ entry: 'doctor-fixture', state: 'corrupt' })]);
+    expect(unlisted.diagnostics.filter((entry) => entry.code === 'AB7324')[0]?.message).toContain('not listing doctor-fixture at plugins/doctor-fixture');
+
+    // `doctor --from` must surface the same corrupt state once the staged bytes match the bundle again.
+    await cp(bundle, join(repo, 'plugins', 'doctor-fixture'), { force: true, recursive: true });
+    const corruptBundle = await doctor();
+    expect(hostReport(corruptBundle, 'cursor').bundle?.state).toBe('corrupt');
+
+    // A plugin manifest naming a different plugin than the entry is corrupt even with a valid marketplace entry.
+    await writeJson(join(repo, '.cursor-plugin/marketplace.json'), {
+      name: 'doctor-fixture-marketplace',
+      owner: { name: 'doctor-fixture' },
+      plugins: [{ name: 'doctor-fixture', source: 'plugins/doctor-fixture' }],
+    });
+    const stagedManifest = await readFile(join(repo, 'plugins', 'doctor-fixture', '.cursor-plugin', 'plugin.json'), 'utf8');
+    await writeJson(join(repo, 'plugins', 'doctor-fixture', '.cursor-plugin', 'plugin.json'), { name: 'someone-else', version: '1.2.3' });
+    const misnamed = await doctor();
+    expect(hostReport(misnamed, 'cursor').inventory.findings).toEqual([expect.objectContaining({ entry: 'doctor-fixture', state: 'corrupt' })]);
+    expect(misnamed.diagnostics.filter((entry) => entry.code === 'AB7324')[0]?.message).toContain('not named doctor-fixture');
+    await writeFile(join(repo, 'plugins', 'doctor-fixture', '.cursor-plugin', 'plugin.json'), stagedManifest);
+
+    // Any other pinned-schema violation in marketplace.json (here an empty owner name) is corrupt too.
+    await writeJson(join(repo, '.cursor-plugin/marketplace.json'), {
+      name: 'doctor-fixture-marketplace',
+      owner: { name: '' },
+      plugins: [{ name: 'doctor-fixture', source: 'plugins/doctor-fixture' }],
+    });
+    const invalidManifest = await doctor();
+    expect(hostReport(invalidManifest, 'cursor').inventory.findings).toEqual([expect.objectContaining({ entry: 'doctor-fixture', state: 'corrupt' })]);
+    expect(invalidManifest.diagnostics.filter((entry) => entry.code === 'AB7324')[0]?.message).toContain('pinned marketplace schema');
+    await writeJson(join(repo, '.cursor-plugin/marketplace.json'), {
+      name: 'doctor-fixture-marketplace',
+      owner: { name: 'doctor-fixture' },
+      plugins: [{ name: 'doctor-fixture', source: 'plugins/doctor-fixture' }],
+    });
+
+    // A .git directory whose HEAD cannot be resolved to a commit is not an importable repository.
+    await writeFile(join(repo, '.git', 'refs', 'heads', 'main'), 'not-a-sha\n');
+    const unbornHead = await doctor();
+    expect(hostReport(unbornHead, 'cursor').inventory.findings).toEqual([expect.objectContaining({ entry: 'doctor-fixture', state: 'corrupt' })]);
+    expect(unbornHead.diagnostics.filter((entry) => entry.code === 'AB7324')[0]?.message).toContain('no committed Git HEAD');
+    await writeFile(join(repo, '.git', 'refs', 'heads', 'main'), `${commit}\n`);
+    expect(hostReport(await doctor(), 'cursor').inventory.findings).toEqual([{ ...stagedFinding, state: 'registered' }]);
+
+    // A staged repository whose plugin copy was deleted is corrupt for `--from` too, not "missing".
+    await rm(join(repo, 'plugins', 'doctor-fixture'), { recursive: true });
+    const gonePlugin = await doctor();
+    expect(hostReport(gonePlugin, 'cursor').bundle).toMatchObject({ marketplace: 'doctor-fixture-marketplace', path: repo, state: 'corrupt' });
+    expect(gonePlugin.diagnostics.filter((entry) => entry.code === 'AB7307')).toEqual([]);
+    expect(gonePlugin.diagnostics.filter((entry) => entry.code === 'AB7324').length).toBeGreaterThan(0);
+    await cp(bundle, join(repo, 'plugins', 'doctor-fixture'), { recursive: true });
+
+    await rm(join(repo, '.git'), { recursive: true });
+    const corrupt = await doctor();
+    expect(hostReport(corrupt, 'cursor').inventory.findings).toEqual([expect.objectContaining({ entry: 'doctor-fixture', state: 'corrupt' })]);
+    expect(corrupt.diagnostics.filter((entry) => entry.code === 'AB7324')[0]).toMatchObject({ severity: 'error' });
+  } finally {
+    await fixture.cleanup();
+  }
+});
diff --git a/packages/agent-bundle/tests/host-install-proof.test.ts b/packages/agent-bundle/tests/host-install-proof.test.ts
index 1dd92b333..fd2449be2 100644
--- a/packages/agent-bundle/tests/host-install-proof.test.ts
+++ b/packages/agent-bundle/tests/host-install-proof.test.ts
@@ -411,12 +411,21 @@ it('installs into an isolated Cursor home, validates schemas, and is idempotent'
       mcp: 'schema-valid',
       plugin: 'schema-valid',
     },
+    hooksRegistration: { events: ['sessionStart'], state: 'registered', userHooksJson: 'absent' },
     host: 'cursor',
     install: { first: 'installed', sameVersionRebuild: 'replaced', second: 'already-installed', version: '1.0.0' },
     logo: {
       path: './assets/docs/media/logo.svg',
       resolvesInsideDeployTree: true,
     },
+    marketplace: {
+      commit: 'git-sha',
+      first: 'staged',
+      imported: false,
+      manifest: 'marketplace.json lists the plugin',
+      repository: '.cursor/agent-bundle/marketplaces/host-install-proof',
+      second: 'already-staged',
+    },
     pluginRootVariable: {
       locations: [
         'hooks/hooks.json#/hooks/sessionStart/0/command',
diff --git a/packages/agent-bundle/tests/install-surface.test.ts b/packages/agent-bundle/tests/install-surface.test.ts
index 0ef730205..c5fe5185b 100644
--- a/packages/agent-bundle/tests/install-surface.test.ts
+++ b/packages/agent-bundle/tests/install-surface.test.ts
@@ -89,12 +89,38 @@ it('emits a standalone safe-copy installer only for Cursor-compatible fallback p
     expect(writes.get('install.mjs')).toContain('install-fixture');
     expect(writes.get('install.mjs')).toContain('1.2.3');
     expect(writes.get('install.mjs')).not.toContain('sudo');
+    expect(writes.get('install.mjs')).toContain("if (mode === 'marketplace') {");
+    expect(writes.get('install.mjs')).toContain("join(cursorRoot, 'agent-bundle', 'marketplaces')");
+    expect(writes.get('install.mjs')).toContain('Add Plugins from Local Repository');
+    expect(writes.get('install.mjs')).toContain("await git(stage, ['init', '-q', '--object-format=sha1']);");
+    // Bytes must survive the commit unchanged: attributes disabled, autocrlf off, blob ids proven against HEAD.
+    expect(writes.get('install.mjs')).toContain("'* -text -eol -filter -ident -working-tree-encoding -export-ignore -export-subst\\n'");
+    expect(writes.get('install.mjs')).toContain("['-c', 'core.autocrlf=false', '-c', 'core.safecrlf=false', 'add', '--all', '--force']");
+    expect(writes.get('install.mjs')).toContain("await git(stage, ['ls-tree', '-r', '-z', 'HEAD'])");
+    expect(writes.get('install.mjs')).toContain('the committed tree differs from the staged bundle bytes');
+    // Owner/description are read from the emitted .cursor-plugin/plugin.json at run time, not baked in.
+    expect(writes.get('install.mjs')).toContain("typeof manifest?.author?.name === 'string' ? manifest.author.name : pluginName");
+    expect(writes.get('install.mjs')).not.toContain('const pluginDescription');
+    expect(writes.get('install.mjs')).toContain("await findNestedGit(source)");
   }
   for (const target of ['claude', 'codex']) {
     expect(writesFor(target).has('install.mjs')).toBe(false);
   }
 });
 
+it('documents both Cursor delivery modes without user-level hooks registration', () => {
+  const install = writesFor('cursor').get('INSTALL.md');
+
+  expect(install).toContain('### Local plugin (default)');
+  expect(install).toContain('`~/.cursor/plugins/local/install-fixture`');
+  expect(install).toContain('need no `~/.cursor/hooks.json` entry');
+  expect(install).toContain('### Marketplace plugin');
+  expect(install).toContain('node ./install.mjs --mode marketplace');
+  expect(install).toContain('`~/.cursor/agent-bundle/marketplaces/install-fixture`');
+  expect(install).toContain('"Add Plugins from Local Repository"');
+  expect(install).toContain('`agent-bundle doctor --host cursor`');
+});
+
 it('documents native Agent Plugins clients for the portable profile', () => {
   const install = writesFor('portable').get('INSTALL.md');
 
diff --git a/packages/agent-bundle/tests/install.test.ts b/packages/agent-bundle/tests/install.test.ts
index 2026462ad..6dde45670 100644
--- a/packages/agent-bundle/tests/install.test.ts
+++ b/packages/agent-bundle/tests/install.test.ts
@@ -1,11 +1,17 @@
 import { execFile as executeFile } from 'node:child_process';
-import { access, chmod, cp, link, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, writeFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { access, chmod, cp, link, lstat, mkdir, mkdtemp, readFile, readdir, rm, stat, symlink, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { promisify } from 'node:util';
 
 import { expect, it } from '@rstest/core';
+import { Ajv } from 'ajv/dist/ajv.js';
+import addFormats from 'ajv-formats';
 
+import cursorMarketplaceSchema from '../src/adapters/schemas/cursor/marketplace.schema.json' with { type: 'json' };
+import { stageCursorMarketplace } from '../src/install/cursor-marketplace.ts';
+import { formatInstallResult } from '../src/install/format.ts';
 import { installBundle, type InstallCommandRunner } from '../src/install/install.ts';
 import {
   installReceiptFile,
@@ -21,8 +27,29 @@ interface CommandCall {
   readonly cwd: string;
 }
 
+/** What a faithful `git ls-tree -r -z HEAD` would print for the files under `root` (SHA-1 blob ids). */
+const fakeTreeListing = async (root: string, relative = ''): Promise<string> => {
+  let listing = '';
+  for (const name of (await readdir(join(root, relative))).sort()) {
+    if (relative === '' && name === '.git') continue;
+    const child = relative === '' ? name : `${relative}/${name}`;
+    const metadata = await lstat(join(root, child));
+    if (metadata.isDirectory()) {
+      listing += await fakeTreeListing(root, child);
+    } else if (metadata.isFile()) {
+      const bytes = await readFile(join(root, child));
+      const id = createHash('sha1').update(`blob ${bytes.length}\0`).update(bytes).digest('hex');
+      listing += `100644 blob ${id}\t${child}\0`;
+    }
+  }
+  return listing;
+};
+
+/** Default fake git: answers `ls-tree` faithfully for the staged tree so byte proofs pass; everything else is silent. */
+const gitLike = async (call: CommandCall): Promise<string> => (call.args[0] === 'ls-tree' ? fakeTreeListing(call.cwd) : '');
+
 const recordingRunner = (
-  respond: (call: CommandCall) => string = () => '',
+  respond: (call: CommandCall) => string | Promise<string> = gitLike,
 ): {
   readonly calls: CommandCall[];
   readonly runner: InstallCommandRunner;
@@ -34,7 +61,7 @@ const recordingRunner = (
       run: async (command, args, options) => {
         const call = { args: [...args], command, cwd: options.cwd };
         calls.push(call);
-        return { code: 0, stderr: '', stdout: respond(call) };
+        return { code: 0, stderr: '', stdout: await respond(call) };
       },
     },
   };
@@ -1097,3 +1124,368 @@ it('dispatches the public CLI install command to the native installer', async ()
     state: 'installed',
   });
 });
+
+const marketplaceRepo = (home: string): string =>
+  join(home, '.cursor', 'agent-bundle', 'marketplaces', 'install-fixture');
+
+it('stages a committed local marketplace repository for Cursor in marketplace mode', async () => {
+  const fixture = await createHostBundle('cursor');
+  const home = await mkdtemp(join(tmpdir(), 'agent-bundle-home-'));
+  await mkdir(join(home, '.cursor'));
+  const repo = marketplaceRepo(home);
+  const { calls, runner } = recordingRunner();
+  try {
+    const result = await installBundle({
+      commandRunner: runner,
+      from: fixture.from,
+      home,
+      host: 'cursor',
+      mode: 'marketplace',
+      scope: 'user',
+    });
+
+    expect(result).toMatchObject({
+      destination: repo,
+      host: 'cursor',
+      marketplace: 'install-fixture-marketplace',
+      mode: 'marketplace',
+      plugin: 'install-fixture',
+      state: 'staged',
+      version: '1.2.3',
+    });
+    expect(result.nextSteps?.[0]).toContain('Add Plugins from Local Repository');
+    expect(result.nextSteps?.[0]).toContain(repo);
+    const marketplaceManifest = JSON.parse(await readFile(join(repo, '.cursor-plugin/marketplace.json'), 'utf8')) as unknown;
+    expect(marketplaceManifest).toEqual({
+      metadata: { description: 'Agent Bundle local marketplace for install-fixture@1.2.3.' },
+      name: 'install-fixture-marketplace',
+      owner: { name: 'install-fixture' },
+      plugins: [{ name: 'install-fixture', source: 'plugins/install-fixture' }],
+    });
+    const validator = new Ajv({ allErrors: true, allowUnionTypes: true, strict: true });
+    (addFormats as unknown as (target: Ajv) => void)(validator);
+    const validate = validator.compile(cursorMarketplaceSchema);
+    expect(validate(marketplaceManifest), JSON.stringify(validate.errors)).toBe(true);
+    expect(await readFile(join(repo, 'plugins', 'install-fixture', 'payload.txt'), 'utf8')).toBe('payload\n');
+    expect(await readFile(join(repo, 'plugins', 'install-fixture', '.cursor-plugin/plugin.json'), 'utf8'))
+      .toContain('"install-fixture"');
+    expect(calls.map((call) => [call.command, call.args[0], call.args.at(-1)])).toEqual([
+      ['git', 'init', '--object-format=sha1'],
+      ['git', '-c', '--force'],
+      ['git', '-c', 'install-fixture@1.2.3'],
+      ['git', 'ls-tree', 'HEAD'],
+      ['git', 'rev-parse', 'HEAD'],
+    ]);
+    expect(calls[1]?.args).toEqual(['-c', 'core.autocrlf=false', '-c', 'core.safecrlf=false', 'add', '--all', '--force']);
+    expect(calls.every((call) => call.cwd.startsWith(join(home, '.cursor', 'agent-bundle', 'marketplaces')))).toBe(true);
+    // Attributes that would rewrite bytes in the index are disabled for every path of the staged repository.
+    expect(await readFile(join(repo, '.git', 'info', 'attributes'), 'utf8')).toBe('* -text -eol -filter -ident -working-tree-encoding -export-ignore -export-subst\n');
+    await expect(access(join(home, '.cursor', 'plugins', 'local', 'install-fixture'))).rejects.toMatchObject({ code: 'ENOENT' });
+  } finally {
+    await Promise.all([
+      rm(fixture.cleanupRoot, { force: true, recursive: true }),
+      rm(home, { force: true, recursive: true }),
+    ]);
+  }
+});
+
+it('re-runs marketplace mode idempotently with real git and refuses collisions', async () => {
+  const fixture = await createHostBundle('cursor');
+  const home = await mkdtemp(join(tmpdir(), 'agent-bundle-home-'));
+  await mkdir(join(home, '.cursor'));
+  const repo = marketplaceRepo(home);
+  try {
+    await writeFile(join(fixture.bundleRoot, '.gitignore'), '*.log\n');
+    await writeFile(join(fixture.bundleRoot, 'ignored.log'), 'kept\n');
+    // Attributes that would normalise bytes into the index must not change what Cursor imports.
+    await writeFile(join(fixture.bundleRoot, '.gitattributes'), '*.txt text eol=lf\n* ident\n');
+    await writeFile(join(fixture.bundleRoot, 'crlf.txt'), 'line one\r\nline two $Id$\r\n');
+    const first = await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' });
+    const second = await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' });
+
+    expect(first.state).toBe('staged');
+    expect(first.commit).toMatch(/^[0-9a-f]{40}$/u);
+    expect(second).toMatchObject({ commit: first.commit, destination: repo, state: 'already-installed' });
+    await access(join(repo, '.git', 'HEAD'));
+    // Files the bundle's own .gitignore would exclude are still committed (Cursor imports the commit, not the tree).
+    const { stdout: tracked } = await execFile('git', ['ls-files'], { cwd: repo });
+    expect(tracked.split('\n')).toEqual(expect.arrayContaining([
+      'plugins/install-fixture/.gitattributes',
+      'plugins/install-fixture/.gitignore',
+      'plugins/install-fixture/crlf.txt',
+      'plugins/install-fixture/ignored.log',
+      'plugins/install-fixture/payload.txt',
+    ]));
+    const { stdout: committedCrlf } = await execFile('git', ['cat-file', 'blob', 'HEAD:plugins/install-fixture/crlf.txt'], { cwd: repo, encoding: 'buffer' });
+    expect(Buffer.from(committedCrlf).toString('utf8')).toBe('line one\r\nline two $Id$\r\n');
+
+    const manifestPath = join(repo, '.cursor-plugin', 'marketplace.json');
+    const manifest = await readFile(manifestPath, 'utf8');
+    await writeJson(manifestPath, { ...JSON.parse(manifest), plugins: [{ name: 'other-plugin', source: 'plugins/other-plugin' }] });
+    const manifestError = await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' })
+      .catch((failure: unknown) => failure);
+    expect((manifestError as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7005' }]);
+    expect((manifestError as DiagnosticError).diagnostics[0]?.message).toContain('marketplace.json differs');
+    await writeFile(manifestPath, manifest);
+    expect(await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' })).toMatchObject({ state: 'already-installed' });
+
+    // The working tree may match the bundle while HEAD records different bytes; Cursor imports HEAD, so refuse.
+    const git = async (args: readonly string[]): Promise<string> => (await execFile('git', [...args], { cwd: repo })).stdout;
+    await writeFile(join(repo, 'plugins', 'install-fixture', 'payload.txt'), 'committed elsewhere\n');
+    await git(['add', '--all']);
+    await git(['-c', 'user.name=t', '-c', 'user.email=t@localhost', '-c', 'commit.gpgsign=false', 'commit', '-q', '-m', 'edit']);
+    await writeFile(join(repo, 'plugins', 'install-fixture', 'payload.txt'), 'payload\n');
+    const dirtyError = await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' })
+      .catch((failure: unknown) => failure);
+    expect((dirtyError as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7005' }]);
+    expect((dirtyError as DiagnosticError).diagnostics[0]?.message).toContain('committed HEAD');
+    await git(['reset', '-q', '--hard', first.commit ?? 'HEAD~1']);
+    expect(await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' })).toMatchObject({ commit: first.commit, state: 'already-installed' });
+
+    // An ignored, uncommitted file in the staged tree also means HEAD is not what was verified.
+    await writeFile(join(repo, 'plugins', 'install-fixture', 'stray.log'), 'not committed\n');
+    await writeFile(join(fixture.bundleRoot, 'stray.log'), 'not committed\n');
+    const ignoredError = await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' })
+      .catch((failure: unknown) => failure);
+    expect((ignoredError as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7005' }]);
+    expect((ignoredError as DiagnosticError).diagnostics[0]?.message).toContain('committed HEAD');
+    await rm(join(repo, 'plugins', 'install-fixture', 'stray.log'));
+    await rm(join(fixture.bundleRoot, 'stray.log'));
+
+    await writeFile(join(repo, 'plugins', 'install-fixture', 'payload.txt'), 'changed\n');
+    const contentError = await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' })
+      .catch((failure: unknown) => failure);
+    expect((contentError as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7005' }]);
+    expect((contentError as DiagnosticError).diagnostics[0]?.message).toContain('content collision');
+
+    await writeJson(join(repo, 'plugins', 'install-fixture', '.cursor-plugin/plugin.json'), {
+      name: 'install-fixture',
+      version: '9.0.0',
+    });
+    const versionError = await installBundle({ from: fixture.from, home, host: 'cursor', mode: 'marketplace' })
+      .catch((failure: unknown) => failure);
+    expect((versionError as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7005' }]);
+    expect((versionError as DiagnosticError).diagnostics[0]?.message).toContain('version collision');
+  } finally {
+    await Promise.all([
+      rm(fixture.cleanupRoot, { force: true, recursive: true }),
+      rm(home, { force: true, recursive: true }),
+    ]);
+  }
+});
+
+it('fails closed without git in marketplace mode and leaves no staged repository', async () => {
+  const fixture = await createHostBundle('cursor');
+  const home = await mkdtemp(join(tmpdir(), 'agent-bundle-home-'));
+  await mkdir(join(home, '.cursor'));
+  const missing = Object.assign(new Error('spawn git ENOENT'), { code: 'ENOENT' });
+  try {
+    const error = await installBundle({
+      commandRunner: { run: async () => { throw missing; } },
+      from: fixture.from,
+      home,
+      host: 'cursor',
+      mode: 'marketplace',
+    }).catch((failure: unknown) => failure);
+
+    expect(error).toBeInstanceOf(DiagnosticError);
+    expect((error as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7002', target: 'cursor' }]);
+    expect((error as DiagnosticError).diagnostics[0]?.message).toContain('--mode local');
+    await expect(access(marketplaceRepo(home))).rejects.toMatchObject({ code: 'ENOENT' });
+  } finally {
+    await Promise.all([
+      rm(fixture.cleanupRoot, { force: true, recursive: true }),
+      rm(home, { force: true, recursive: true }),
+    ]);
+  }
+});
+
+it('refuses marketplace mode for an Agent Plugins bundle without .cursor-plugin/plugin.json', async () => {
+  const fixture = await createHostBundle('cursor');
+  const home = await mkdtemp(join(tmpdir(), 'agent-bundle-home-'));
+  await mkdir(join(home, '.cursor'));
+  const { calls, runner } = recordingRunner();
+  try {
+    await rm(join(fixture.bundleRoot, '.cursor-plugin'), { recursive: true });
+    await writeJson(join(fixture.bundleRoot, 'plugin.json'), { name: 'install-fixture', version: '1.2.3' });
+    const error = await installBundle({
+      commandRunner: runner,
+      from: fixture.from,
+      home,
+      host: 'cursor',
+      mode: 'marketplace',
+    }).catch((failure: unknown) => failure);
+
+    // The public install path already fails closed on the missing Cursor manifest (AB7001);
+    // stageCursorMarketplace repeats the check (AB7003) for direct callers.
+    expect((error as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7001', target: 'cursor' }]);
+    expect((error as DiagnosticError).diagnostics[0]?.message).toContain('No cursor bundle manifest');
+    expect(calls).toEqual([]);
+    await expect(access(join(home, '.cursor', 'agent-bundle'))).rejects.toMatchObject({ code: 'ENOENT' });
+
+    const direct = await stageCursorMarketplace({
+      cursorRoot: join(home, '.cursor'),
+      identity: { bundleRoot: fixture.bundleRoot, plugin: 'install-fixture', version: '1.2.3' },
+      runner,
+      treeHash: async () => 'unused',
+    }).catch((failure: unknown) => failure);
+    expect((direct as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7003', target: 'cursor' }]);
+    expect((direct as DiagnosticError).diagnostics[0]?.message).toContain('--mode local');
+    expect(calls).toEqual([]);
+  } finally {
+    await Promise.all([
+      rm(fixture.cleanupRoot, { force: true, recursive: true }),
+      rm(home, { force: true, recursive: true }),
+    ]);
+  }
+});
+
+it('refuses marketplace mode for a bundle that contains nested Git metadata', async () => {
+  const fixture = await createHostBundle('cursor');
+  const home = await mkdtemp(join(tmpdir(), 'agent-bundle-home-'));
+  await mkdir(join(home, '.cursor'));
+  const { calls, runner } = recordingRunner();
+  try {
+    // A `.git` anywhere in the bundle would be committed as an empty gitlink (mode 160000), not as files.
+    await mkdir(join(fixture.bundleRoot, 'vendor', 'tool', '.git'), { recursive: true });
+    await writeJson(join(fixture.bundleRoot, 'vendor', 'tool', '.git', 'config'), {});
+    const error = await installBundle({
+      commandRunner: runner,
+      from: fixture.from,
+      home,
+      host: 'cursor',
+      mode: 'marketplace',
+    }).catch((failure: unknown) => failure);
+
+    expect((error as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7003', target: 'cursor' }]);
+    expect((error as DiagnosticError).diagnostics[0]?.message).toContain(join('vendor', 'tool', '.git'));
+    expect(calls).toEqual([]);
+    await expect(access(join(home, '.cursor', 'agent-bundle'))).rejects.toMatchObject({ code: 'ENOENT' });
+  } finally {
+    await Promise.all([
+      rm(fixture.cleanupRoot, { force: true, recursive: true }),
+      rm(home, { force: true, recursive: true }),
+    ]);
+  }
+});
+
+it('fails closed when the committed tree does not hold the staged bytes', async () => {
+  const fixture = await createHostBundle('cursor');
+  const home = await mkdtemp(join(tmpdir(), 'agent-bundle-home-'));
+  await mkdir(join(home, '.cursor'));
+  // A git that silently transformed one blob (e.g. through a clean filter) reports a different id for it.
+  const { runner } = recordingRunner(async (call) => (await gitLike(call))
+    .replace(/[0-9a-f]{40}(\tplugins\/install-fixture\/payload\.txt)/u, `${'0'.repeat(40)}$1`));
+  try {
+    const error = await installBundle({ commandRunner: runner, from: fixture.from, home, host: 'cursor', mode: 'marketplace' })
+      .catch((failure: unknown) => failure);
+    expect((error as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7004', target: 'cursor' }]);
+    expect((error as DiagnosticError).diagnostics[0]?.message).toContain('plugins/install-fixture/payload.txt');
+    await expect(access(marketplaceRepo(home))).rejects.toMatchObject({ code: 'ENOENT' });
+    expect(await readdir(join(home, '.cursor', 'agent-bundle', 'marketplaces'))).toEqual([]);
+  } finally {
+    await Promise.all([
+      rm(fixture.cleanupRoot, { force: true, recursive: true }),
+      rm(home, { force: true, recursive: true }),
+    ]);
+  }
+});
+
+it('rejects an install mode for hosts other than Cursor', async () => {
+  const fixture = await createHostBundle('claude');
+  const { calls, runner } = recordingRunner();
+  try {
+    const error = await installBundle({
+      commandRunner: runner,
+      from: fixture.from,
+      host: 'claude',
+      mode: 'marketplace',
+    }).catch((failure: unknown) => failure);
+
+    expect((error as DiagnosticError).diagnostics).toMatchObject([{ code: 'AB7003', target: 'claude' }]);
+    expect(calls).toEqual([]);
+  } finally {
+    await rm(fixture.cleanupRoot, { force: true, recursive: true });
+  }
+});
+
+it('passes --mode through the public CLI and prints the staged next steps', async () => {
+  const stderr: string[] = [];
+  const stdout: string[] = [];
+  const calls: unknown[] = [];
+  Object.defineProperty(globalThis, '__AGENT_BUNDLE_VERSION__', { configurable: true, value: 'test' });
+  const dependencies = {
+    installBundle: async (options: unknown) => {
+      calls.push(options);
+      return {
+        bundleRoot: '/tmp/example bundle',
+        commit: 'abc123',
+        destination: '/home/user/.cursor/agent-bundle/marketplaces/fixture',
+        host: 'cursor',
+        marketplace: 'fixture-marketplace',
+        mode: 'marketplace',
+        nextSteps: ['Open Cursor and import /home/user/.cursor/agent-bundle/marketplaces/fixture.'],
+        plugin: 'fixture',
+        state: 'staged',
+        version: '1.0.0',
+      };
+    },
+  } as unknown as Parameters<typeof runCli>[2];
+
+  const code = await runCli(
+    ['install', 'cursor', '--from', '/tmp/example bundle', '--mode', 'marketplace'],
+    {
+      stderr: { write: (chunk: string) => stderr.push(chunk) },
+      stdout: { write: (chunk: string) => stdout.push(chunk) },
+    },
+    dependencies,
+  );
+
+  expect(code).toBe(0);
+  expect(stderr.join('')).toBe('');
+  expect(calls).toEqual([{ from: '/tmp/example bundle', host: 'cursor', mode: 'marketplace', replace: false, scope: 'user' }]);
+  expect(stdout.join('')).toBe([
+    'Staged fixture@1.0.0 for cursor (marketplace mode) at /home/user/.cursor/agent-bundle/marketplaces/fixture',
+    'Marketplace: fixture-marketplace @ abc123',
+    'Next steps:',
+    '  1. Open Cursor and import /home/user/.cursor/agent-bundle/marketplaces/fixture.',
+    '',
+  ].join('\n'));
+
+  const invalid = await runCli(
+    ['install', 'cursor', '--from', '/tmp/example bundle', '--mode', 'remote'],
+    {
+      stderr: { write: (chunk: string) => stderr.push(chunk) },
+      stdout: { write: () => undefined },
+    },
+    dependencies,
+  );
+  expect(invalid).not.toBe(0);
+  expect(stderr.join('')).toContain('Install mode must be local or marketplace.');
+});
+
+it('labels a repeated marketplace-mode run as already staged, not installed', () => {
+  const base = {
+    bundleRoot: '/tmp/example bundle',
+    host: 'cursor' as const,
+    plugin: 'fixture',
+    state: 'already-installed' as const,
+    version: '1.0.0',
+  };
+  expect(formatInstallResult({
+    ...base,
+    commit: 'abc123',
+    destination: '/home/user/.cursor/agent-bundle/marketplaces/fixture',
+    marketplace: 'fixture-marketplace',
+    mode: 'marketplace',
+    nextSteps: ['Open Cursor and import the repository.'],
+  })).toBe([
+    'Already staged fixture@1.0.0 for cursor (marketplace mode) at /home/user/.cursor/agent-bundle/marketplaces/fixture',
+    'Marketplace: fixture-marketplace @ abc123',
+    'Next steps:',
+    '  1. Open Cursor and import the repository.',
+    '',
+  ].join('\n'));
+  expect(formatInstallResult({ ...base, destination: '/home/user/.cursor/plugins/local/fixture', mode: 'local' }))
+    .toBe('Already installed fixture@1.0.0 for cursor (local mode) at /home/user/.cursor/plugins/local/fixture\n');
+});
diff --git a/packages/agent-bundle/tests/installer-entry.test.ts b/packages/agent-bundle/tests/installer-entry.test.ts
index 7f9097677..07c746d7b 100644
--- a/packages/agent-bundle/tests/installer-entry.test.ts
+++ b/packages/agent-bundle/tests/installer-entry.test.ts
@@ -8,6 +8,7 @@ import { afterEach, expect, it } from '@rstest/core';
 
 import { build } from '../src/api.ts';
 import { installReceiptFile } from '../src/install/receipt.ts';
+import { installBundle } from '../src/install/install.ts';
 
 const execFile = promisify(executeFile);
 const roots: string[] = [];
@@ -18,6 +19,7 @@ afterEach(async () => {
 });
 
 const fixture = async (options: {
+  readonly author?: string;
   readonly bin?: false | readonly string[];
   readonly target: 'cursor' | 'plugin' | 'portable';
 }): Promise<string> => {
@@ -38,6 +40,7 @@ const fixture = async (options: {
         : options.bin === false
           ? ['  bin: false,']
           : [`  bin: { ${options.bin.map((name) => `${JSON.stringify(name)}: './src/cli.ts'`).join(', ')} },`]),
+      ...(options.author === undefined ? [] : [`  cursor: { author: { name: ${JSON.stringify(options.author)} } },`]),
       "  lib: './src/index.ts',",
       "  plugin: { name: 'installer-fixture' },",
       `  targets: [${JSON.stringify(options.target)}],`,
@@ -83,7 +86,7 @@ it('builds a package-relative installer with fallback naming and built-host argv
 
   const help = await run(installer, [], { cwd: tmpdir() });
   expect(help).toMatchObject({ code: 0, stderr: '' });
-  expect(help.stdout).toContain('install <host> [--scope <scope>] [--replace|--force] [--json]');
+  expect(help.stdout).toContain('install <host> [--scope <scope>] [--mode local|marketplace] [--replace|--force] [--json]');
   expect(help.stdout).toContain('cursor');
   expect(help.stdout).not.toContain('claude');
 
@@ -134,11 +137,31 @@ it('builds a package-relative installer with fallback naming and built-host argv
   await writeFile(join(destination, 'INSTALL.md'), '# stale\n');
   const replaced = await run(installer, ['install', 'cursor'], { cwd: tmpdir(), env: { ...process.env, HOME: home } });
   expect(replaced).toMatchObject({ code: 0, stderr: '' });
-  expect(replaced.stdout).toMatch(/^Replaced installer-fixture@1\.2\.3 for cursor at .* \(content [0-9a-f]{12} -> [0-9a-f]{12}\)\n$/u);
+  expect(replaced.stdout).toMatch(/^Replaced installer-fixture@1\.2\.3 for cursor \(local mode\) at .* \(content [0-9a-f]{12} -> [0-9a-f]{12}\)\n$/u);
 
   const unknown = await run(installer, ['install', 'cursor', '--overwrite'], { cwd: tmpdir() });
   expect(unknown.code).toBe(1);
   expect(unknown.stderr).toContain('Unknown installer argument "--overwrite"');
+
+  const staged = await run(installer, ['install', 'cursor', '--mode', 'marketplace', '--json'], {
+    cwd: tmpdir(),
+    env: { ...process.env, HOME: home },
+  });
+  expect(staged).toMatchObject({ code: 0, stderr: '' });
+  const repository = join(home, '.cursor', 'agent-bundle', 'marketplaces', 'installer-fixture');
+  expect(JSON.parse(staged.stdout)).toMatchObject({
+    commit: expect.stringMatching(/^[0-9a-f]{40}$/u),
+    destination: repository,
+    marketplace: 'installer-fixture-marketplace',
+    mode: 'marketplace',
+    state: 'staged',
+  });
+  await expect(stat(join(repository, '.cursor-plugin', 'marketplace.json'))).resolves.toBeDefined();
+  await expect(stat(join(repository, 'plugins', 'installer-fixture', '.cursor-plugin', 'plugin.json'))).resolves.toBeDefined();
+
+  const badMode = await run(installer, ['install', 'cursor', '--mode', 'remote'], { cwd: tmpdir() });
+  expect(badMode.code).toBe(1);
+  expect(badMode.stderr).toContain('Install mode must be local or marketplace.');
 }, 120_000);
 
 it('chooses an unused installer name when both primary candidates are bins', async () => {
@@ -167,11 +190,11 @@ it('handles installer help when the project path contains a percent sign', async
   const help = await run(join(root, 'dist', 'bin', 'installer-fixture-install.js'), ['--help'], { cwd: tmpdir() });
 
   expect(help).toMatchObject({ code: 0, stderr: '' });
-  expect(help.stdout).toContain('install <host> [--scope <scope>] [--replace|--force] [--json]');
+  expect(help.stdout).toContain('install <host> [--scope <scope>] [--mode local|marketplace] [--replace|--force] [--json]');
 }, 120_000);
 
 it('uses the plugin name when free and skips portable-only artifacts', async () => {
-  const cursorRoot = await fixture({ bin: false, target: 'cursor' });
+  const cursorRoot = await fixture({ author: 'Fixture Owner', bin: false, target: 'cursor' });
   const cursor = await build({ output: 'host-packs', packageOutputs: true, root: cursorRoot });
   expect(cursor.packageBuild?.files.map((file) => file.path)).toContain('bin/installer-fixture.js');
 
@@ -179,6 +202,52 @@ it('uses the plugin name when free and skips portable-only artifacts', async ()
   const portable = await build({ output: 'host-packs', packageOutputs: true, root: portableRoot });
   expect(portable.packageBuild?.files.map((file) => file.path))
     .not.toContain('bin/installer-fixture.js');
+  // The Agent Plugins pack has no .cursor-plugin manifest, so its install.mjs must refuse marketplace mode.
+  const portableHome = join(portableRoot, 'home');
+  await mkdir(join(portableHome, '.cursor'), { recursive: true });
+  const portableMarketplace = await run(
+    process.execPath,
+    [join(portableRoot, 'host-packs', 'portable', 'install.mjs'), '--mode', 'marketplace'],
+    { cwd: tmpdir(), env: { ...process.env, HOME: portableHome } },
+  );
+  expect(portableMarketplace.code).toBe(1);
+  expect(portableMarketplace.stderr).toContain('--mode marketplace requires a Cursor Plugin');
+  await expect(stat(join(portableHome, '.cursor', 'agent-bundle'))).rejects.toMatchObject({ code: 'ENOENT' });
+
+  // A bundle carrying nested Git metadata would be committed as an empty gitlink; the emitted installer refuses it.
+  const cursorHome = join(cursorRoot, 'home');
+  await mkdir(join(cursorHome, '.cursor'), { recursive: true });
+  await mkdir(join(cursorRoot, 'host-packs', 'cursor', 'vendor', '.git'), { recursive: true });
+  const nestedGit = await run(
+    process.execPath,
+    [join(cursorRoot, 'host-packs', 'cursor', 'install.mjs'), '--mode', 'marketplace'],
+    { cwd: tmpdir(), env: { ...process.env, HOME: cursorHome } },
+  );
+  expect(nestedGit.code).toBe(1);
+  expect(nestedGit.stderr).toContain('refuses bundle-internal Git metadata at "vendor/.git"');
+  await expect(stat(join(cursorHome, '.cursor', 'agent-bundle'))).rejects.toMatchObject({ code: 'ENOENT' });
+  await rm(join(cursorRoot, 'host-packs', 'cursor', 'vendor'), { recursive: true });
+
+  // The emitted install.mjs and `agent-bundle install cursor --mode marketplace` derive owner/description from the
+  // same emitted manifest (authored cursor.author here), so staging with one and rerunning the other is idempotent.
+  const stagedByScript = await run(
+    process.execPath,
+    [join(cursorRoot, 'host-packs', 'cursor', 'install.mjs'), '--mode', 'marketplace'],
+    { cwd: tmpdir(), env: { ...process.env, HOME: cursorHome } },
+  );
+  expect(stagedByScript).toMatchObject({ code: 0, stderr: '' });
+  const stagedManifest = JSON.parse(await readFile(
+    join(cursorHome, '.cursor', 'agent-bundle', 'marketplaces', 'installer-fixture', '.cursor-plugin', 'marketplace.json'),
+    'utf8',
+  ));
+  expect(stagedManifest.owner).toEqual({ name: 'Fixture Owner' });
+  const rerunByCli = await installBundle({
+    from: join(cursorRoot, 'host-packs', 'cursor'),
+    home: cursorHome,
+    host: 'cursor',
+    mode: 'marketplace',
+  });
+  expect(rerunByCli).toMatchObject({ mode: 'marketplace', state: 'already-installed' });
 
   const pluginRoot = await fixture({ bin: false, target: 'plugin' });
   const plugin = await build({ output: 'host-packs', packageOutputs: true, root: pluginRoot });
diff --git a/packages/agent-bundle/tests/packed-host-install-proof.test.ts b/packages/agent-bundle/tests/packed-host-install-proof.test.ts
index e8f47aff0..78218408d 100644
--- a/packages/agent-bundle/tests/packed-host-install-proof.test.ts
+++ b/packages/agent-bundle/tests/packed-host-install-proof.test.ts
@@ -235,12 +235,21 @@ it('installs the packed tarball into an isolated Cursor home, validates schemas,
       mcp: 'schema-valid',
       plugin: 'schema-valid',
     },
+    hooksRegistration: { events: ['sessionStart'], state: 'registered', userHooksJson: 'absent' },
     host: 'cursor',
     install: { first: 'installed', sameVersionRebuild: 'replaced', second: 'already-installed', version: '1.0.0' },
     logo: {
       path: './assets/docs/media/logo.svg',
       resolvesInsideDeployTree: true,
     },
+    marketplace: {
+      commit: 'git-sha',
+      first: 'staged',
+      imported: false,
+      manifest: 'marketplace.json lists the plugin',
+      repository: '.cursor/agent-bundle/marketplaces/host-install-proof',
+      second: 'already-staged',
+    },
     pluginRootVariable: {
       locations: [
         'hooks/hooks.json#/hooks/sessionStart/0/command',
diff --git a/packages/agent-bundle/tests/support/host-install.ts b/packages/agent-bundle/tests/support/host-install.ts
index 290575d26..660e8ec94 100644
--- a/packages/agent-bundle/tests/support/host-install.ts
+++ b/packages/agent-bundle/tests/support/host-install.ts
@@ -36,6 +36,7 @@ import { DEV_INSTALL_MARKER, DevHostInstallManager } from '../../src/dev/host-in
 import { ProjectEventHub } from '../../src/dev/events.ts';
 import type { ArtifactEpoch } from '../../src/dev/types.ts';
 import { startDevServer } from '../../src/dev/workbench-server.ts';
+import { runDoctor } from '../../src/install/doctor.ts';
 import { installBundle, type InstallHost } from '../../src/install/install.ts';
 import {
   normalClaudeSettingsAndPluginsUnchanged,
@@ -256,6 +257,12 @@ export interface CursorHostInstallReport {
     readonly mcp: 'schema-valid';
     readonly plugin: 'schema-valid';
   };
+  /** Doctor's read-only registration proof for the installed plugin's manifest hooks (#407). */
+  readonly hooksRegistration: {
+    readonly events: readonly string[];
+    readonly state: 'registered';
+    readonly userHooksJson: 'absent';
+  };
   readonly host: 'cursor';
   readonly install: {
     readonly first: 'installed';
@@ -263,6 +270,15 @@ export interface CursorHostInstallReport {
     readonly second: 'already-installed';
     readonly version: '1.0.0';
   };
+  /** The emitted `install.mjs --mode marketplace` staging proof in the same isolated home (#407). */
+  readonly marketplace: {
+    readonly commit: 'git-sha';
+    readonly first: 'staged';
+    readonly imported: false;
+    readonly manifest: 'marketplace.json lists the plugin';
+    readonly repository: string;
+    readonly second: 'already-staged';
+  };
   readonly logo: {
     readonly path: string;
     readonly resolvesInsideDeployTree: true;
@@ -1135,6 +1151,100 @@ const assertCursorPluginRootVariable = (input: {
   ]);
 };
 
+const assertCursorHooksRegistration = async (
+  home: string,
+  destination: string,
+): Promise<CursorHostInstallReport['hooksRegistration']> => {
+  await access(join(home, '.cursor', 'hooks.json')).then(
+    () => fail('Cursor install must not create ~/.cursor/hooks.json; plugin hooks are manifest-registered.'),
+    () => undefined,
+  );
+  const report = await runDoctor({ home, hosts: ['cursor'] });
+  const cursor = report.hosts.find((entry) => entry.host === 'cursor');
+  const finding = cursor?.inventory.findings.find((entry) => entry.path === destination);
+  assertProof(finding !== undefined, 'Doctor did not inventory the installed Cursor plugin.');
+  assertProof(finding.hooks?.state === 'registered', `Doctor reported hooks ${JSON.stringify(finding.hooks)} instead of registered.`);
+  assertProof(finding.hooks.events.includes('sessionStart'), 'Doctor did not see the emitted sessionStart hook registration.');
+  assertProof(finding.hooks.duplicates.length === 0, 'Doctor reported duplicate user-level hook delivery.');
+  const proof = report.diagnostics.filter((entry) => entry.code === 'AB7322');
+  assertProof(
+    proof.length === 1 && proof[0]?.severity === 'info' && proof[0].message.includes('plugin-scoped hooks'),
+    `Doctor did not report AB7322 hook registration proof: ${JSON.stringify(proof)}`,
+  );
+  return Object.freeze({ events: finding.hooks.events, state: 'registered', userHooksJson: 'absent' });
+};
+
+const assertCursorMarketplaceStaging = async (
+  fixture: BuiltHostInstallFixture,
+  home: string,
+  environment: NodeJS.ProcessEnv,
+): Promise<CursorHostInstallReport['marketplace']> => {
+  const installer = join(fixture.bundles.cursor, 'install.mjs');
+  const repository = join(home, '.cursor', 'agent-bundle', 'marketplaces', plugin);
+  const stage = async (expected: 'Already staged' | 'Staged'): Promise<string> => {
+    const result = await run(process.execPath, [installer, '--mode', 'marketplace'], {
+      cwd: fixture.bundles.cursor,
+      environment,
+    });
+    assertProof(result.exitCode === 0, `Cursor emitted installer (marketplace mode) failed: ${commandDetail(result)}`);
+    const [summary, marketplaceLine] = result.stdout.split('\n');
+    assertProof(
+      summary?.startsWith(`${expected} ${plugin}@${version} for cursor (marketplace mode) at ${repository}`) === true,
+      `Cursor emitted installer did not report ${expected.toLowerCase()}: ${JSON.stringify(summary)}`,
+    );
+    const commit = /@ ([0-9a-f]{40})$/u.exec(marketplaceLine ?? '')?.[1];
+    assertProof(commit !== undefined, `Cursor emitted installer did not print the marketplace commit: ${JSON.stringify(marketplaceLine)}`);
+    assertProof(
+      result.stdout.includes('Add Plugins from Local Repository') && result.stdout.includes(repository),
+      'Cursor emitted installer did not print the Customize import step.',
+    );
+    return commit;
+  };
+  const first = await stage('Staged');
+  const manifest = record(await readJson(join(repository, '.cursor-plugin', 'marketplace.json'), 'staged marketplace manifest'));
+  const plugins = manifest?.plugins;
+  assertProof(
+    manifest?.name === `${plugin}-marketplace` &&
+      Array.isArray(plugins) &&
+      record(plugins[0])?.name === plugin &&
+      record(plugins[0])?.source === `plugins/${plugin}` &&
+      Object.keys(record(plugins[0]) ?? {}).every((key) => ['description', 'minClientVersions', 'name', 'source'].includes(key)),
+    `Staged marketplace manifest did not list the plugin with pinned-schema entry fields only: ${JSON.stringify(manifest)}`,
+  );
+  const stagedPlugin = record(
+    await readJson(join(repository, 'plugins', plugin, '.cursor-plugin', 'plugin.json'), 'staged plugin manifest')
+      .catch(() => fail('Staged marketplace repository did not contain the plugin copy.')),
+  );
+  assertProof(
+    stagedPlugin?.name === plugin && stagedPlugin.version === version,
+    `Staged plugin copy did not carry the plugin version: ${JSON.stringify(stagedPlugin)}`,
+  );
+  await access(join(repository, '.git', 'HEAD')).catch(() => fail('Staged marketplace repository is not a git repository.'));
+  const second = await stage('Already staged');
+  assertProof(first === second, 'Re-running marketplace staging changed the commit.');
+
+  const report = await runDoctor({ from: fixture.bundles.cursor, home, hosts: ['cursor'] });
+  const cursor = report.hosts.find((entry) => entry.host === 'cursor');
+  const staged = cursor?.inventory.findings.find((entry) => entry.path === repository);
+  assertProof(
+    staged?.state === 'unregistered' && staged.commit === first && staged.marketplace === `${plugin}-marketplace`,
+    `Doctor did not report the staged marketplace as awaiting import: ${JSON.stringify(staged)}`,
+  );
+  const pending = report.diagnostics.filter((entry) => entry.code === 'AB7324');
+  assertProof(
+    pending.length > 0 && pending.every((entry) => entry.severity === 'warning' && entry.recovery?.includes('Add Plugins from Local Repository') === true),
+    `Doctor did not report AB7324 import guidance: ${JSON.stringify(pending)}`,
+  );
+  return Object.freeze({
+    commit: 'git-sha',
+    first: 'staged',
+    imported: false,
+    manifest: 'marketplace.json lists the plugin',
+    repository: normalizedRelative(home, repository),
+    second: 'already-staged',
+  });
+};
+
 export const runCursorHostInstallProof = async (
   fixture: BuiltHostInstallFixture,
   options: HostInstallProofOptions,
@@ -1194,6 +1304,9 @@ export const runCursorHostInstallProof = async (
       installedRoot: destination,
     });
 
+    const hooksRegistration = await assertCursorHooksRegistration(home, destination);
+    const marketplace = await assertCursorMarketplaceStaging(fixture, home, environment);
+
     return Object.freeze({
       destination: normalizedRelative(home, destination),
       documents: Object.freeze({
@@ -1201,6 +1314,7 @@ export const runCursorHostInstallProof = async (
         mcp: 'schema-valid',
         plugin: 'schema-valid',
       }),
+      hooksRegistration,
       host: 'cursor',
       install: Object.freeze({
         first: 'installed',
@@ -1208,6 +1322,7 @@ export const runCursorHostInstallProof = async (
         second: 'already-installed',
         version,
       }),
+      marketplace,
       logo: Object.freeze({
         path: logo,
         resolvesInsideDeployTree: true as const,