fix: validate published bins and npm modes

[ScriptedAlchemy]

Closes #673.

Summary

• validate bin entries from both the generated npm root and the repository package.json npm will publish, reporting absent packed targets as AB7012
• compare npm-installed manifest rows by valid executable state, restore manifest modes before host copies, and retain AB7001 byte, digest, and executable-tamper checks
• install the shared release tarballs once per packed pool and execute every declared package bin with --help
• document the updated AB7012 and AB7001 contracts in the diagnostics source and both site locales

Acceptance

• prepack.test.ts proves a stale repository-root bin map is rejected even when the generated npm-root manifest is valid
• install.test.ts uses npm 11 pack + clean install under npm's real mode handling, covers stripped and preserved executable states, exercises install and Doctor, proves restored host modes, prevents false AB7308, and preserves installed-copy mode-drift detection
• the packed pool executes all bins declared by the packed agent-bundle and create-agent-bundle manifests

Local merge gate

PASS on fe69b8b083:

• pnpm build && pnpm typecheck && pnpm lint && pnpm test:unit — 292 files, 4,355 passed, 6 skipped
• (umask 0022; pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/install.test.ts --testNamePattern 'mode drift|npm normalization') — 2 passed
• pnpm exec rstest --config rstest.integration.config.ts packages/agent-bundle/tests/prepack.test.ts — 24 passed
• pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/install.test.ts packages/agent-bundle/tests/doctor.test.ts — 123 passed (also covered by the final unit gate)
• pnpm docs:site:build — pass, including locale drift and diagnostics coverage
• pnpm test:packed — 14 files, 39 passed, 1 skipped

Two earlier full packed runs hit the same unrelated Workbench aborted-Evals-request race; full retries passed, including the final run on the commit candidate.

Deslop

Deslop: GPT-5.6 Sol, 2 edits (kept merged diagnostics code-sorted and documented the npm mode branch at its decision point).

Self-review

Reviewer: Claude Fable 5.1 Thinking High (change-risk-reviewer), three passes plus final confirmation.

Findings and dispositions:

• npm 0775 umask output and staged 0664 executable were mishandled; fixed with npm-aware acceptance, install-only manifest-mode restoration, and real npm regressions
• Doctor source hashes could disagree with restored host hashes (AB7308); fixed by canonical source executable-state hashing
• installed Claude/Codex copy drift could be hidden by canonical hashing; fixed with actual-mode hashing in installedBundleInventory and a hash-drift regression
• CI test encoded local umask 0002; fixed to assert executable state and verified under 0022
• AB7012 source labeling, bilingual docs, and changeset PR number gaps; fixed
• packed-pool consumer-fixture expansion, read-only chmod handling, and dev-only private root bins were considered non-blocking: the requested pool executes every bin in its release tarballs; read-only drift was already refused before this change; repository-root validation is the explicit Package build must refuse bin entries that are absent from the packed tarball #673 contract

Final review: no concrete merge-blocking or correctness risks remain. All PR checks are green.

[changeset-bot]

🦋 Changeset detected

Latest commit: fe69b8b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@674

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@674

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@674

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@674

commit: fe69b8b