feat: complete remaining native project client E2E

.github/workflows/project-native-research.yml

@@ -0,0 +1,98 @@
+name: Remaining Project Native Research
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/project-native-research.yml'
+      - 'scripts/project_native_research.py'
+      - 'scripts/project_native_cursor_acquisition.py'
+      - 'scripts/project_native_service.py'
+      - 'scripts/project_native_collectors/**'
+      - 'scripts/test_project_native_*.py'
+      - 'scripts/native_client_research.py'
+      - 'scripts/native_client_project_artifacts.py'
+      - 'scripts/research-grok-native.py'
+      - 'scripts/run-native-client-matrix.py'
+      - 'repotests/testdata/agentplugins_native_probe/**'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: project-native-research-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  contracts:
+    name: Inert contracts and explicit research selection
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.selection.outputs.matrix }}
+      count: ${{ steps.selection.outputs.count }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Test capture, pins, admission and leaf parsers without vendor execution
+        run: python3 -m unittest discover -s scripts -p 'test_project_native_*.py'
+      - name: Select only declared research phases
+        id: selection
+        run: |
+          python3 - <<'PYTHON'
+          import json, os, subprocess
+          result = subprocess.check_output(['python3', 'scripts/project_native_research.py', '--matrix'], text=True).strip()
+          matrix = json.loads(result)
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write('matrix=' + result + '\n')
+              output.write('count=' + str(len(matrix['include'])) + '\n')
+          print(result)
+          print('Research selection does not qualify lifecycle, MCP, model use or a release.')
+          PYTHON
+  research:
+    name: ${{ matrix.client }} / ${{ matrix.phase }} / current source
+    needs: contracts
+    if: ${{ needs.contracts.outputs.count != '0' }}
+    strategy:
+      fail-fast: false
+      max-parallel: 5
+      matrix: ${{ fromJSON(needs.contracts.outputs.matrix) }}
+    runs-on: ${{ matrix.host }}
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        if: ${{ matrix.client == 'kimi' && matrix.phase == 'observe' }}
+        with:
+          go-version: '1.26.10'
+          cache: false
+      - name: Acquire or observe exact native bytes in a fresh original profile
+        env:
+          AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
+          EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: python3 scripts/project_native_research.py --client '${{ matrix.client }}' --phase '${{ matrix.phase }}' --output '${{ runner.temp }}/project-native-${{ matrix.client }}'
+      - name: Admit the exact bounded evidence ZIP
+        id: admission
+        if: ${{ always() }}
+        env:
+          EVIDENCE: ${{ runner.temp }}/project-native-${{ matrix.client }}/upload/research.zip
+        run: |
+          /usr/bin/python3 -I - <<'PYTHON'
+          import os, stat
+          from pathlib import Path
+          path = Path(os.environ['EVIDENCE'])
+          info = path.lstat()
+          if path.resolve() != path or not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_uid != os.getuid() or info.st_size > 32 * 1024 * 1024:
+              raise SystemExit('refusing nonregular or unbounded research ZIP')
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write('valid=true\n')
+          PYTHON
+      - name: Upload closed research evidence
+        if: ${{ always() && steps.admission.outputs.valid == 'true' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: project-native-${{ matrix.client }}-${{ matrix.phase }}-linux-amd64
+          path: ${{ runner.temp }}/project-native-${{ matrix.client }}/upload/research.zip
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/project-native-runtime.yml

@@ -0,0 +1,134 @@
+name: Project Native Runtime
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/project-native-runtime.yml'
+      - 'scripts/project_native_runtime.py'
+      - 'scripts/project_native_research.py'
+      - 'scripts/project_native_service.py'
+      - 'scripts/project_native_collectors/**'
+      - 'scripts/test_project_native_runtime.py'
+      - 'repotests/agentplugins_*project_native_*test.go'
+      - 'repotests/testdata/agentplugins_native_probe/**'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: project-native-runtime-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+jobs:
+  contracts:
+    name: Runtime admission contracts and exact selection
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    outputs:
+      matrix: ${{ steps.selection.outputs.matrix }}
+      count: ${{ steps.selection.outputs.count }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Verify inert envelope and selection contracts
+        run: python3 -m unittest discover -s scripts -p 'test_project_native_runtime.py'
+      - name: Select only implemented exact native tests
+        id: selection
+        run: |
+          python3 - <<'PYTHON'
+          import json, os, subprocess
+          value = subprocess.check_output(['python3', 'scripts/project_native_runtime.py', '--matrix'], text=True).strip()
+          matrix = json.loads(value)
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write('matrix=' + value + '\n')
+              output.write('count=' + str(len(matrix['include'])) + '\n')
+          print(value)
+          PYTHON
+      - name: Prepare pinned Go for selected Copilot inert process contracts
+        if: ${{ contains(fromJSON(steps.selection.outputs.matrix).include.*.client, 'copilot') }}
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26.10'
+          cache: false
+      - name: Verify selected Copilot inert process contracts before native execution
+        if: ${{ contains(fromJSON(steps.selection.outputs.matrix).include.*.client, 'copilot') }}
+        run: go test -json -p=1 -count=1 -timeout=120s ./repotests -run '^(TestCopilot|TestProjectNativeRuntime)'
+  native:
+    name: ${{ matrix.client }} / ${{ matrix.phase }} / installed public CLI
+    needs: contracts
+    if: ${{ needs.contracts.outputs.count != '0' }}
+    strategy:
+      fail-fast: false
+      max-parallel: 3
+      matrix: ${{ fromJSON(needs.contracts.outputs.matrix) }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 26
+    env:
+      AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED: '1'
+      EXPECTED_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Admit actual hosted environment and clean source before toolchain setup
+        run: |
+          python3 - <<'PYTHON'
+          import os, platform, re, sys
+          from pathlib import Path
+          sys.path.insert(0, str(Path.cwd() / 'scripts'))
+          from native_client_research import run_probe
+          required = {'GITHUB_ACTIONS': 'true', 'RUNNER_ENVIRONMENT': 'github-hosted', 'AGENTPLUGINS_NATIVE_DISPOSABLE_HOSTED': '1'}
+          if any(os.environ.get(key) != value for key, value in required.items()) or platform.system() != 'Linux' or platform.machine() != 'x86_64':
+              raise SystemExit('actual opted-in GitHub-hosted Linux x64 required')
+          expected = os.environ['EXPECTED_COMMIT']
+          env = {'PATH': '/usr/bin:/bin', 'LC_ALL': 'C', 'GIT_CONFIG_NOSYSTEM': '1', 'GIT_CONFIG_GLOBAL': '/dev/null', 'GIT_TERMINAL_PROMPT': '0'}
+          def git(*args):
+              record, stdout, stderr = run_probe(['/usr/bin/git', *args], Path.cwd(), env, Path('/tmp'), 'source-guard', timeout=10, limit=65536, memory_only=True)
+              if record['error'] is not None or record['exit'] != 0 or stderr:
+                  raise SystemExit('bounded source identity query failed')
+              return stdout.decode('ascii', errors='strict').strip()
+          if not re.fullmatch('[0-9a-f]{40}', expected) or git('rev-parse', 'HEAD') != expected or not re.fullmatch('[0-9a-f]{40}', git('rev-parse', 'HEAD^{tree}')) or git('status', '--porcelain', '--untracked-files=normal'):
+              raise SystemExit('exact clean current-source checkout required')
+          PYTHON
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: '1.26.10'
+          cache: false
+      - name: Run the selected bounded current-source native test
+        run: python3 scripts/project_native_runtime.py --client '${{ matrix.client }}' --output '${{ runner.temp }}/project-runtime-${{ matrix.client }}'
+      - name: Admit exact closed output files
+        id: admission
+        if: ${{ always() }}
+        env:
+          EVIDENCE: ${{ runner.temp }}/project-runtime-${{ matrix.client }}/upload
+        run: |
+          /usr/bin/python3 -I - <<'PYTHON'
+          import os, stat
+          from pathlib import Path
+          root = Path(os.environ['EVIDENCE'])
+          for label in ('frontend', 'runtime'):
+              path = root / (label + '.zip')
+              if not path.exists():
+                  continue
+              info = path.lstat()
+              if path.resolve() != path or not stat.S_ISREG(info.st_mode) or info.st_nlink != 1 or info.st_uid != os.getuid() or info.st_size > 32 * 1024 * 1024:
+                  raise SystemExit('refusing aliased or unbounded closed evidence')
+              with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+                  output.write(label + '=true\n')
+          PYTHON
+      - name: Upload source, build and test receipt
+        if: ${{ always() && steps.admission.outputs.frontend == 'true' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: project-runtime-${{ matrix.client }}-${{ matrix.phase }}-frontend
+          path: ${{ runner.temp }}/project-runtime-${{ matrix.client }}/upload/frontend.zip
+          if-no-files-found: error
+          retention-days: 14
+      - name: Upload admitted native runtime evidence
+        if: ${{ always() && steps.admission.outputs.runtime == 'true' }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: project-runtime-${{ matrix.client }}-${{ matrix.phase }}-native
+          path: ${{ runner.temp }}/project-runtime-${{ matrix.client }}/upload/runtime.zip
+          if-no-files-found: error
+          retention-days: 14

cli/cmd/agentplugins/cursor_project_cycle_contract_test.go

@@ -0,0 +1,110 @@
+package main
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/777genius/plugin-kit-ai/cli/internal/agentpluginscli"
+)
+
+// Real public Cobra/installer/filesystem composition with inert host discovery
+// and assessment. No Cursor process or authored MCP process is executed.
+func TestProjectCursorDirectMCPCyclePublicContracts(t *testing.T) {
+	f := newCursorProjectJourney(t, newProjectJourneyTransport(t, "zip"))
+	projectJourneyWrite(t, filepath.Join(f.a, ".cursor", "mcp.json"), "{\"mcpServers\":{}}\n")
+	source := projectJourneyTemp(t)
+	write := func(version string) {
+		t.Helper()
+		projectJourneyWrite(t, filepath.Join(source, "plugin.json"), `{"$schema":"https://agent-plugins.org/schemas/1.0.0/plugin.schema.json","name":"native-proof","version":"`+version+`"}`+"\n")
+		projectJourneyWrite(t, filepath.Join(source, "mcp.json"), `{"$schema":"https://agent-plugins.org/schemas/1.0.0/mcp.schema.json","mcpServers":{"uapcursora":{"type":"stdio","command":"./bin/probe","args":["cursor-component"],"cwd":"${PLUGIN_ROOT}"}}}`+"\n")
+		projectJourneyWrite(t, filepath.Join(source, "bin", "probe"), "inert fixture bytes; never executed\n")
+		if err := os.Chmod(filepath.Join(source, "bin", "probe"), 0700); err != nil {
+			t.Fatal(err)
+		}
+	}
+	write("1.0.0")
+	var iid, oldState string
+	run := func(stage, verb, selector string, changed bool) {
+		t.Helper()
+		var stdout, stderr bytes.Buffer
+		app := f.app
+		app.Input, app.Output, app.ErrorOutput, app.Terminal = strings.NewReader(""), &stdout, &stderr, false
+		root := agentpluginscli.NewRoot(app)
+		args := []string{verb, selector, "--scope", "project", "--project-root", f.a, "--target", "cursor", "--format", "json"}
+		if verb == "add" {
+			args = append(args, "--no-save")
+		}
+		root.SetArgs(args)
+		if err := root.Execute(); err != nil {
+			t.Fatalf("%s: %v\n%s\n%s", stage, err, stdout.String(), stderr.String())
+		}
+		var row map[string]any
+		if err := json.Unmarshal(stdout.Bytes(), &row); err != nil {
+			t.Fatal(err)
+		}
+		data := row["data"].(map[string]any)
+		output := data
+		if stage == "repeat-add-a" {
+			if _, present := data["targets"]; present || data["operation_id"] != nil {
+				t.Fatal("repeat add is not the exact singleton")
+			}
+		} else {
+			if data["batch"] != true || data["succeeded"] != float64(1) || data["failed"] != float64(0) {
+				t.Fatal("public batch differs", row)
+			}
+			output = data["targets"].([]any)[0].(map[string]any)["output"].(map[string]any)
+		}
+		outcome := output["result"].(map[string]any)
+		if iid == "" {
+			iid = outcome["installation_id"].(string)
+		}
+		if outcome["installation_id"] != iid || outcome["mutated"] != changed || outcome["requires_confirmation"] != false {
+			t.Fatal("held public outcome differs", row)
+		}
+		label := "direct local source"
+		if verb == "repair" || verb == "remove" {
+			label = "local"
+		}
+		if output["source"] != label {
+			t.Fatal("source label differs", row)
+		}
+		if verb != "remove" {
+			plan, activation := outcome["plan"].(map[string]any), outcome["activation"].(map[string]any)
+			if plan["verification"] != "package_validated" || activation["verification"] != "installation_verified" || !reflect.DeepEqual(plan["components"], []any{map[string]any{"kind": "mcp_server", "name": "uapcursora", "support": "native"}}) {
+				t.Fatal("Prepared MCP-only DTO differs", row)
+			}
+		}
+		if stage == "unchanged-update-a" && outcome["no_change"] != true {
+			t.Fatal("unchanged update flag differs", row)
+		}
+		state := projectJourneyRead(t, filepath.Join(f.a, ".uap", "state-v2.json"))
+		if !changed && state != oldState {
+			t.Fatal("public no-op rewrote exact state")
+		}
+		oldState = state
+	}
+	run("add-a", "add", source, true)
+	run("repeat-add-a", "add", source, false)
+	run("unchanged-update-a", "update", iid, false)
+	run("intact-repair-a", "repair", iid, true)
+	write("1.1.0")
+	run("update-a", "update", iid, true)
+	// Remove only the sole owned native document, leaving the package intact.
+	config := filepath.Join(f.a, ".cursor", "mcp.json")
+	if err := os.Remove(config); err != nil {
+		t.Fatal(err)
+	}
+	run("missing-repair-a", "repair", iid, true)
+	run("remove-a", "remove", iid, true)
+	if _, err := f.execute(f.a, "remove", iid, "--target", "cursor"); err == nil || err.Error() != `plugin is not installed for target "cursor" in project scope; no target was changed` {
+		t.Fatal("repeated removal refusal differs", err)
+	}
+	if projectJourneyRead(t, filepath.Join(f.a, ".uap", "state-v2.json")) != oldState {
+		t.Fatal("repeated removal changed state")
+	}
+}