@cursorpool-dev/cli 0.5.6

package/test/install.test.ts

@@ -0,0 +1,862 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import test from 'node:test';
+import {
+  CURSOR_POOL_AGENT_EXEC_PROVIDER_REGISTER_ANCHOR,
+  CURSOR_POOL_PATCH_MARKER,
+} from '../../patcher/src/marker';
+import { writeRuntimeInfo } from '../../service/src/runtime';
+import type { CompatibilityManifestEntry } from '../../shared/src/manifest';
+import { buildCompatManifestSignature } from '../src/compat';
+import { getExtensionState } from '../src/extensionBundle';
+import { getLinkedExtensionState, linkedExtensionPathForDir } from '../src/extensionLink';
+import { readInstallRecord } from '../src/installRecord';
+import { install } from '../src/install';
+import { readTrialRecord } from '../src/trial';
+import { readClientConfig } from '../../shared/src/clientConfig';
+
+const targetRelativePath =
+  'Contents/Resources/app/extensions/cursor-agent-exec/dist/main.js';
+const alwaysLocalRelativePath =
+  'Contents/Resources/app/extensions/cursor-always-local/dist/main.js';
+const workbenchRelativePath = 'Contents/Resources/app/out/vs/workbench/workbench.desktop.main.js';
+const composerAuthGateAnchor =
+  'get when(){return p()&&!fzC},get fallback(){return he(DGC,{})}';
+const composerSubmitAuthGateAnchor =
+  'if(!p()){e.cursorAuthenticationService.login(),e.commandService.executeCommand(wV,"general");return}';
+const agentLoopRunAnchor = 'await this.agentClientService.run(te,H,$e,Ne,Ce,T,ze,me,we,[],ct)';
+const buildFlagsLocalModeAnchor = 'localMode:!1';
+const localProviderConfigAnchor =
+  'async getLocalAgentProviderConfig(e){const t="[AgentClientService][getLocalAgentProviderConfig]",i=L0.localMode?await this.shellEnvironmentService.getShellEnv():{},r=e?.credentials,s=r?.case==="apiKeyCredentials"?r.value:void 0,o=this.reactiveStorageService.applicationUserPersistentStorage,a=o.useOpenAIKey===!0?this.cursorAuthenticationService.openAIKey()??void 0:void 0,u=xgS({apiKeyCandidates:[{value:s?.apiKey,source:"modelDetails.apiKeyCredentials.apiKey"},{value:a,source:"storage.openAIKey"}],baseUrlCandidates:[{value:s?.baseUrl,source:"modelDetails.apiKeyCredentials.baseUrl"},{value:o.openAIBaseUrl,source:"storage.openAIBaseUrl"}]});return{baseUrl:u.baseUrl,apiKey:u.apiKey}}createDefaultLocalModel(e){return "default"}';
+const agentClientRunLocalModeAnchor =
+  'if(L0.localMode){try{g.onNetworkPhaseStart?.()}catch(b){this.logService.warn("[AgentClientService] onNetworkPhaseStart callback failed in local mode",b)}return this.runLocalAgentInExtensionHost(e,t,i,r,s,a,d,h,g)}return this.client.run(e,t,i,r,s,o,a,u,d,h,g)';
+
+function workbenchFixture() {
+  return [
+    `function composer(){return he(Mt,{${composerAuthGateAnchor},get children(){return "controls"}})}`,
+    `async function submit(){${composerSubmitAuthGateAnchor};return "submitted";}`,
+    `const flags={${buildFlagsLocalModeAnchor}}`,
+    localProviderConfigAnchor,
+    `async function runAgentLoop(){${agentLoopRunAnchor}}`,
+    `async function agentClientRun(){const g={};${agentClientRunLocalModeAnchor}}`,
+  ].join(';');
+}
+
+async function createFixtureApp() {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-cli-install-'));
+  const appPath = join(tempDir, 'Cursor.app');
+  const targetPath = join(appPath, targetRelativePath);
+  const targetContent = `function main() { return "agent"; }\n${CURSOR_POOL_AGENT_EXEC_PROVIDER_REGISTER_ANCHOR}\nmain();\n`;
+  await mkdir(join(appPath, 'Contents/Resources/app/extensions/cursor-agent-exec/dist'), {
+    recursive: true,
+  });
+  await mkdir(join(appPath, 'Contents/Resources/app/extensions/cursor-always-local/dist'), {
+    recursive: true,
+  });
+  await mkdir(join(appPath, 'Contents/Resources/app/out/vs/workbench'), {
+    recursive: true,
+  });
+  await writeFile(
+    join(appPath, 'Contents/Resources/app/product.json'),
+    JSON.stringify({
+      version: '3.5.38',
+      commit: '009bb5a3600dd98fe1c1f25798f767f686e14750',
+    }),
+    'utf8',
+  );
+  await writeFile(targetPath, targetContent, 'utf8');
+  await writeFile(join(appPath, alwaysLocalRelativePath), 'function alwaysLocal(){}\n', 'utf8');
+  await writeFile(join(appPath, workbenchRelativePath), workbenchFixture(), 'utf8');
+
+  const expectedSha256 = createHash('sha256').update(targetContent).digest('hex');
+  const compatEntry: CompatibilityManifestEntry = {
+    platform: process.platform,
+    arch: process.arch,
+    cursorVersion: '3.5.38',
+    cursorCommit: '009bb5a3600dd98fe1c1f25798f767f686e14750',
+    supportStatus: 'supported',
+    targetRelativePath,
+    expectedSha256,
+    structureSignature: 'fixture',
+    patchStrategy: 'cursor-agent-exec-snippet',
+    verifyMarker: 'cursor-pool',
+    restoreStrategy: 'external-backup',
+    minCliVersion: '0.0.0',
+    minExtensionVersion: '0.0.0',
+    minServiceVersion: '0.0.0',
+    requiresWritableAppBundle: true,
+    requiresAdHocResign: false,
+    userMessage: 'fixture supported',
+  };
+
+  return {
+    appPath,
+    tempDir,
+    targetPath,
+    runtimeFile: join(tempDir, 'runtime.json'),
+    backupDir: join(tempDir, 'backups'),
+    compatEntry,
+  };
+}
+
+async function createLinuxFixtureApp() {
+  const tempDir = await mkdtemp(join(tmpdir(), 'cursor-pool-cli-install-linux-'));
+  const appPath = join(tempDir, 'squashfs-root');
+  const targetRelativePath = 'usr/share/cursor/resources/app/extensions/cursor-agent-exec/dist/main.js';
+  const targetPath = join(appPath, targetRelativePath);
+  const targetContent = `function main() { return "linux-agent"; }\n${CURSOR_POOL_AGENT_EXEC_PROVIDER_REGISTER_ANCHOR}\nmain();\n`;
+  await mkdir(join(appPath, 'usr/share/cursor/resources/app/extensions/cursor-agent-exec/dist'), {
+    recursive: true,
+  });
+  await mkdir(join(appPath, 'usr/share/cursor/resources/app/extensions/cursor-always-local/dist'), {
+    recursive: true,
+  });
+  await mkdir(join(appPath, 'usr/share/cursor/resources/app/out/vs/workbench'), {
+    recursive: true,
+  });
+  await writeFile(
+    join(appPath, 'usr/share/cursor/resources/app/product.json'),
+    JSON.stringify({
+      version: '3.6.31',
+      commit: 'linux-commit',
+    }),
+    'utf8',
+  );
+  await writeFile(targetPath, targetContent, 'utf8');
+  await writeFile(
+    join(appPath, 'usr/share/cursor/resources/app/extensions/cursor-always-local/dist/main.js'),
+    'function alwaysLocal(){}\n',
+    'utf8',
+  );
+  await writeFile(
+    join(appPath, 'usr/share/cursor/resources/app/out/vs/workbench/workbench.desktop.main.js'),
+    workbenchFixture(),
+    'utf8',
+  );
+
+  const expectedSha256 = createHash('sha256').update(targetContent).digest('hex');
+  const compatEntry: CompatibilityManifestEntry = {
+    platform: 'linux',
+    arch: process.arch,
+    cursorVersion: '3.6.31',
+    cursorCommit: 'linux-commit',
+    supportStatus: 'supported',
+    targetRelativePath,
+    expectedSha256,
+    structureSignature: 'linux-fixture',
+    patchStrategy: 'cursor-agent-exec-snippet',
+    verifyMarker: 'cursor-pool',
+    restoreStrategy: 'external-backup',
+    minCliVersion: '0.0.0',
+    minExtensionVersion: '0.0.0',
+    minServiceVersion: '0.0.0',
+    requiresWritableAppBundle: true,
+    requiresAdHocResign: false,
+    userMessage: 'linux fixture supported',
+  };
+
+  return {
+    appPath,
+    tempDir,
+    targetPath,
+    runtimeFile: join(tempDir, 'runtime.json'),
+    backupDir: join(tempDir, 'backups'),
+    compatEntry,
+  };
+}
+
+function resignCompatEntry(entry: CompatibilityManifestEntry): CompatibilityManifestEntry {
+  return {
+    ...entry,
+    requiresAdHocResign: true,
+  };
+}
+
+async function createRemoteOnlyFixtureApp() {
+  const fixture = await createFixtureApp();
+  const productPath = join(fixture.appPath, 'Contents/Resources/app/product.json');
+  await writeFile(
+    productPath,
+    JSON.stringify({
+      version: '3.7.0',
+      commit: 'remote-commit',
+    }),
+    'utf8',
+  );
+  const compatEntry = {
+    ...fixture.compatEntry,
+    cursorVersion: '3.7.0',
+    cursorCommit: 'remote-commit',
+    userMessage: 'remote fixture supported',
+  };
+  return { ...fixture, compatEntry };
+}
+
+test('install reports Cursor version, simulated extension, service, patch, and health status', async () => {
+  const fixture = await createFixtureApp();
+
+  try {
+    const output = await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir: join(fixture.tempDir, 'trials'),
+      extensionInstallPath: join(fixture.tempDir, 'extensions/cursor-pool-status'),
+      compatEntries: [fixture.compatEntry],
+      stopServiceAfterInstall: true,
+    });
+
+    assert.match(output, /Cursor 3\.5\.38/);
+    assert.match(output, /mode: disposable/);
+    assert.match(output, /app: .*Cursor\.app/);
+    assert.match(output, /extension: bundled/);
+    assert.match(output, /trial: recorded/);
+    assert.match(output, /service: running/);
+    assert.match(output, /patch: applied/);
+    assert.match(output, /health: ok/);
+    assert.match(await readFile(fixture.targetPath, 'utf8'), new RegExp(CURSOR_POOL_PATCH_MARKER));
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install detects Linux Cursor AppImage layout under usr/share/cursor', async () => {
+  const fixture = await createLinuxFixtureApp();
+
+  try {
+    const output = await install({
+      appPath: fixture.appPath,
+      platform: 'linux',
+      arch: process.arch,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir: join(fixture.tempDir, 'trials'),
+      extensionInstallPath: join(fixture.tempDir, 'extensions/cursor-pool-status'),
+      compatEntries: [fixture.compatEntry],
+      stopServiceAfterInstall: true,
+    });
+
+    assert.match(output, /Cursor 3\.6\.31/);
+    assert.match(output, /patch: applied/);
+    assert.match(output, /health: ok/);
+    assert.match(await readFile(fixture.targetPath, 'utf8'), new RegExp(CURSOR_POOL_PATCH_MARKER));
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install can use a signed remote compatibility manifest from api base url', async () => {
+  const fixture = await createRemoteOnlyFixtureApp();
+  const envelope = {
+    version: 9,
+    signatureAlgorithm: 'hmac-sha256-dev',
+    signatureKeyId: 'dev-compatibility-key',
+    signature: buildCompatManifestSignature(9, [fixture.compatEntry]),
+    rules: [fixture.compatEntry],
+  };
+
+  try {
+    const output = await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir: join(fixture.tempDir, 'trials'),
+      extensionInstallPath: join(fixture.tempDir, 'extensions/cursor-pool-status'),
+      apiBaseUrl: 'https://platform.example.test',
+      fetchCompatManifest: async (url) => {
+        assert.equal(url, 'https://platform.example.test/api/client/compatibility/manifest');
+        return { ok: true, json: async () => envelope };
+      },
+      stopServiceAfterInstall: true,
+    });
+
+    assert.match(output, /Cursor 3\.7\.0/);
+    assert.match(output, /patch: applied/);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install passes API base URL to detached service startup', async () => {
+  const fixture = await createFixtureApp();
+  const serviceCalls: Record<string, unknown>[] = [];
+
+  try {
+    await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir: join(fixture.tempDir, 'trials'),
+      extensionInstallPath: join(fixture.tempDir, 'extensions/cursor-pool-status'),
+      compatEntries: [fixture.compatEntry],
+      apiBaseUrl: 'https://platform.example.test',
+      startDetachedService: async (options) => {
+        serviceCalls.push(options);
+        await writeRuntimeInfo(
+          { host: '127.0.0.1', port: 56393, runtimeId: 'runtime-1' },
+          { runtimeFile: fixture.runtimeFile },
+        );
+        return { host: '127.0.0.1', port: 56393, runtimeId: 'runtime-1' };
+      },
+      fetchHealth: async () => ({ ok: true, healthy: true }),
+    });
+
+    assert.equal(serviceCalls[0]?.apiBaseUrl, 'https://platform.example.test');
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install persists API base URL and installs user autostart for real client runtime', async () => {
+  const fixture = await createFixtureApp();
+  const configFile = join(fixture.tempDir, 'client-config.json');
+  const autostartCalls: Record<string, unknown>[] = [];
+
+  try {
+    const output = await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir: join(fixture.tempDir, 'trials'),
+      extensionInstallPath: join(fixture.tempDir, 'extensions/cursor-pool-status'),
+      compatEntries: [fixture.compatEntry],
+      apiBaseUrl: 'https://platform.example.test/',
+      clientConfigFile: configFile,
+      installUserAutostart: async (options) => {
+        autostartCalls.push(options);
+        return { state: 'installed' as const };
+      },
+      startDetachedService: async () => {
+        await writeRuntimeInfo(
+          { host: '127.0.0.1', port: 56393, runtimeId: 'runtime-1' },
+          { runtimeFile: fixture.runtimeFile },
+        );
+        return { host: '127.0.0.1', port: 56393, runtimeId: 'runtime-1' };
+      },
+      fetchHealth: async () => ({ ok: true, healthy: true }),
+    });
+
+    assert.deepEqual(await readClientConfig({ configFile }), {
+      apiBaseUrl: 'https://platform.example.test',
+    });
+    assert.equal(autostartCalls[0]?.configFile, configFile);
+    assert.equal(autostartCalls[0]?.runtimeFile, fixture.runtimeFile);
+    assert.match(output, /autostart: installed/);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('real-mode install writes install record and reports real mode', async () => {
+  const fixture = await createFixtureApp();
+  const installRecordFile = join(fixture.tempDir, 'install.json');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+  const cursorExtensionsDir = join(fixture.tempDir, 'real-extensions');
+
+  try {
+    const output = await install({
+      realAppPath: fixture.appPath,
+      yes: true,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      installRecordFile,
+      extensionInstallPath,
+      cursorExtensionsDir,
+      compatEntries: [fixture.compatEntry],
+      stopServiceAfterInstall: true,
+    });
+
+    assert.match(output, /mode: real/);
+    assert.match(output, /patch: applied/);
+    assert.match(output, /install-record: recorded/);
+    assert.doesNotMatch(output, /trial: recorded/);
+    assert.match(await readFile(fixture.targetPath, 'utf8'), new RegExp(CURSOR_POOL_PATCH_MARKER));
+
+    const record = await readInstallRecord({ installRecordFile });
+    assert.ok(record);
+    assert.equal(record.mode, 'real');
+    assert.equal(record.appPath, fixture.appPath);
+    assert.equal(record.cursorVersion, '3.5.38');
+    assert.equal(record.extensionInstallPath, extensionInstallPath);
+    assert.equal(record.extensionLinkedPath, linkedExtensionPathForDir(cursorExtensionsDir));
+    assert.equal(record.lastOperation, 'install');
+    assert.equal(record.lastOperationStatus, 'ok');
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('real-mode install rolls back install record after health failure', async () => {
+  const fixture = await createFixtureApp();
+  const installRecordFile = join(fixture.tempDir, 'install.json');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+
+  try {
+    await assert.rejects(
+      install({
+        realAppPath: fixture.appPath,
+        yes: true,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        installRecordFile,
+        extensionInstallPath,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        fetchHealth: async () => ({ ok: false, healthy: false }),
+      }),
+      /Service health check failed/,
+    );
+
+    assert.equal(await readInstallRecord({ installRecordFile }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('real-mode install requires confirmation when yes is missing', async () => {
+  const fixture = await createFixtureApp();
+  const originalTargetContent = await readFile(fixture.targetPath, 'utf8');
+  const installRecordFile = join(fixture.tempDir, 'install.json');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+
+  try {
+    await assert.rejects(
+      install({
+        realAppPath: fixture.appPath,
+        isInteractive: false,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        installRecordFile,
+        extensionInstallPath,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+      }),
+      /Pass --yes to confirm install for real Cursor/,
+    );
+
+    assert.equal(await readFile(fixture.targetPath, 'utf8'), originalTargetContent);
+    assert.equal(await getExtensionState(extensionInstallPath), 'missing');
+    assert.equal(await readInstallRecord({ installRecordFile }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install links extension into an explicit Cursor extensions directory', async () => {
+  const fixture = await createFixtureApp();
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+  const cursorExtensionsDir = join(fixture.tempDir, 'Cursor-Pool-Trial-Extensions');
+  const linkedPath = linkedExtensionPathForDir(cursorExtensionsDir);
+
+  try {
+    const output = await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir,
+      extensionInstallPath,
+      cursorExtensionsDir,
+      compatEntries: [fixture.compatEntry],
+      stopServiceAfterInstall: true,
+    });
+
+    assert.match(output, /extension: linked/);
+    assert.equal(await getExtensionState(extensionInstallPath), 'bundled');
+    assert.equal(await getLinkedExtensionState(linkedPath), 'linked');
+
+    const trialRecord = await readTrialRecord(fixture.appPath, { trialRecordDir });
+    assert.equal(trialRecord?.extensionState, 'linked');
+    assert.equal(trialRecord?.extensionInstallPath, extensionInstallPath);
+    assert.equal(trialRecord?.extensionLinkedPath, linkedPath);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install refreshes explicit Cursor extensions index for the user client', async () => {
+  const fixture = await createFixtureApp();
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+  const cursorExtensionsDir = join(fixture.tempDir, 'real-extensions');
+  await mkdir(cursorExtensionsDir, { recursive: true });
+  await writeFile(
+    join(cursorExtensionsDir, 'extensions.json'),
+    JSON.stringify([
+      {
+        identifier: { id: 'cursor-pool.@cursor-pool/extension' },
+        relativeLocation: 'cursor-pool.extension-0.0.0',
+        version: '0.0.0',
+      },
+    ]),
+    'utf8',
+  );
+
+  try {
+    await install({
+      realAppPath: fixture.appPath,
+      yes: true,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      installRecordFile: join(fixture.tempDir, 'install.json'),
+      extensionInstallPath,
+      cursorExtensionsDir,
+      compatEntries: [fixture.compatEntry],
+      stopServiceAfterInstall: true,
+    });
+
+    const index = JSON.parse(await readFile(join(cursorExtensionsDir, 'extensions.json'), 'utf8'));
+    assert.deepEqual(index, [
+      {
+        identifier: { id: 'cursor-pool.cursorpool' },
+        location: {
+          $mid: 1,
+          path: linkedExtensionPathForDir(cursorExtensionsDir),
+          scheme: 'file',
+        },
+        relativeLocation: 'cursor-pool.extension-0.0.0',
+        version: '0.0.0',
+      },
+    ]);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install ad-hoc resigns macOS app when compatibility requires it', async () => {
+  const fixture = await createFixtureApp();
+  const resignCalls: string[] = [];
+
+  try {
+    const output = await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir: join(fixture.tempDir, 'trials'),
+      extensionInstallPath: join(fixture.tempDir, 'extensions/cursor-pool-status'),
+      compatEntries: [resignCompatEntry(fixture.compatEntry)],
+      stopServiceAfterInstall: true,
+      adHocResignApp: async (appPath) => {
+        resignCalls.push(appPath);
+      },
+    });
+
+    assert.deepEqual(resignCalls, process.platform === 'darwin' ? [fixture.appPath] : []);
+    assert.match(output, process.platform === 'darwin' ? /resign: ad-hoc/ : /resign: skipped/);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install rolls back patch when required ad-hoc resign fails', async () => {
+  const fixture = await createFixtureApp();
+  const originalTargetContent = await readFile(fixture.targetPath, 'utf8');
+
+  try {
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir: join(fixture.tempDir, 'trials'),
+        extensionInstallPath: join(fixture.tempDir, 'extensions/cursor-pool-status'),
+        compatEntries: [resignCompatEntry(fixture.compatEntry)],
+        stopServiceAfterInstall: true,
+        adHocResignApp: async () => {
+          throw new Error('synthetic codesign failure');
+        },
+      }),
+      /synthetic codesign failure/,
+    );
+
+    assert.equal(await readFile(fixture.targetPath, 'utf8'), originalTargetContent);
+    assert.equal(await readTrialRecord(fixture.appPath, { trialRecordDir: join(fixture.tempDir, 'trials') }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install rollback stops service and removes runtime file when patch fails after service start', async () => {
+  const fixture = await createFixtureApp();
+  let startedPort: number | undefined;
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+
+  try {
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir,
+        extensionInstallPath,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        patchCursorAgentExec: async () => {
+          const runtime = JSON.parse(await readFile(fixture.runtimeFile, 'utf8')) as {
+            port: number;
+          };
+          startedPort = runtime.port;
+          throw new Error('synthetic patch failure');
+        },
+      }),
+      /synthetic patch failure/,
+    );
+
+    await assert.rejects(readFile(fixture.runtimeFile, 'utf8'), /ENOENT/);
+    assert.equal(typeof startedPort, 'number');
+    await assert.rejects(fetch(`http://127.0.0.1:${startedPort}/health`), /fetch failed/);
+    assert.equal(await getExtensionState(extensionInstallPath), 'missing');
+    assert.equal(await readTrialRecord(fixture.appPath, { trialRecordDir }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('install rollback stops service and removes runtime file when restore fails after health failure', async () => {
+  const fixture = await createFixtureApp();
+  let startedPort: number | undefined;
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+
+  try {
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir,
+        extensionInstallPath,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        fetchHealth: async () => {
+          const runtime = JSON.parse(await readFile(fixture.runtimeFile, 'utf8')) as {
+            port: number;
+          };
+          startedPort = runtime.port;
+          return { ok: false, healthy: false };
+        },
+        restoreCursorAgentExec: async () => {
+          throw new Error('synthetic restore failure');
+        },
+      }),
+      /Service health check failed/,
+    );
+
+    await assert.rejects(readFile(fixture.runtimeFile, 'utf8'), /ENOENT/);
+    assert.equal(typeof startedPort, 'number');
+    await assert.rejects(fetch(`http://127.0.0.1:${startedPort}/health`), /fetch failed/);
+    assert.equal(await getExtensionState(extensionInstallPath), 'missing');
+    assert.equal(await readTrialRecord(fixture.appPath, { trialRecordDir }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('failed reinstall preserves existing patch, trial record, and extension bundle', async () => {
+  const fixture = await createFixtureApp();
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+
+  try {
+    await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir,
+      extensionInstallPath,
+      compatEntries: [fixture.compatEntry],
+      stopServiceAfterInstall: true,
+    });
+    const trialRecord = await readTrialRecord(fixture.appPath, { trialRecordDir });
+    assert.ok(trialRecord);
+    assert.equal(await getExtensionState(extensionInstallPath), 'bundled');
+    const sentinelExtensionContent = 'module.exports = { sentinel: true };\n';
+    await writeFile(join(extensionInstallPath, 'dist/extension.js'), sentinelExtensionContent, 'utf8');
+    await writeRuntimeInfo(
+      { host: '127.0.0.1', port: 45123, runtimeId: 'pre-existing-runtime' },
+      { runtimeFile: fixture.runtimeFile },
+    );
+    const existingRuntimeJson = await readFile(fixture.runtimeFile, 'utf8');
+    assert.match(await readFile(fixture.targetPath, 'utf8'), new RegExp(CURSOR_POOL_PATCH_MARKER));
+
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir,
+        extensionInstallPath,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        fetchHealth: async () => ({ ok: false, healthy: false }),
+      }),
+      /Service health check failed/,
+    );
+
+    assert.match(await readFile(fixture.targetPath, 'utf8'), new RegExp(CURSOR_POOL_PATCH_MARKER));
+    assert.equal(await getExtensionState(extensionInstallPath), 'bundled');
+    assert.equal(
+      await readFile(join(extensionInstallPath, 'dist/extension.js'), 'utf8'),
+      sentinelExtensionContent,
+    );
+    assert.equal(await readFile(fixture.runtimeFile, 'utf8'), existingRuntimeJson);
+    assert.deepEqual(await readTrialRecord(fixture.appPath, { trialRecordDir }), trialRecord);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('failed linked reinstall restores pre-existing linked extension bytes', async () => {
+  const fixture = await createFixtureApp();
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+  const cursorExtensionsDir = join(fixture.tempDir, 'Extensions');
+  const linkedPath = linkedExtensionPathForDir(cursorExtensionsDir);
+  const sentinelExtensionContent = 'module.exports = { sentinel: "linked" };\n';
+
+  try {
+    await install({
+      appPath: fixture.appPath,
+      runtimeFile: fixture.runtimeFile,
+      backupDir: fixture.backupDir,
+      trialRecordDir,
+      extensionInstallPath,
+      cursorExtensionsDir,
+      compatEntries: [fixture.compatEntry],
+      stopServiceAfterInstall: true,
+    });
+    await writeFile(join(linkedPath, 'dist/extension.js'), sentinelExtensionContent, 'utf8');
+    const trialRecord = await readTrialRecord(fixture.appPath, { trialRecordDir });
+    assert.ok(trialRecord);
+
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir,
+        extensionInstallPath,
+        cursorExtensionsDir,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        fetchHealth: async () => ({ ok: false, healthy: false }),
+      }),
+      /Service health check failed/,
+    );
+
+    assert.equal(await getLinkedExtensionState(linkedPath), 'linked');
+    assert.equal(await readFile(join(linkedPath, 'dist/extension.js'), 'utf8'), sentinelExtensionContent);
+    assert.deepEqual(await readTrialRecord(fixture.appPath, { trialRecordDir }), trialRecord);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('failed linked install restores pre-existing incomplete linked bytes', async () => {
+  const fixture = await createFixtureApp();
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+  const cursorExtensionsDir = join(fixture.tempDir, 'Extensions');
+  const linkedPath = linkedExtensionPathForDir(cursorExtensionsDir);
+  const sentinelPath = join(linkedPath, 'sentinel.txt');
+
+  await mkdir(linkedPath, { recursive: true });
+  await writeFile(sentinelPath, 'keep incomplete bytes\n', 'utf8');
+
+  try {
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir,
+        extensionInstallPath,
+        cursorExtensionsDir,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        fetchHealth: async () => ({ ok: false, healthy: false }),
+      }),
+      /Service health check failed/,
+    );
+
+    assert.equal(await readFile(sentinelPath, 'utf8'), 'keep incomplete bytes\n');
+    assert.equal(await readTrialRecord(fixture.appPath, { trialRecordDir }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('failed link operation removes partially-created linked extension bytes', async () => {
+  const fixture = await createFixtureApp();
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+  const cursorExtensionsDir = join(fixture.tempDir, 'Extensions');
+  const linkedPath = linkedExtensionPathForDir(cursorExtensionsDir);
+
+  try {
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir,
+        extensionInstallPath,
+        cursorExtensionsDir,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        linkExtensionBundle: async () => {
+          await mkdir(join(linkedPath, 'dist'), { recursive: true });
+          await writeFile(join(linkedPath, 'package.json'), JSON.stringify({ name: 'partial' }), 'utf8');
+          await writeFile(join(linkedPath, 'dist/extension.js'), 'partial\n', 'utf8');
+          throw new Error('synthetic link failure');
+        },
+      }),
+      /synthetic link failure/,
+    );
+
+    assert.equal(await getLinkedExtensionState(linkedPath), 'missing');
+    assert.equal(await readTrialRecord(fixture.appPath, { trialRecordDir }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});
+
+test('failed bundle operation restores pre-existing extension bundle bytes', async () => {
+  const fixture = await createFixtureApp();
+  const trialRecordDir = join(fixture.tempDir, 'trials');
+  const extensionInstallPath = join(fixture.tempDir, 'extensions/cursor-pool-status');
+  const sentinelExtensionContent = 'module.exports = { sentinel: "bundle-failure" };\n';
+  await mkdir(join(extensionInstallPath, 'dist'), { recursive: true });
+  await writeFile(join(extensionInstallPath, 'package.json'), JSON.stringify({ name: 'sentinel' }), 'utf8');
+  await writeFile(join(extensionInstallPath, 'dist/extension.js'), sentinelExtensionContent, 'utf8');
+
+  try {
+    await assert.rejects(
+      install({
+        appPath: fixture.appPath,
+        runtimeFile: fixture.runtimeFile,
+        backupDir: fixture.backupDir,
+        trialRecordDir,
+        extensionInstallPath,
+        compatEntries: [fixture.compatEntry],
+        stopServiceAfterInstall: true,
+        bundleExtension: async () => {
+          await rm(extensionInstallPath, { recursive: true, force: true });
+          throw new Error('synthetic bundle failure');
+        },
+      }),
+      /synthetic bundle failure/,
+    );
+
+    assert.equal(
+      await readFile(join(extensionInstallPath, 'dist/extension.js'), 'utf8'),
+      sentinelExtensionContent,
+    );
+    assert.equal(await readTrialRecord(fixture.appPath, { trialRecordDir }), null);
+  } finally {
+    await rm(fixture.tempDir, { recursive: true, force: true });
+  }
+});