skillrepo 3.2.0 → 4.1.0

package/src/test/commands/init.test.mjs

@@ -18,6 +18,7 @@ import { tmpdir } from "node:os";
 import { runInit } from "../../commands/init.mjs";
 import { readConfig } from "../../lib/config.mjs";
 import { CliError, EXIT_AUTH, EXIT_VALIDATION } from "../../lib/errors.mjs";
+import { AGENT_REGISTRY } from "../../lib/agent-registry.mjs";
 import { createMockServer } from "../e2e/mock-server.mjs";
 import { createCaptureStream } from "../helpers/capture-stream.mjs";
 import {
@@ -33,19 +34,48 @@ let serverUrl;
 let originalCwd;
 /** @type {import("../helpers/sandbox-home.mjs").HomeEnvSnapshot} */
 let originalHomeEnv;
+/** @type {Record<string, string | undefined>} */
+let originalDetectionEnv;
 let stdout;
 let stderr;
 const VALID_KEY = "sk_live_init_test";
 
+// Every env var the agent registry uses as a detection signal. The
+// init test runner inherits the developer's shell env, which on
+// machines running an agent (e.g., CLAUDECODE=1 inside Claude Code)
+// would otherwise pre-fire detection and silently change which
+// targets the picker auto-selects. Clearing these in setup() makes
+// every test deterministic.
+const DETECTION_ENV_VARS = Array.from(
+  new Set(
+    AGENT_REGISTRY.flatMap((entry) =>
+      entry.detectionSignals
+        .filter((s) => s.type === "env")
+        .map((s) => s.value),
+    ),
+  ),
+);
+
 async function setup() {
   sandbox = mkdtempSync(join(tmpdir(), "cli-cmd-init-"));
-  // init defaults to detecting IDEs in cwd. Create a `.claude/`
-  // marker so detection finds claudeCode and the command doesn't
-  // refuse for "no IDEs detected".
+  // The Phase 3 picker (#1236) pre-checks the Claude Code row when
+  // detection finds a Claude signal. Most existing tests rely on
+  // that pre-check landing → vendors include claudeCode → MCP /
+  // session-sync hooks fire. Create the `.claude/` marker so the
+  // existing tests' assumptions still hold; tests that need the
+  // empty-detection state strip it explicitly.
   mkdirSync(join(sandbox, "project", ".claude"), { recursive: true });
   mkdirSync(join(sandbox, "home"), { recursive: true });
   originalCwd = process.cwd();
   originalHomeEnv = captureHome();
+  // Snapshot every detection env var so a stray host-env var
+  // (e.g. CLAUDECODE=1 inside a Claude Code session) doesn't
+  // pre-fire a signal and skew the picker's auto-selection.
+  originalDetectionEnv = {};
+  for (const name of DETECTION_ENV_VARS) {
+    originalDetectionEnv[name] = process.env[name];
+    delete process.env[name];
+  }
   process.chdir(join(sandbox, "project"));
   setSandboxHome(join(sandbox, "home"));
   delete process.env.SKILLREPO_ACCESS_KEY;
@@ -63,6 +93,12 @@ async function teardown() {
   if (server) await server.stop();
   process.chdir(originalCwd);
   restoreHome(originalHomeEnv);
+  if (originalDetectionEnv) {
+    for (const name of DETECTION_ENV_VARS) {
+      if (originalDetectionEnv[name] === undefined) delete process.env[name];
+      else process.env[name] = originalDetectionEnv[name];
+    }
+  }
   if (sandbox) rmSync(sandbox, { recursive: true, force: true });
   server = null;
 }
@@ -139,9 +175,9 @@ describe("runInit — happy path", () => {
     assert.ok(Array.isArray(json.mcp.merged));
   });
 
-  it("respects --ide flag to override detection", async () => {
+  it("respects --agent flag to override detection", async () => {
     await runInit(
-      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--ide", "claude"],
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--agent", "claude"],
       { stdout, stderr },
     );
     const mcp = JSON.parse(readFileSync(join(process.cwd(), ".mcp.json"), "utf-8"));
@@ -224,31 +260,176 @@ describe("runInit — error paths", () => {
     );
   });
 
-  it("refuses with clear error when no IDE detected and no --ide flag", async () => {
-    // Remove the .claude marker that setup() created
+  it("non-interactive scenario: explicit --agent claude works in empty project", async () => {
+    // Remove the .claude marker — empty dir
     rmSync(join(process.cwd(), ".claude"), { recursive: true, force: true });
-    await assert.rejects(
-      () => runInit(
-        ["--key", VALID_KEY, "--url", serverUrl, "--yes"],
+    // With --agent claude, init should proceed even in an empty dir
+    await runInit(
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--agent", "claude"],
+      { stdout, stderr },
+    );
+    // And write the MCP config
+    assert.ok(existsSync(join(process.cwd(), ".mcp.json")));
+  });
+});
+
+// ── Phase 3 picker (#1236) ────────────────────────────────────────────
+
+describe("runInit — Phase 3 detection picker (#1236)", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("--yes + no detection signals → both default rows pre-checked → both targets configured", async () => {
+    // Spec rationale: "writing a few KB the user didn't strictly
+    // need is trivial; CI running init --yes on a fresh clone and
+    // writing nothing is broken automation." A fresh-clone --yes run
+    // must configure BOTH targets. Strip the .claude marker setup()
+    // creates so we land in the genuine no-detection state.
+    rmSync(join(process.cwd(), ".claude"), { recursive: true, force: true });
+    await runInit(
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--json"],
+      { stdout, stderr },
+    );
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.action, "initialized");
+    assert.ok(
+      json.vendors.includes("claudeCode"),
+      "Claude Code must be configured on a fresh-clone --yes run",
+    );
+    // Cohort vendors (anything that lives at .agents/skills/) must
+    // also be configured. We don't assert the full list because the
+    // registry is the source of truth — instead we assert at least
+    // one cohort vendor besides claudeCode.
+    const nonClaude = json.vendors.filter((v) => v !== "claudeCode");
+    assert.ok(
+      nonClaude.length > 0,
+      "cohort vendors must also be configured on a fresh-clone --yes run",
+    );
+  });
+
+  it("--yes + only Claude signal → only Claude row pre-checked → only claudeCode configured", async () => {
+    // setup() already creates .claude/, so the Claude row pre-checks
+    // and the cohort row does not. The picker auto-selects only the
+    // pre-checked rows under --yes.
+    await runInit(
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--json"],
+      { stdout, stderr },
+    );
+    const json = JSON.parse(stdout.text());
+    assert.deepEqual(
+      json.vendors,
+      ["claudeCode"],
+      "only the Claude Code target must be configured when only its signal fires",
+    );
+  });
+
+  it("--yes + only cohort signal → only cohort row pre-checked → cohort configured (no claudeCode)", async () => {
+    // Strip the .claude marker setup() creates and add a cohort
+    // signal instead — .cursor/ should fire the cohort row.
+    rmSync(join(process.cwd(), ".claude"), { recursive: true, force: true });
+    mkdirSync(join(process.cwd(), ".cursor"), { recursive: true });
+    await runInit(
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--json"],
+      { stdout, stderr },
+    );
+    const json = JSON.parse(stdout.text());
+    assert.ok(
+      !json.vendors.includes("claudeCode"),
+      "Claude Code must NOT be configured when only the cohort signal fires",
+    );
+    assert.ok(
+      json.vendors.includes("cursor"),
+      "cohort vendors must be configured when a cohort signal fires",
+    );
+  });
+
+  it("--yes + both signals → both rows pre-checked → both targets configured", async () => {
+    // setup() creates .claude/, add .cursor/ for cohort signal.
+    mkdirSync(join(process.cwd(), ".cursor"), { recursive: true });
+    await runInit(
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--json"],
+      { stdout, stderr },
+    );
+    const json = JSON.parse(stdout.text());
+    assert.ok(json.vendors.includes("claudeCode"));
+    assert.ok(json.vendors.includes("cursor"));
+  });
+
+  it("does not throw 'No agent targets detected' (the old refuse-branch is gone)", async () => {
+    // The pre-Phase-3 init refused with this error when no signal
+    // fired. Phase 3 deletes that branch entirely — fresh clones
+    // configure both targets. This test locks the deletion: even
+    // with no detection markers, init must NOT throw a validation
+    // error about agent detection.
+    rmSync(join(process.cwd(), ".claude"), { recursive: true, force: true });
+    await assert.doesNotReject(() =>
+      runInit(
+        ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--json"],
         { stdout, stderr },
       ),
-      (err) =>
-        err instanceof CliError &&
-        err.exitCode === EXIT_VALIDATION &&
-        /No IDEs detected/.test(err.message),
     );
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.action, "initialized");
   });
+});
 
-  it("headless CI scenario: explicit --ide claude works in empty project", async () => {
-    // Remove the .claude marker — empty dir
+// ── --agent none (skip placement) ─────────────────────────────────────
+
+describe("runInit — --agent none", () => {
+  beforeEach(setup);
+  afterEach(teardown);
+
+  it("skips first sync but still writes config + JSON summary", async () => {
+    // `--agent none` is the explicit "no placement writes" sentinel.
+    // Init's credential write, gitignore management, and MCP merge
+    // (which is a no-op for empty vendors via mergeMcpForVendors)
+    // still run; only step 7 is skipped. The library sync is the
+    // expensive network call — skipping it is the user's intent.
+    //
+    // We DON'T preconfigure a mock library response. If init were
+    // (incorrectly) calling the library endpoint, the mock server's
+    // default empty response would still let the test pass — that's
+    // why we also assert the readable success line.
+    await runInit(
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--agent", "none", "--json"],
+      { stdout, stderr },
+    );
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.action, "initialized");
+    assert.deepEqual(json.vendors, [], "vendors must be empty under --agent none");
+    // The synthesized sync summary uses fullSync=null to signal
+    // "the network call never ran" — same shape as the failure
+    // recovery path. Locking it here keeps that contract explicit.
+    assert.equal(json.sync.added, 0);
+    assert.equal(json.sync.updated, 0);
+    assert.equal(json.sync.removed, 0);
+    assert.equal(json.sync.fullSync, null);
+    // The session-sync hook is Claude-specific, so under --agent
+    // none (no Claude target, no --global) it must be skipped.
+    assert.equal(json.sessionSync.action, "not-applicable");
+  });
+
+  it("does NOT throw 'No agent targets detected' when --agent none is passed in an empty dir", async () => {
+    // Without --agent none, an empty dir would refuse with the
+    // "No agent targets detected" error. The `none` sentinel skips
+    // detection entirely — the user already told us what they want.
     rmSync(join(process.cwd(), ".claude"), { recursive: true, force: true });
-    // With --ide claude, init should proceed even in an empty dir
     await runInit(
-      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--ide", "claude"],
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--agent", "none", "--json"],
       { stdout, stderr },
     );
-    // And write the MCP config
-    assert.ok(existsSync(join(process.cwd(), ".mcp.json")));
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.action, "initialized");
+  });
+
+  it("config is persisted on disk after --agent none init", async () => {
+    await runInit(
+      ["--key", VALID_KEY, "--url", serverUrl, "--yes", "--agent", "none"],
+      { stdout, stderr },
+    );
+    const cfg = readConfig();
+    assert.equal(cfg.apiKey, VALID_KEY);
+    assert.equal(cfg.serverUrl, serverUrl);
   });
 });
 
@@ -640,9 +821,9 @@ describe("runInit — session sync (#884)", () => {
     assert.equal(json.sessionSync.path, null);
   });
 
-  it("skips session sync entirely when only non-Claude-Code IDEs are targeted (cross-PR review fix)", async () => {
+  it("skips session sync entirely when only non-Claude-Code agents are targeted (cross-PR review fix)", async () => {
     // Cross-PR review flagged: before this guard, a user running
-    // `skillrepo init --ide cursor` would get a Claude Code-specific
+    // `skillrepo init --agent cursor` would get a Claude Code-specific
     // SessionStart hook written to `.claude/settings.local.json`.
     // Cursor never reads that file, so the hook was silent useless
     // state that `skillrepo uninstall` later had to clean up.
@@ -651,7 +832,7 @@ describe("runInit — session sync (#884)", () => {
     // `claudeCode` is not in the resolved vendors list AND
     // `--global` is not passed. This test proves the skip fires.
     //
-    // Use --ide cursor to force vendors = ["cursor"]. Bypass the
+    // Use --agent cursor to force vendors = ["cursor"]. Bypass the
     // .claude/ auto-detection by creating .cursor/ instead.
     mkdirSync(join(process.cwd(), ".cursor"), { recursive: true });
     rmSync(join(process.cwd(), ".claude"), { recursive: true, force: true });
@@ -663,7 +844,7 @@ describe("runInit — session sync (#884)", () => {
         "--url",
         serverUrl,
         "--yes",
-        "--ide",
+        "--agent",
         "cursor",
         "--json",
       ],
@@ -686,17 +867,15 @@ describe("runInit — session sync (#884)", () => {
     );
   });
 
-  it("still installs session sync under --global even without claudeCode in vendors", async () => {
-    // INTENT: `--global` writes to `~/.claude/settings.local.json`,
-    // which IS Claude Code's user-wide settings path. A user who
-    // runs `skillrepo init --global` (even without `--ide claude`)
-    // is implicitly targeting Claude Code. The guard must allow
-    // this path so `--global` users still get auto-sync.
-    //
-    // Note: the setup() helper already creates `.claude/` in the
-    // project, which would normally push vendors to include
-    // claudeCode. Force vendors = ["cursor"] via --ide to exercise
-    // the "--global overrides vendors" branch.
+  it("does NOT install Claude SessionStart hook for --global --agent cursor", async () => {
+    // INTENT: the SessionStart hook is Claude Code-specific. Pre-#1249,
+    // `claudeTargeted` was `Boolean(flags.global) || vendors.includes("claudeCode")`
+    // because bare `--global` historically routed to Claude. After
+    // #1249's effectiveVendors fix preserves --agent under --global,
+    // `--global --agent cursor` legitimately targets Cursor only —
+    // installing a Claude hook the user never asked for is a bug.
+    // Manual E2E sweep on staging caught this regression; this test
+    // pins the corrected behavior.
     await runInit(
       [
         "--key",
@@ -705,7 +884,7 @@ describe("runInit — session sync (#884)", () => {
         serverUrl,
         "--yes",
         "--global",
-        "--ide",
+        "--agent",
         "cursor",
         "--json",
       ],
@@ -715,10 +894,298 @@ describe("runInit — session sync (#884)", () => {
     const json = JSON.parse(stdout.text());
     assert.equal(
       json.sessionSync.action,
+      "not-applicable",
+      "Claude SessionStart hook must NOT install for --global --agent cursor",
+    );
+    assert.equal(json.sessionSync.path, null);
+    // Critical: the user-wide settings.local.json file must NOT have
+    // been written. A Cursor-only --global user should never see a
+    // Claude-specific file materialize.
+    assert.ok(
+      !existsSync(join(sandbox, "home", ".claude", "settings.local.json")),
+      "~/.claude/settings.local.json must NOT be written for Cursor-only --global init",
+    );
+  });
+});
+
+// ── runInit — cohort SessionStart hooks (#1240) ────────────────────
+//
+// Sibling step to the Claude session-hook block above. These tests
+// exercise the cohort installer wired in init.mjs step 6 alongside
+// `installSessionSyncHook`. The cohort installer writes user-scope
+// hook configs for Cursor / Gemini CLI / Codex CLI / VS Code +
+// Copilot — every selected vendor with a non-null `agentHook` spec.
+//
+// HOME isolation is the load-bearing safety property: the cohort
+// hooks live at `~/.<vendor>/...` so a sandbox HOME leak would
+// pollute the developer's real home. The setupWithShim helper
+// already overrides HOME / USERPROFILE; that's the gate.
+
+describe("runInit — cohort SessionStart hooks (#1240)", () => {
+  beforeEach(setupWithShim);
+  afterEach(teardownWithShim);
+
+  it("writes cohort hooks for every selected non-Claude vendor with --yes --agent", async () => {
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini,codex,copilot",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const json = JSON.parse(stdout.text());
+    assert.ok(
+      Array.isArray(json.sessionSync.cohortHooks),
+      "sessionSync.cohortHooks must be an array",
+    );
+    assert.equal(json.sessionSync.cohortHooks.length, 4);
+    for (const r of json.sessionSync.cohortHooks) {
+      assert.equal(
+        r.action,
+        "installed",
+        `expected install for ${r.vendorKey}, got ${r.action}`,
+      );
+    }
+
+    // Each vendor's file landed on disk under the sandbox HOME
+    const home = join(sandbox, "home");
+    assert.ok(existsSync(join(home, ".cursor", "hooks.json")));
+    assert.ok(existsSync(join(home, ".gemini", "settings.json")));
+    assert.ok(existsSync(join(home, ".codex", "hooks.json")));
+    assert.ok(
+      existsSync(
+        join(home, ".copilot", "hooks", "skillrepo-update.json"),
+      ),
+    );
+  });
+
+  it("each cohort hook command is `npx --yes skillrepo update --silent`", async () => {
+    // INTENT: the universal command is the single source of truth.
+    // A future refactor that drifts one vendor's command out of sync
+    // breaks the round-trip uninstall via the shared fingerprint.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+      ],
+      { stdout, stderr },
+    );
+
+    const home = join(sandbox, "home");
+
+    const cursor = JSON.parse(
+      readFileSync(join(home, ".cursor", "hooks.json"), "utf-8"),
+    );
+    assert.equal(
+      cursor.hooks.sessionStart[0].command,
+      "npx --yes skillrepo update --silent",
+    );
+    assert.equal(cursor.version, 1);
+
+    const gemini = JSON.parse(
+      readFileSync(join(home, ".gemini", "settings.json"), "utf-8"),
+    );
+    const geminiHook = gemini.hooks.SessionStart[0].hooks[0];
+    assert.equal(geminiHook.command, "npx --yes skillrepo update --silent");
+    assert.equal(geminiHook.type, "command");
+    assert.equal(geminiHook.timeout, 60000);
+  });
+
+  it("--no-session-sync skips ALL cohort hooks (semantics widened in #1240)", async () => {
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+        "--no-session-sync",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const json = JSON.parse(stdout.text());
+    // No cohort hooks installed
+    assert.equal(json.sessionSync.cohortHooks.length, 0);
+
+    // Files do not exist
+    const home = join(sandbox, "home");
+    assert.ok(!existsSync(join(home, ".cursor", "hooks.json")));
+    assert.ok(!existsSync(join(home, ".gemini", "settings.json")));
+  });
+
+  it("re-running init is idempotent — exactly one cohort entry per vendor file", async () => {
+    const args = [
+      "--key", VALID_KEY,
+      "--url", serverUrl,
+      "--yes",
+      "--agent", "cursor,gemini",
+    ];
+    await runInit(args, { stdout, stderr });
+    stdout.clear();
+    await runInit([...args, "--json"], { stdout, stderr });
+
+    // Second run reports unchanged for every cohort vendor
+    const json = JSON.parse(stdout.text());
+    for (const r of json.sessionSync.cohortHooks) {
+      assert.equal(r.action, "unchanged", `${r.vendorKey} should be unchanged`);
+    }
+
+    // Cursor file has exactly one SkillRepo entry, not two
+    const home = join(sandbox, "home");
+    const cursor = JSON.parse(
+      readFileSync(join(home, ".cursor", "hooks.json"), "utf-8"),
+    );
+    const skillrepoEntries = cursor.hooks.sessionStart.filter((h) =>
+      h.command?.includes("skillrepo update --silent"),
+    );
+    assert.equal(skillrepoEntries.length, 1);
+  });
+
+  it("does NOT install cohort hooks for vendors not in the selected list", async () => {
+    // --agent cursor only → gemini/codex/copilot files must NOT exist
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const home = join(sandbox, "home");
+    assert.ok(existsSync(join(home, ".cursor", "hooks.json")));
+    assert.ok(!existsSync(join(home, ".gemini", "settings.json")));
+    assert.ok(!existsSync(join(home, ".codex", "hooks.json")));
+    assert.ok(
+      !existsSync(join(home, ".copilot", "hooks", "skillrepo-update.json")),
+    );
+
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.sessionSync.cohortHooks.length, 1);
+    assert.equal(json.sessionSync.cohortHooks[0].vendorKey, "cursor");
+  });
+
+  it("does NOT install cohort hooks for windsurf or cline (deferred per agent registry)", async () => {
+    // Windsurf and Cline are deliberately excluded from the cohort
+    // installer per the registry's `agentHook: null`. A user
+    // selecting them should get file-based skill placement but NO
+    // hook-config writes.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "windsurf,cline",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+
+    const home = join(sandbox, "home");
+    assert.ok(!existsSync(join(home, ".cline", "hooks.json")));
+    // Windsurf has no hook config file by spec
+    const json = JSON.parse(stdout.text());
+    assert.equal(json.sessionSync.cohortHooks.length, 0);
+  });
+
+  it("Copilot install surfaces a Preview-status warning to the user (#1244)", async () => {
+    // INTENT: GitHub currently labels Copilot's hook system as
+    // Preview. The init step-6 cohort flow adds a one-time `p.warning`
+    // when Copilot was among the installed vendors so a user knows
+    // the hook schema may shift before GA. This test locks the warning
+    // to the installed-Copilot path.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "copilot",
+      ],
+      { stdout, stderr },
+    );
+    assert.match(
+      stdout.text(),
+      /Copilot.*Preview/,
+      "Copilot's Preview-status caveat must surface on a successful copilot install",
+    );
+  });
+
+  it("Preview warning does NOT fire when Copilot is not selected", async () => {
+    // INTENT: the warning is Copilot-specific. Installing for cohort
+    // vendors WITHOUT Copilot must not surface the Preview note.
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+      ],
+      { stdout, stderr },
+    );
+    assert.doesNotMatch(
+      stdout.text(),
+      /Preview/,
+      "Preview warning is Copilot-specific and must NOT fire for cursor/gemini installs",
+    );
+  });
+
+  it("init JSON output's cohortHooks array reports per-vendor failures with reason (#1239 coverage gap 44)", async () => {
+    // INTENT: when a per-vendor cohort install fails (e.g. corrupt
+    // existing hook config), the failure must surface in
+    // `sessionSync.cohortHooks[].action === "failed"` with a `reason`
+    // field. Force a failure by pre-seeding Cursor's hook file with
+    // invalid JSON so the merger throws diskError.
+    const home = join(sandbox, "home");
+    mkdirSync(join(home, ".cursor"), { recursive: true });
+    writeFileSync(
+      join(home, ".cursor", "hooks.json"),
+      "{not valid json",
+    );
+
+    await runInit(
+      [
+        "--key", VALID_KEY,
+        "--url", serverUrl,
+        "--yes",
+        "--agent", "cursor,gemini",
+        "--json",
+      ],
+      { stdout, stderr },
+    );
+    const json = JSON.parse(stdout.text());
+
+    const cursorResult = json.sessionSync.cohortHooks.find(
+      (h) => h.vendorKey === "cursor",
+    );
+    assert.equal(
+      cursorResult.action,
+      "failed",
+      "cursor install must report failed when its config is corrupt",
+    );
+    assert.match(
+      cursorResult.reason,
+      /Cannot parse/,
+      "failure reason must be actionable (parse error mentions the file)",
+    );
+
+    // Critical: sibling vendor still installed despite cursor's failure
+    const geminiResult = json.sessionSync.cohortHooks.find(
+      (h) => h.vendorKey === "gemini",
+    );
+    assert.equal(
+      geminiResult.action,
       "installed",
-      "--global must install the hook even when vendors doesn't include claudeCode",
+      "Gemini install must succeed even when Cursor's failed (per-vendor isolation)",
     );
-    assert.equal(json.sessionSync.path, "~/.claude/settings.local.json");
   });
 });
 
@@ -1433,9 +1900,9 @@ describe("runInit — v3.1.2 step 6 auto-install (npx)", () => {
     assert.equal(parsed.sessionSync.action, "skipped");
   });
 
-  it("Branch 2: --ide cursor (non-Claude target) → spawn never called, action = not-applicable", async () => {
+  it("Branch 2: --agent cursor (non-Claude target) → spawn never called, action = not-applicable", async () => {
     // QA gap fix: previously had no test for the non-Claude branch.
-    // Even under npx, if the user targets a non-Claude IDE, the
+    // Even under npx, if the user targets a non-Claude agent, the
     // SessionStart hook (Claude-specific) is skipped without an
     // install offer.
     makeNpxArgv();
@@ -1451,7 +1918,7 @@ describe("runInit — v3.1.2 step 6 auto-install (npx)", () => {
         "--url",
         serverUrl,
         "--yes",
-        "--ide",
+        "--agent",
         "cursor",
         "--json",
       ],

package/src/test/commands/remove.test.mjs

@@ -178,7 +178,10 @@ describe("runRemove — happy path", () => {
   });
 
   it("--global removes from home dir", async () => {
-    writeSkillDir(makeSkill("alice", "pdf-helper"), { global: true });
+    writeSkillDir(makeSkill("alice", "pdf-helper"), {
+      global: true,
+      vendors: ["claudeCode"],
+    });
     const dir = resolvePlacementDir("claudeGlobal", "pdf-helper");
     assert.ok(existsSync(dir));