fix(install): roll back a marketplace this install created when the plugin install fails; exact standalone marketplace plans

- install: when marketplace add succeeded but plugin install / receipt write fails, remove the marketplace this run registered (its claim lived only in memory); a pre-existing marketplace is never touched
- install.mjs --uninstall --mode marketplace --plan names the receipt store, marketplaces root, and agent-bundle namespace it would prune, matching the completed run

Author: ScriptedAlchemy

packages/agent-bundle/src/install/install.ts

@@ -669,14 +669,36 @@ const installPublicCli = async (
     'add',
     identity.bundleRoot,
   ]);
-  await runHostCommand(runner, identity, host, host === 'claude'
-    ? ['plugin', 'install', id, '--scope', scope]
-    : ['plugin', 'add', id]);
-  await writeStoredInstallReceipt(receiptPath, createInstallReceipt({
-    ...recorded,
-    inventory: storeInventory,
-    updatedAt: new Date().toISOString(),
-  }));
+  // Between `marketplace add` and the receipt write, a marketplace this run created is claimed only in memory.
+  // If the plugin install or the receipt write fails there, roll the registration back rather than leave a
+  // marketplace nothing records: a retry would then sample it as pre-existing, record only the plugin, and
+  // `uninstall` would retain it as user-owned forever.
+  const createdMarketplace = previousReceipt === undefined &&
+    recorded.registrations.some((registration) => registration.kind === `${host}-marketplace`);
+  try {
+    await runHostCommand(runner, identity, host, host === 'claude'
+      ? ['plugin', 'install', id, '--scope', scope]
+      : ['plugin', 'add', id]);
+    await writeStoredInstallReceipt(receiptPath, createInstallReceipt({
+      ...recorded,
+      inventory: storeInventory,
+      updatedAt: new Date().toISOString(),
+    }));
+  } catch (error) {
+    if (!createdMarketplace) throw error;
+    try {
+      await runHostCommand(runner, identity, host, publicHostMarketplaceRemoveArguments(marketplace), 'removal');
+    } catch (rollbackError) {
+      throw failure(
+        'AB7004',
+        `${errorMessage(error)} Rolling back the marketplace this install registered also failed: ` +
+          `${errorMessage(rollbackError)}. Marketplace ${marketplace} is registered with ${host} but no receipt records it; ` +
+          `run \`${host} ${publicHostMarketplaceRemoveArguments(marketplace).join(' ')}\` before retrying.`,
+        host,
+      );
+    }
+    throw error;
+  }
   // The receipt lands before the load verdict: the host did install the copy, so a refused one stays
   // receipt-owned and `uninstall` removes it without --force.
   if (host === 'claude') {

packages/agent-bundle/src/install/surface.ts

@@ -507,7 +507,19 @@ const cursorUninstallerSource = (): readonly string[] => [
   '      console.log(`  1. Open Cursor, then Customize -> Plugins, and uninstall "${pluginName}" (marketplace ${pluginName}-marketplace) there.`);',
   '    }',
   '  };',
-  "  if (plan) { summary('Would uninstall'); finish('Would uninstall', directories); process.exit(0); }",
+  '  if (plan) {',
+  '    // The plan names exactly what the run would prune: each parent below is removed only once every entry in it is gone.',
+  '    const gone = new Set([...files, ...directories]);',
+  '    const prunable = [];',
+  "    for (const directory of [receiptsRoot, marketplaceRoot, join(cursorRoot, 'agent-bundle')]) {",
+  '      let entries;',
+  "      try { entries = await readdir(directory); } catch (error) { if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') continue; throw error; }",
+  '      if (entries.every((entry) => gone.has(join(directory, entry)))) { gone.add(directory); prunable.push(directory); }',
+  '    }',
+  "    summary('Would uninstall');",
+  "    finish('Would uninstall', [...directories, ...prunable]);",
+  '    process.exit(0);',
+  '  }',
   '  if (repoExists) await rm(marketplaceRepo, { force: true, recursive: true });',
   '  for (const path of files) await rm(path, { force: true });',
   '  const pruned = [...directories];',

packages/agent-bundle/tests/install-surface.test.ts

@@ -799,6 +799,25 @@ it('emitted install.mjs --uninstall mirrors the core lifecycle: plan, receipt-ow
     const marketplaceUninstalled = await run(installer, ['--uninstall', '--mode', 'marketplace'], home);
     expect(marketplaceUninstalled).toMatchObject({ code: 0, stderr: '' });
     expect(marketplaceUninstalled.stdout).toContain('Registration cursor-marketplace-staging install-fixture-marketplace: removed');
+    // The plan is exact: this was the last staged marketplace and store receipt, so the run prunes the receipt
+    // store, the marketplaces root, and the agent-bundle namespace — and the plan already named every one of them.
+    const pathLines = (stdout: string, label: string): string[] => {
+      const lines = stdout.split('\n');
+      const start = lines.findIndex((line) => line.startsWith(label));
+      const listed: string[] = [];
+      for (const line of lines.slice(start + 1)) {
+        if (!line.startsWith('  ')) break;
+        listed.push(line.trim());
+      }
+      return listed.sort();
+    };
+    const plannedDirectories = pathLines(marketplacePlan.stdout, 'Would remove directory');
+    expect(plannedDirectories).toEqual(pathLines(marketplaceUninstalled.stdout, 'Removed directory'));
+    expect(plannedDirectories).toEqual(expect.arrayContaining([
+      join(cursorRoot, 'agent-bundle', 'receipts'),
+      join(cursorRoot, 'agent-bundle', 'marketplaces'),
+      join(cursorRoot, 'agent-bundle'),
+    ]));
     expect(marketplaceUninstalled.stdout).toContain('Data (keep): unavailable');
     expect(diffTreeSnapshots(before, await snapshotTree(home))).toEqual({ added: [], changed: [], removed: [] });
     expect((await run(installer, ['--uninstall', '--mode', 'marketplace'], home)).stdout).toContain('Not installed install-fixture@1.2.3 for cursor (marketplace mode)');

packages/agent-bundle/tests/install.test.ts

@@ -256,6 +256,57 @@ it.each([
     await rm(receiptPath);
     await installBundle({ ...isolated(fixture), commandRunner: unreadable.runner, from: fixture.from, host, scope });
     expect((await readInstallReceiptFile(receiptPath))?.registrations.map((registration) => registration.kind)).toEqual([`${host}-plugin`]);
+
+    // `marketplace add` succeeded but the plugin install failed: the marketplace this run created is claimed only
+    // in memory, so it is rolled back rather than left registered with no receipt (a retry would otherwise sample it
+    // as pre-existing, record only the plugin, and `uninstall` would retain it as user-owned forever).
+    await rm(receiptPath);
+    const installVerb = host === 'claude' ? 'plugin install' : 'plugin add';
+    const failing: CommandCall[] = [];
+    const rolledBack = await installBundle({
+      ...isolated(fixture),
+      commandRunner: { run: async (command, args, runOptions) => {
+        const call = { args: [...args], command, cwd: runOptions.cwd };
+        failing.push(call);
+        if (isMarketplaceListCall(call)) return { code: 0, stderr: '', stdout: noMarketplaces(call) };
+        return args.join(' ').startsWith(installVerb)
+          ? { code: 1, stderr: 'install exploded', stdout: '' }
+          : { code: 0, stderr: '', stdout: '' };
+      } },
+      from: fixture.from,
+      host,
+      scope,
+    }).catch((failure: unknown) => failure);
+    expect(rolledBack).toBeInstanceOf(DiagnosticError);
+    expect((rolledBack as DiagnosticError).diagnostics[0]).toMatchObject({ code: 'AB7004', target: host });
+    expect((rolledBack as DiagnosticError).diagnostics[0]?.message).toContain('install exploded');
+    expect(failing.map((call) => call.args.join(' ')).slice(-2)).toEqual([
+      `${installVerb} install-fixture@install-fixture-marketplace${host === 'claude' ? ` --scope ${scope}` : ''}`,
+      'plugin marketplace remove install-fixture-marketplace',
+    ]);
+    expect(await readInstallReceiptFile(receiptPath)).toBeUndefined();
+
+    // A marketplace that pre-existed the install is not this run's to roll back.
+    const preExisting: CommandCall[] = [];
+    await installBundle({
+      ...isolated(fixture),
+      commandRunner: { run: async (command, args, runOptions) => {
+        const call = { args: [...args], command, cwd: runOptions.cwd };
+        preExisting.push(call);
+        if (isMarketplaceListCall(call)) {
+          return { code: 0, stderr: '', stdout: host === 'claude'
+            ? JSON.stringify([{ name: 'install-fixture-marketplace' }])
+            : JSON.stringify({ marketplaces: [{ name: 'install-fixture-marketplace', root: '/elsewhere' }] }) };
+        }
+        return args.join(' ').startsWith(installVerb)
+          ? { code: 1, stderr: 'install exploded', stdout: '' }
+          : { code: 0, stderr: '', stdout: '' };
+      } },
+      from: fixture.from,
+      host,
+      scope,
+    }).catch(() => undefined);
+    expect(preExisting.map((call) => call.args.join(' '))).not.toContain('plugin marketplace remove install-fixture-marketplace');
   } finally {
     await rm(fixture.cleanupRoot, { force: true, recursive: true });
   }