fix: migrate Codex plugin cache to personal namespace

[spa5k]

Why

tracedecay install --agent codex could leave an existing Codex plugin install in the old caveman-home marketplace namespace. That made the documented command codex plugin add tracedecay@personal fail even though tracedecay@caveman-home was installed, and it also meant rerunning the TraceDecay installer did not refresh that installed Codex cache.

While checking the current Codex and Cursor plugin specs, the Cursor bundle also had a metadata gap: the Cursor command template/validator expects native command files to carry both name and description frontmatter, but our Cursor command overlays only had descriptions.

What Changed

Codex plugin migration

• Canonicalizes generated Codex marketplace metadata to personal / Personal, so the documented tracedecay@personal namespace resolves consistently.
• Teaches Codex install/update discovery to scan legacy .codex/plugins/cache/caveman-home/tracedecay installs as refresh candidates.
• Refreshes/migrates detected legacy caches into .codex/plugins/cache/personal/tracedecay/<version> while keeping the existing TraceDecay-owned directory safety checks.
• Updates the README and user guide to describe install-driven source/cache refresh behavior.

Cursor plugin spec alignment

• Adds displayName and category to the Cursor plugin manifest, matching current Cursor template metadata guidance while staying within the official schema.
• Updates Cursor bundle assertions so install/render tests expect that documented manifest metadata.
• Adds name frontmatter to every Cursor native slash command.
• Extends the Cursor command lint so command frontmatter must include a slug-matching scalar name and a non-empty scalar description.

Release note

• Adds a patch changeset for the Codex namespace migration, install/update refresh behavior, and Cursor metadata alignment.

Spec Checks

• OpenAI Codex manual: Build plugins, Plugins, MCP, and Hooks sections.
• Cursor official cursor/plugins schemas: live plugin.schema.json and marketplace.schema.json match the vendored fixtures.
• Cursor plugin-template validator/docs: command files require name and description frontmatter.

Validation

Previously run for the Codex migration:

• cargo fmt
• cargo check
• cargo test --test agent_suite test_codex_install_migrates_legacy_caveman_home_cache_and_marketplace
• cargo test --test agent_suite codex_update_plugin_migrates_legacy_caveman_home_cache_to_personal
• cargo test --test agent_suite codex_install_refreshes_existing_cache
• cargo test --test agent_suite codex_update_plugin_refreshes_cache_and_keeps_bootstrap_source_listable
• cargo test --test agent_suite codex_update_plugin_recreates_bootstrap_source_from_cache_only_state
• cargo test --test agent_suite codex_update_plugin_repairs_personal_marketplace_for_bootstrap_bundle
• cargo test --test agent_suite test_codex_local_install_creates_repo_plugin_bundle_and_marketplace

Run after the Cursor/Codex spec audit:

• cargo fmt
• cargo test --test agent_suite cursor_bundle_manifest_matches_the_official_cursor_plugin_schema
• cargo test --test agent_suite cursor_commands_are_hygienic_and_reference_resolve
• cargo test --test agent_suite cursor_install_renders_structurally_valid_bundle
• cargo test --test agent_suite codex_bundle_manifest_matches_the_cursor_schema_plus_interface_extension

Run after review feedback:

• cargo fmt
• git diff --check
• cargo test --test agent_suite test_cursor_install_creates_plugin
• cargo test --test agent_suite cursor_install

Reviewer Notes

• Cursor schema fixtures did not need to change; they already match the current upstream Cursor schemas.
• The Codex cache migration still only touches directories whose plugin manifest identifies them as TraceDecay-owned.
• The review comment about assert_cursor_plugin_bundle is addressed by expecting the new Cursor manifest metadata.

[changeset-bot]

🦋 Changeset detected

Latest commit: f7f3c81

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[spa5k]

@codex review it

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c79c54a4f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update Cursor bundle tests for displayName

Adding displayName here makes every Cursor install/render test that calls assert_cursor_plugin_bundle fail, because that helper still asserts manifest.get("displayName").is_none() with the message that displayName must not reappear (tests/agent_suite/agent_test.rs:500-504). In any test path that copies or installs the Cursor bundle, the rendered manifest now includes this field, so the agent suite will reject the intended schema update until the assertion is updated or removed.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 153f27f472

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve existing marketplace identity

Codex uses the marketplace name as the $MARKETPLACE_NAME cache namespace, so running install_codex_marketplace_entry against an existing personal marketplace that also contains non-TraceDecay plugins now rewrites all of those entries from their current namespace to personal (the previous code only filled this field when it was missing). This migration only needs to repair the legacy TraceDecay caveman-home marketplace; clobbering arbitrary marketplace metadata can make unrelated local plugins appear under a different marketplace/cache identity.

Useful? React with 👍 / 👎.