Stop shipping a mock API to users, and stop fixtures being tidier than the real one

AGENTS.md

@@ -27,6 +27,8 @@ That file also holds `AWAITING_COVERAGE`: commands that were already mounted whe
 
 Run the suite with `pnpm --filter @prisma/cli test:e2e`. It needs `PRISMA_E2E_SERVICE_TOKEN` (and optionally `PRISMA_E2E_WORKSPACE_ID`) for a workspace you are willing to see resources created and deleted in; without them the suite skips. CI sets `PRISMA_E2E_REQUIRED=1`, which turns a missing credential into a failure rather than a silent skip.
 
+Unit tests may still mock, and should — error paths and edge cases belong there. Two rules keep those mocks honest. Give fixtures the id shapes the API really uses: `wksp_`-prefixed workspace ids in API responses, the bare form in credential claims and stored sessions, and the `proj_` / `db_` / `bkt_` prefixes on resources. And never write both sides of a comparison from one constant — if a test supplies the credential's workspace id and the API's, they must differ exactly as they differ in production. Where a fake API server is easier than mocking a client, `packages/cli/tests/helpers/fake-management-api.ts` starts one.
+
 Why this rule exists: `prisma-v8 project list` reported "No projects found." and exited 0 for a workspace holding 15 projects, and every project-scoped command was broken with it. The unit suite covered that command thoroughly and passed throughout, because its fixtures supplied both sides of every comparison — the credential's workspace id and the API's were the same hand-written string, while the real API returns a `wksp_` prefix that the credential does not carry. A test that writes both sides of a comparison can only confirm what its author already believed. Mocks are still the right tool for error paths and edge cases; they cannot tell you what the API actually returns.
 
 ## Pre-Commit Verification

packages/cli/e2e/agent.e2e.ts

@@ -0,0 +1,85 @@
+/**
+ * The agent commands install and report Prisma's skills for local
+ * coding agents. They touch no management API — they run the `skills`
+ * CLI and write files into the working directory — but they ship in the
+ * binary, so they get the same real happy path as everything else.
+ *
+ * Each runs in a throwaway working directory, so the files they write
+ * belong to the run and go with it.
+ */
+import { existsSync } from "node:fs";
+import path from "node:path";
+
+import { beforeAll, expect, it } from "vitest";
+
+import { describeCommand, session } from "./suite";
+
+interface StatusResult {
+  readonly skillsInstalled: boolean;
+  readonly skillsLockInstalled: boolean;
+  readonly skillsLockPath: string;
+  readonly statusScope: string;
+}
+
+interface OperationResult {
+  readonly operation: string;
+  readonly skills: { readonly status: string };
+}
+
+/** Shared so `status` can be asked before and after `install`, which is
+ *  what shows the install did something. */
+let workdir: string;
+let installedBefore: StatusResult | undefined;
+
+beforeAll(async () => {
+  const cli = await session();
+  workdir = await cli.workdir();
+  installedBefore = (await cli.run(["agent", "status"], { cwd: workdir }))
+    .envelope.result as StatusResult;
+});
+
+describeCommand("agent status", () => {
+  it("reports nothing installed in a fresh directory", async () => {
+    expect(installedBefore?.statusScope).toBe("project");
+    expect(installedBefore?.skillsInstalled).toBe(false);
+    expect(installedBefore?.skillsLockInstalled).toBe(false);
+    expect(installedBefore?.skillsLockPath).toBe("skills-lock.json");
+  });
+});
+
+describeCommand("agent install", () => {
+  it("installs the skills and writes the lock file", async () => {
+    const cli = await session();
+    const run = await cli.run(["agent", "install"], { cwd: workdir });
+    const result = run.envelope.result as OperationResult;
+
+    expect(result.operation).toBe("install");
+    expect(result.skills.status).toBe("installed");
+    // The command's own answer is not the whole story: the lock file it
+    // claims to write has to be there.
+    expect(existsSync(path.join(workdir, "skills-lock.json"))).toBe(true);
+
+    const after = (await cli.run(["agent", "status"], { cwd: workdir }))
+      .envelope.result as StatusResult;
+    expect(after.skillsLockInstalled).toBe(true);
+    expect(after.skillsInstalled).toBe(true);
+  });
+});
+
+describeCommand("agent update", () => {
+  it("updates the skills already installed", async () => {
+    const cli = await session();
+    // Its own directory and its own install: depending on the block
+    // above would make this pass or fail on test order, and a focused
+    // run would find an empty directory.
+    const cwd = await cli.workdir();
+    await cli.run(["agent", "install"], { cwd });
+
+    const run = await cli.run(["agent", "update"], { cwd });
+    const result = run.envelope.result as OperationResult;
+
+    expect(result.operation).toBe("update");
+    expect(result.skills.status).toBe("installed");
+    expect(existsSync(path.join(cwd, "skills-lock.json"))).toBe(true);
+  });
+});