refactor(agent-bundle): move test-only host-contract smoke harnesses to tests/support

[ScriptedAlchemy]

Summary

packages/agent-bundle/src/host-contracts/ shipped ~1,600 lines that only the test suite called. Per AGENTS.md ("a module with no production importer is not delivered"), the test-only code moves under packages/agent-bundle/tests/support/ and the production surface shrinks to what production imports.

• host-contract.ts (586 lines) → tests/support/host-contract.ts. Its only non-test consumers were the api.ts re-export block (no docs, examples, or other source referenced any of those names) and normalizeCodexNativeSmokeEvents, which is itself test-only. The api.ts re-export block is removed: evaluateHostContract, compareInstalledHostContract, compareLocalHostContract, parseHostContractManifest, parseRedactedEventEnvelopes, nativeHostContractComparisonEnabled and the HostContract* / NativeHost / RedactedEventEnvelope types are no longer exported from agent-bundle/api.
• native-codex-contract.ts (539 → 31 lines): keeps withoutProviderApiKeys, copyOpaqueCodexAuthState, copyOpaqueCodexAuthStateProgram (used by eval/codex-home.ts and tests/effect-filesystem-phase2.test.ts). The smoke plan, executor, staging, classifier, SmokeStepError, and runCodexNativeSmoke move to tests/support/native-codex-smoke.ts.
• native-claude-contract.ts (843 → 175 lines): keeps createNativeClaudeCommand, createNativeClaudeChildEnvironment, runNativeClaudeProcess and its types, and parseClaudeVersion / formatClaudeVersion / isCompatibleClaudeVersion (used by eval/*). Stream normalization, normal-home digesting, and runNativeClaudeSmoke move to tests/support/native-claude-smoke.ts.
• parseClaudeVersion / isCompatibleClaudeVersion now delegate to core/semver.ts (parseSemanticVersion / meetsMinimumVersion) instead of carrying a private copy; the unused ClaudeVersion alias goes away in favour of SemanticVersion. core/semver.ts now keeps the old Claude parser's strict trailing boundary ((?=$|[^0-9A-Za-z.-])) on top of its +build support, and forbids a . before the token, so 2.1.232abc, 2.1.232.4, and 0.146.9.1 are all rejected instead of being reinterpreted; tests/core.test.ts pins these vectors.
• The moved Claude smoke digests the normal home with native-host-spine.ts's digestFileTree({ includeIdentity: true }), which has the same preimage as the private digestClaudeFileTree it replaces; the private isMissingExecutableError copy is replaced by the spine's export.
• Not done: core/runtime.ts parseRuntimeVersion / compareVersions are not delegated to core/semver.ts — they are anchored major.minor[.patch] parsers with an optional patch, no leading zeros, and a tuple return, so the semantics differ.

.github/workflows/native-host-smoke.yml still targets tests/native-claude-contract.test.ts and tests/native-codex-contract.test.ts; those files stay where they are and only their import path changed.

Validation

• pnpm build && pnpm typecheck && pnpm lint && pnpm test:unit — green (283 files, 4237 passed, 6 skipped).
• pnpm test:unit packages/agent-bundle/tests/native-claude-contract.test.ts packages/agent-bundle/tests/native-codex-contract.test.ts packages/agent-bundle/tests/host-contract.test.ts packages/agent-bundle/tests/effect-filesystem-phase2.test.ts packages/agent-bundle/tests/eval-codex-home.test.ts — 53 passed, 4 skipped (the opt-in nativeIt cases self-skip without the host CLI flag, as before).
• pnpm docs:site:build — green (public exports changed, so TypeDoc and language parity re-ran).
• Dead-module check: git grep -l for host-contract, native-claude-smoke, native-codex-smoke each resolve to a test importer; native-claude-contract / native-codex-contract keep their eval/* production importers.

Deslop

Deslop: Claude Fable 5.1, 3 edits (dropped the ClaudeVersion alias for SemanticVersion, aliased parseClaudeVersion = parseSemanticVersion instead of a wrapper lambda, removed the dead export type { NativeHost } re-export from the moved host-contract.ts).

Self-review

Reviewer: gpt-5.6-sol-medium (generalPurpose; TraceDecay daemon was down so change-risk-reviewer could not run). Three findings, all fixed:

1. parseClaudeVersion = parseSemanticVersion broadened parsing: 2.1.232abc newly passed and 2.1.232.4 changed from 1.232.4 to 2.1.232. Fixed — core/semver.ts now uses the stricter lookahead boundary the Claude parser had, while keeping +build metadata; added a vector test in tests/core.test.ts.
2. Changeset omitted the removed CompareInstalledHostContractOptions type. Fixed — named in the summary.
3. docs/audits/2026-09-03-claude-live-session-proofs.md:86 still called runNativeClaudeSmoke product code at its deleted src path. Fixed — notes the move to tests/support/native-claude-smoke.ts.

Second pass (same reviewer): the tightened trailing boundary let 0.146.9.1 backtrack to 146.9.1, which the Codex check would accept. Fixed — the leading boundary now also excludes ., so a four-component token is rejected outright; vectors added to tests/core.test.ts. Real claude --version / codex --version banners and v22.19.0-style prefixes still parse.

Third pass (same reviewer): no merge risks found.

[changeset-bot]

🦋 Changeset detected

Latest commit: 12ef50d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@655

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@655

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@655

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@655

commit: 78a435d

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.