refactor: remove legacy API compatibility paths

[ScriptedAlchemy]

Summary

Remove deprecated compatibility APIs after migrating every in-repository caller. Package versions now come only from package.json, generated MCP tools use direct defineTool(...) definitions, and runtime consumers use Agent Documents/projectors instead of the removed JSX lowerers.

Removal matrix

Removed item	Callers migrated to	Deleted surface
plugin.version	package.json.version in examples, fixtures, benchmarks, Workbench tests, integration tests, and packed consumers	Config key and mismatch diagnostic AB4008; AB4001 now rejects the retired key so un-typechecked configs cannot silently ignore it; resolvePluginVersion deleted
Split MCP tool exports	Direct export default defineTool({ inputSchema, resultSchema, ... }, handler) definitions	Tool config/execute/render split contract
Install --force alias	--replace for installation	agent-bundle install <host> --force and standalone installer install-mode alias
ServedApp	ServedMcpApp	Public type alias
Generated CLI isTty callbacks	Explicit terminal or process probing	RunGeneratedCliOptions.isTty and RunGeneratedRenderedScriptOptions.isTty
Project-root MCP App templates	Route-relative templates	Project-root fallback and ambiguous resolution branch; AB4827 now names the route-relative path
Runtime JSX lowerers/context	Agent Document rendering/projectors and request-scoped agent()	Hook, Mcp, lowerHookResult, NativePostToolUseOutput, lowerMcpResult, createRscRequestContext, RscRequestContext
AgentDocumentSnapshot	AgentDocument	Public type alias and downstream annotations
React <=18 markdown branches	React 19 element/context contracts	Legacy element symbol, provider symbol, and secret-internals fallback
Internal compatibility aliases	Canonical names/subscriptions	McpAppHostProfile, PlaygroundStore, McpConfigDownload, Workbench feature aggregate and ProjectClient.connect(..., onEvent)

Kept with justification

• Install receipt format-1 parsing, receipt-less legacy ownership detection, and uninstall --force: required to safely inspect, upgrade, or remove on-disk installs without deleting foreign data.
• State/notice migration and persisted Agent Document parsing: required to replay and upgrade existing on-disk state while preserving strict validation.
• JSON snapshot bounds, redaction placeholders, parent/origin checks, path containment, and generated-module authority checks: trust-boundary and AGENTS.md-protected invariants, not API compatibility shims.
• AB4001 as a retired-key error only: config loading does not run tsc, so this guard prevents a lingering plugin.version from being silently ignored; it does not restore authored-version behavior.

Independent review

Fable change-risk-reviewer: one medium and two low findings.

• Fixed: silent plugin.version ignore. Any own retired key now fails closed with AB4001; test, changeset, diagnostics source, and en/zh docs agree.
• Fixed: stale public InstallBundleOptions.replace JSDoc no longer advertises install --force.
• Not changed (low): the removed multi-server tool recipe is optional documentation, not a behavior or migration gap; canonical defineTool authoring remains documented in both locales.
• Follow-up review found no new material findings.

Verification

Final tip 5a4ae0a782afca3e264b42c07a7c3f3866ce074f, rebased on current origin/main:

• pnpm build && pnpm typecheck && pnpm lint && pnpm test:unit — pass (307 files; 4,458 tests, 4,452 passed, 6 skipped)
• pnpm test:integration — pass (104 files; 1,185 tests, 1,181 passed, 4 skipped)
• pnpm check:release:ci — pass (packed pool: 16 files; 47 tests, 46 passed, 1 skipped; package/declaration checks passed)
• pnpm docs:site:build — pass (0 locale drift failures, diagnostics coverage complete, 0 broken links across 30,527 anchors)
• IDE diagnostics on reviewed files — none

[changeset-bot]

🦋 Changeset detected

Latest commit: 19ab901

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
agent-bundle	Minor
@agent-bundle/runtime	Minor
rsc-markdown-stream	Minor
create-agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T10:23:43.622005Z	d4c2a11	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@810

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@810

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@810

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@810

commit: 19ab901