refactor(transport): move shared host mechanics

[thymikee]

Summary

Move line framing, lazy Node HTTP/body mechanics, and constant-time secret comparison behind the private @agent-device/host-kit/transport port; move runtime-hint resolution into core and relocate daemon-client tests to their existing owner. Existing policy, errors, wire shape, and lazy CLI startup closure remain unchanged.

Closes #2139

Validation

Focused host-kit/core/CLI, daemon/remote/auth/upload, lifecycle/runtime/Metro, layering, Fallow, typecheck, build, package, and Node integration checks pass. The staged affected run reached 2,474 passing tests; 8 unrelated interaction/provider/gesture timing tests remain host-load-sensitive at their existing 5-second budgets.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.56 MB	2.55 MB	-9.2 kB
JS gzip	860.9 kB	857.5 kB	-3.4 kB
npm tarball	982.9 kB	979.6 kB	-3.3 kB
npm unpacked	3.40 MB	3.39 MB	-10.2 kB

npm unpacked components

Component	Base	Current	Diff
JS / dist source	2.72 MB	2.71 MB	-9.2 kB
Apple runner source/project	544.4 kB	543.4 kB	-1.0 kB
macOS helper source	54.8 kB	54.8 kB	0 B
Android helper artifacts	0 B	0 B	0 B
Other package files	46.0 kB	79.8 kB	+33.8 kB

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	28.7 ms	28.8 ms	+0.0 ms
CLI --help	76.1 ms	78.7 ms	+2.6 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/interactor.js	-2.0 kB	-613 B
dist/src/runtime4.js	-23 B	-10 B
dist/src/internal/daemon.js	-37 B	-7 B
dist/src/app-inventory-contract.js	-30 B	-6 B
dist/src/device-claim-conflict.js	+6 B	+5 B

Top changed packed files

Packed file	Base	Current	Diff
dist/src/ios-snapshot-engine.js	22.6 kB	0 B	-22.6 kB
dist/src/snapshot-state.js	5.5 kB	21.5 kB	+16.0 kB
dist/src/interactor.js	31.9 kB	29.9 kB	-2.0 kB
dist/src/rect-center.js	712 B	0 B	-712 B
dist/src/runtime-transport-hints.js	0 B	679 B	+679 B
dist/src/runtime-transport.js	679 B	0 B	-679 B
dist/apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/RunnerTests+Models.swift	9.8 kB	9.1 kB	-660 B
dist/src/android-input-ownership.js	4.6 kB	5.2 kB	+621 B
dist/src/runner-cache-metadata.js	9.9 kB	9.4 kB	-473 B
dist/apple/runner/AgentDeviceRunner/AgentDeviceRunnerUITests/RunnerTests+SnapshotCapturePlan.swift	31.5 kB	31.1 kB	-430 B

[thymikee]

Reviewed exact head 88b3f9e23e9b38a4c3697ae9aa653721d95083ab against corrected #2139 and ADR 0019. Clean verdict: shared line framing, lazy HTTP/body mechanics, and constant-time comparison now live behind the private @agent-device/host-kit/transport port; runtime-hint normalization moved to core; all current importers use the owning seams; no compatibility shim, public npm surface, eager node:http/node:https value import, or command/daemon policy leakage remains. Focused regression coverage is non-vacuous, all exact-head checks including native smoke are green, and package size is net lower. Ready for human review.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-01 17:45 UTC