refactor(agent-bundle): move test-only host-contract smoke harnesses to tests/support (#655)

* refactor(agent-bundle): move test-only host-contract smoke harnesses to tests/support

* Keep strict semver token boundary; name removed type in changeset; fix stale audit path

* Reject four-component version tokens instead of reinterpreting the tail

Author: ScriptedAlchemy

.changeset/ponytail-host-contract-tests.md

@@ -0,0 +1,5 @@
+---
+"agent-bundle": minor
+---
+
+Remove the test-only host-contract smoke harness from `agent-bundle/api`: `evaluateHostContract`, `compareInstalledHostContract`, `compareLocalHostContract`, `parseHostContractManifest`, `parseRedactedEventEnvelopes`, `nativeHostContractComparisonEnabled`, and their `HostContract*`, `CompareInstalledHostContractOptions`, `NativeHost`, and `RedactedEventEnvelope` types are no longer exported; the native Claude and Codex host proofs (`runNativeClaudeSmoke`, `runCodexNativeSmoke`, …) now live in the test suite. (#655)

docs/audits/2026-09-03-claude-live-session-proofs.md

@@ -83,8 +83,8 @@ is reproduced here beyond counts, codes, and field names.
    `normalHome: 'settings-and-plugins-unchanged'`; `packed-native-smoke.test.ts`
    gained a unit test that a `.claude.json` rewrite passes while a
    `settings.json` or `plugins/` change fails.
-3. **`runNativeClaudeSmoke` (product code,
-   `packages/agent-bundle/src/host-contracts/native-claude-contract.ts`) has
+3. **`runNativeClaudeSmoke` (then product code at
+   `packages/agent-bundle/src/host-contracts/native-claude-contract.ts`, since moved to `packages/agent-bundle/tests/support/native-claude-smoke.ts`) has
    the same guard** and therefore cannot pass on Claude Code 2.1.257: its
    `snapshotClaudeNormalHome` digests `.claude.json` (`claudeJson`) beside
    `config.json`, `settings.local.json`, `plugins/`, and `settings.json`, and

packages/agent-bundle/src/api.ts

@@ -287,30 +287,6 @@ import {
 import { runWithPlatform, withTempDirectory } from './effect/platform.ts';
 import { liftPromise } from './effect/lift.ts';
 
-export {
-  compareInstalledHostContract,
-  compareLocalHostContract,
-  evaluateHostContract,
-  nativeHostContractComparisonEnabled,
-  parseHostContractManifest,
-  parseRedactedEventEnvelopes,
-} from './host-contracts/host-contract.ts';
-export type {
-  CompareInstalledHostContractOptions,
-  HostContractCommand,
-  HostContractCommandResult,
-  HostContractCommandRunner,
-  HostContractDiagnostic,
-  HostContractEvidence,
-  HostContractHelpProbe,
-  HostContractManifest,
-  HostContractProbe,
-  HostContractProbeKind,
-  HostContractReport,
-  HostContractStatus,
-  NativeHost,
-  RedactedEventEnvelope,
-} from './host-contracts/host-contract.ts';
 export { validateClaudePlugin, validateCodexPlugin, validateCursorPlugin, validatePortablePlugin };
 export type {
   ClaudePluginValidationReport,

packages/agent-bundle/src/core/semver.ts

@@ -5,9 +5,9 @@ export interface SemanticVersion {
   readonly prerelease: boolean;
 }
 
-/** Finds the first semver-shaped token inside surrounding CLI banner text. */
+/** Finds the first semver-shaped token inside surrounding CLI banner text; a fourth dotted component disqualifies the token. */
 export const parseSemanticVersion = (value: string): SemanticVersion | undefined => {
-  const match = /(?:^|[^0-9])(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?:$|[^0-9])/u.exec(value);
+  const match = /(?:^|[^0-9.])(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?(?=$|[^0-9A-Za-z.-])/u.exec(value);
   if (match === null) return undefined;
   return Object.freeze({
     major: Number(match[1]),