fix(dev): harden runtime relay against Rsbuild internals

[ScriptedAlchemy]

Summary

• make the Runtime App relay react only to the provider-emitted full-reload kind; private ok / hash and unknown frames are inert
• accept bounded public Rsbuild token strings with URLSearchParams, and proxy the encoded normalized dev.client.path instead of duplicating /rsbuild-hmr
• preserve legitimate MultiCompiler hook overlap while rejecting ambiguous identities, explicitly name Rspack compilers, remove the incidental provider-tail startup wait, and document the top upgrade-fragile assumptions
• preserve initial activation when a declaration reconcile races startup; add a patch changeset for the corrected dev-server behavior

Refs #72.

Conformance dispositions

• W1 / U1: fixed with a full-reload-only frame contract; deeper provider-owned channel tracked in Replace raw Rsbuild HMR frames with a provider-owned Runtime App reload channel #73
• U2: fixed with bounded string validation, percent encoding, and normalized environment HMR path propagation
• U3: hardened with missing/duplicate identity invariants while preserving observed overlapping hooks; completed-cohort rearchitecture tracked in Make completed MultiCompiler cohorts authoritative without FIFO hook identity #75
• U4: hardened with explicit compiler names, exact child assertions, serialized checkpoint capture, and upgrade comments; immutable per-environment staging tracked in Stage immutable per-environment outputs before assembling runtime cohorts #74
• U5: fixed by returning the documented compiling session state without treating providerTail as an initial-compile barrier; startup reconciliation now preserves the bootstrap generation

Test plan

• pnpm build
• pnpm typecheck
• pnpm --filter @agent-bundle/rsc-agent-runtime-demo typecheck
• pnpm lint
• pnpm test:unit (1,775 tests; 0 failed)
• runtime example suite passed before review (178 tests); after adding regressions, its only failure was unrelated fixed-port EADDRINUSE, and the focused test passed on the one permitted rerun
• runtime-playground-capture.test.ts with integration config + prebuilt flags (including compile-error recovery)
• runtime-playground.e2e.test.ts with integration config + prebuilt flags
• runtime-playground-hmr.e2e.test.ts with integration config + prebuilt flags

[changeset-bot]

🦋 Changeset detected

Latest commit: d91308b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T08:17:21.503573Z	b1f573d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@76

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@76

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/rsc-runtime@76

commit: d91308b

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b1f573dc5d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".