refactor: remove legacy API compatibility paths

[ScriptedAlchemy]

Summary

Remove deprecated compatibility APIs after migrating every in-repository caller. Package versions now come only from package.json, generated MCP tools use direct defineTool(...) definitions, and runtime consumers use Agent Documents/projectors instead of the removed JSX lowerers.

Removal matrix

Removed item	Callers migrated to	Deleted surface
plugin.version	package.json.version in examples, fixtures, benchmarks, Workbench tests, integration tests, and packed consumers	Config key and mismatch diagnostic AB4008; AB4001 now rejects the retired key so un-typechecked configs cannot silently ignore it; resolvePluginVersion deleted
Split MCP tool exports	Direct export default defineTool({ inputSchema, resultSchema, ... }, handler) definitions	Tool config/execute/render split contract
Install --force alias	--replace for installation	agent-bundle install <host> --force and standalone installer install-mode alias
ServedApp	ServedMcpApp	Public type alias
Generated CLI isTty callbacks	Explicit terminal or process probing	RunGeneratedCliOptions.isTty and RunGeneratedRenderedScriptOptions.isTty
Project-root MCP App templates	Route-relative templates	Project-root fallback and ambiguous resolution branch; AB4827 now names the route-relative path
Runtime JSX lowerers/context	Agent Document rendering/projectors and request-scoped agent()	Hook, Mcp, lowerHookResult, NativePostToolUseOutput, lowerMcpResult, createRscRequestContext, RscRequestContext
AgentDocumentSnapshot	AgentDocument	Public type alias and downstream annotations
React <=18 markdown branches	React 19 element/context contracts	Legacy element symbol, provider symbol, and secret-internals fallback
Internal compatibility aliases	Canonical names/subscriptions	McpAppHostProfile, PlaygroundStore, McpConfigDownload, Workbench feature aggregate and ProjectClient.connect(..., onEvent)

Kept with justification

• Install receipt format-1 parsing, receipt-less legacy ownership detection, and uninstall --force: required to safely inspect, upgrade, or remove on-disk installs without deleting foreign data.
• State/notice migration and persisted Agent Document parsing: required to replay and upgrade existing on-disk state while preserving strict validation.
• JSON snapshot bounds, redaction placeholders, parent/origin checks, path containment, and generated-module authority checks: trust-boundary and AGENTS.md-protected invariants, not API compatibility shims.
• AB4001 as a retired-key error only: config loading does not run tsc, so this guard prevents a lingering plugin.version from being silently ignored; it does not restore authored-version behavior.

Merge with main (after #808 and #818–#829)

#808 migrated the consumer side (examples) and explicitly left these framework removals to this PR, so nothing here is superseded.

• Textual conflicts resolved: generated-route-server.test.ts (ported feat: filter MCP tool inventory by negotiated client #820's excludeClients: ['codex'] from the removed split config export into the defineTool({...}) metadata, which reaches route.config unchanged), en/zh installation.mdx (kept fix(install): hash install.mjs destinations from files present #818's install.mjs hashing prose, dropped the removed install --force alias), and test import unions in route-caller-input-types.test.ts / workbench-surface-dev-server.test.ts (test: canonical removeTree helper and a lint gate on bare recursive rm #823 removeTree).
• Semantic conflicts resolved: new Emit repository-root marketplaces for committed GitHub artifacts #827/Preserve repository marketplaces during temporary builds #828 tests in api.test.ts and eval-harness.test.ts authored plugin.version; moved the version to package.json.

Independent review

GPT-5.6 Sol change-risk-reviewer on git diff origin/main...HEAD after the merge: no blocking findings.

• Fixed (medium): docs/framework-mode.md still taught the removed split tool contract; examples now use defineTool(...).
• Fixed (low): rsc-markdown-stream installDispatcher kept a React <=18 ReactCurrentDispatcher branch; it now uses React 19 H only.
• Verified the excludeClients port, the docs resolutions, the fixture migrations, and the single minor changeset. Follow-up review of the fix commit found no new material findings.

Earlier Fable review (pre-merge): the AB4001 retired-key guard and the InstallBundleOptions.replace JSDoc fixes were made; the optional multi-server recipe was left out.

Verification

Tip ee1d48595b, which contains current origin/main (b0b131bbf7):

• pnpm build, pnpm typecheck, pnpm lint: pass
• pnpm test:unit: pass (309 files; 4,477 tests, 4,471 passed, 6 skipped)
• pnpm test:integration (whole pool): pass (104 files; 1,187 tests, 1,183 passed, 4 skipped)
• pnpm check:release:ci (packed pool): pass (16 files; 47 tests, 46 passed, 1 skipped)
• pnpm docs:site:build: pass (0 locale drift, diagnostics coverage complete, 0 broken links across 30,539 anchors)
• rsc-markdown-stream tests: pass

Root verification verdict: PASS+NOTES on the merged commit 18a913e9d8

This PR merged at 01:58Z from head 89feb0fd9b, before the root reissued its verdict. The earlier verdict at 6fa35efa4a was ISSUES with three fix-before-merge items. All three are fixed on main:

1. .changeset/remove-legacy-apis.md now names the defineTool default-export rule and AB4810, the five removed @agent-bundle/runtime types, the dropped AgentBundlePluginConfig index signature, and the install.mjs --force exit.
2. rsc-markdown-stream is now a patch.
3. docs/diagnostics.md carries an AB4008 | retired row.

Outside .changeset/ and docs/diagnostics.md, the PR's patch on main (dd322cb647..18a913e9d8) is line-identical to the verified 6fa35efa4a patch. The PR does not touch pnpm-lock.yaml. So the earlier gate and live results carry over.

Lane	Model	Result
Gates at 6fa35efa4a, carried over	Grok 4.7 (commands only)	PASS. Unit, the whole integration pool, packed, and docs.
Live CLI at 6fa35efa4a, carried over	GPT-5.6 Sol	No removed path crashes. Every removed path except install --force fails with a named diagnostic. install --force fails with a generic unknown-option error.
Diff audit at 6fa35efa4a, carried over	Claude Fable 5.1	PASS+NOTES on code.
Full local gate on main 18a913e9d8, which also contains #815, #837, and #838	root	PASS. build, typecheck, lint, test:unit (4475 passed), the whole integration pool (1183 passed), and docs:site:build (0 broken links). No semantic conflict with the PRs that landed underneath.

Still open, follow-up material:

• agent-bundle install <host> --force prints only error: unknown option '--force'. The changeset tells upgraders to use --replace, but the CLI message does not.

Final merge with main and gate (head 89feb0fd9b)

Merged origin/main dd322cb647 (#837, #838, #830, #815) cleanly; no conflicts.

Local gate on merge 398e76ca9f (later commits change only docs/diagnostics.md and the changeset):

• pnpm install --frozen-lockfile, pnpm build, pnpm typecheck, pnpm lint: pass
• pnpm test:unit: pass (4,475 passed, 6 skipped)
• Integration, modules touched by the new main commits (emitted-artifact-effect-surface, generated-route-server, route-invocation-dev-server, notices-sqlite-cross-process, state-packaging, state-sqlite-cross-process, mcp-app-preview-browser): pass (42/42)
• examples/rsc-agent-runtime pnpm check (validate, build, typecheck, tests, route tests): pass (170 + 3)
• pnpm docs:site:build: pass (0 broken links across 30,539 anchors)
• After the docs/changeset commits: check-diagnostics-coverage (all codes documented), check-locale-drift (0), diagnostics-doc-targets test, changeset status: pass

Root verdict items resolved:

1. Changeset now names the defineTool default-export requirement and AB4810, the removed runtime Mcp*Props and RscRequestContext types, the dropped AgentBundlePluginConfig index signature, install.mjs --force exiting 2, and AB4827.
2. rsc-markdown-stream is now patch (no export removed; react peer was already ^19).
3. docs/diagnostics.md keeps AB4008 as a retired row.

• Should-fix --force hint: not added; the owner rule for this PR is no leftover compatibility path for the removed alias.

Independent review (Claude Opus 5.5 change-risk-reviewer, whole PR plus merges): no material risks; its two optional findings (AB4008 retired row, name AB4827) are fixed above.

[changeset-bot]

🦋 Changeset detected

Latest commit: 89feb0f

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
agent-bundle	Minor
@agent-bundle/runtime	Minor
rsc-markdown-stream	Patch
create-agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T10:23:43.622005Z	d4c2a11	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@810

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@810

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@810

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@810

commit: 6fa35ef