refactor(move): move the daemon proxy into @agent-device/proxy

Moves the proxy that backs `agent-device proxy` out of src/remote into a
private workspace package so a later change can publish it for gateways.
Health-only host helpers load on the first /health request to keep the
package entry within the domain-facade eager-closure ceiling.

Author: thymikee

package.json

@@ -175,7 +175,7 @@
     "check:unit": "pnpm test:unit && pnpm check:tmpdir-leaks && pnpm test:smoke",
     "check": "pnpm check:tooling && pnpm check:fallow && pnpm check:unit",
     "prepack": "pnpm check:mcp-metadata && pnpm package:npm",
-    "typecheck": "tsc -b packages/xml packages/kernel packages/contracts packages/device-selection packages/host-kit packages/capture-kit packages/managed-allocation packages/provision-kit packages/platform-apple packages/platform-android packages/platform-harmonyos packages/platform-vega packages/platform-linux packages/platform-web packages/ad-script packages/selectors packages/command-registry packages/session-journal packages/ad-replay packages/maestro packages/replay-port packages/replay-test packages/provider-webdriver packages/provider-limrun && tsc -p tsconfig.json && tsc -p examples/sdk/tsconfig.json",
+    "typecheck": "tsc -b packages/xml packages/kernel packages/contracts packages/device-selection packages/host-kit packages/capture-kit packages/managed-allocation packages/provision-kit packages/platform-apple packages/platform-android packages/platform-harmonyos packages/platform-vega packages/platform-linux packages/platform-web packages/ad-script packages/selectors packages/command-registry packages/session-journal packages/ad-replay packages/maestro packages/replay-port packages/replay-test packages/provider-webdriver packages/provider-limrun packages/proxy && tsc -p tsconfig.json && tsc -p examples/sdk/tsconfig.json",
     "test-app:install": "pnpm install --dir examples/test-app",
     "test-app:start": "pnpm --dir examples/test-app start",
     "test-app:ios": "pnpm --dir examples/test-app ios",
@@ -302,6 +302,7 @@
     "@agent-device/provider-limrun": "workspace:*",
     "@agent-device/provider-webdriver": "workspace:*",
     "@agent-device/provision-kit": "workspace:*",
+    "@agent-device/proxy": "workspace:*",
     "@agent-device/replay-port": "workspace:*",
     "@agent-device/replay-test": "workspace:*",
     "@agent-device/selectors": "workspace:*",

packages/proxy/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@agent-device/proxy",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "description": "Authenticating proxy in front of an agent-device daemon. Internal workspace package bundled into the published artifact.",
+  "dependencies": {
+    "@agent-device/contracts": "workspace:*",
+    "@agent-device/host-kit": "workspace:*",
+    "@agent-device/kernel": "workspace:*"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.ts",
+      "default": "./src/index.ts"
+    }
+  }
+}

src/remote/daemon-proxy.ts packages/proxy/src/daemon-proxy.tssrc/remote/daemon-proxy.ts renamed to packages/proxy/src/daemon-proxy.ts

@@ -17,12 +17,10 @@ import {
   buildDaemonHttpAuthHeaders,
   buildDaemonHttpUrl,
 } from '@agent-device/contracts/daemon-http';
-import { readVersion } from '@agent-device/host-kit/version';
-import { readHostCpuArch } from '@agent-device/host-kit/process';
 import {
   carriesUnbackedHostPathInstallSource,
   sendHostPathInstallSourceRefused,
-} from './proxy-install-source-admission.ts';
+} from './install-source-admission.ts';
 
 export type DaemonProxyOptions = {
   upstreamBaseUrl: string;
@@ -115,7 +113,11 @@ async function sendProxyHealth(
   options: Required<DaemonProxyOptions>,
   instanceId: string,
 ) {
-  const upstream = await readUpstreamHealth(options);
+  const [upstream, { readVersion }, { readHostCpuArch }] = await Promise.all([
+    readUpstreamHealth(options),
+    import('@agent-device/host-kit/version'),
+    import('@agent-device/host-kit/process'),
+  ]);
   res.statusCode = 200;
   res.setHeader('content-type', 'application/json');
   res.end(

packages/proxy/src/index.ts

@@ -0,0 +1 @@
+export { createDaemonProxyServer } from './daemon-proxy.ts';

…remote/proxy-install-source-admission.ts …es/proxy/src/install-source-admission.tssrc/remote/proxy-install-source-admission.ts renamed to packages/proxy/src/install-source-admission.ts src/remote/proxy-install-source-admission.ts renamed to packages/proxy/src/install-source-admission.ts

@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "composite": true,
+    "noEmit": false,
+    "emitDeclarationOnly": true,
+    "declaration": true,
+    "declarationDir": "./dist-types",
+    "rootDir": "./src"
+  },
+  "include": ["src"]
+}

packages/proxy/tsconfig.json

@@ -2,7 +2,7 @@ import { test } from 'vitest';
 import assert from 'node:assert/strict';
 import crypto from 'node:crypto';
 import http from 'node:http';
-import { createDaemonProxyServer } from '../remote/daemon-proxy.ts';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import { createDaemonHttpServer } from '../daemon/server/http-server.ts';
 import { getRequestSignal } from '@agent-device/host-kit/request';
 import { readHostCpuArch } from '@agent-device/host-kit/process';

pnpm-lock.yaml

@@ -1,5 +1,5 @@
 import { randomBytes } from 'node:crypto';
-import { createDaemonProxyServer } from '../../remote/daemon-proxy.ts';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import { buildDaemonHttpBaseUrl } from '@agent-device/contracts/daemon-http';
 import {
   ensureDaemon,

src/__tests__/daemon-proxy.test.ts

@@ -21,7 +21,7 @@ import {
   sendRequest,
 } from '../daemon-client-transport.ts';
 import { resolveDaemonPaths } from '../../daemon-resolution.ts';
-import { createDaemonProxyServer } from '../../remote/daemon-proxy.ts';
+import { createDaemonProxyServer } from '@agent-device/proxy';
 import {
   closeLoopbackServer,
   listenOnLoopback,