fix: block private workspace imports in npm bundles

[szdziedzic]

Summary

• fail npm packaging when emitted JavaScript still imports a private @agent-device/* workspace package
• run the shared bundle checks from package:npm, check:tooling, and packaged CLI CI
• cover the minified static, dynamic, and CommonJS import forms that broke agent-device@0.20.4

This prevents a stale publisher workspace from producing a tarball whose CLI cannot start. The guard runs immediately after the JavaScript build and before native package work.

Touched 6 files. Scope stayed within npm packaging and CI validation.

Validation

pnpm check:tooling passed, including a clean distributable build and both bundle checks. The full unit suite passed (598 files, 5,263 tests), and the changed-code fallow audit passed. A synthetic emitted @agent-device/ad-script import made the new guard fail with the expected recovery hint; after removing it, an isolated tarball install successfully ran agent-device --version and agent-device help devices.

[Copilot]

Pull request overview

Adds an npm-packaging guardrail that fails builds when emitted dist/src JavaScript still contains imports of private @agent-device/* workspace packages, and wires that check into the packaging and CI paths that produce/validate the published tarball. This hardens the release pipeline against “works in workspace, breaks when installed” bundle regressions.

Changes:

• Introduces scripts/check-bundle-private-imports.ts plus a focused unit test to detect static, dynamic, and CommonJS private-workspace import leaks in built chunks.
• Adds a new aggregate check:bundle script and runs it from package:npm, check:tooling, and packaged-CLI CI.
• Updates packaging-smoke workflow path triggers and the script topology test to include the new bundle-check script(s).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/__tests__/npm-package-scripts.test.ts	Updates script/workflow assertions to require running the shared check:bundle step during npm packaging.
src/__tests__/bundle-private-imports.test.ts	Adds unit coverage for detecting private-workspace import leaks and ignoring non-import mentions.
scripts/check-bundle-private-imports.ts	Implements the dist-bundle scan for @agent-device/* import specifiers and fails with actionable output.
package.json	Adds check:bundle + check:bundle-private-imports scripts and integrates them into packaging/tooling validation.
.github/workflows/package-smoke.yml	Ensures the packaging smoke workflow triggers on changes to bundle-check scripts.
.github/workflows/ci.yml	Runs the shared pnpm check:bundle step before packing/installing the CLI in CI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.