feat: add runtime admin, batch, diagnostics, and recording commands

[thymikee]

Summary

Moves phases 4/5/6 onto the runtime/router surface and trims back the unfinished phase 7 exposure:

• keeps runtime admin.*, router batch, record, trace, and diagnostics.* public
• removes router-level replay and test from the public runtime types and dispatch path, and marks them planned again in commandCatalog
• replaces the separate implemented-command manifest with a single runtime dispatcher map and adds catalog alignment coverage
• hardens diagnostics body redaction by recursively sanitizing parsed JSON payloads and extending fallback text redaction to common bearer-token/header patterns
• updates runtime ownership and client API docs to describe diagnostics redaction as best-effort
• fixes admin.install/admin.reinstall temp-input cleanup so uploaded-artifact materialization is released even when backend source resolution fails

Validation

• pnpm format
• pnpm typecheck
• pnpm vitest run src/__tests__/runtime-admin-router.test.ts
• pnpm vitest run src/__tests__/runtime-admin-router.test.ts src/__tests__/runtime-diagnostics-router.test.ts src/__tests__/runtime-public.test.ts
• pnpm check:quick
• STATE_DIR=$(mktemp -d); AGENT_DEVICE_STATE_DIR="$STATE_DIR" pnpm check:unit; STATUS=$?; rm -rf "$STATE_DIR"; exit $STATUS
• pnpm build
• STATE_DIR=$(mktemp -d); AGENT_DEVICE_STATE_DIR="$STATE_DIR" pnpm test:integration; STATUS=$?; rm -rf "$STATE_DIR"; exit $STATUS
• AGENT_DEVICE_STATE_DIR=$(mktemp -d /tmp/agent-device-e2e-ios-XXXXXX) pnpm test:replay:ios (6 passed)
• AGENT_DEVICE_STATE_DIR=$(mktemp -d /tmp/agent-device-e2e-ios-device-XXXXXX) pnpm test:replay:ios-device (1 passed)
• AGENT_DEVICE_STATE_DIR=$(mktemp -d /tmp/agent-device-e2e-macos-rerun-XXXXXX) pnpm test:replay:macos (1 passed on rerun; first attempt hit transient _LSOpenURLsWithCompletionHandler ... error -600 launching System Settings)
• AGENT_DEVICE_STATE_DIR=$(mktemp -d /tmp/agent-device-e2e-android-XXXXXX) pnpm test:replay:android failed because no Android devices were connected
• AGENT_DEVICE_STATE_DIR=$(mktemp -d /tmp/agent-device-e2e-linux-XXXXXX) pnpm test:replay:linux failed because no Linux desktop target was available on this host
• AGENT_DEVICE_STATE_DIR=$(mktemp -d /tmp/agent-device-recording-e2e-XXXXXX) AGENT_DEVICE_RECORDING_E2E=1 node --test test/integration/recording-overlay.test.ts exposed existing live failures: iOS tap passed, iOS scroll overlay saw 0 overlay pixels, iOS back-swipe reported iOS runner session restarted during recording, and Android recording cases failed because no Android device was available

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://callstackincubator.github.io/agent-device/pr-preview/pr-416/
Built to branch gh-pages at 2026-04-16 15:04 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4f7e067cd5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Clean up resolved inputs when source resolution fails

If backend.resolveInstallSource throws, the temporary file/materialization created by resolveLocalInstallSource is leaked because cleanup is only returned on success and only executed later in runInstallCommand's finally. This is reproducible with source.kind === 'uploadedArtifact' when the backend rejects or times out during source resolution, and it can accumulate temp artifacts across failed installs. Wrap backend source resolution in a local try/finally (or catch + rethrow) so localResolved.cleanup runs on this error path too.

Useful? React with 👍 / 👎.