perf: bundle tar-stream to reduce install footprint

[thymikee]

Summary

Bundle tar-stream's Node.js dependency path so consumers no longer install tar-stream and its transitive packages. Archive extraction behavior stays unchanged.

The clean npm comparison removes 12 runtime packages and saves about 5.7 MB net with current registry resolutions. Bundled JavaScript grows by 38,050 bytes; bundling excludes the unused Bare runtime packages. The independent review found no actionable issues and confirmed this tradeoff uses the existing build mechanism without replacing archive functionality.

Scope: three build/dependency metadata files. No dependency versions, runtime source, docs, or skills changed.

Validation

Validated content at de64381d7be8bef93031a856cf8454183c19ffe4:

• Build, lint, typecheck, formatting, bundle-owner check, and 31 focused archive/package tests passed.
• Packed tarball passed publint, attw, dependency-closure validation, all 13 public imports, and CLI smoke checks in a clean install.
• Installed bundle extracted TAR/TGZ files and rejected path traversal with cleanup, without external tar-stream or Bare packages installed.
• Dependency-closure check first failed as expected against the pre-bundling output.

The full affected-check run was canceled before starting at the user's request. CI on this head remains pending.

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://callstack.github.io/agent-device/pr-preview/pr-2286/
Built to branch gh-pages at 2026-09-05 07:04 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.61 MB	2.64 MB	+37.3 kB
JS gzip	878.8 kB	889.2 kB	+10.5 kB
npm bundled raw	2.61 MB	2.64 MB	+37.3 kB
npm bundled gzip	878.8 kB	889.2 kB	+10.5 kB
npm tarball	1.04 MB	1.05 MB	+11.0 kB
npm unpacked	3.52 MB	3.56 MB	+37.3 kB
npm clean-installed	3.52 MB	3.56 MB	+37.3 kB

npm unpacked components

Component	Base	Current	Diff
JS / dist source	2.77 MB	2.81 MB	+37.3 kB
Apple runner source/project	544.4 kB	544.4 kB	0 B
Apple snapshot presentation source	33.8 kB	33.8 kB	0 B
Apple Simulator snapshot bridge source	30.5 kB	30.5 kB	0 B
macOS helper source	54.8 kB	54.8 kB	0 B
Android helper artifacts	43.3 kB	43.3 kB	0 B
Other package files	46.7 kB	46.7 kB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	29.7 ms	30.0 ms	+0.3 ms
CLI --help	80.7 ms	79.8 ms	-0.8 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/archive.js	+45.5 kB	+13.5 kB
dist/src/internal/daemon.js	+953 B	+309 B
dist/src/session2.js	+176 B	+36 B
dist/src/interaction2.js	-15 B	-9 B
dist/src/device-claim-rule.js	-15 B	-4 B

Top changed packed files

Packed file	Base	Current	Diff
dist/src/archive.js	7.9 kB	45.5 kB	+37.6 kB
dist/src/request-runtime-binding.js	2.6 kB	0 B	-2.6 kB
dist/src/device-ready.js	0 B	975 B	+975 B
dist/src/internal/daemon.js	106.9 kB	107.9 kB	+953 B
dist/src/rolldown-runtime.js	309 B	788 B	+479 B
dist/src/response.js	0 B	278 B	+278 B
dist/src/session2.js	218.4 kB	218.6 kB	+176 B
dist/src/record-runtime.js	7.2 kB	7.1 kB	-145 B
dist/src/session-snapshot.js	26.9 kB	26.9 kB	-87 B
dist/src/snapshot4.js	12.0 kB	11.9 kB	-79 B

[thymikee]

Repo Guards is correctly blocking this head: moving root tar-stream to devDependencies leaves packages/host-kit/package.json declaring it as a runtime dependency, so R11 can no longer match the private package’s external dependency to a root published dependency.

Move tar-stream to host-kit’s devDependencies too, following the existing bundled-dependency pattern, keep the root entry only for build resolution, and rerun Repo Guards plus the packed clean-install/archive checks. Do not weaken R11 or restore the root runtime dependency, which would defeat the install-footprint goal. The established tsdown bundling path and the reported +37.3 kB packed-output tradeoff otherwise look sound.