fix: simplify install-from-source identity resolution

[thymikee]

Summary

Add deterministic install-from-source identity resolution and an explicit retained-materialization contract at the daemon boundary.

• Parse Android package names directly from APK/AAB manifests
• Return normalized packageName / bundleId plus launchTarget from install flows
• Share URL/path download, extraction, and nested-archive materialization across CLI and daemon installs
• Keep request cancellation and AGENT_DEVICE_SOURCE_DOWNLOAD_TIMEOUT_MS active through the full download, including body streaming
• Add optional retainPaths: true for install_from_source, returning daemon-managed installablePath, optional archivePath, materializationId, and materializationExpiresAt
• Add agent_device.release_materialized_paths and auto-clean retained paths on session close or TTL expiry

Validation

• pnpm typecheck
• node --test src/daemon/__tests__/materialized-path-registry.test.ts src/daemon/handlers/__tests__/session.test.ts src/daemon/handlers/__tests__/session-reinstall.test.ts
• node --test src/platforms/android/__tests__/index.test.ts src/platforms/ios/__tests__/index.test.ts
• pnpm test:smoke
• node --test src/daemon/__tests__/http-server.test.ts (new assertions pass, but this file still does not terminate cleanly in this environment)

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-03-13 18:35 UTC

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 79e297865a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep source-download timeout active while streaming body

The timeout/cancel wiring is removed immediately after fetch resolves headers, before the response body is copied to disk. That means install_from_source downloads can still hang indefinitely on slow or stalled body streams (and ignore request cancellation) even when AGENT_DEVICE_SOURCE_DOWNLOAD_TIMEOUT_MS is set, so the new timeout guarantee is not actually enforced for the full download path.

Useful? React with 👍 / 👎.