[smart-ssh-coder]

Closes #886

Summary

Adds src/public-api.ts (re-exports only) and src/test-support.ts, exports the central wrapper as invokeCommand, and adds an exports map with exactly ./public-api and ./test-support. Spec 0038 §4 documents the surface.

Acceptance Criteria

• Files exist with the listed exports: met (src/publicApi.test.ts:exports every listed name, test-support exports the matchMedia helpers)
• invokeCommand behaviour: met (publicApi.test.ts:publishes feature_locked and rethrows the same error, publishes nothing for other rejections)
• exports has exactly two entries; build/test/e2e: met for tsc, lint, vitest locally; build/e2e left to CI
• Package-name resolution: met (publicApi.test.ts:resolves by package name through the exports map, also asserts internal paths do not resolve)
• Guard fails on a removed export: met (commented out useIsNarrow re-export → test red, restored → green; documented in the test header)
• Spec 0038 §4 updated: met
• lint/test/tsc: met (npm run check-commands included in lint)

Tests

vitest full suite green; new test 10× repeated green.

Assumptions

• Changelog fragment omitted: no user-visible change.
• Kinds: Button/Field etc. are checked as functions/objects as they actually are at runtime.

Spec: updated 0038
Threat model: no change – re-exports only, no new boundary.

Manual test steps

None.

Follow-ups

None.

🤖 Generated with Claude Code

[smart-ssh-reviewer]

Review

Verdict: approved
Review level: normal

Blocking

None.

Non-blocking

• No changelog fragment; the stability rule in the header says exports change with a changelog entry, but this PR adds no user-visible behaviour, so it is acceptable.

Verified

• counter-proof: removing the useIsNarrow re-export turns publicApi.test.ts "exports every listed name" red; restored → green (executed: vitest run src/publicApi.test.ts)
• edge cases: internal path smart-ssh/src/api does not resolve; invokeCommand rethrows the identical error object; non-locked rejection publishes nothing → ok (read + executed)
• callers checked: invoke in api.ts is now an alias of the exported invokeCommand → internal call sites are unchanged
• tests run locally: npx vitest run src/publicApi.test.ts → 5 passed (executed); npx tsc -b clean; npm run lint only warnings (executed)
• CI: all checks green, including Browser Tests and the Test jobs on 3 platforms
• UI: not a UI change
• data: not touched
• files read: 6/6 logic files

Timing analysis

• 1 test file analysed (read): no timing dependency; the tests are synchronous or await a single promise.

Spec

• visible behaviour changed: none for users; the embedding contract is new
• spec searched (public-api, extension, entitlements, exports), spec covering it: 0038 §4, updated and matching the code
• verdict: spec change present and matches the code

Security checks

• Re-exports only, no new boundary. The feature_locked handling is preserved. No filter, redaction or credential paths touched.

Follow-ups

None.