Start the connector only after the setup that succeeds; keep helpers below exports

The first-time-setup eval matched any `connect setup` before the
connector start, so a trace that started the connector between a refused
setup (the mock refuses one without --serve) and the one that succeeds
passed. The step now matches the successful invocation.

normalizeSemver sat between two exported functions; it moves below the
private helpers it sits beside, per STYLE.md's export order.

Author: robzolkos

internal/harness/claude.go

@@ -313,14 +313,6 @@ func PluginUpdateNotice(cli string) string {
 	return ""
 }
 
-func normalizeSemver(v string) string {
-	v = strings.TrimSpace(v)
-	if v != "" && !strings.HasPrefix(v, "v") {
-		v = "v" + v
-	}
-	return v
-}
-
 // InstalledPluginVersion reads the installed plugin version from
 // ~/.claude/plugins/installed_plugins.json. Returns "" if unreadable.
 func InstalledPluginVersion() string {
@@ -398,6 +390,14 @@ func installedPluginVersionMatching(data []byte, match func(string) bool) string
 	return ""
 }
 
+func normalizeSemver(v string) string {
+	v = strings.TrimSpace(v)
+	if v != "" && !strings.HasPrefix(v, "v") {
+		v = "v" + v
+	}
+	return v
+}
+
 // pluginInstalled checks if "basecamp" appears as an installed plugin.
 // Handles multiple possible JSON schemas without panicking.
 func pluginInstalled(data []byte) bool {

skill-evals/cases/basecamp-connect/first-time-setup.yml

@@ -32,7 +32,8 @@ mocks:
 expect_sequence:
   - match: 'auth agent connect .*(-P|--profile)[ =]''?helper\b'
   - match: '^me .*(-P|--profile)[ =]''?helper\b'
-  - match: 'connect setup'
+  # The setup that succeeds: the mock refuses one without --serve.
+  - match: 'connect setup .*--serve[ =]'
   # Connecting, setup and the watcher are one flow: the connector starts
   # right after setup, without asking again.
   - match: '^connect\s+(-P|--profile)[ =]''?helper\b'