@robota-sdk/agent-command 3.0.0-beta.100

package/src/devices/__tests__/devices-command-module.test.ts

@@ -0,0 +1,299 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { scriptedSession, type ScriptedSessionHarness } from '@robota-sdk/agent-framework/testing';
+
+import { createDevicesCommandModule } from '../devices-command-module.js';
+
+import type { IDevicesCommandPort } from '../devices-command-port.js';
+import type { ITerminalHandoff } from '@robota-sdk/agent-interface-session';
+
+const DEVICE_A = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+const DEVICE_B = 'BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB';
+const USER = 'UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU';
+const SIGNING = 'SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS';
+
+function fakePort(): IDevicesCommandPort & { calls: string[] } {
+  const calls: string[] = [];
+  return {
+    calls,
+    list: vi.fn(async () => {
+      calls.push('list');
+      return {
+        userId: USER,
+        devices: [
+          {
+            deviceId: DEVICE_A,
+            name: 'laptop',
+            thisDevice: true,
+            holdsSigningKey: true,
+            certificateExpiresAt: Date.UTC(2026, 11, 25),
+          },
+          {
+            deviceId: DEVICE_B,
+            name: 'desktop',
+            thisDevice: false,
+            holdsSigningKey: false,
+            certificateExpiresAt: Date.UTC(2026, 11, 20),
+          },
+        ],
+        revokedDeviceCount: 1,
+        listsExpireAt: Date.UTC(2026, 8, 27),
+      };
+    }),
+    init: vi.fn(async (options) => {
+      calls.push(`init:${options.name ?? ''}`);
+      return {
+        ok: true as const,
+        value: {
+          userId: USER,
+          deviceId: DEVICE_A,
+          signingKeyId: SIGNING,
+          keyStorage: 'OS keychain',
+        },
+      };
+    }),
+    recover: vi.fn(async () => {
+      calls.push('recover');
+      return {
+        ok: true as const,
+        value: {
+          deviceId: DEVICE_A,
+          signingKeyId: SIGNING,
+          revokedSigningKeyCount: 1,
+          droppedDeviceCount: 1,
+        },
+      };
+    }),
+    revoke: vi.fn(async (target) => {
+      calls.push(`revoke:${target}`);
+      return { ok: true as const, value: { deviceId: DEVICE_B, name: 'desktop' } };
+    }),
+    add: vi.fn(async () => {
+      calls.push('add');
+      return {
+        ok: true as const,
+        value: { deviceId: DEVICE_B, name: 'desktop', confirmed: true },
+      };
+    }),
+    join: vi.fn(async (options) => {
+      calls.push(`join:${options.name ?? ''}`);
+      return {
+        ok: true as const,
+        value: { userId: USER, deviceId: DEVICE_B, name: 'desktop', keyStorage: 'OS keychain' },
+      };
+    }),
+  };
+}
+
+function handoff(enabled: boolean, onRun?: () => void): ITerminalHandoff {
+  return {
+    canHandoffTerminal: enabled,
+    runWithTerminal: async (operation) => {
+      onRun?.();
+      return operation();
+    },
+  };
+}
+
+let session: ScriptedSessionHarness | undefined;
+
+afterEach(async () => {
+  await session?.dispose();
+  session = undefined;
+});
+
+function start(port: IDevicesCommandPort, terminal = handoff(true)): ScriptedSessionHarness {
+  session = scriptedSession({
+    turns: [{ text: 'unused' }],
+    terminalHandoff: terminal,
+    commandModules: [createDevicesCommandModule(port)],
+  });
+  return session;
+}
+
+describe('/devices command', () => {
+  it('is operator-only: never model-invocable, and palette metadata matches the executable', () => {
+    const module = createDevicesCommandModule(fakePort());
+    const palette = module.commandSources?.[0]?.getCommands()[0];
+    const executable = module.systemCommands?.[0];
+    expect(executable?.modelInvocable).toBe(false);
+    expect(palette?.modelInvocable).toBe(false);
+    expect(executable?.userInvocable).toBe(true);
+    expect(palette?.subcommands?.map(({ name }) => name)).toEqual([
+      'list',
+      'init',
+      'revoke',
+      'recover',
+      'add',
+      'join',
+    ]);
+    // What the model reads names the one-time code as terminal-only, so it never asks for it.
+    expect(palette?.description).toMatch(/enrol/i);
+    expect(palette?.description).toMatch(/terminal/i);
+  });
+
+  it('tells the model it also shows the device mesh status', () => {
+    const description =
+      createDevicesCommandModule(fakePort()).commandSources?.[0]?.getCommands()[0]?.description;
+    expect(description).toMatch(/device mesh/);
+    expect(description).toMatch(/Operator-only/);
+  });
+
+  it('lists the roster with short ids, this device, the signing-key holder and expiry', async () => {
+    const port = fakePort();
+    const result = await start(port).command('devices', '');
+    expect(result?.success).toBe(true);
+    expect(result?.message).toContain(DEVICE_A.slice(0, 10));
+    expect(result?.message).not.toContain(DEVICE_A);
+    expect(result?.message).toMatch(/laptop.*this device.*signing key/);
+    expect(result?.message).toContain('2026-12-25');
+    expect(result?.message).toContain('desktop');
+    expect(result?.message).toMatch(/1 revoked/);
+  });
+
+  it('says so when this device has no identity yet', async () => {
+    const port = fakePort();
+    vi.mocked(port.list).mockResolvedValueOnce(undefined);
+    const result = await start(port).command('devices', 'list');
+    expect(result?.message).toMatch(/\/devices init/);
+    // A device of a user who already has others joins them; `init` would never link to them.
+    expect(result?.message).toMatch(/\/devices join/);
+    expect(result?.message).toMatch(/separate identity/);
+  });
+
+  it('describes init as for the first device, and join as the way to the devices a user has', () => {
+    const entry = createDevicesCommandModule(fakePort()).commandSources?.[0]?.getCommands()[0];
+    const init = entry?.subcommands?.find((sub) => sub.name === 'init');
+    expect(init?.description).toMatch(/first device/);
+    expect(init?.description).toMatch(/separate identity/);
+    expect(entry?.description).toMatch(/separate identity/);
+  });
+
+  it('runs init, recover and revoke on the operator terminal', async () => {
+    const port = fakePort();
+    const runs = vi.fn();
+    const harness = start(port, handoff(true, runs));
+    const init = await harness.command('devices', 'init my laptop');
+    expect(init?.success).toBe(true);
+    expect(init?.message).toContain(DEVICE_A.slice(0, 10));
+    expect(init?.message).toContain('OS keychain');
+    const recover = await harness.command('devices', 'recover');
+    expect(recover?.success).toBe(true);
+    expect(recover?.message).toMatch(/signing key/i);
+    const revoke = await harness.command('devices', `revoke ${DEVICE_B.slice(0, 8)}`);
+    expect(revoke?.success).toBe(true);
+    expect(revoke?.message).toContain('desktop');
+    expect(port.calls).toEqual(['init:my laptop', 'recover', `revoke:${DEVICE_B.slice(0, 8)}`]);
+    expect(runs).toHaveBeenCalledTimes(3);
+  });
+
+  it('reports a refusal by its reason', async () => {
+    const port = fakePort();
+    vi.mocked(port.recover).mockResolvedValueOnce({ ok: false, reason: 'phrase-mismatch' });
+    const result = await start(port).command('devices', 'recover');
+    expect(result?.success).toBe(false);
+    expect(result?.message).toMatch(/different identity/i);
+  });
+
+  it('refuses without an interactive terminal and never reaches the port (fail closed)', async () => {
+    const port = fakePort();
+    const harness = start(port, handoff(false));
+    for (const args of ['init', 'recover', 'revoke abcdef', 'add', 'join', 'join desktop']) {
+      const result = await harness.command('devices', args);
+      expect(result?.success).toBe(false);
+      expect(result?.message).toMatch(/interactive terminal/i);
+    }
+    expect(port.calls).toEqual([]);
+  });
+
+  it('refuses a model invocation', async () => {
+    const port = fakePort();
+    const harness = start(port);
+    for (const args of ['init', 'add', 'join']) {
+      const result = await harness.session.executeModelCommand('devices', args);
+      expect(result?.success ?? false).toBe(false);
+    }
+    expect(port.calls).toEqual([]);
+  });
+
+  it('refuses every verb from a remote surface', async () => {
+    const port = fakePort();
+    const harness = start(port);
+    for (const args of ['', 'init', 'recover', 'revoke abcdef', 'add', 'join']) {
+      const result = await harness.session.executeCommand('devices', args, 'remote');
+      expect(result?.success).toBe(false);
+      expect(result?.message).toMatch(/operator/i);
+    }
+    expect(port.calls).toEqual([]);
+  });
+
+  it('shows the device mesh: whether it is on, how it finds devices, and what is linked', async () => {
+    const port = {
+      ...fakePort(),
+      meshStatus: () => ({
+        state: 'on' as const,
+        sources: ['local network (mDNS)', 'Mainline DHT'],
+        linked: [{ deviceId: DEVICE_B, name: 'desktop', locality: 'another-host' as const }],
+      }),
+    };
+    const result = await start(port).command('devices', '');
+    expect(result?.message).toMatch(/Device mesh: on/);
+    expect(result?.message).toContain('local network (mDNS), Mainline DHT');
+    expect(result?.message).toMatch(
+      new RegExp(`${DEVICE_B.slice(0, 10)}\\s+desktop\\s+on another machine`),
+    );
+  });
+
+  it('says how to turn the device mesh on when it is off', async () => {
+    const port = {
+      ...fakePort(),
+      meshStatus: () => ({ state: 'off' as const, sources: [], linked: [] }),
+    };
+    const result = await start(port).command('devices', 'list');
+    expect(result?.message).toMatch(/Device mesh: off/);
+    expect(result?.message).toContain('transports.mesh.enabled');
+  });
+
+  it('runs add and join on the operator terminal and reports ids and names only', async () => {
+    const port = fakePort();
+    const runs = vi.fn();
+    const harness = start(port, handoff(true, runs));
+    const add = await harness.command('devices', 'add');
+    expect(add?.success).toBe(true);
+    expect(add?.message).toContain('desktop');
+    expect(add?.message).toContain(DEVICE_B.slice(0, 10));
+    const join = await harness.command('devices', 'join my desktop');
+    expect(join?.success).toBe(true);
+    expect(join?.message).toContain(DEVICE_B.slice(0, 10));
+    expect(join?.message).toContain('OS keychain');
+    expect(port.calls).toEqual(['add', 'join:my desktop']);
+    expect(runs).toHaveBeenCalledTimes(2);
+  });
+
+  it('says what to do when an enrollment is refused', async () => {
+    const port = fakePort();
+    const harness = start(port);
+    vi.mocked(port.join).mockResolvedValueOnce({ ok: false, reason: 'code-not-accepted' });
+    expect((await harness.command('devices', 'join'))?.message).toMatch(/devices add/);
+    vi.mocked(port.add).mockResolvedValueOnce({ ok: false, reason: 'no-relay' });
+    expect((await harness.command('devices', 'add'))?.message).toMatch(/relayUrl/);
+    vi.mocked(port.join).mockResolvedValueOnce({ ok: false, reason: 'code-on-command-line' });
+    expect((await harness.command('devices', 'join ABCDE'))?.message).toMatch(/devices add/);
+  });
+
+  it('requires a device id for revoke', async () => {
+    const port = fakePort();
+    const result = await start(port).command('devices', 'revoke');
+    expect(result?.success).toBe(false);
+    expect(result?.message).toMatch(/usage/i);
+    expect(port.calls).toEqual([]);
+  });
+
+  it('reports a failure without its stack', async () => {
+    const port = fakePort();
+    vi.mocked(port.init).mockRejectedValueOnce(new Error('credential store unavailable'));
+    const result = await start(port).command('devices', 'init');
+    expect(result?.success).toBe(false);
+    expect(result?.message).toContain('credential store unavailable');
+  });
+});

package/src/devices/devices-command-module.ts

@@ -0,0 +1,308 @@
+/**
+ * `/devices` — this device's place in the user's device identity: list the roster, create the
+ * identity, enrol another device or join with one, revoke a device, recover from the recovery phrase.
+ *
+ * Operator-only, twice over: the command is not model-invocable, and it refuses any invocation that
+ * is not the operator's own (a remote surface, the model). Every verb that touches a secret or
+ * asks for a confirmation runs inside the terminal handoff, so what is typed goes to the host's
+ * terminal and never through the session's input, prompt history or conversation — the enrollment
+ * code included, which is why `join` reads it there instead of taking it as an argument. Without an
+ * interactive terminal those verbs refuse rather than fall back to anything else.
+ */
+import { createSystemCommandFromEntry } from '../command-module-utils.js';
+
+import type {
+  IDevicesCommandPort,
+  IDevicesMeshStatus,
+  IDevicesView,
+  TDevicesOutcome,
+  TDevicesRefusal,
+} from './devices-command-port.js';
+import type {
+  ICommandHostContext,
+  ICommandModule,
+  ISystemCommand,
+} from '@robota-sdk/agent-framework';
+import type { ICommand, ICommandResult, ICommandSource } from '@robota-sdk/agent-interface-command';
+
+const SHORT_ID_CHARS = 10;
+const USAGE = 'Usage: /devices [list|init [name]|add|join [name]|revoke <device-id>|recover]';
+
+export function createDevicesCommandEntry(): ICommand {
+  return {
+    name: 'devices',
+    displayName: 'Devices',
+    description:
+      "Manage this device's identity among the user's devices: list the roster with the device mesh status (whether it is on, how this device finds the others, which are linked), create the identity and its recovery phrase (init, for the user's first device only: on a device of a user who already has others it makes a separate identity that can never link to them), enrol another device (add shows a one-time code; join on the new device reads it), revoke a device, or rotate the signing key from the phrase. A new identity or new lists take effect in the running session's device mesh at once. Operator-only; the phrase and the enrollment code are handled on the terminal only, and results carry only device ids and names.",
+    source: 'devices',
+    modelInvocable: false,
+    userInvocable: true,
+    argumentHint: '[list|init [name]|add|join [name]|revoke <device-id>|recover]',
+    subcommands: [
+      {
+        name: 'list',
+        description: 'List your devices and the device mesh status',
+        source: 'devices',
+      },
+      {
+        name: 'init',
+        description:
+          'Create your device identity and recovery phrase, on your first device only (on another, a separate identity that can never link to your devices; use add/join there)',
+        source: 'devices',
+        argumentHint: '[name]',
+      },
+      {
+        name: 'revoke',
+        description: 'Revoke a device with the signing key',
+        source: 'devices',
+        argumentHint: '<device-id>',
+      },
+      {
+        name: 'recover',
+        description: 'Rotate the signing key from your recovery phrase',
+        source: 'devices',
+      },
+      {
+        name: 'add',
+        description: 'Enrol another device: show a one-time code for it',
+        source: 'devices',
+      },
+      {
+        name: 'join',
+        description: 'Join your devices with the code another device shows',
+        source: 'devices',
+        argumentHint: '[name]',
+      },
+    ],
+  };
+}
+
+const REFUSALS: Readonly<Record<TDevicesRefusal, string>> = {
+  'no-terminal':
+    'This needs an interactive terminal; the recovery phrase is never shown or read anywhere else.',
+  'not-initialized':
+    'This device has no identity yet. If your other devices are already linked, run `/devices add` there and `/devices join` here, typing the code it shows. Run `/devices init` only when setting up your first device: it creates a separate identity that cannot link to an existing device group.',
+  'already-initialized':
+    'This device already has an identity. Use `/devices recover` to rotate its signing key.',
+  cancelled: 'Cancelled. Nothing was changed.',
+  'confirmation-failed': 'The confirmation did not match. Nothing was changed.',
+  'phrase-invalid': 'That is not a valid recovery phrase. Nothing was changed.',
+  'phrase-mismatch':
+    'That phrase (with that passphrase) belongs to a different identity than this device. Nothing was changed.',
+  'no-signing-key':
+    'This device does not hold the signing key. Revoke from a device that does, or `/devices recover`.',
+  'signing-key-expired':
+    'The signing key on this device has expired. Run `/devices recover` to issue a new one.',
+  'unknown-device': 'No device in the roster has that id.',
+  'ambiguous-device': 'More than one device starts with that id; give more of it.',
+  'self-revocation':
+    'This device cannot revoke itself. Revoke it from another device, or `/devices recover`.',
+  'changed-concurrently':
+    'The device identity changed in another session while this was waiting. Nothing was changed; try again.',
+  'no-relay':
+    'Enrolling a device needs a signaling relay. Set `transports.webrtc.options.relayUrl` in your settings on both devices.',
+  'code-invalid': 'That is not an enrollment code. Nothing was changed.',
+  'code-on-command-line':
+    'Do not put the code on the command line, where history keeps it. Run `/devices add` again on the other device for a new code, then `/devices join` here and type it at the prompt.',
+  'code-not-accepted':
+    'No device accepted that code: it is wrong, expired or already used, or the connection was tampered with. Run `/devices add` on the other device for a new code.',
+  'enrollment-expired': 'The code expired before a device joined. Nothing was changed.',
+  'too-many-attempts':
+    'Too many attempts failed to prove the code, so it no longer works. Nothing was changed; run `/devices add` again.',
+  'enrollment-declined': 'The enrollment was declined. Nothing was changed.',
+  'enrollment-timed-out': 'Nobody answered in time. Nothing was changed.',
+  'enrollment-failed':
+    'The signaling relay or the connection to the other device failed before the enrollment finished. Nothing was changed; try again.',
+};
+
+function short(id: string): string {
+  return id.slice(0, SHORT_ID_CHARS);
+}
+
+function day(ms: number): string {
+  return new Date(ms).toISOString().slice(0, 10);
+}
+
+function refused(reason: TDevicesRefusal): ICommandResult {
+  return { success: false, message: REFUSALS[reason] };
+}
+
+function formatMesh(mesh: IDevicesMeshStatus): string[] {
+  if (mesh.state === 'off') {
+    return [
+      'Device mesh: off. Set `transports.mesh.enabled` to true in your user settings to link your devices.',
+    ];
+  }
+  if (mesh.state === 'failed') {
+    return [`Device mesh: could not start: ${mesh.reason ?? 'no reason was reported'}.`];
+  }
+  const found = mesh.sources.length > 0 ? `; finds devices by ${mesh.sources.join(', ')}` : '';
+  const linked = mesh.linked.map(
+    (device) =>
+      `  ${short(device.deviceId)}  ${device.name ?? ''}  ${device.locality === 'same-host' ? 'on this machine' : 'on another machine'}`,
+  );
+  return [
+    `Device mesh: ${mesh.state}${found}.`,
+    ...(linked.length > 0 ? ['Linked now:', ...linked] : ['No device is linked right now.']),
+  ];
+}
+
+function formatList(view: IDevicesView | undefined, mesh?: IDevicesMeshStatus): ICommandResult {
+  if (view === undefined) return { success: true, message: REFUSALS['not-initialized'] };
+  const lines = view.devices.map((device) => {
+    const notes = [
+      ...(device.thisDevice ? ['this device'] : []),
+      ...(device.holdsSigningKey ? ['holds the signing key'] : []),
+    ];
+    const suffix = notes.length > 0 ? `  (${notes.join(', ')})` : '';
+    return `  ${short(device.deviceId)}  ${device.name}${suffix}  certificate expires ${day(device.certificateExpiresAt)}`;
+  });
+  return {
+    success: true,
+    message: [
+      `Devices of user ${short(view.userId)}:`,
+      ...lines,
+      `${view.revokedDeviceCount} revoked. Roster and revocation list valid until ${new Date(view.listsExpireAt).toISOString()}.`,
+      ...(mesh !== undefined ? formatMesh(mesh) : []),
+    ].join('\n'),
+  };
+}
+
+function isOperator(context: ICommandHostContext): boolean {
+  return context.getCommandInvocationSource() === 'user';
+}
+
+/** Run a terminal-bound port call; a refusal or a thrown error becomes a failed result. */
+async function onTerminal<T>(
+  context: ICommandHostContext,
+  run: () => Promise<TDevicesOutcome<T>>,
+  done: (value: T) => string,
+): Promise<ICommandResult> {
+  if (!context.canHandoffTerminal()) return refused('no-terminal');
+  try {
+    const outcome = await context.runWithTerminal(run);
+    return outcome.ok ? { success: true, message: done(outcome.value) } : refused(outcome.reason);
+  } catch (error) {
+    return {
+      success: false,
+      message: `Device identity operation failed: ${error instanceof Error ? error.message : 'unknown error'}`,
+    };
+  }
+}
+
+export async function executeDevicesCommand(
+  port: IDevicesCommandPort,
+  context: ICommandHostContext,
+  args: string,
+): Promise<ICommandResult> {
+  if (!isOperator(context)) {
+    return {
+      success: false,
+      message:
+        '`/devices` runs only for the operator at this terminal, never from a remote surface or the model.',
+    };
+  }
+  const trimmed = args.trim();
+  const spaceAt = trimmed.indexOf(' ');
+  const verb = (spaceAt === -1 ? trimmed : trimmed.slice(0, spaceAt)).toLowerCase();
+  // Device ids are case-sensitive base64url, so the remainder keeps its case.
+  const rest = spaceAt === -1 ? '' : trimmed.slice(spaceAt + 1).trim();
+
+  switch (verb) {
+    case '':
+    case 'list':
+      try {
+        return formatList(await port.list(), port.meshStatus?.());
+      } catch (error) {
+        return {
+          success: false,
+          message: `Device identity could not be read: ${error instanceof Error ? error.message : 'unknown error'}`,
+        };
+      }
+    case 'init':
+      return onTerminal(
+        context,
+        () => port.init(rest.length > 0 ? { name: rest } : {}),
+        (value) =>
+          [
+            `Device identity created. This device: ${short(value.deviceId)}; user ${short(value.userId)}.`,
+            `It holds signing key ${short(value.signingKeyId)}.`,
+            ...(value.keyStorage !== undefined
+              ? [`Private keys are kept in: ${value.keyStorage}.`]
+              : []),
+            'Keep the recovery phrase offline; it is the only way to recover this identity.',
+          ].join('\n'),
+      );
+    case 'recover':
+      return onTerminal(
+        context,
+        () => port.recover(),
+        (value) =>
+          [
+            `Recovered. New signing key ${short(value.signingKeyId)}; ${value.revokedSigningKeyCount} old signing key(s) revoked.`,
+            `This device (${short(value.deviceId)}) is certified again.`,
+            ...(value.droppedDeviceCount > 0
+              ? [
+                  `${value.droppedDeviceCount} other device(s) were certified by a retired signing key and must enrol again.`,
+                ]
+              : []),
+          ].join('\n'),
+      );
+    case 'revoke':
+      if (rest.length === 0)
+        return { success: false, message: 'Usage: /devices revoke <device-id>' };
+      return onTerminal(
+        context,
+        () => port.revoke(rest),
+        (value) =>
+          `Revoked ${value.name} (${short(value.deviceId)}). A new roster and revocation list were issued.`,
+      );
+    case 'add':
+      return onTerminal(
+        context,
+        () => port.add(),
+        (value) =>
+          [
+            `Enrolled ${value.name} (${short(value.deviceId)}). A new roster was issued.`,
+            ...(value.confirmed
+              ? []
+              : ['The new device did not confirm it kept its identity; check `/devices` there.']),
+          ].join('\n'),
+      );
+    case 'join':
+      return onTerminal(
+        context,
+        () => port.join(rest.length > 0 ? { name: rest } : {}),
+        (value) =>
+          [
+            `Joined the devices of user ${short(value.userId)}. This device: ${value.name} (${short(value.deviceId)}).`,
+            ...(value.keyStorage !== undefined
+              ? [`Private keys are kept in: ${value.keyStorage}.`]
+              : []),
+          ].join('\n'),
+      );
+    default:
+      return { success: false, message: `Unknown argument "${verb}". ${USAGE}` };
+  }
+}
+
+export class DevicesCommandSource implements ICommandSource {
+  readonly name = 'devices';
+
+  getCommands(): ICommand[] {
+    return [createDevicesCommandEntry()];
+  }
+}
+
+export function createDevicesCommandModule(port: IDevicesCommandPort): ICommandModule {
+  const command: ISystemCommand = createSystemCommandFromEntry(createDevicesCommandEntry(), {
+    requiresPermission: false,
+    lifecycle: 'inline',
+    execute: (context, args) => executeDevicesCommand(port, context, args),
+  });
+  return {
+    name: 'agent-command-devices',
+    commandSources: [new DevicesCommandSource()],
+    systemCommands: [command],
+  };
+}