@robota-sdk/agent-command 3.0.0-beta.82 → 3.0.0-beta.84

package/src/peers/__tests__/peers-command.test.ts

@@ -142,6 +142,84 @@ describe('what the operator is told', () => {
   });
 });
 
+describe('linked devices of the device mesh', () => {
+  const DEVICE = 'D'.repeat(43);
+
+  function hostWithDevices(
+    peers: readonly TPeerSummary[],
+    devices: readonly { deviceId: string; name?: string; locality: 'same-host' | 'another-host' }[],
+  ): ICommandHostAdapterAccess {
+    return {
+      getCommandHostAdapters: () => ({
+        localPeers: { list: () => peers, ownSessionId: () => OWN, listDevices: () => devices },
+      }),
+    } as ICommandHostAdapterAccess;
+  }
+
+  it('lists a linked device beside the sessions on this host, addressable by its id', async () => {
+    const result = await executePeersCommand(
+      hostWithDevices(
+        [
+          { sessionId: OWN, liveness: 'alive' },
+          { sessionId: 'session-other', liveness: 'alive' },
+        ],
+        [{ deviceId: DEVICE, name: 'desktop', locality: 'another-host' }],
+      ),
+    );
+    expect(result.success).toBe(true);
+    expect(result.message).toContain('session-other');
+    expect(result.message).toMatch(new RegExp(`${DEVICE}\\s+desktop\\s+on another machine`));
+    expect(result.message).toContain('/peers send <session-or-device-id>');
+  });
+
+  it('lists a linked device even when this is the only session on this host', async () => {
+    const result = await executePeersCommand(
+      hostWithDevices(
+        [{ sessionId: OWN, liveness: 'alive' }],
+        [{ deviceId: DEVICE, locality: 'same-host' }],
+      ),
+    );
+    expect(result.message).not.toContain('No other live session');
+    expect(result.message).toMatch(new RegExp(`${DEVICE}\\s+on this machine`));
+  });
+});
+
+describe('when local discovery is off but the device mesh is not', () => {
+  const DEVICE = 'D'.repeat(43);
+
+  function hostWithoutDiscovery(
+    devices: readonly { deviceId: string; name?: string; locality: 'same-host' | 'another-host' }[],
+  ): ICommandHostAdapterAccess {
+    return {
+      getCommandHostAdapters: () => ({
+        localPeers: {
+          list: () => [],
+          ownSessionId: () => OWN,
+          listDevices: () => devices,
+          localDiscoveryOff: 'the rendezvous directory was not admitted',
+        },
+      }),
+    } as ICommandHostAdapterAccess;
+  }
+
+  it('lists the linked devices and says why sessions on this host are not listed', async () => {
+    const result = await executePeersCommand(
+      hostWithoutDiscovery([{ deviceId: DEVICE, name: 'desktop', locality: 'another-host' }]),
+    );
+    expect(result.success).toBe(true);
+    expect(result.message).toMatch(new RegExp(`${DEVICE}\\s+desktop\\s+on another machine`));
+    expect(result.message).toContain('not admitted');
+    expect(result.message).not.toContain('Live sessions');
+    expect(result.message).toContain('/peers send <device-id>');
+  });
+
+  it('with no device linked, says discovery is off rather than that nobody is there', async () => {
+    const result = await executePeersCommand(hostWithoutDiscovery([]));
+    expect(result.message).toContain('not admitted');
+    expect(result.message).not.toContain('No other live session');
+  });
+});
+
 describe('when the host wires no discovery', () => {
   it('says the feature is unavailable rather than reporting no peers', async () => {
     // The two are different facts and the difference matters: "nobody is there" invites the operator

package/src/peers/peers-command-module.ts

@@ -8,7 +8,7 @@ export function createPeersCommandEntry(): ICommand {
     name: 'peers',
     displayName: 'Peers',
     description:
-      'List the other live sessions on this host, send one a message, or send one a copy of a file',
+      "List the other live Robota sessions on this host and the user's other devices linked over the device mesh, send one a message, or send one a copy of a file. Returns the sessions and devices with the ids to address them by (linked devices even when local discovery is off and sessions on this host cannot be listed), or how a send ended. User-only: the model cannot run it; it answers a peer's message with its reply tool, and when the user wants to reach another session or device, suggest they run `/peers`.",
     source: 'peers',
     // The model does not enumerate the operator's other sessions. Discovery is an operator-facing
     // view of who is at the machine, which is a fact about the person and not about the task.

package/src/peers/peers-command.ts

@@ -33,6 +33,16 @@ function describe(peer: TPeerSummary, ownSessionId: string): string {
   return `  ${peer.sessionId}${peer.name ? `  ${peer.name}` : ''}  status ${status}${self ? '' : workspace(peer)}${liveness}${self}`;
 }
 
+type TDeviceSummary = ReturnType<
+  NonNullable<NonNullable<ICommandHostAdapters['localPeers']>['listDevices']>
+>[number];
+
+/** A linked device: its full id, since that is what `send` takes, and where it runs. */
+function describeDevice(device: TDeviceSummary): string {
+  const where = device.locality === 'same-host' ? 'on this machine' : 'on another machine';
+  return `  ${device.deviceId}${device.name ? `  ${device.name}` : ''}  ${where}`;
+}
+
 /** The relation this session verified. A claim it could not confirm is named as such, not shown. */
 function workspace(peer: TPeerSummary): string {
   if (peer.workspaceClaim === 'mismatched') return '  workspace claim mismatched, not believed';
@@ -165,6 +175,21 @@ export async function executePeersCommand(
   const sendVerb = /^send(?=\s|$)/.exec(trimmed);
   if (sendVerb !== null) return executeSend(adapter, trimmed.slice(sendVerb[0].length));
 
+  const devices = adapter.listDevices?.() ?? [];
+  const discoveryOff = adapter.localDiscoveryOff;
+  if (discoveryOff !== undefined) {
+    const off = `Sessions on this host are not listed: local peer discovery is off for this session (${discoveryOff}).`;
+    return {
+      message:
+        devices.length === 0
+          ? `${off}\nNo device is linked right now.`
+          : `Linked devices:\n${devices.map(describeDevice).join('\n')}\n\n${off}` +
+            `\n\nSend to one: /peers send <device-id> <message>` +
+            `\nSend a file: /peers send-file <device-id> <path>`,
+      success: true,
+    };
+  }
+
   const own = adapter.ownSessionId();
   // The workspace-judged listing when the host has one; it reads git, so only this view asks for it.
   const peers = (
@@ -172,7 +197,7 @@ export async function executePeersCommand(
   ).filter(addressable);
   const others = peers.filter((peer) => peer.sessionId !== own);
 
-  if (others.length === 0) {
+  if (others.length === 0 && devices.length === 0) {
     return {
       message:
         'No other live session is announced. Start a second session on this host, as this user, ' +
@@ -181,11 +206,15 @@ export async function executePeersCommand(
     };
   }
 
-  const lines = peers.map((peer) => describe(peer, own));
+  const sections = [`Live sessions:\n${peers.map((peer) => describe(peer, own)).join('\n')}`];
+  if (devices.length > 0) {
+    sections.push(`Linked devices:\n${devices.map(describeDevice).join('\n')}`);
+  }
+  const target = devices.length > 0 ? '<session-or-device-id>' : '<session-id>';
   return {
     message:
-      `Live sessions:\n${lines.join('\n')}\n\nSend to one: /peers send <session-id> <message>` +
-      '\nSend a file: /peers send-file <session-id> <path>',
+      `${sections.join('\n\n')}\n\nSend to one: /peers send ${target} <message>` +
+      `\nSend a file: /peers send-file ${target} <path>`,
     success: true,
   };
 }

package/src/plugin/__tests__/plugin-command-module.test.ts

@@ -46,7 +46,10 @@ function createCommandSessionRuntime() {
   });
 }
 
-function createCommandHostContext(adapter?: ICommandPluginAdapter) {
+function createCommandHostContext(
+  adapter?: ICommandPluginAdapter,
+  locality?: 'local' | 'remote',
+) {
   const checkpoint = {
     id: 'checkpoint_1',
     sessionId: 'session_1',
@@ -66,6 +69,7 @@ function createCommandHostContext(adapter?: ICommandPluginAdapter) {
       }),
       getAutoCompactThreshold: () => 0.8,
       getCommandHostAdapters: () => (adapter === undefined ? {} : { plugin: adapter }),
+      ...(locality ? { getCommandSurfaceLocality: () => locality } : {}),
       compactContext: async () => undefined,
       getCwd: () => '/workspace',
       listCommands: () => [],
@@ -186,6 +190,82 @@ describe('executePluginCommand', () => {
       message: 'Usage: /plugin disable <name>@<marketplace>',
     });
   });
+
+  it('lists installed plugins through the adapter, for the Settings screen (#3282 §4 part b-2)', async () => {
+    const adapter = createPluginAdapter({
+      listInstalled: vi.fn().mockResolvedValue([
+        { name: 'formatter@robota', description: 'Formats code.', enabled: true },
+        { name: 'linter@robota', description: 'Lints code.', enabled: false },
+      ]),
+    });
+
+    const result = await executePluginCommand(createCommandHostContext(adapter), 'list');
+
+    expect(result.success).toBe(true);
+    expect(result.data).toEqual({
+      plugins: [
+        { name: 'formatter@robota', description: 'Formats code.', enabled: true },
+        { name: 'linter@robota', description: 'Lints code.', enabled: false },
+      ],
+    });
+    expect(result.message).toContain('formatter@robota');
+    expect(result.message).toContain('linter@robota (disabled)');
+  });
+
+  it('no plugins installed reports a plain empty list', async () => {
+    const adapter = createPluginAdapter();
+    const result = await executePluginCommand(createCommandHostContext(adapter), 'list');
+    expect(result).toEqual({
+      success: true,
+      message: 'No plugins are installed.',
+      data: { plugins: [] },
+    });
+  });
+
+  describe('install/uninstall stay local-surface-only (#3282 §4 part b-2)', () => {
+    it('runs install from a local surface', async () => {
+      const adapter = createPluginAdapter();
+      const result = await executePluginCommand(
+        createCommandHostContext(adapter, 'local'),
+        'install demo@community',
+      );
+      expect(result.success).toBe(true);
+      expect(adapter.install).toHaveBeenCalledWith('demo@community');
+    });
+
+    it('refuses install from a remote surface with a plain message, writing nothing', async () => {
+      const adapter = createPluginAdapter();
+      const result = await executePluginCommand(
+        createCommandHostContext(adapter, 'remote'),
+        'install demo@community',
+      );
+      expect(result.success).toBe(false);
+      expect(result.message).toMatch(/only works from the desktop app or the page opened here/);
+      expect(result.message).toMatch(/not from a remote device/);
+      expect(adapter.install).not.toHaveBeenCalled();
+    });
+
+    it('refuses uninstall from a remote surface with a plain message, writing nothing', async () => {
+      const adapter = createPluginAdapter();
+      const result = await executePluginCommand(
+        createCommandHostContext(adapter, 'remote'),
+        'uninstall demo@community',
+      );
+      expect(result.success).toBe(false);
+      expect(result.message).toMatch(/not from a remote device/);
+      expect(adapter.uninstall).not.toHaveBeenCalled();
+    });
+
+    it('never refuses enable/disable/reload from a remote surface — only install/uninstall run new code', async () => {
+      const adapter = createPluginAdapter();
+      const enableResult = await executePluginCommand(
+        createCommandHostContext(adapter, 'remote'),
+        'enable demo@community',
+      );
+      expect(enableResult.success).toBe(true);
+      expect(adapter.enable).toHaveBeenCalledWith('demo@community');
+    });
+  });
 });
 
 describe('executeReloadPluginsCommand', () => {

package/src/plugin/plugin-command.ts

@@ -3,9 +3,13 @@ import {
   resolvePluginCommandAdapter,
 } from '@robota-sdk/agent-framework';
 
-import type { ICommandHostAdapterAccess } from '@robota-sdk/agent-framework';
+import type { ICommandHostAdapterAccess, ICommandHostWorkspace } from '@robota-sdk/agent-framework';
 import type { ICommandPluginAdapter, ICommandResult } from '@robota-sdk/agent-interface-command';
 
+/** What `/plugin` reaches: its adapter port, and — for install/uninstall — this connection's locality. */
+export type TPluginCommandContext = ICommandHostAdapterAccess &
+  Partial<Pick<ICommandHostWorkspace, 'getCommandSurfaceLocality'>>;
+
 function getSubcommandParts(args: string): { subcommand: string; subArgs: string } {
   const parts = args
     .trim()
@@ -28,6 +32,20 @@ function getPluginAdapter(context: ICommandHostAdapterAccess): ICommandPluginAda
   return resolvePluginCommandAdapter(context);
 }
 
+const REMOTE_INSTALL_REFUSAL =
+  'Installing and uninstalling plugins runs code on this computer, so it only works from the ' +
+  'desktop app or the page opened here — not from a remote device.';
+
+/**
+ * #3282 §4 part b-2: the same rule the GUI's Settings screen applies before it ever sends the
+ * write — installing/uninstalling stays local-surface-only because it runs third-party code.
+ * `getCommandSurfaceLocality` absent (an older host, a test double, the in-process TUI) reads as
+ * `'local'`, matching the allow-by-default posture the rest of the command layer already uses.
+ */
+function isRemoteSurface(context: TPluginCommandContext): boolean {
+  return (context.getCommandSurfaceLocality?.() ?? 'local') === 'remote';
+}
+
 async function executePluginOperation(
   context: ICommandHostAdapterAccess,
   operation: (adapter: ICommandPluginAdapter) => Promise<string>,
@@ -123,9 +141,10 @@ function executePluginManager(): ICommandResult {
 }
 
 function executeInstallCommand(
-  context: ICommandHostAdapterAccess,
+  context: TPluginCommandContext,
   pluginId: string,
 ): Promise<ICommandResult> {
+  if (isRemoteSurface(context)) return Promise.resolve(usage(REMOTE_INSTALL_REFUSAL));
   return executePluginIdOperation(
     context,
     pluginId,
@@ -138,9 +157,10 @@ function executeInstallCommand(
 }
 
 function executeUninstallCommand(
-  context: ICommandHostAdapterAccess,
+  context: TPluginCommandContext,
   pluginId: string,
 ): Promise<ICommandResult> {
+  if (isRemoteSurface(context)) return Promise.resolve(usage(REMOTE_INSTALL_REFUSAL));
   return executePluginIdOperation(
     context,
     pluginId,
@@ -152,6 +172,27 @@ function executeUninstallCommand(
   );
 }
 
+/** #3282 §4 part b-2: the Settings screen's Plugins section reads through this, like `/mcp status`. */
+async function executeListInstalledCommand(
+  context: ICommandHostAdapterAccess,
+): Promise<ICommandResult> {
+  const adapter = getPluginAdapter(context);
+  if (adapter === undefined) {
+    return { success: true, message: 'Plugin management is not available.', data: { plugins: [] } };
+  }
+  try {
+    const plugins = await adapter.listInstalled();
+    const message =
+      plugins.length === 0
+        ? 'No plugins are installed.'
+        : `Installed plugins:\n${plugins.map((plugin) => `  ${plugin.name}${plugin.enabled ? '' : ' (disabled)'} — ${plugin.description}`).join('\n')}`;
+    return { success: true, message, data: { plugins } };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { success: false, message: `Plugin error: ${message}` };
+  }
+}
+
 function executeEnableCommand(
   context: ICommandHostAdapterAccess,
   pluginId: string,
@@ -183,7 +224,7 @@ function executeDisableCommand(
 }
 
 export async function executePluginCommand(
-  context: ICommandHostAdapterAccess,
+  context: TPluginCommandContext,
   args: string,
 ): Promise<ICommandResult> {
   const { subcommand, subArgs } = getSubcommandParts(args);
@@ -191,6 +232,8 @@ export async function executePluginCommand(
     case '':
     case 'manage':
       return executePluginManager();
+    case 'list':
+      return executeListInstalledCommand(context);
     case 'install':
       return executeInstallCommand(context, subArgs);
     case 'uninstall':

package/src/provider/__tests__/org-policy.test.ts

@@ -97,6 +97,10 @@ describe('org policy enforcement in provider commands', () => {
   });
 
   it('allows /provider switch when target is in allowedProviders', async () => {
+    // #3282: the switch now validates the target profile against `providerDefinitions` before
+    // writing anything, the same way the hot-swap it triggers would build the provider — so the
+    // profile needs a resolvable credential, same as a real one would.
+    vi.stubEnv('OPENAI_API_KEY', 'sk-test');
     const { adapter } = createSettingsAdapter({
       currentProvider: 'anthropic',
       providers: {