[robstolarz]

CLI side of plugin views (DEP-7248). Stacked on #606.

• session watch, create and attach now send client {name:"cli", blocks:1, view_kinds:["cli"]} and print each plugin view under a ── plugin: title ── rule whenever its rev changes.
• Text is sanitised before it is styled or measured, and lines are clipped to the terminal width. Links print as text (url) (https only, never OSC 8), images as [image: alt], and unknown blocks as their alt or "1 item not shown". Each view is capped at 40 lines.
• kinds.cli.compact and kinds.cli.keys are honoured. --views full|compact|none picks the mode.
• New depot agent session action <session> <plugin>/<view> <action-or-key> calls InvokeViewAction with one client_request_id across retries. Selects take --value and forms take --field; the server validates both.
• The proto mirrors the api contract with the same field numbers (ViewClient, PluginCall, views_json = 20, InvokeViewAction).

Test plan

• go test ./pkg/cmd/agent/ covers the todos fixture, every block type, the 40-line cap, compact mode, key fallback, hostile strings (CSI, OSC 52/8, C1, bidi, zero-width) in every field, rev-change printing, the client sent on GetSession and WatchSession, and action resolution, forms, selects and retry ids.
• Against a session with the todos plugin: depot agent session watch <id> shows the plan view, and depot agent session action <id> todos/plan 1 queues the call and the view updates.

Stack and decisions made without Rob

Stack (each PR is based on the one it names):

1. feat: add depot agent session commands #606 depot agent session commands
2. feat: send files to Depot agents and chat in attach #607 files and chat attach (on feat: add depot agent session commands #606)
3. this PR: plugin views (on feat: add depot agent session commands #606)

Decisions made without Rob:

• The command is session action, next to session attach, not a top-level agent action.
• No key presses inside attach: attach reads stdin a line at a time and has no key model. Each view prints a hint naming the command instead.
• No "open in app" footer, because the CLI has no session app URL.
• A view that changes mid-stream is printed once the partial response finishes, or as soon as another line cuts into it, since a cut partial prints whole at the end anyway.
• When stdout isn't a terminal, width falls back to COLUMNS, then 80.
• A collapsed section shows only its title and hides its controls.
• A non-https link shows only its text. Checked list items are muted.
• Invalid, duplicate or all-digit kinds.cli.keys fall back to numbers. A key that matches no control gets its own chip line.
• The action argument matches an action id first, then a chip key. Several values for one action need --value.
• Removed client-side confirm gate, prompter and server-duplicated validation. The CLI still parses checkbox fields as booleans and lists select options when --value is missing.
• When --value matches no control for an action, the first control for that action is used and the value is sent as given, so the server rejects a typo. With no --value, the first control is used unless controls for that action carry different values.
• A bad views_json prints one note and doesn't end the watch.
• Controls past the 40-line cap are hidden but still work through session action.
• PushView isn't in the CLI's proto, so it was left out.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NdhqP6oGqJMRJLwBU5Zepm

---

Note

Medium Risk
Introduces a new agent RPC that queues plugin actions on live sessions; risk is mitigated by server-side validation, CLI sanitisation, and broad tests, but wrong controls still affect sandbox plugin behavior.

Overview
Adds CLI support for DEP-7248 plugin views: while watching, creating, or attaching to a session, the CLI advertises a cli ViewClient, receives views_json, and prints plugin UIs (full, compact, or none via --views).

Rendering maps the block vocabulary to terminal lines with width clipping, optional styling, numbered/kinds.cli keys on controls, and aggressive sanitisation of untrusted plugin text (no escape sequences or misleading links).

Interaction is a new depot agent session action <session> <plugin>/<view> <key-or-action> that loads the current view, resolves the control (including --value for selects and --field for forms), and calls InvokeViewAction with retried, idempotent client_request_ids. Watch output hints at this command when controls are shown.

The agent proto/connect stubs gain ViewClient, PluginCall, views_json on get/watch responses, and the InvokeViewAction RPC.

^{Reviewed by Cursor Bugbot for commit 44b7a93. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

DEP-7248

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 47e4af8. Configure here.}

[cursor]

Stale comment

Risk: medium. Left a non-blocking comment: Cursor Bugbot reported 1 unresolved potential issue (views can stay hidden after a stream break), so this PR is not approved. Human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Risk: medium. Approved: Cursor Bugbot completed successfully, the prior finding is resolved, and no unresolved issues remain. Human review is not required for approval.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[robstolarz]

Superseded by #613 in the per-feature Depot agents stack (DEP-7247). Closing.