Land Depot agents CLI (DEP-7264)

[robstolarz]

Lands the approved Depot agents CLI stack in one PR (DEP-7264). The stacked PRs conflict pairwise, and the whole CLI can be verified locally. Each PR is a --no-ff merge onto main: #606 (607b222) → #611 (3df2ef5) → #607 (741e8d3) → #610 (4cfa7ed) → #609 (c02ffda) → #608 (44b7a93). After the merges, one fix commit validates skill names before pull --force removes anything (Bugbot finding). #612 (MCP management) is a draft and is merged in after approval.

Review: only the #609 and #608 merges have conflicts. Run git show --remerge-diff on each; resolution notes are in the details below.

Test plan (local, end to end)

• go build -o depot-dev ./cmd/depot and go test ./... pass.
• ./depot-dev --help has no agent. ./depot-dev agent --help lists pull, push and session, and agent session --help lists action, attach, create, interrupt, list, send and watch. session create --help shows --file, --stdin-file, --definition and --views (TestAgentIsHiddenFromRootHelp, TestAgentHelpStillWorks).
• session create/send/watch/attach against the in-process fake server: go test ./pkg/cmd/agent -run 'TestCreate|TestSend|TestWatch|TestAttach' -v (retries with one request ID, reconnects, settles, attach forwarding).
• Files and chat: -run 'TestUploadAttachments|TestAttach|TestChatModel|TestMediaType'.
• pull/push: -run 'Definition|TestPull|TestPush|TestForcedPull'. This includes the new TestForcedPullWithABadSkillNameKeepsTheExistingDefinition, which fails without the fix.
• Local MCP (attach --mcp-config) on a real stdio server: -run 'TestServe|TestStartServer|TestLoadMcpConfig'.
• Views and session action: -run 'TestRenderView|TestRenderTodos|TestRendererPrintsViews|TestInvokeViewAction|TestWatchAdvertises'.
• TODO(verify): session list, session interrupt and pull's RPC call have no fake-server test.

Conflict resolutions

Generated code (depot_agent.pb.go, depot_agent.connect.go): take either side, then buf generate. Re-running make generate produces no diff.

proto/depot/agent/v1/depot_agent.proto

• feat: offer local MCP servers to a Depot agent session on attach (DEP-7247) #609: union. After the definition RPCs, the service gets PullLocalMcpCalls and RespondLocalMcpCall. The definition messages come before the LocalMcp* messages.
• Render plugin views and run their controls from the CLI (DEP-7248) #608: union. Git's hunk spans the end of the service and the start of DepotAgentAttachment. rpc InvokeViewAction goes at the end of the service, after RespondLocalMcpCall, not inside the message.
• DepotAgentInput keeps both attachments = 8 (feat: send files to Depot agents and chat in attach #607) and optional PluginCall plugin_call = 20 (Render plugin views and run their controls from the CLI (DEP-7248) #608). Render plugin views and run their controls from the CLI (DEP-7248) #608 numbers its fields from 20, so nothing collides. The InvokeViewAction* messages follow RespondLocalMcpCallResponse.

pkg/cmd/agent/render.go: keep both imports, docker/go-units and x/term.

pkg/cmd/agent/session.go (#608)

• session create vars: HEAD's files, stdinFile and definition, plus views. session attach vars: auth, mcpConfig and views.
• attach Long: HEAD's text, plus Render plugin views and run their controls from the CLI (DEP-7248) #608's line about depot agent session action.
• attach RunE: HEAD's body (local MCP startup, chat vs stdin), with views passed to chatSession and attachSession. Both flag sets are kept.
• attachSession: keep HEAD's version, which delegates to attachLines. attachLines takes a new viewMode argument and calls r.SetViewMode(viewMode) after NewRenderer.

Compile-only fixes (no textual conflict): chatSession takes viewMode and passes it to attachLines. Four attachSession calls in files_test.go gain viewsFull.

depot agent session action stays under session, where #608 put it. Briefly split into #614–#619 and then rejoined here; those PRs are closed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01NdhqP6oGqJMRJLwBU5Zepm

---

Note

Medium Risk
Large new client surface (sessions, uploads, subprocess MCP) against Depot APIs; mitigated by hidden GA flag, retries/idempotency keys, and terminal output sanitization.

Overview
Adds a hidden depot agent command (not shown on depot --help) wired through NewDepotAgentClient and the Depot Agent Connect RPCs.

Sessions: session create|send|watch|list|interrupt|attach|action — create sessions with repo/model/definition/attachments, stream transcripts with reconnect and --until-idle, and attach for interactive chat (Bubble Tea when TTY) with /file, /steer, /interrupt, and plugin action for view controls.

Definitions: pull / push round-trip AGENTS.md, skills/*/SKILL.md, and plugins.json, with rollback via --version and skill name validation before pull --force deletes existing files.

Attachments: SHA-256 uploads via PrepareAttachmentUploads, git-aware directory packing, limits, and stdin/--stdin-file support.

Local MCP: optional --mcp-config on attach starts stdio MCP servers (modelcontextprotocol/go-sdk), offers tools to the session, and proxies PullLocalMcpCalls / RespondLocalMcpCall.

Output: terminal-safe rendering (streaming partials, plugin views full/compact/none) and sanitized errors.

^{Reviewed by Cursor Bugbot for commit ca97f5b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[linear-code]

DEP-7264

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 9998867. Configure here.}

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: Cursor Bugbot reported an unresolved medium-severity finding about pull destroying a local definition, so this is not approved. Human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[robstolarz]

From Claude: Superseded by the per-feature landing stack, so each feature can be verified on its own: #614 (session) → #615 (hide) → #616 (files) → #617 (definitions) → #618 (local MCP) → #619 (views). This branch is kept because CI uses it as a cli_branch input; its tree is identical to #619's head.

[cursor]

Stale comment

Risk: high. Left a non-blocking comment: Cursor Bugbot still has an unresolved medium-severity finding that pull can destroy a local definition, so this is not approved. Human review is needed and no reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Risk: high. Approved: Cursor Bugbot completed successfully on the current head with no unresolved findings that need human review.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

🔒 Agentic Security Review

Severity: MEDIUM

Description: Local MCP CallTool dispatch is not bound to the trimmed tool list this attach advertised on PullLocalMcpCalls.

Impact: A Depot-delivered CallTool can run stdio MCP tools that offerFor skipped or never listed (over-50, over-budget, empty/overlong name) while the live ClientSession stays connected. Those tools still execute in the attach user's process/environment and their results are returned on RespondLocalMcpCall. That is a real local side-effect and data-return path beyond the capability the CLI computed, notified the user about, and sent as Servers. It is not a new way to start an unconfigured server, but it does hide extra tools from the advertised allowlist on a server the user was told was only partly offered.

Remediation: In call(), resolve server_name in l.offers (or an allowlist built from the offer sent on this stream) and reject a missing/empty tool_name that is not in that server's offered Tools. Treat trimmed, over-budget, and overlong-name tools as denied even though the stdio session is still running. Optionally require a non-empty attachment_id from the matching Attached event before executing.