refactor(tui): adopt command shapes in plugins group (FEAT-020)

[aboimpinto]

Summary

FEAT-020 converts the TUI plugins command group (/plugin, alias plugins) to the external command shapes introduced by FEAT-014 and hosted by FEAT-015, following the pattern FEAT-018 (utility) and FEAT-019 (memory) established. The command files remain under codewhale-tui; this PR changes their execution boundary without physically moving them.

Baseline: the implementation is built on the v0.9.12 integration branch (codex/v0912-integration-20260823, 96bc9e79c), where FEAT-019 landed and the plugins group gained the marketplace and Kimi managed-import verbs. Those verbs joined the FEAT-020 scope per the migration rule ("every production command then present in that group joins the FEAT-020 scope").

This PR:

• adds the contract-owned CommandPluginContext facet with exact-minimum typed delegates: registry reads (summaries, detail, registry_diagnostics, validation_is_clean, len, is_empty, state_path, suggest), registry mutations (reload/rediscover + skill-cache, trust/enable/disable/revoke_trust), async-bridged bundle mutations returning synchronous portable receipts (install, update, uninstall, uninstall_path rollback, export, legacy_scan, Kimi managed_scan/managed_install, marketplace marketplace_state/marketplace_add/marketplace_remove/marketplace_install) and the PLUGIN = 1 << 10 capability bit with one envelope slot;
• converts the complete /plugin dispatch, render helpers, legacy-tools scan, Kimi managed import, and marketplace operations to portable contract values — 19 structured DTOs, byte-identical output preserved;
• registers /plugin via ContextualCommand::from_contract with the exact WORKSPACE | PRESENTATION | PLUGIN capability set (no SKILLS: skill-cache refresh and active-skill resets happen host-side in the adapter);
• maps all plugin catalog messages to stable keys through the presentation facet (key_to_plugin_message_id), with description_key: "cmd_plugin_description" and authoritative English fallback;
• removes plugins from both migration-frontier representations atomically;
• preserves names, aliases, usage strings, registry order, messages, diagnostics, review tokens, network approval/denial text, and safety checks byte-for-byte.

Tracking: EPIC-006 / FEAT-020 in umbrella Hmbown/CodeWhale#5316.

Dependency boundary

The intended dependency direction remains acyclic:

future codewhale-commands plugins group
                 |
                 v
codewhale-command-contract ---> codewhale-core / other acyclic leaf crates
                 ^
                 |
codewhale-tui implements the host facets

/plugin handlers no longer name or call concrete App, PluginRegistry, crate::plugins, or Config; the plugin facet delegates to the TUI-owned services through the adapter. The capability-driven dispatcher populates only declared slots.

Review hardening (PR #5525 lessons + post-completion audit)

• Missing required facets return Command capability unavailable: <facet> — zero .expect() in production handlers.
• D1 fix: the Kimi content-hash-mismatch rollback previously called crate::plugins::install::uninstall directly from the portable handler; it now crosses the boundary through the new CommandPluginContext::uninstall_path facet method, and the host adapter owns the crate::plugins call.
• Facet-count doc comments refreshed to eleven slots; preservation proven by parity tests with exact-string evidence.

Scope and behavior

• Only groups/plugins is migrated (one production command: /plugin).
• No command file moves out of codewhale-tui; no shared result/action ownership moves (FEAT-037); CommandResult and AppAction remain bounded temporary data references.
• No localization system extraction occurs (FEAT-036); the presentation facet maps existing MessageIds.
• Names, aliases, usage strings, registry order, help/palette discovery, messages, parsing, review-token semantics, marketplace/Kimi behavior, and safety checks remain unchanged.

Testing

• cargo fmt --all -- --check
• cargo test -p codewhale-command-contract --lib --locked — 23 passed
• cargo test -p codewhale-tui --lib --locked plugins-scoped — 205 passed; full TUI lib 11,394 passed / 0 failed at completion
• python3 scripts/test_check_command_crate_boundaries.py — 8 passed
• python3 scripts/check-command-migration-manifest.py --baseline-ref origin/codex/v0912-integration-20260823 — PASS (plugins absent from both frontier representations)
• python3 scripts/test_check_command_migration_manifest.py — 54 passed
• Strict workspace Clippy with -D warnings — 0 warnings
• git diff --check

Checklist

• Only /plugin migrated; zero concrete-App / PluginRegistry / crate::plugins / Config handler dependencies
• CommandPluginContext is the only new plugin-specific host facet; PLUGIN = 1 << 10
• /plugin declares exactly WORKSPACE | PRESENTATION | PLUGIN; no other facets
• Typed signatures and contract-owned result shapes for every operation
• Existing user-facing output byte-identical (parity tests with exact-string evidence)
• plugins removed from both migration-frontier representations
• Rollback routed through the facet (D1); host-helper extraction tracked for the FEAT-040 move
• Dispatcher exposes only declared facets; missing facets fail safely
• No manual UI verification required for this structural change

CI status

The base is the codex/v0912-integration-20260823 branch (where FEAT-019 landed and the plugins
group's marketplace/Kimi verbs live); the repo's ci.yml triggers only on master/main-targeted
PRs, so the full Actions matrix does not run here. Lightweight cross-repo checks (DCO, link,
GitGuardian, contribution gate) are green, and the full matrix was verified locally with the exact
configured gates: TUI lib 11,394/0, contract 23/23, boundary 8/8 + live, migration 54/54 + live
scan, strict workspace Clippy -D warnings 0, cargo fmt --check. The matrix will run on this
branch when the v0.9.12 integration branch reaches main.

No-Issue: FEAT-020 is tracked in umbrella #5316, which must remain open for the remaining decomposition FEATs.

Paulo Aboim Pinto

[Hmbown]

Landing into codex/v0912-integration-20260823 (the v0.9.12 stack), not main.

Rebase onto origin/main is not landable: FEAT-020 is stacked on FEAT-019 (CommandMemoryContext, CommandCapabilities::MEMORY = 1<<9, PLUGIN = 1<<10). Current main still has the FEAT-018 contract (no capability bitset, no memory facet), so cherry-picking the seven commits immediately conflicts in crates/command-contract/{facets,handler,tests}.rs and would require rewriting the slot numbering.

Verified on be4626fd891e1de48db16775c81ddc6891fa9cba:

• cargo fmt --all -- --check
• codewhale-command-contract --lib 23/23
• codewhale-tui --lib plugin filter 205/205
• command-crate-boundary 8/8; migration-manifest 54/54; live scan PASS (plugins removed from both frontiers)

Merging with a merge commit to keep Paulo's authorship.