decnet/cli.py

@@ -1761,11 +1761,12 @@ def db_reset(
 # Forgetting to register a new command is a role-boundary bug. Grep for
 # MASTER_ONLY when touching command registration.
 #
-# Worker-legitimate commands (NOT in these sets): agent, updater, forwarder.
+# Worker-legitimate commands (NOT in these sets): agent, updater, forwarder,
+# status (agents run deckies locally and should be able to inspect them).
 # ───────────────────────────────────────────────────────────────────────────
 MASTER_ONLY_COMMANDS: frozenset[str] = frozenset({
     "api", "swarmctl", "deploy", "redeploy", "teardown",
-    "probe", "collect", "mutate", "listener", "status",
+    "probe", "collect", "mutate", "listener",
     "services", "distros", "correlate", "archetypes", "web",
     "profiler", "sniffer", "db-reset",
 })

tests/test_cli.py

@@ -217,6 +217,28 @@ class TestStatusCommand:
         result = runner.invoke(app, ["status"])
         assert result.exit_code == 0
 
+    def test_status_available_in_agent_mode(self, monkeypatch):
+        # Agents run deckies locally and must be able to inspect them;
+        # `status` is intentionally NOT in MASTER_ONLY_COMMANDS.
+        import importlib
+
+        import decnet.cli as cli_mod
+
+        monkeypatch.setenv("DECNET_MODE", "agent")
+        monkeypatch.setenv("DECNET_DISALLOW_MASTER", "true")
+        reloaded = importlib.reload(cli_mod)
+        try:
+            names = {
+                (c.name or c.callback.__name__)
+                for c in reloaded.app.registered_commands
+            }
+            assert "status" in names
+            assert "deploy" not in names  # sanity: master-only still gated
+        finally:
+            monkeypatch.delenv("DECNET_MODE", raising=False)
+            monkeypatch.delenv("DECNET_DISALLOW_MASTER", raising=False)
+            importlib.reload(cli_mod)
+
 
 # ── mutate command ────────────────────────────────────────────────────────────