addressing claude review

pgondhi987 · pgondhi987 · commit bd6bd55aa7c0 · 2026-05-07T08:41:37.000Z
diff --git a/extensions/active-memory/index.test.ts b/extensions/active-memory/index.test.ts
@@ -440,37 +440,33 @@ describe("active-memory plugin", () => {
     expect(runEmbeddedPiAgent).toHaveBeenCalledTimes(1);
   });
 
-  it("blocks write-scoped gateway callers from changing global active-memory config", async () => {
+  it("blocks gateway callers without admin scope from changing global active-memory config", async () => {
     const command = registeredCommands["active-memory"];
 
-    const offResult = await command.handler({
-      channel: "gateway",
-      isAuthorizedSender: true,
-      gatewayClientScopes: ["operator.write"],
-      args: "off --global",
-      commandBody: "/active-memory off --global",
-      config: {},
-      requestConversationBinding: async () => ({ status: "error", message: "unsupported" }),
-      detachConversationBinding: async () => ({ removed: false }),
-      getCurrentConversationBinding: async () => null,
-    });
-
-    expect(offResult.text).toContain("requires operator.admin");
-    expect(api.runtime.config.replaceConfigFile).not.toHaveBeenCalled();
+    for (const { args, gatewayClientScopes } of [
+      { args: "off --global", gatewayClientScopes: ["operator.write"] },
+      { args: "on --global", gatewayClientScopes: ["operator.write"] },
+      { args: "disable --global", gatewayClientScopes: ["operator.write"] },
+      { args: "enable --global", gatewayClientScopes: ["operator.write"] },
+      { args: "disabled --global", gatewayClientScopes: ["operator.write"] },
+      { args: "enabled --global", gatewayClientScopes: ["operator.write"] },
+      { args: "off --global", gatewayClientScopes: [] },
+    ]) {
+      const result = await command.handler({
+        channel: "gateway",
+        isAuthorizedSender: true,
+        gatewayClientScopes,
+        args,
+        commandBody: `/active-memory ${args}`,
+        config: {},
+        requestConversationBinding: async () => ({ status: "error", message: "unsupported" }),
+        detachConversationBinding: async () => ({ removed: false }),
+        getCurrentConversationBinding: async () => null,
+      });
 
-    const onResult = await command.handler({
-      channel: "gateway",
-      isAuthorizedSender: true,
-      gatewayClientScopes: ["operator.write"],
-      args: "on --global",
-      commandBody: "/active-memory on --global",
-      config: {},
-      requestConversationBinding: async () => ({ status: "error", message: "unsupported" }),
-      detachConversationBinding: async () => ({ removed: false }),
-      getCurrentConversationBinding: async () => null,
-    });
+      expect(result.text).toContain("global enable/disable changes require operator.admin");
+    }
 
-    expect(onResult.text).toContain("requires operator.admin");
     expect(api.runtime.config.replaceConfigFile).not.toHaveBeenCalled();
   });
 
diff --git a/extensions/active-memory/index.ts b/extensions/active-memory/index.ts
@@ -786,6 +786,9 @@ function requiresAdminToMutateActiveMemoryGlobal(gatewayClientScopes?: readonly
   return Array.isArray(gatewayClientScopes) && !gatewayClientScopes.includes("operator.admin");
 }
 
+const ACTIVE_MEMORY_GLOBAL_MUTATION_ADMIN_REQUIRED_TEXT =
+  "⚠️ /active-memory global enable/disable changes require operator.admin for gateway clients.";
+
 function normalizePluginConfig(pluginConfig: unknown): ResolvedActiveRecallPluginConfig {
   const raw = (
     pluginConfig && typeof pluginConfig === "object" ? pluginConfig : {}
@@ -2823,12 +2826,12 @@ export default definePluginEntry({
               text: `Active Memory: ${isActiveMemoryGloballyEnabled(currentConfig) ? "on" : "off"} globally.`,
             };
           }
+          if (requiresAdminToMutateActiveMemoryGlobal(ctx.gatewayClientScopes)) {
+            return {
+              text: ACTIVE_MEMORY_GLOBAL_MUTATION_ADMIN_REQUIRED_TEXT,
+            };
+          }
           if (action === "on" || action === "enable" || action === "enabled") {
-            if (requiresAdminToMutateActiveMemoryGlobal(ctx.gatewayClientScopes)) {
-              return {
-                text: "⚠️ /active-memory on|off --global requires operator.admin for gateway clients.",
-              };
-            }
             const nextConfig = updateActiveMemoryGlobalEnabledInConfig(currentConfig, true);
             await api.runtime.config.replaceConfigFile({
               nextConfig,
@@ -2838,11 +2841,6 @@ export default definePluginEntry({
             return { text: "Active Memory: on globally." };
           }
           if (action === "off" || action === "disable" || action === "disabled") {
-            if (requiresAdminToMutateActiveMemoryGlobal(ctx.gatewayClientScopes)) {
-              return {
-                text: "⚠️ /active-memory on|off --global requires operator.admin for gateway clients.",
-              };
-            }
             const nextConfig = updateActiveMemoryGlobalEnabledInConfig(currentConfig, false);
             await api.runtime.config.replaceConfigFile({
               nextConfig,
