# Native TestClient command shell

The `test-client` binary is a native Rust multi-client shell. It does not load
the former C# executable or start a CLR process. The command registry owns the
implemented system, communication, inventory, appearance, asset, movement,
object, parcel, estate, and grid commands, and reports the remaining upstream
targets through `pending_test_client_commands()`.

## World command behavior

Movement commands use `AgentManager` movement updates, autopilot, teleport,
sit, stand, flight, and home APIs. Timed movement is limited to 60 seconds and
checks cancellation while sending updates. `follow` retains the selected
avatar and refreshes autopilot whenever a coarse-location update moves it;
`follow off` cancels autopilot. Region crossing is bounded to 60 seconds.

Object queries snapshot the current simulator caches before filtering.
Searches and parcel/map results are capped at 65,535 entries. Linkset export
requires ownership, sorts serialized LLSD deterministically, limits a linkset
to 10,000 primitives, and downloads each unique texture as both JPEG 2000 and
TGA. Import accepts only a bounded LLSD array, waits for each native rez event,
applies primitive properties, links children, and restores root rotation and
permissions. Individual asset and terrain files are limited to 64 MiB. Regular
expressions are limited in source and compiled size.

`textures on` downloads the textures already visible in the current simulator
and subscribes newly observed primitives for deduplicated native asset-cache
requests. `--gettextures` enables that subscription at login. Parcel, grid,
wind, owner, selection, covenant, and terrain commands use their corresponding
native managers and propagate cancellation through request/reply waits.

## Live-operation gates

Read-only queries need no privilege flag. Every movement, teleport, derez,
permission, import, tree, and terrain mutation requires both
`--allow-live-mutations` at process startup and `--confirm` on the command.
Import and terrain upload additionally require `--allow-spending`; estate
terrain download/upload additionally require `--allow-estate-actions`.
Consequently the default invocation cannot move an avatar, alter or create an
object, upload an asset, or invoke an estate-owner action.

Output paths reject parent-directory traversal. Timeouts, cancellation, file
limits, result limits, and linkset limits apply equally to live and fake-grid
runs. Passwords and login secrets continue to pass through the shell's common
redaction path.

## Offline verification

Fake scripts can seed the same command layer with `!world-region`,
`!world-avatar`, `!world-prim`, `!world-parcel`, `!world-parcel-owner`,
`!world-parcel-object`, `!world-grid-region`, `!world-layer`,
`!world-agent-location`, `!world-estate`, `!world-asset`, and `!world-syntax`
tab-separated directives. These fixtures never open a network connection.

Run the issue-focused compatibility gate with:

```text
cargo test -p libremetaverse-programs --test test_client_world_cli
```

The gate drives every command owned by the movement/object/land/grid issue,
checks the exact fake backend calls, verifies destructive-operation guards,
round-trips an exported linkset through import, compares two exports byte for
byte, and validates generated terrain, texture, and TGA files.