fix(commands): surface execution failures

[web3dev1337]

Summary

• Normalize command registry results so validation, lookup, explicit false flags, top-level errors, and thrown failures return aligned ok and success values.
• Preserve version 1 plugin compatibility for void, primitive, and array handler returns. New plugin handlers have a documented explicit result contract.
• Propagate nested execution failures through Commander free-text, slash-command, command-palette, browser voice, and Whisper paths.
• Sanitize server-provided command errors before writing them to the terminal.
• Exercise /api/voice/command and the real multipart /api/whisper/command route with deterministic Playwright-only ffmpeg and Whisper stand-ins.

Relationship to #1081

This is complementary to #1081. The intended merged state keeps #1081's guarded executeAuthorizedCommand flow with this PR's strict registry-result check. Both PRs edit server/voiceCommandService.js, server/index.js, client/commander-panel.js, playwright.config.js, and documentation, so the second PR to land needs a manual merge. Do not choose one side wholesale.

Verification

• npm run test:unit -- --runInBand (122 suites, 806 tests)
• focused command, voice, and plugin unit tests (3 suites, 43 tests)
• npm run test:e2e -- tests/e2e/command-execution-results.spec.js (3 tests)
• node --check for all changed JavaScript entry points and test executables
• npm run check:command-surface (94 registry actions, 94 client handlers)
• npm run release:check-version
• npm run audit:public-release
• git diff --check

The broad UI Playwright run hits the existing safe-runner onboarding failure. The same commander-advice timeout reproduces on an untouched origin/main worktree with one worker. PR #1081 fixes that runner and also makes the shared-backend suite serial.

Two independent read-only reviews checked the result contract. The latest exact-delta review found no blockers and verified the real Whisper process path plus plugin loader compatibility.

[web3dev1337]

Independent exact-head review — CLEAN

Head reviewed: 64196ed85ccf69255186dfd5d958cfc045150e73 (verified: refs/pull/1083/head and headRefOid both match before and after review). Isolated detached worktree, no tracked files edited, no merge.

No actionable findings.

• No false success acknowledgements — commandRegistry.execute() now derives success/ok from the handler's actual payload instead of hard-coding success: true. A non-empty error field forces failure even if the handler never set success/ok (the exact gap that let a handler returning {error: '...'} alone report as success before). Malformed truthy-but-non-boolean flags (success: 'true', ok: 1) are correctly treated as failure, not coerced. A contradictory result (success:true + non-empty error) resolves to failure — errs toward not claiming success. voiceCommandService.processVoiceCommand no longer hard-codes executed: true; it's now tied to the real outcome.
• All action paths covered — traced and confirmed the fix is centralized in commandRegistry.execute(), so it's inherited for free by every caller: direct execute (/api/commander/execute), the parsed text pipeline (/api/commander/execute-text), voice (/api/voice/command), Whisper (/api/whisper/command), and plugin-registered commands (new pluginLoaderService test confirms legacy void/primitive plugin handlers still work).
• Backward compatibility — legacy handlers returning bare primitives, void, or arbitrary shapes with no success/ok/error keys still default to success (explicitly tested for null/undefined/string/number/boolean/array results, including exact-shape preservation). Client-side, both app.js and commander-panel.js carry an inlined fallback identical to command-execution.js's isSuccess, tested with the helper script explicitly removed (delete window.CommandExecutionResult).
• Client/server propagation — new client/command-execution.js (isSuccess/errorMessage) is loaded before both consumers in index.html; errorMessage correctly prioritizes nested result.error over parsed.error/top-level error/message, and strips control characters from terminal-rendered error text.
• Test truthfulness — unit specs execute the real client/server sources (vm for browser code, real commandRegistry/voiceCommandService/pluginLoaderService instances, not reimplementations); E2E hits real HTTP endpoints including a deterministic fake ffmpeg/whisper.cpp binary pair for a reproducible Whisper-backend round trip, and a real-browser Playwright page evaluating the actual client fallback path.

Ran everything live at this exact head:

• npx jest tests/unit/commandRegistry.execution.test.js tests/unit/commandExecutionClient.test.js tests/unit/voiceCommandService.test.js tests/unit/pluginLoaderService.test.js → 55/55 passed
• node scripts/run-e2e-safe.js tests/e2e/command-execution-results.spec.js → 3/3 passed

—
Reviewed by Claude (Sonnet 5) via Claude Code, read-only.