mesh-cli: the operator's command on every node, nox in zsh (hq ADR 0272)

The records send the operator to "the controller's terminal", and on the
control-node nothing answered (hq issue 343). mesh-cli is a module of its
own, assigned to every node and built from its own directory: its program
is unpacked into /usr/local/bin by an archive resource (one file, no link,
no copy), and its zsh contribution makes nox its alias. It holds no
credential: it asks the node-engine on its machine over the SDK's go/cli
socket, and prints the controller's answer with its exit.

The agent module's refusals and README, and the route adapter's README, now
name `mesh-cli settings set …` on the control-node instead of a
mesh-controller command nobody could type; a settings file is passed inline,
since a path would be read where the controller runs.

modules/mesh-cli/cmd/mesh-cli/main_test.go

@@ -0,0 +1,95 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"net"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"git.novox.be/novox/mesh-sdk/go/cli"
+)
+
+// engine answers one connection on a socket of the test's own as the node-engine would, and says what it was asked.
+func engine(t *testing.T, answer cli.Answer) <-chan []string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "cli.sock")
+	l, err := net.Listen("unix", path)
+	if err != nil {
+		t.Skipf("no unix socket here: %v", err)
+	}
+	t.Cleanup(func() { l.Close() })
+	before := socket
+	socket = path
+	t.Cleanup(func() { socket = before })
+	asked := make(chan []string, 1)
+	go func() {
+		conn, err := l.Accept()
+		if err != nil {
+			return
+		}
+		defer conn.Close()
+		req, err := cli.ReadRequest(conn)
+		if err != nil {
+			return
+		}
+		asked <- req.Line
+		_ = cli.WriteAnswer(conn, answer)
+	}()
+	return asked
+}
+
+// The line is asked as given, what the controller printed is printed, and its exit is mesh-cli's.
+func TestTheLineIsAskedAndTheAnswerIsPrinted(t *testing.T) {
+	t.Setenv("MESH_VERB", "")
+	asked := engine(t, cli.Answer{Stdout: []byte("out\n"), Stderr: []byte("err\n"), Exit: 3, Terminal: true, Why: "the terminal"})
+	var out, errOut bytes.Buffer
+	code := run(context.Background(), []string{"settings", "set", "zsh", `{"execute":"withhold"}`}, &out, &errOut)
+	if line := <-asked; strings.Join(line, "|") != `settings|set|zsh|{"execute":"withhold"}` {
+		t.Fatalf("asked %q", line)
+	}
+	if code != 3 || out.String() != "out\n" || errOut.String() != "err\n" {
+		t.Fatalf("exit %d, stdout %q, stderr %q", code, out.String(), errOut.String())
+	}
+}
+
+// Not the terminal, refused, or cut: each is said, and a refusal never exits 0.
+func TestWhyARefusalAndACutAreSaid(t *testing.T) {
+	t.Setenv("MESH_VERB", "")
+	engine(t, cli.Answer{Why: "not the controller's terminal: agents on laptop may run as operator",
+		Refused: "set at the controller's terminal only", Cut: true})
+	var out, errOut bytes.Buffer
+	code := run(context.Background(), []string{"settings", "set", "x", "{}"}, &out, &errOut)
+	said := errOut.String()
+	if code == 0 || !strings.Contains(said, "not the controller's terminal") || !strings.Contains(said, "terminal only") ||
+		!strings.Contains(said, "cut") {
+		t.Fatalf("exit %d, said %q", code, said)
+	}
+}
+
+// A verb's own process is never the operator: refused before anything is asked.
+func TestAVerbsProcessIsRefusedBeforeAsking(t *testing.T) {
+	t.Setenv("MESH_VERB", "command")
+	before := socket
+	socket = filepath.Join(t.TempDir(), "nothing-listens.sock")
+	t.Cleanup(func() { socket = before })
+	var out, errOut bytes.Buffer
+	if code := run(context.Background(), []string{"status"}, &out, &errOut); code != 1 ||
+		!strings.Contains(errOut.String(), "never the operator") {
+		t.Fatalf("exit %d, said %q", code, errOut.String())
+	}
+}
+
+// An engine that does not answer is said, with where it was asked.
+func TestAnEngineThatDoesNotAnswerIsSaid(t *testing.T) {
+	t.Setenv("MESH_VERB", "")
+	before := socket
+	socket = filepath.Join(t.TempDir(), "nothing-listens.sock")
+	t.Cleanup(func() { socket = before })
+	var out, errOut bytes.Buffer
+	if code := run(context.Background(), []string{"status"}, &out, &errOut); code != 1 ||
+		!strings.Contains(errOut.String(), "does not answer") {
+		t.Fatalf("exit %d, said %q", code, errOut.String())
+	}
+}