zsh: let a machine withhold node-login-shell's execute

execute runs any command as the operator account, which can become root
without a person. The operator withholds it on the control-node until a
call needs a person's approval (hq ADR 0268); the other machines keep it
for now. The setting execute (serve by default) is written into a
root-owned file the tools bundle reads at start, and anything but serve
withholds the verb, so the machine's runtime does not offer it.

modules/zsh/test/withhold.test.ts

@@ -0,0 +1,45 @@
+// Withholding node-login-shell's `execute` on one machine (novox/hq ADR 0268). It runs any command as the
+// operator account, which can become root without a person, so the operator withholds it on the
+// control-node until a call to it needs a person's approval. The machine's choice is the module's
+// setting `execute`, written by the mesh into a root-owned file the tools bundle reads at start; the
+// bundle then registers the verb or not, so the machine's runtime does not offer it at all.
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { executeServed, readExecuteSetting, TOOLS_CONF_WORD } from "../shell.ts";
+
+test("execute is served only when the machine's setting says serve", () => {
+  assert.equal(executeServed("execute=serve\n").served, true);
+  assert.equal(executeServed("# the mesh's\nexecute = serve \n").served, true);
+  const withheld = executeServed("execute=withhold\n");
+  assert.equal(withheld.served, false);
+  assert.match(withheld.why, /withhold/);
+});
+
+test("anything but serve withholds it: a wrong value, no line, no file", () => {
+  for (const text of ["execute=yes\n", "execute=\n", "", "other=serve\n", "execute=serve-ish\n"]) {
+    const got = executeServed(text);
+    assert.equal(got.served, false, JSON.stringify(text));
+    assert.ok(got.why.length > 0, "it says why");
+  }
+  const none = executeServed(undefined);
+  assert.equal(none.served, false);
+  assert.match(none.why, /no setting/);
+});
+
+test("the setting is read from the file the bundle's word names", () => {
+  const dir = mkdtempSync(join(tmpdir(), "zsh-tools-"));
+  const file = join(dir, "tools.conf");
+  writeFileSync(file, "execute=serve\n");
+  assert.equal(readExecuteSetting({ [TOOLS_CONF_WORD]: file }).served, true);
+  writeFileSync(file, "execute=withhold\n");
+  assert.equal(readExecuteSetting({ [TOOLS_CONF_WORD]: file }).served, false);
+  const missing = readExecuteSetting({ [TOOLS_CONF_WORD]: join(dir, "absent.conf") });
+  assert.equal(missing.served, false);
+  assert.match(missing.why, /cannot read/);
+  const unnamed = readExecuteSetting({});
+  assert.equal(unnamed.served, false);
+  assert.match(unnamed.why, new RegExp(TOOLS_CONF_WORD));
+});