mesh-tools
652b00b25b
mesh/merge-gate checking again: the gate refused `unknown` because the controller judged with a node-engine validator pinned before mesh-host #117; mesh-co…
mesh/repo-check checking again: the gate refused `unknown` because the controller judged with a node-engine validator pinned before mesh-host #117; mesh-co…
mesh/delivery-group group feat/owned-paths checking: 0 of 2 member(s) ready
mesh/delivery superseded: a newer head of the same pull request
Every directory and archive resource carries `unknown`: move-out for a home folder whose program writes nothing there (the node-engine, delivered in mesh-host #117, moves the rest to ~/.local/state/mesh-moved/<module>/ with a list), module for ~/.ssh and ~/.claude, program elsewhere; `knows` keeps what a program or the operator relies on (powerlevel10k's compiled files, i3's scripts and the asus/g14 drop-ins, dunst's slack rule, betterbird's records, node-env's forge credential, issue 1033). Two shared folders are no longer declared. Each module's README says it. checks/owned holds every manifest to it; checks/sshdir stays while main's merge check runs it (issue 1035). Tests that pin a manifest follow the new key only. Reviewed in three rounds.
71 lines
3.9 KiB
Markdown
71 lines
3.9 KiB
Markdown
# mesh-cli
|
|
|
|
The operator's command on every node (novox/hq ADR 0272): `mesh-cli <command line>` asks the controller to run one
|
|
of its command lines, from wherever the operator is. In interactive zsh it is also `nox`.
|
|
|
|
```
|
|
nox status
|
|
nox settings show zsh --node <node>
|
|
nox settings set zsh '{"execute":"withhold"}' --node <node>
|
|
```
|
|
|
|
## What it places
|
|
|
|
| What | Where | How |
|
|
|---|---|---|
|
|
| the program | `/usr/local/bin/mesh-cli` | the `program` bundle, unpacked by an `archive` resource: the node-engine moves the one file in, refuses to write over a file it did not place, and takes out only that file when the module goes |
|
|
| the alias `nox` | the zsh module's mesh block in `~/.zshrc` | a `shell` contribution in the `normal` slot (ADR 0204) |
|
|
|
|
No link and no second copy. `/usr/local/bin` is on every account's `PATH` already, so the module contributes no
|
|
environment. The alias is interactive zsh only: a script, `sudo`, a cron line and any document meant to work
|
|
everywhere say `mesh-cli`. In interactive zsh the alias hides any other `nox` (Arch's `python-nox` installs
|
|
`/usr/bin/nox`); `command nox` still reaches it.
|
|
|
|
## How it is answered
|
|
|
|
`mesh-cli` holds no credential and reads no file of the mesh. It writes one request to the node-engine's socket
|
|
(the SDK's `go/cli`: the line, as words) and prints the one answer.
|
|
|
|
1. The node-engine reads which account is asking from the kernel, never from the program, and asks the controller
|
|
on its own node's subject.
|
|
2. The controller judges (ADR 0272 §4):
|
|
- **the controller's terminal**: the node's operator account, on the control-node. The line runs as the
|
|
operator typed it there.
|
|
- **an ordinary call**: the node's operator account on any other node, where agents may run as that account.
|
|
It meets every refusal of the generic `command` verb, and a change made at the terminal alone is refused with
|
|
the reason.
|
|
- **refused**: any other account, root included. Run it as yourself, not under `sudo`.
|
|
3. A line still running after ten seconds is followed by its call until it ends. `mesh-cli` prints standard
|
|
output and standard error as the command wrote them, says why a line was not the terminal or was refused, says
|
|
when the output was cut to fit one bus message, and exits with the command's status. When no answer comes in
|
|
time it says the line may have run and names its call; "nothing ran" is said only of a line no controller
|
|
took.
|
|
|
|
A process that runs for a verb (it carries `MESH_VERB`) is refused before anything is asked: a verb is never the
|
|
operator.
|
|
|
|
## What it does not do yet
|
|
|
|
- **No standard input.** A command that reads one gets nothing, and fails saying so.
|
|
- **No local files.** A path in a line names a file where the controller runs, read by the controller's account.
|
|
Give settings inline: `nox settings set <module> "$(cat settings.json)" --node <node>`.
|
|
- **No streaming.** The answer arrives when the command ends, within the controller's bound on a call (five
|
|
minutes). Interrupting `mesh-cli` stops the wait, not the command.
|
|
- **The `MESH_VERB` refusal is a courtesy.** A verb's process is refused before asking, but the gate is the
|
|
controller: it judges the account the node-engine vouches for, whatever the program says.
|
|
- **No other node is the terminal.** Phase 2 of ADR 0272 adds a node whose agents run under an account of their
|
|
own (ADR 0266), judged unable to become root.
|
|
|
|
## Tests
|
|
|
|
`go test ./...`: the module places exactly one file (one archive resource, one Go bundle compiled to the binary
|
|
alone); the line is asked as given and the answer printed with its exit; a reason, a refusal, a cut and an outcome not known
|
|
are said and a refusal never exits 0; a verb's process is refused before asking; an engine that does not answer
|
|
is said.
|
|
|
|
## Files it does not know
|
|
|
|
Each directory or archive this module declares says how it treats a file it did not write (ADR 0422, ADR 0416).
|
|
|
|
- `/usr/local/bin`: everything in it is the program's; the mesh moves nothing out (ADR 0422 §2).
|