mesh-cli: give a terminal line the standard input mesh-cli carried, refuse it to any other, keep it nowhere

A secret given at the controller's terminal through mesh-cli (secret accept … --from -) never reached the
line: every line ran with no standard input. A line that runs as the terminal now reads what mesh-cli
carried (at most 64 KiB); an ordinary call carrying any is refused and nothing runs; the calls record keeps
only that some was given, the journal and the answer nothing of it.

internal/link/meshcli.go

@@ -41,6 +41,30 @@ type CLIAsked struct {
 	// (`session-<id>.scope` under the account's own slice), or empty: a service, a user unit. Only a login session is
 	// the terminal (novox/hq ADR 0272).
 	Session string `json:"session,omitempty"`
+	// Stdin is what mesh-cli's standard input held, at most CLIMaxStdin: given to a line that runs as the terminal,
+	// as its standard input, and refused with any other (novox/hq ADR 0259 §10, ADR 0272). It is kept nowhere: not in
+	// the calls record (cliRecorded), not in the journal, not in the answer.
+	Stdin []byte `json:"stdin,omitempty"`
+}
+
+// CLIMaxStdin bounds the standard input a mesh-cli line carries (mesh-sdk go/cli MaxStdin).
+const CLIMaxStdin = 64 << 10
+
+// cliRecorded is the request as the calls record keeps it: everything but the standard input, which the record
+// never holds in any form. The line itself is cut to its command word by the record's own rule (kept).
+func cliRecorded(raw json.RawMessage) json.RawMessage {
+	var m map[string]json.RawMessage
+	if json.Unmarshal(raw, &m) != nil {
+		return json.RawMessage(`{}`)
+	}
+	if _, given := m["stdin"]; given {
+		// Said as given, under a key of its own: the record still reads as the request it was (followCLI decodes
+		// it), and holds nothing of the input.
+		delete(m, "stdin")
+		m["stdin-given"] = json.RawMessage(`true`)
+	}
+	body, _ := json.Marshal(m)
+	return body
 }
 
 // CLIAnswer is what the controller answers, as the `result` of a call's answer: what the command printed, how it
@@ -135,6 +159,10 @@ func (b OverNATS) answerCLI(msg *nats.Msg, calls *CallLog, slots chan struct{},
 	case len(asked.Line) == 0:
 		respond(cliEnvelope(CLIRefusal("the request names no command, so nothing ran")))
 		return
+	case len(asked.Stdin) > CLIMaxStdin:
+		respond(cliEnvelope(CLIRefusal(fmt.Sprintf("standard input of more than %d bytes is not taken, so nothing ran",
+			CLIMaxStdin))))
+		return
 	}
 	select {
 	case slots <- struct{}{}:
@@ -145,7 +173,7 @@ func (b OverNATS) answerCLI(msg *nats.Msg, calls *CallLog, slots chan struct{},
 		return
 	}
 	limit := b.Conn.MaxPayload()
-	calls.serveCallWithin(CLISeat, node, msg.Data, msg.Reply, func(ctx context.Context, _ json.RawMessage) (any, error) {
+	calls.serveCallWithin(CLISeat, node, cliRecorded(msg.Data), msg.Reply, func(ctx context.Context, _ json.RawMessage) (any, error) {
 		return fitCLI(handle(ctx, node, asked), limit-4096), nil
 	}, msg.Respond, limit, logger)
 }