Merge main (hq ADR 0266) into the mesh-cli answer, and close what the confirmation review found

- The generic command verb only reads now (commandReads) and terminal-only
  commands are refused through any verb (terminalOnly). mesh-cli's
  ordinary line made neither check: `node account`, `token issue` and
  `secret export` from another node would have run. It now meets both, in
  the one function the command verb shares.
- The serving controller marks itself and its children never the terminal
  (ADR 0266); a line mesh-cli runs as the terminal drops that mark and
  carries MESH_CLI_TERMINAL, so it reads as the terminal it is.
- Two withholding tests searched the answer's text while JSON writes bytes
  as base64, so they held nothing. They search both now, each proved by
  disabling what it guards (Shown, the bus withholding, `calls` via Get).
- The control-node refusal is tested through the assign and unassign acts.

cmd/mesh-controller/meshcli_test.go

@@ -2,11 +2,17 @@ package main
 
 import (
 	"context"
+	"encoding/base64"
+	"encoding/json"
 	"strings"
 	"testing"
+	"time"
+
+	"github.com/nats-io/nats.go"
 
 	"github.com/novox/mesh-controller/internal/inventory"
 	"github.com/novox/mesh-controller/internal/link"
+	"github.com/novox/mesh-controller/internal/testbus"
 )
 
 // echoEnvironment makes the test binary, run as a command line, say the verb and caller it was given (TestMain).
@@ -60,13 +66,16 @@ func TestMeshCLIIsTheTerminalOnlyForTheControlNodesOperator(t *testing.T) {
 func TestTheTerminalRunsWithoutAVerbAndAnOrdinaryCallNamesMeshCLI(t *testing.T) {
 	t.Setenv(echoEnvironment, "1")
 	t.Setenv("MESH_VERB", "leaked-from-the-serving-process")
+	// The serving controller marks itself (ADR 0266); its terminal line for mesh-cli is still the terminal's.
+	t.Setenv(servedVar, "1")
 	ctx := context.Background()
 
 	a := runForMeshCLI(ctx, "control", asked("operator", 1000, "status"), cliVerdict{terminal: true, why: "the terminal"})
 	if a.Exit != 0 || a.Refused != "" || !a.Terminal {
 		t.Fatalf("the terminal's line did not run: %+v", a)
 	}
-	if got := string(a.Stdout); !strings.Contains(got, `verb=""`) || !strings.Contains(got, "operator through mesh-cli on control") {
+	if got := string(a.Stdout); !strings.Contains(got, `verb=""`) || !strings.Contains(got, "operator through mesh-cli on control") ||
+		!strings.Contains(got, "terminal=true") {
 		t.Fatalf("the terminal's line ran with %s", got)
 	}
 
@@ -74,7 +83,7 @@ func TestTheTerminalRunsWithoutAVerbAndAnOrdinaryCallNamesMeshCLI(t *testing.T)
 	if a.Exit != 0 || a.Terminal || a.Why != "not the terminal" {
 		t.Fatalf("an ordinary line did not run as one: %+v", a)
 	}
-	if got := string(a.Stdout); !strings.Contains(got, `verb="mesh-cli"`) {
+	if got := string(a.Stdout); !strings.Contains(got, `verb="mesh-cli"`) || !strings.Contains(got, "terminal=false") {
 		t.Fatalf("an ordinary line ran with %s", got)
 	}
 }
@@ -106,12 +115,22 @@ func TestAnOrdinaryCallMeetsTheCommandVerbsRefusals(t *testing.T) {
 
 // **Which node is the terminal does not follow a verb** (review of ADR 0272): the controller's module is assigned
 // and unassigned at the terminal alone, so no caller of `assign` can move the terminal to a node of its choosing.
+// Asked through the acts themselves, as the verbs ask them; refused before any store is touched (none is given).
 func TestTheControllersModuleIsMovedAtTheTerminalAlone(t *testing.T) {
 	t.Setenv("MESH_VERB", "assign")
-	if err := refusedMovingTheController([]string{"zsh", "mesh-controller"}); err == nil ||
+	ctx := context.Background()
+	if _, err := assignWith(ctx, nil, "laptop", assignOptions{}, "zsh", "mesh-controller"); err == nil ||
 		!strings.Contains(err.Error(), "terminal") {
 		t.Fatalf("assigning the controller through a verb was not refused: %v", err)
 	}
+	if _, err := assign(ctx, nil, "laptop", "mesh-controller"); err == nil || !strings.Contains(err.Error(), "terminal") {
+		t.Fatalf("assigning the controller through a verb was not refused: %v", err)
+	}
+	t.Setenv("MESH_VERB", "unassign")
+	if _, err := unassign(ctx, nil, "control", "mesh-controller"); err == nil || !strings.Contains(err.Error(), "terminal") {
+		t.Fatalf("unassigning the controller through a verb was not refused: %v", err)
+	}
+	// Another module through a verb, and the controller's at the terminal, are not refused for it.
 	if err := refusedMovingTheController([]string{"zsh"}); err != nil {
 		t.Fatalf("another module was refused: %v", err)
 	}
@@ -151,8 +170,8 @@ func TestAnOrdinarySettingsLineTakesTheSettingsVerbsPath(t *testing.T) {
 		}
 	}
 	// Anything else still meets the generic command verb's refusals.
-	if _, err := ordinaryLine([]string{"retire", "delete", "x"}); err != nil && !strings.Contains(err.Error(), "why") {
-		t.Errorf("a repair was refused for another reason: %v", err)
+	if _, err := ordinaryLine([]string{"retire", "delete", "x"}); err == nil {
+		t.Error("a repair composed as an ordinary line")
 	}
 }
 
@@ -177,3 +196,71 @@ func TestEveryMeshCLILineIsSaidInTheJournal(t *testing.T) {
 		t.Fatalf("the journal carries the line's values: %q", said)
 	}
 }
+
+// **An ordinary line runs only what the generic command verb would** (review of ADR 0272, ADR 0266): its reading
+// forms, and never a command that is the terminal's alone. Each of these, from another node's operator, is refused
+// and runs nothing.
+func TestAnOrdinaryLineRunsNothingTheCommandVerbWouldRefuse(t *testing.T) {
+	t.Setenv(echoEnvironment, "1")
+	for _, line := range [][]string{
+		{"node", "account", "control", "x"},
+		{"node", "agent-account", "control", "x", "--clear"},
+		{"token", "issue", "laptop"},
+		{"secret", "export", "x"},
+		{"operator", "key", "set", "x"},
+		{"assign", "laptop", "zsh"},
+	} {
+		if _, err := ordinaryLine(line); err == nil {
+			t.Errorf("%q composed as an ordinary line", line)
+		}
+		a := runForMeshCLI(context.Background(), "laptop", asked("operator", 1000, line...), cliVerdict{why: "not the terminal"})
+		if a.Refused == "" || len(a.Stdout) != 0 {
+			t.Errorf("%q ran as an ordinary line: %+v", line, a)
+		}
+	}
+	if argv, err := ordinaryLine([]string{"status"}); err != nil || argv[0] != "status" {
+		t.Fatalf("a read was refused: %v", err)
+	}
+}
+
+// **`calls` never shows a mesh-cli line's answer** (review of ADR 0272): the verb's own answer is read for a line
+// served over a bus, and neither the answer's text nor the base64 JSON writes its bytes in is there.
+func TestTheCallsVerbNeverShowsAMeshCLILinesAnswer(t *testing.T) {
+	conn, err := nats.Connect(testbus.URL(t))
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer conn.Close()
+	stop, err := link.OverNATS{Conn: conn}.ServeCLI(func(context.Context, string, link.CLIAsked) link.CLIAnswer {
+		return link.CLIAnswer{Stdout: []byte("s3cret-join")}
+	}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer stop()
+	body, _ := json.Marshal(link.CLIAsked{Line: []string{"token", "issue", "x"}, Account: "operator"})
+	msg, err := conn.Request(link.CLISubject("control"), body, 5*time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(msg.Data), base64.StdEncoding.EncodeToString([]byte("s3cret-join"))) {
+		t.Fatalf("the asker was not given its answer: %s", msg.Data)
+	}
+	recent, _ := link.Calls.Recent()
+	var id string
+	for _, c := range recent {
+		if c.Seat == link.CLISeat {
+			id = c.ID
+			break
+		}
+	}
+	shown, err := callsAnswer(link.Calls, id)
+	if err != nil {
+		t.Fatal(err)
+	}
+	said, _ := json.Marshal(shown)
+	if strings.Contains(string(said), "s3cret-join") ||
+		strings.Contains(string(said), base64.StdEncoding.EncodeToString([]byte("s3cret-join"))) {
+		t.Fatalf("calls showed a mesh-cli line's answer: %s", said)
+	}
+}