Vouch for the account that runs mesh-cli, and ask the controller its line (hq ADR 0272)

The records send the operator to "the controller's terminal", and nothing
reaches it (hq issue 343). mesh-cli holds no credential: it asks the engine
on its own machine over a socket. The engine reads the asking account from
the kernel (SO_PEERCRED), never from the program, and asks the controller on
mesh.control.<node>.cli, its own node's subject, so the bus server says which
node asked. The controller decides what the line may do; nothing received
on the socket is run or applied here, and the socket has no network address
(ADR 0004 stands).

The local protocol is the SDK's go/cli package, at a pseudo-version of its
branch until that merges and is tagged go/v0.1.8.

cmd/mesh-host/meshcli.go

@@ -0,0 +1,39 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"git.novox.be/novox/mesh-sdk/go/cli"
+	"github.com/novox/mesh-host/internal/link"
+	"github.com/novox/mesh-host/internal/meshcli"
+)
+
+// serveMeshCLI answers mesh-cli on this machine for as long as this engine serves (novox/hq ADR 0272): the account
+// from the kernel, the line asked of the controller over the link open at the time. A socket that cannot be served
+// is said once, and this engine goes on applying; mesh-cli then says the engine does not answer.
+func serveMeshCLI(ctx context.Context, queue *link.Queue, say func(string)) {
+	if err := meshcli.Serve(ctx, cli.Socket, forwardOver(queue), say); err != nil {
+		say("mesh-cli is not answered on this machine: " + err.Error())
+	}
+}
+
+// forwardOver asks the controller over the queue's link, and reads its answer as mesh-cli's.
+func forwardOver(queue *link.Queue) meshcli.Forward {
+	return func(ctx context.Context, asked meshcli.Asked) (cli.Answer, error) {
+		body, err := json.Marshal(asked)
+		if err != nil {
+			return cli.Answer{}, err
+		}
+		reply, err := queue.AskController(ctx, body)
+		if err != nil {
+			return cli.Answer{}, err
+		}
+		var a cli.Answer
+		if err := json.Unmarshal(reply, &a); err != nil {
+			return cli.Answer{}, fmt.Errorf("the controller's answer is not one: %w", err)
+		}
+		return a, nil
+	}
+}