Say the login session a mesh-cli line comes from, and pin the SDK at go/v0.1.9 (hq ADR 0272)

A service running as the operator — the tool runner, a unit of the
account's user manager — shares the operator's user id, and was as much the
terminal on the control-node as a person typing. The engine now reads the
asking process's cgroup and sends its login session's scope
(session-<id>.scope under the account's own user-<uid>.slice), or nothing;
the controller makes nothing else the terminal. The SDK is pinned at its
tag now that go/v0.1.9 exists.

internal/meshcli/meshcli_test.go

@@ -126,6 +126,11 @@ func TestTheRequestToTheControllerKeepsItsFieldNames(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
+	body, _ = json.Marshal(Asked{Line: []string{"status"}, Account: "a", UID: 1, Session: "session-3.scope"})
+	if got := keysOf(t, body); got != "account line session uid" {
+		t.Fatalf("the request's fields are %q", got)
+	}
+	body, _ = json.Marshal(Asked{Line: []string{"status"}, Account: "a", UID: 1})
 	if got := keysOf(t, body); got != "account line uid" {
 		t.Fatalf("the request's fields are %q", got)
 	}
@@ -216,3 +221,35 @@ func TestAPeerInAnotherNamespaceIsRefused(t *testing.T) {
 		t.Fatalf("a peer in another namespace was asked (%v): %+v", asked, a)
 	}
 }
+
+// **The session a line comes from is the kernel's word, and only a login session counts** (review of ADR 0272): a
+// service running as the operator — the tool runner, a user unit — is not a person at a terminal. The engine reads
+// the peer's cgroup and sends the login session's scope, or nothing; the controller makes no other terminal.
+func TestTheLoginSessionAskingIsReadFromTheKernel(t *testing.T) {
+	for _, c := range []struct{ cgroup, session string }{
+		{"0::/user.slice/user-1000.slice/session-3.scope\n", "session-3.scope"},
+		{"0::/user.slice/user-1000.slice/session-c1.scope\n", "session-c1.scope"},
+		{"0::/user.slice/user-1000.slice/user@1000.service/app.slice/tmux.scope\n", ""},
+		{"0::/system.slice/node-tools.service\n", ""},
+		{"0::/user.slice/user-1001.slice/session-3.scope\n", ""}, // another account's session
+		{"12:pids:/user.slice\n0::/user.slice/user-1000.slice/session-9.scope/sub\n", ""},
+		{"", ""},
+	} {
+		if got := loginSessionIn(c.cgroup, 1000); got != c.session {
+			t.Errorf("%q read as %q, want %q", c.cgroup, got, c.session)
+		}
+	}
+	// And it is sent: the test process's own, whatever it is, as the kernel says it.
+	var got Asked
+	socket := serving(t, func(_ context.Context, asked Asked) cli.Answer {
+		got = asked
+		return cli.Answer{}
+	})
+	if _, err := cli.Ask(context.Background(), socket, []string{"status"}); err != nil {
+		t.Fatal(err)
+	}
+	raw, _ := os.ReadFile("/proc/self/cgroup")
+	if want := loginSessionIn(string(raw), uint32(os.Getuid())); got.Session != want {
+		t.Fatalf("sent session %q, the kernel says %q", got.Session, want)
+	}
+}