mesh-cli: follow a line to its answer, bound each account, refuse other namespaces (review of hq ADR 0272)

- A request that timed out was said as "the controller was not reached,
  nothing ran", though the line may have run. The engine now follows a line
  the controller answers as running, by its call, until it ends; when no
  answer comes in time it says the line may have run and names the call.
  "Nothing ran" is said only of a request no controller took.
- One account could hold the socket: accepting waited for a free slot, and
  a connection could stall before its deadline was set. The deadline is set
  at accept, before any lookup; each user id has two lines at once and the
  machine eight, and one over is answered busy at once.
- A container running with the operator's user id shares the number, not
  the machine: a peer whose mount or user namespace is not the engine's is
  refused, and nothing is asked.

SDK pinned at the go/cli branch's newest commit until go/v0.1.9 is tagged.

cmd/mesh-host/meshcli.go

@@ -2,8 +2,6 @@ package main
 
 import (
 	"context"
-	"encoding/json"
-	"fmt"
 
 	"git.novox.be/novox/mesh-sdk/go/cli"
 	"github.com/novox/mesh-host/internal/link"
@@ -19,21 +17,9 @@ func serveMeshCLI(ctx context.Context, queue *link.Queue, say func(string)) {
 	}
 }
 
-// forwardOver asks the controller over the queue's link, and reads its answer as mesh-cli's.
+// forwardOver asks the controller over the queue's link, and follows the line to what came of it.
 func forwardOver(queue *link.Queue) meshcli.Forward {
-	return func(ctx context.Context, asked meshcli.Asked) (cli.Answer, error) {
-		body, err := json.Marshal(asked)
-		if err != nil {
-			return cli.Answer{}, err
-		}
-		reply, err := queue.AskController(ctx, body)
-		if err != nil {
-			return cli.Answer{}, err
-		}
-		var a cli.Answer
-		if err := json.Unmarshal(reply, &a); err != nil {
-			return cli.Answer{}, fmt.Errorf("the controller's answer is not one: %w", err)
-		}
-		return a, nil
+	return func(ctx context.Context, asked meshcli.Asked) cli.Answer {
+		return meshcli.AskTheController(ctx, queue.AskController, asked)
 	}
 }