go/cli: carry mesh-cli's standard input with its line, bounded at 64 KiB, for the controller's terminal alone

A secret given at the terminal (secret accept … --from -) has no way through mesh-cli today: the controller
runs every line with no standard input. The request now carries it, refused over 64 KiB by mesh-cli and by
the reader alike, and MaxRequest grows by what base64 makes of that bound.

go/cli/cli_test.go

@@ -3,6 +3,7 @@ package cli
 import (
 	"bytes"
 	"context"
+	"encoding/json"
 	"errors"
 	"net"
 	"path/filepath"
@@ -44,6 +45,17 @@ func TestARequestAndAnAnswerSurviveTheirRoundTrip(t *testing.T) {
 // A request over the bound is refused, not read whole; one naming no command is refused.
 func TestARequestOverTheBoundOrNamingNothingIsRefused(t *testing.T) {
 	long := Request{Line: []string{strings.Repeat("x", MaxRequest)}}
+	big := Request{Line: []string{"secret"}, Stdin: bytes.Repeat([]byte("s"), MaxStdin+1)}
+	var bb bytes.Buffer
+	if err := WriteRequest(&bb, big); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := ReadRequest(&bb); !errors.Is(err, ErrTooLong) {
+		t.Fatalf("standard input over its bound was read: %v", err)
+	}
+	if _, err := AskWith(context.Background(), "/nonexistent.sock", big); err == nil || !strings.Contains(err.Error(), "nothing was asked") {
+		t.Fatalf("mesh-cli would ask with standard input over its bound: %v", err)
+	}
 	var b bytes.Buffer
 	if err := WriteRequest(&b, long); err != nil {
 		t.Fatal(err)
@@ -103,3 +115,27 @@ func TestAnUnknownOutcomeIsNotARefusal(t *testing.T) {
 		t.Fatalf("an unknown outcome with no call names one: %+v", b)
 	}
 }
+
+// Standard input up to its bound travels whole, beside the line: a secret given with --from -.
+func TestStandardInputTravelsWithItsLine(t *testing.T) {
+	given := append(bytes.Repeat([]byte{0, 0xff, '\n', 'x'}, MaxStdin/4-1), "end"...)
+	var b bytes.Buffer
+	if err := WriteRequest(&b, Request{Line: []string{"secret", "accept", "anchor", "telegram", "telegram-token", "--from", "-"},
+		Stdin: given}); err != nil {
+		t.Fatal(err)
+	}
+	if b.Len() > MaxRequest {
+		t.Fatalf("a request with standard input at its bound is %d bytes, over MaxRequest %d", b.Len(), MaxRequest)
+	}
+	got, err := ReadRequest(&b)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(got.Stdin, given) || got.Line[1] != "accept" {
+		t.Fatalf("standard input did not travel whole: %d bytes, want %d", len(got.Stdin), len(given))
+	}
+	none, _ := json.Marshal(Request{Line: []string{"status"}})
+	if strings.Contains(string(none), "stdin") {
+		t.Fatalf("a request without standard input says it has one: %s", none)
+	}
+}