Report ssh command failures to the surface (#1959)

Report ssh command failures to the surface (#1959)

The ssh debug commands told the user when something went wrong but
never told the surface that ran them, so `ssh host cmd` always exited 0
and a few failures were not reported at all. A failed command now
returns its error, a failure the user has already heard about is a
commands.Failure, and the ssh exec path exits 1 for either. The command
bodies also lose their ssh prefixes and the duplication they carried
over from ssh.go; both goldens pin that nothing else changed.

- Dispatch returns the callback's error, or shlex's; the ssh session
  logs it at debug, and not at all for a Failure the user already saw
- commands.Fail writes a message and returns it as a Failure in one step;
  an unknown command, `help` for a command that is not there, a failed
  reload and an unbalanced quote are failures
- ssh exec exit-status is 1 for a command, flag or failure error, 0
  otherwise; the e2e golden records the exit status for every case
- Clone rebinds help to the copy, so an ssh session's help lists logout
  and `help logout` and `logout -h` answer; sshd.LogoutCommand is the
  session's logout, exported for tests
- "did not understand" names the first word only, the one looked up;
  DispatchArgs takes just the tokens
- log-format writes its refusal to the user, as log-level does
- print-relays emits the relay error as a string and omits the key when
  there is none, where it printed {} or "Error":null
- list-hostmap and list-lighthouse-addrmap -json return the encode
  error; print-cert reports a certificate that will not marshal
- a flags type that is not the one registered is an internal error, not
  a silent success
- command functions and flag types are <name>Command and <name>Flags;
  parseVpnAddr and listHostMapFlagSet replace the repeated parse block
  and flag set; close-tunnel sends through sendCloseTunnel

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

e2e/commands_output_test.go

@@ -14,6 +14,7 @@ import (
 	"github.com/slackhq/nebula/cert"
 	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/commands"
+	"github.com/slackhq/nebula/sshd"
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/require"
 )
@@ -64,16 +65,22 @@ func TestCommandOutput(t *testing.T) {
 	control.Start()
 	t.Cleanup(func() { control.Stop() })
 
+	// As an ssh session does: a clone of the daemon's registry with logout added, which
+	// help on the clone lists and describes. There is no session to end here.
 	reg := control.Commands().Clone()
+	reg.Register(sshd.LogoutCommand(func() {}))
 
-	run := func(args ...string) string {
+	// run dispatches as the ssh exec path does and returns the output and the error, which
+	// over ssh is exit status 1.
+	run := func(args ...string) (string, error) {
 		buf := &bytes.Buffer{}
-		_ = reg.DispatchArgs(args, strings.Join(args, " "), commands.NewStringWriter(buf))
-		return buf.String()
+		err := reg.DispatchArgs(args, commands.NewStringWriter(buf))
+		return buf.String(), err
 	}
 
 	// Seed a pending tunnel so the listing and per-address commands have something to show.
-	seed := run("create-tunnel", "10.222.0.9")
+	seed, err := run("create-tunnel", "10.222.0.9")
+	require.NoError(t, err)
 	require.Equal(t, "Created\n", seed, "seeding a tunnel should succeed before anything else is recorded")
 
 	cases := []outputCase{
@@ -120,6 +127,9 @@ func TestCommandOutput(t *testing.T) {
 		{"close-tunnel", []string{"not-an-address"}},
 		{"help", nil},
 		{"help", []string{"print-cert"}},
+		{"help", []string{"logout"}},
+		{"logout", []string{"-h"}},
+		{"not-a-command", []string{"10.222.0.9"}},
 		// reload is last so that whatever a reload does to the daemon cannot leak into an
 		// earlier case. In this harness it fails: the config was loaded from a string and
 		// has no path to re-read, which is what the recorded result says.
@@ -133,13 +143,19 @@ func TestCommandOutput(t *testing.T) {
 			args = append(args, c.args...)
 
 			fmt.Fprintf(got, "$ %s\n", strings.Join(args, " "))
-			out := normalise(run(args...))
+			out, err := run(args...)
+			out = normalise(out)
 			got.WriteString(out)
 			// Output that does not end in a newline is recorded as such, the way diff marks
 			// it, so the golden sees that byte too and the next prompt still starts a line.
 			if out != "" && !strings.HasSuffix(out, "\n") {
 				got.WriteString("\\ No newline at end of output\n")
 			}
+			// A failed command is recorded as the exit status an ssh caller sees, so the
+			// golden pins which outcomes count as failures.
+			if err != nil {
+				got.WriteString("exit status 1\n")
+			}
 			got.WriteString("\n")
 		}
 	}