Report ssh command failures to the surface (#1959)

Report ssh command failures to the surface (#1959)

The ssh debug commands told the user when something went wrong but
never told the surface that ran them, so `ssh host cmd` always exited 0
and a few failures were not reported at all. A failed command now
returns its error, a failure the user has already heard about is a
commands.Failure, and the ssh exec path exits 1 for either. The command
bodies also lose their ssh prefixes and the duplication they carried
over from ssh.go; both goldens pin that nothing else changed.

- Dispatch returns the callback's error, or shlex's; the ssh session
  logs it at debug, and not at all for a Failure the user already saw
- commands.Fail writes a message and returns it as a Failure in one step;
  an unknown command, `help` for a command that is not there, a failed
  reload and an unbalanced quote are failures
- ssh exec exit-status is 1 for a command, flag or failure error, 0
  otherwise; the e2e golden records the exit status for every case
- Clone rebinds help to the copy, so an ssh session's help lists logout
  and `help logout` and `logout -h` answer; sshd.LogoutCommand is the
  session's logout, exported for tests
- "did not understand" names the first word only, the one looked up;
  DispatchArgs takes just the tokens
- log-format writes its refusal to the user, as log-level does
- print-relays emits the relay error as a string and omits the key when
  there is none, where it printed {} or "Error":null
- list-hostmap and list-lighthouse-addrmap -json return the encode
  error; print-cert reports a certificate that will not marshal
- a flags type that is not the one registered is an internal error, not
  a silent success
- command functions and flag types are <name>Command and <name>Flags;
  parseVpnAddr and listHostMapFlagSet replace the repeated parse block
  and flag set; close-tunnel sends through sendCloseTunnel

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

e2e/testdata/commands_output.golden

@@ -158,66 +158,84 @@ $ print-cert -pretty -raw
 
 $ print-cert 10.222.0.9
 Could not find tunnel for vpn addr: 10.222.0.9
+exit status 1
 
 $ print-cert -json 10.222.0.9
 Could not find tunnel for vpn addr: 10.222.0.9
+exit status 1
 
 $ print-cert -pretty 10.222.0.9
 Could not find tunnel for vpn addr: 10.222.0.9
+exit status 1
 
 $ print-cert 10.222.0.250
 Could not find tunnel for vpn addr: 10.222.0.250
+exit status 1
 
 $ print-cert -json 10.222.0.250
 Could not find tunnel for vpn addr: 10.222.0.250
+exit status 1
 
 $ print-cert -pretty 10.222.0.250
 Could not find tunnel for vpn addr: 10.222.0.250
+exit status 1
 
 $ print-cert not-an-address
 The provided vpn addr could not be parsed: not-an-address
+exit status 1
 
 $ print-cert -json not-an-address
 The provided vpn addr could not be parsed: not-an-address
+exit status 1
 
 $ print-cert -pretty not-an-address
 The provided vpn addr could not be parsed: not-an-address
+exit status 1
 
 $ print-tunnel
 No vpn address was provided
+exit status 1
 
 $ print-tunnel -json
 flag provided but not defined: -json
 Usage:
   -pretty
     	pretty prints json
+exit status 1
 
 $ print-tunnel -pretty
 No vpn address was provided
+exit status 1
 
 $ print-tunnel 10.222.0.9
 Could not find tunnel for vpn addr: 10.222.0.9
+exit status 1
 
 $ print-tunnel -json 10.222.0.9
 flag provided but not defined: -json
 Usage:
   -pretty
     	pretty prints json
+exit status 1
 
 $ print-tunnel -pretty 10.222.0.9
 Could not find tunnel for vpn addr: 10.222.0.9
+exit status 1
 
 $ print-tunnel 10.222.0.250
 Could not find tunnel for vpn addr: 10.222.0.250
+exit status 1
 
 $ print-tunnel -json 10.222.0.250
 flag provided but not defined: -json
 Usage:
   -pretty
     	pretty prints json
+exit status 1
 
 $ print-tunnel -pretty 10.222.0.250
 Could not find tunnel for vpn addr: 10.222.0.250
+exit status 1
 
 $ print-relays
 {"Relays":null}
@@ -227,6 +245,7 @@ flag provided but not defined: -json
 Usage:
   -pretty
     	pretty prints json
+exit status 1
 
 $ print-relays -pretty
 {
@@ -235,183 +254,230 @@ $ print-relays -pretty
 
 $ query-lighthouse
 No vpn address was provided
+exit status 1
 
 $ query-lighthouse -json
 The provided vpn address could not be parsed: -json
+exit status 1
 
 $ query-lighthouse -pretty
 The provided vpn address could not be parsed: -pretty
+exit status 1
 
 $ query-lighthouse 10.222.0.9
 {}
 
 $ query-lighthouse -json 10.222.0.9
 The provided vpn address could not be parsed: -json
+exit status 1
 
 $ query-lighthouse -pretty 10.222.0.9
 The provided vpn address could not be parsed: -pretty
+exit status 1
 
 $ query-lighthouse not-an-address
 The provided vpn address could not be parsed: not-an-address
+exit status 1
 
 $ query-lighthouse -json not-an-address
 The provided vpn address could not be parsed: -json
+exit status 1
 
 $ query-lighthouse -pretty not-an-address
 The provided vpn address could not be parsed: -pretty
+exit status 1
 
 $ log-level
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -json
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -pretty
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level debug
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -json debug
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -pretty debug
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level bogus
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -json bogus
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -pretty bogus
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level info
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -json info
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-level -pretty info
 Log level is not reconfigurable on this logger
+exit status 1
 
 $ log-format
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format -json
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format -pretty
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format json
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format -json json
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format -pretty json
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format text
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format -json text
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ log-format -pretty text
 Log format is not reconfigurable on this logger
+exit status 1
 
 $ change-remote
 No vpn address was provided
+exit status 1
 
 $ change-remote -json
 flag provided but not defined: -json
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ change-remote -pretty
 flag provided but not defined: -pretty
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ change-remote 10.222.0.9
 No address was provided
+exit status 1
 
 $ change-remote -json 10.222.0.9
 flag provided but not defined: -json
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ change-remote -pretty 10.222.0.9
 flag provided but not defined: -pretty
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ change-remote -address 10.94.0.10:4242 10.222.0.9
 Could not find tunnel for vpn address: 10.222.0.9
+exit status 1
 
 $ change-remote -json -address 10.94.0.10:4242 10.222.0.9
 flag provided but not defined: -json
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ change-remote -pretty -address 10.94.0.10:4242 10.222.0.9
 flag provided but not defined: -pretty
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ change-remote -address 10.94.0.10:4242 10.222.0.250
 Could not find tunnel for vpn address: 10.222.0.250
+exit status 1
 
 $ change-remote -json -address 10.94.0.10:4242 10.222.0.250
 flag provided but not defined: -json
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ change-remote -pretty -address 10.94.0.10:4242 10.222.0.250
 flag provided but not defined: -pretty
 Usage:
   -address string
     	The new remote address, ip:port
+exit status 1
 
 $ create-tunnel
 No vpn address was provided
+exit status 1
 
 $ create-tunnel -json
 flag provided but not defined: -json
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ create-tunnel -pretty
 flag provided but not defined: -pretty
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ create-tunnel 10.222.0.9
 Tunnel already handshaking
+exit status 1
 
 $ create-tunnel -json 10.222.0.9
 flag provided but not defined: -json
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ create-tunnel -pretty 10.222.0.9
 flag provided but not defined: -pretty
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ create-tunnel -address 10.94.0.10:4242 10.222.0.10
 Created
@@ -421,72 +487,86 @@ flag provided but not defined: -json
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ create-tunnel -pretty -address 10.94.0.10:4242 10.222.0.10
 flag provided but not defined: -pretty
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ create-tunnel not-an-address
 The provided vpn address could not be parsed: not-an-address
+exit status 1
 
 $ create-tunnel -json not-an-address
 flag provided but not defined: -json
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ create-tunnel -pretty not-an-address
 flag provided but not defined: -pretty
 Usage:
   -address string
     	Optionally provide a real remote address, ip:port 
+exit status 1
 
 $ close-tunnel
 No vpn address was provided
+exit status 1
 
 $ close-tunnel -json
 flag provided but not defined: -json
 Usage:
   -local-only
     	Disables notifying the remote that the tunnel is shutting down
+exit status 1
 
 $ close-tunnel -pretty
 flag provided but not defined: -pretty
 Usage:
   -local-only
     	Disables notifying the remote that the tunnel is shutting down
+exit status 1
 
 $ close-tunnel 10.222.0.250
 Could not find tunnel for vpn address: 10.222.0.250
+exit status 1
 
 $ close-tunnel -json 10.222.0.250
 flag provided but not defined: -json
 Usage:
   -local-only
     	Disables notifying the remote that the tunnel is shutting down
+exit status 1
 
 $ close-tunnel -pretty 10.222.0.250
 flag provided but not defined: -pretty
 Usage:
   -local-only
     	Disables notifying the remote that the tunnel is shutting down
+exit status 1
 
 $ close-tunnel not-an-address
 The provided vpn address could not be parsed: not-an-address
+exit status 1
 
 $ close-tunnel -json not-an-address
 flag provided but not defined: -json
 Usage:
   -local-only
     	Disables notifying the remote that the tunnel is shutting down
+exit status 1
 
 $ close-tunnel -pretty not-an-address
 flag provided but not defined: -pretty
 Usage:
   -local-only
     	Disables notifying the remote that the tunnel is shutting down
+exit status 1
 
 $ help
 Available commands:
@@ -500,6 +580,7 @@ list-lighthouse-addrmap - List all lighthouse map entries
 list-pending-hostmap - List all handshaking hosts
 log-format - Gets or sets the current log format
 log-level - Gets or sets the current log level
+logout - Ends the current session
 print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
 print-relays - Prints json details about all relay info
 print-tunnel - Prints json details about a tunnel for the provided vpn addr
@@ -510,9 +591,11 @@ version - Prints the currently running version of nebula
 
 $ help -json
 Command not available -json
+exit status 1
 
 $ help -pretty
 Command not available -pretty
+exit status 1
 
 $ help print-cert
 print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
@@ -525,19 +608,113 @@ print-cert - Prints the current certificate being used or the certificate for th
 
 $ help -json print-cert
 Command not available -json
+exit status 1
 
 $ help -pretty print-cert
 Command not available -pretty
+exit status 1
+
+$ help logout
+logout - Ends the current session
+
+$ help -json logout
+Command not available -json
+exit status 1
+
+$ help -pretty logout
+Command not available -pretty
+exit status 1
+
+$ logout -h
+logout - Ends the current session
+
+$ logout -json -h
+logout - Ends the current session
+
+$ logout -pretty -h
+logout - Ends the current session
+
+$ not-a-command 10.222.0.9
+did not understand: not-a-command
+Available commands:
+change-remote - Changes the remote address used in the tunnel for the provided vpn addr
+close-tunnel - Closes a tunnel for the provided vpn addr
+create-tunnel - Creates a tunnel for the provided vpn address
+device-info - Prints information about the network device.
+help - prints available commands or help <command> for specific usage info
+list-hostmap - List all known previously connected hosts
+list-lighthouse-addrmap - List all lighthouse map entries
+list-pending-hostmap - List all handshaking hosts
+log-format - Gets or sets the current log format
+log-level - Gets or sets the current log level
+logout - Ends the current session
+print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
+print-relays - Prints json details about all relay info
+print-tunnel - Prints json details about a tunnel for the provided vpn addr
+query-lighthouse - Query the lighthouses for the provided vpn address
+reload - Reloads configuration from disk, same as sending HUP to the process
+version - Prints the currently running version of nebula
+
+exit status 1
+
+$ not-a-command -json 10.222.0.9
+did not understand: not-a-command
+Available commands:
+change-remote - Changes the remote address used in the tunnel for the provided vpn addr
+close-tunnel - Closes a tunnel for the provided vpn addr
+create-tunnel - Creates a tunnel for the provided vpn address
+device-info - Prints information about the network device.
+help - prints available commands or help <command> for specific usage info
+list-hostmap - List all known previously connected hosts
+list-lighthouse-addrmap - List all lighthouse map entries
+list-pending-hostmap - List all handshaking hosts
+log-format - Gets or sets the current log format
+log-level - Gets or sets the current log level
+logout - Ends the current session
+print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
+print-relays - Prints json details about all relay info
+print-tunnel - Prints json details about a tunnel for the provided vpn addr
+query-lighthouse - Query the lighthouses for the provided vpn address
+reload - Reloads configuration from disk, same as sending HUP to the process
+version - Prints the currently running version of nebula
+
+exit status 1
+
+$ not-a-command -pretty 10.222.0.9
+did not understand: not-a-command
+Available commands:
+change-remote - Changes the remote address used in the tunnel for the provided vpn addr
+close-tunnel - Closes a tunnel for the provided vpn addr
+create-tunnel - Creates a tunnel for the provided vpn address
+device-info - Prints information about the network device.
+help - prints available commands or help <command> for specific usage info
+list-hostmap - List all known previously connected hosts
+list-lighthouse-addrmap - List all lighthouse map entries
+list-pending-hostmap - List all handshaking hosts
+log-format - Gets or sets the current log format
+log-level - Gets or sets the current log level
+logout - Ends the current session
+print-cert - Prints the current certificate being used or the certificate for the provided vpn addr
+print-relays - Prints json details about all relay info
+print-tunnel - Prints json details about a tunnel for the provided vpn addr
+query-lighthouse - Query the lighthouses for the provided vpn address
+reload - Reloads configuration from disk, same as sending HUP to the process
+version - Prints the currently running version of nebula
+
+exit status 1
 
 $ reload
 Reloading config
 Config reload failed, the new config did not load: no config files found at 
+exit status 1
 
 $ reload -json
 Reloading config
 Config reload failed, the new config did not load: no config files found at 
+exit status 1
 
 $ reload -pretty
 Reloading config
 Config reload failed, the new config did not load: no config files found at 
+exit status 1