Report ssh command failures to the surface (#1959)

Report ssh command failures to the surface (#1959)

The ssh debug commands told the user when something went wrong but
never told the surface that ran them, so `ssh host cmd` always exited 0
and a few failures were not reported at all. A failed command now
returns its error, a failure the user has already heard about is a
commands.Failure, and the ssh exec path exits 1 for either. The command
bodies also lose their ssh prefixes and the duplication they carried
over from ssh.go; both goldens pin that nothing else changed.

- Dispatch returns the callback's error, or shlex's; the ssh session
  logs it at debug, and not at all for a Failure the user already saw
- commands.Fail writes a message and returns it as a Failure in one step;
  an unknown command, `help` for a command that is not there, a failed
  reload and an unbalanced quote are failures
- ssh exec exit-status is 1 for a command, flag or failure error, 0
  otherwise; the e2e golden records the exit status for every case
- Clone rebinds help to the copy, so an ssh session's help lists logout
  and `help logout` and `logout -h` answer; sshd.LogoutCommand is the
  session's logout, exported for tests
- "did not understand" names the first word only, the one looked up;
  DispatchArgs takes just the tokens
- log-format writes its refusal to the user, as log-level does
- print-relays emits the relay error as a string and omits the key when
  there is none, where it printed {} or "Error":null
- list-hostmap and list-lighthouse-addrmap -json return the encode
  error; print-cert reports a certificate that will not marshal
- a flags type that is not the one registered is an internal error, not
  a silent success
- command functions and flag types are <name>Command and <name>Flags;
  parseVpnAddr and listHostMapFlagSet replace the repeated parse block
  and flag set; close-tunnel sends through sendCloseTunnel

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

ssh_reload_test.go

@@ -7,6 +7,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/slackhq/nebula/commands"
 	"github.com/slackhq/nebula/config"
 	"github.com/slackhq/nebula/test"
 	"github.com/stretchr/testify/assert"
@@ -26,7 +27,7 @@ func (w *lineWriter) Write(s string) error      { return w.WriteLine(s) }
 func (w *lineWriter) WriteBytes(b []byte) error { return w.WriteLine(string(b)) }
 func (w *lineWriter) GetWriter() io.Writer      { return io.Discard }
 
-func TestSSHReloadReportsTheResult(t *testing.T) {
+func TestReloadCommandReportsTheResult(t *testing.T) {
 	dir := t.TempDir()
 	write := func(body string) {
 		require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yml"), []byte(body), 0o600))
@@ -43,32 +44,42 @@ func TestSSHReloadReportsTheResult(t *testing.T) {
 		}
 	})
 
-	reload := func() []string {
+	// reload returns what the client was told. A reload that failed is a commands.Failure
+	// to the surface, exit 1 over ssh, with the result line as its message; one that
+	// merely needs a restart is not.
+	reload := func(failed bool) []string {
 		w := &lineWriter{}
-		require.NoError(t, sshReload(l, c, w))
+		err := reloadCommand(l, c, w)
+		if failed {
+			var f *commands.Failure
+			require.ErrorAs(t, err, &f)
+			assert.Equal(t, w.lines[len(w.lines)-1], f.Msg)
+		} else {
+			require.NoError(t, err)
+		}
 		return w.lines
 	}
 
 	write("a: 2\nb: 1")
-	assert.Equal(t, []string{"Reloading config", "Config reload complete"}, reload())
+	assert.Equal(t, []string{"Reloading config", "Config reload complete"}, reload(false))
 
 	fail = true
 	write("a: 3\nb: 1")
-	assert.Equal(t, []string{"Reloading config", "Config reload completed with errors, review the logs"}, reload())
+	assert.Equal(t, []string{"Reloading config", "Config reload completed with errors, review the logs"}, reload(true))
 
 	fail = false
 	write("a: 3\nb: 2")
-	assert.Equal(t, []string{"Reloading config", "Config reload was completed but requires a restart to fully apply, keys [b]"}, reload())
+	assert.Equal(t, []string{"Reloading config", "Config reload was completed but requires a restart to fully apply, keys [b]"}, reload(false))
 
 	write("a: [")
-	lines := reload()
+	lines := reload(true)
 	require.Len(t, lines, 2)
 	assert.Contains(t, lines[1], "Config reload failed, the new config did not load")
 	assert.Contains(t, lines[1], dir, "names the config that did not load")
 }
 
 // A client that went away still gets the reload it asked for
-func TestSSHReloadReloadsWhenTheClientIsGone(t *testing.T) {
+func TestReloadCommandReloadsWhenTheClientIsGone(t *testing.T) {
 	dir := t.TempDir()
 	require.NoError(t, os.WriteFile(filepath.Join(dir, "config.yml"), []byte("a: 1"), 0o600))
 	l := test.NewLogger()
@@ -78,6 +89,6 @@ func TestSSHReloadReloadsWhenTheClientIsGone(t *testing.T) {
 	c.RegisterReloadCallback(func(*config.C, *config.Reload) { reloaded = true })
 
 	gone := errors.New("client is gone")
-	require.ErrorIs(t, sshReload(l, c, &lineWriter{err: gone}), gone)
+	require.ErrorIs(t, reloadCommand(l, c, &lineWriter{err: gone}), gone)
 	assert.True(t, reloaded)
 }