Report ssh command failures to the surface (#1959)

Report ssh command failures to the surface (#1959)

The ssh debug commands told the user when something went wrong but
never told the surface that ran them, so `ssh host cmd` always exited 0
and a few failures were not reported at all. A failed command now
returns its error, a failure the user has already heard about is a
commands.Failure, and the ssh exec path exits 1 for either. The command
bodies also lose their ssh prefixes and the duplication they carried
over from ssh.go; both goldens pin that nothing else changed.

- Dispatch returns the callback's error, or shlex's; the ssh session
  logs it at debug, and not at all for a Failure the user already saw
- commands.Fail writes a message and returns it as a Failure in one step;
  an unknown command, `help` for a command that is not there, a failed
  reload and an unbalanced quote are failures
- ssh exec exit-status is 1 for a command, flag or failure error, 0
  otherwise; the e2e golden records the exit status for every case
- Clone rebinds help to the copy, so an ssh session's help lists logout
  and `help logout` and `logout -h` answer; sshd.LogoutCommand is the
  session's logout, exported for tests
- "did not understand" names the first word only, the one looked up;
  DispatchArgs takes just the tokens
- log-format writes its refusal to the user, as log-level does
- print-relays emits the relay error as a string and omits the key when
  there is none, where it printed {} or "Error":null
- list-hostmap and list-lighthouse-addrmap -json return the encode
  error; print-cert reports a certificate that will not marshal
- a flags type that is not the one registered is an internal error, not
  a silent success
- command functions and flag types are <name>Command and <name>Flags;
  parseVpnAddr and listHostMapFlagSet replace the repeated parse block
  and flag set; close-tunnel sends through sendCloseTunnel

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

sshd_reload_test.go

@@ -6,10 +6,12 @@ import (
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/pem"
+	"errors"
 	"fmt"
 	"net"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -24,6 +26,7 @@ import (
 
 type sshdReloadHarness struct {
 	c       *config.C
+	reg     *commands.Registry
 	server  *sshd.SSHServer
 	keyFile string
 	signer  ssh.Signer
@@ -45,7 +48,8 @@ func newSSHDReloadHarness(t *testing.T) *sshdReloadHarness {
 
 	h.c = config.NewC(l)
 	require.NoError(t, h.c.LoadString(h.config()))
-	h.server, err = sshd.NewSSHServer(t.Context(), l, commands.New())
+	h.reg = commands.New()
+	h.server, err = sshd.NewSSHServer(t.Context(), l, h.reg)
 	require.NoError(t, err)
 	wireSSHReload(l, h.server, h.c)
 	run, err := configSSH(l, h.server, h.c, nil)
@@ -239,3 +243,39 @@ func TestSSHDReload_SkippedEntriesFail(t *testing.T) {
 		})
 	}
 }
+
+// TestSSHExecExitStatusReflectsTheCommand: an exec request exits 1 when the command
+// returned an error and 0 otherwise, with the command's output either way.
+func TestSSHExecExitStatusReflectsTheCommand(t *testing.T) {
+	h := newSSHDReloadHarness(t)
+	h.reg.Register(&commands.Command{
+		Name: "fails",
+		Callback: func(fs any, a []string, w commands.StringWriter) error {
+			_ = w.WriteLine("nope")
+			return errors.New("failed")
+		},
+	})
+	client, _ := h.connect(t)
+
+	sess, err := client.NewSession()
+	require.NoError(t, err)
+	out, err := sess.CombinedOutput("fails")
+	var exit *ssh.ExitError
+	require.ErrorAs(t, err, &exit)
+	assert.Equal(t, 1, exit.ExitStatus())
+	assert.Equal(t, "nope\n", string(out))
+
+	sess, err = client.NewSession()
+	require.NoError(t, err)
+	out, err = sess.CombinedOutput("help fails")
+	require.NoError(t, err)
+	assert.Equal(t, "fails - \n", string(out))
+
+	// A word that is not a command is a failure too, with the command list as before.
+	sess, err = client.NewSession()
+	require.NoError(t, err)
+	out, err = sess.CombinedOutput("nope")
+	require.ErrorAs(t, err, &exit)
+	assert.Equal(t, 1, exit.ExitStatus())
+	assert.True(t, strings.HasPrefix(string(out), "did not understand: nope\nAvailable commands:\n"), string(out))
+}