feat: miso agent refuses to run outside the builder VM

Co-Authored-By: Claude <noreply@anthropic.com>
Signed-off-by: karo <karolin.kostial@gmail.com>

Author: The127

cmd/miso/agent.go

@@ -0,0 +1,24 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+
+	"github.com/urfave/cli/v3"
+)
+
+var agentCommand = &cli.Command{
+	Name:   "agent",
+	Usage:  "answer the host, as the init of the builder VM",
+	Hidden: true,
+	Action: runAgent,
+}
+
+func runAgent(context.Context, *cli.Command) error {
+	if os.Getpid() != 1 {
+		return errors.New("miso agent runs as the init of the builder VM")
+	}
+
+	return nil
+}

cmd/miso/main.go

@@ -12,7 +12,7 @@ func main() {
 	miso := &cli.Command{
 		Name:     "miso",
 		Usage:    "build systemd-based operating systems from a build file",
-		Commands: []*cli.Command{planCommand, versionCommand},
+		Commands: []*cli.Command{planCommand, versionCommand, agentCommand},
 	}
 
 	if err := miso.Run(context.Background(), os.Args); err != nil {

justfile

@@ -21,6 +21,10 @@ test-vm *args:
 test-vm-one package *args:
     MISO_VMTEST_PACKAGES={{package}} bash hack/test-vm.sh -test.timeout=20s -test.failfast {{args}}
 
+# test the miso binary from the outside, as a user runs it
+test-cli: build
+    MISO={{justfile_directory()}}/bin/miso bats test
+
 # test with a coverage profile
 cover:
     go test -coverprofile=coverage.out -covermode=atomic ./...
@@ -61,4 +65,4 @@ hooks:
     lefthook install
 
 # everything that must pass before a push
-ci: lint prose doccheck arch build cover vuln
+ci: lint prose doccheck arch build cover test-cli vuln

test/agent.bats

@@ -0,0 +1,9 @@
+#!/usr/bin/env bats
+# MISO names the miso binary under test, see just test-cli.
+
+@test "the agent refuses to run outside the builder VM" {
+    run "$MISO" agent
+
+    [ "$status" -eq 1 ]
+    [[ "$output" == *"miso agent runs as the init of the builder VM"* ]]
+}