Module remote_command 

One targeting rule for every command that reads or changes router state.

Targeting used to be decided per command family, so what “the router” meant depended on which subcommand was typed: auth and with followed the selected server while tokens, accounts, providers, logs and doctor were local-only and refused to start without a local TOKEN_SECRET — even with a selected server reachable and answering in the same second. That turned one predictable behaviour into a table an operator had to memorise (issue #294).

The rule is now stated once, here: act on the router this machine is pointed at, and where an operation genuinely has no remote form, say so and name the target rather than silently answering about local state.

TOKEN_SECRET belongs to the deployment that signs tokens. A workstation driving a remote router authenticates with an admin token instead, so the signing secret has no reason to be there — requiring it pushed operators toward copying it off the host, which is the opposite of what the admin-token design is for.

Enums

Target

Which router a command acts on.

Functions

may_be_remote

Whether this invocation may need a router other than the local one.

names_local_state

Whether this invocation named the local state it wants acted on.

no_remote_form

Say that an operation has no remote form, naming the router it cannot reach.

refuse

Print a refusal and return its exit code.

refuse_managed

Refuse --managed where nothing can start a container.

relax_token_secret_for_cli

Let every command that does not serve start without TOKEN_SECRET.

resolve

Resolve the router target names, reporting a resolution failure itself.

target_of

The target flags a command carries, when it has them.