Module cli 

Worker-binary CLI parsing helpers.

The supermachine-worker binary’s argument loop inlined all of its parsing + validation and called std::process::exit on every bad value, which made none of it unit-testable. These pure functions return Result<_, String> so the binary stays a thin “parse → on Err, print + exit(2)” wrapper while the parsing and validation — including the security-sensitive vsock auth token — are exercised by the tests below.

Structs

TsiToken

The vsock TSI control-channel auth token.

Functions

append_tsi_token_cmdline

Append supermachine.tsi_token=<hex> to a kernel cmdline, inserting a single space separator only when the existing cmdline needs one.

hex_lower

Lowercase-hex render of a byte slice (no separators).

parse_mount_spec

Parse a --mount HOST:TAG:GUEST_PATH[:POLICY] spec. POLICY is one of deny / opaque / follow (default Opaque). Validates the tag (1..=35 bytes) and an absolute guest path.

parse_tsi_token

Parse a --tsi-token value: exactly 64 hex characters (= 32 bytes), case-insensitive on input. Returns the canonical lowercase hex plus the decoded bytes. Anything else — wrong length, a non-hex digit — is an error (the binary turns it into exit code 2).

parse_volume_spec

Parse a --volume HOST:GUEST[:SIZE_BYTES] spec. Size is optional (VolumeSpec applies the 1 GiB default). Splits on at most two : so the host path keeps any later colons (host paths on macOS never contain :, but the guest path / size never do either).