More work on tentacles.

internal/app/internal_ui.go

@@ -42,10 +42,11 @@ type internalUINotice struct {
 	value interaction.Presentation
 }
 type internalUIRequest struct {
-	ctx     context.Context
-	session *interaction.Session
-	result  chan internalUIResult
-	ready   chan error
+	localOnly bool
+	ctx       context.Context
+	session   *interaction.Session
+	result    chan internalUIResult
+	ready     chan error
 }
 
 // internalUI owns one modal session on its worker. The bounded event channel
@@ -70,11 +71,21 @@ type internalUI struct {
 }
 
 func (ui *internalUI) Open(ctx context.Context, form interaction.Form) (<-chan internalUIResult, error) {
+	return ui.open_form(ctx, form, false)
+}
+
+// OpenLocal is core-only. Unknown input backends cannot silently fall back to
+// ordinary forms when authorizing remote access or handling its secrets/trust.
+func (ui *internalUI) OpenLocal(ctx context.Context, form interaction.Form) (<-chan internalUIResult, error) {
+	return ui.open_form(ctx, form, true)
+}
+
+func (ui *internalUI) open_form(ctx context.Context, form interaction.Form, localOnly bool) (<-chan internalUIResult, error) {
 	session, err := interaction.NewSession(form)
 	if err != nil {
 		return nil, err
 	}
-	request := internalUIRequest{ctx: ctx, session: session, result: make(chan internalUIResult, 1), ready: make(chan error, 1)}
+	request := internalUIRequest{ctx: ctx, session: session, result: make(chan internalUIResult, 1), ready: make(chan error, 1), localOnly: localOnly}
 	select {
 	case <-ctx.Done():
 		return nil, ctx.Err()
@@ -202,7 +213,17 @@ func (ui *internalUI) run(ctx context.Context) {
 				continue
 			}
 			var err error
-			sessionID, err = ui.keys.BeginInternalUI(request.ctx)
+			if request.localOnly {
+				if keys, ok := ui.keys.(interface {
+					BeginLocalUI(context.Context) (uint64, error)
+				}); ok {
+					sessionID, err = keys.BeginLocalUI(request.ctx)
+				} else {
+					err = errors.New("local approval input unavailable")
+				}
+			} else {
+				sessionID, err = ui.keys.BeginInternalUI(request.ctx)
+			}
 			if err != nil {
 				request.ready <- err
 				close(request.result)