fix: harden maintenance operations

cmd/proxyctl/main.go

@@ -51,10 +51,16 @@ func (processEnvironment) LookupEnv(name string) (string, bool) { return os.Look
 func runWithEnvironment(args []string, input io.Reader, output io.Writer, environment profile.IdentityEnvironment, files shell.FileSystem, executable string) error {
 	profileConfiguration, err := profile.ResolveConfiguration(environment)
 	if err != nil {
+		if len(args) == 1 && args[0] == "doctor" {
+			fmt.Fprintf(output, "[FAIL] identity resolution — %s\n", profile.RedactText(err.Error()))
+		}
 		return err
 	}
 	shellConfiguration, err := shell.ResolveConfiguration(environment)
 	if err != nil {
+		if len(args) == 1 && args[0] == "doctor" {
+			fmt.Fprintf(output, "[FAIL] Shell Target configuration — %s\n", profile.RedactText(err.Error()))
+		}
 		return err
 	}
 	shellTarget := shell.New(shellConfiguration, files, environment)
@@ -129,6 +135,9 @@ func runMaintenanceCommand(args []string, input io.Reader, output io.Writer, sto
 		checks = append([]target.Check{profileCheck}, checks...)
 		report := app.NewMaintenance(state, targets, nil, nil).Doctor(context.Background(), checks)
 		fmt.Fprint(output, report.String())
+		if !report.Healthy() {
+			return errors.New("doctor found configuration problems")
+		}
 		return nil
 	}
 	if args[0] != "reset" {
@@ -141,11 +150,19 @@ func runMaintenanceCommand(args []string, input io.Reader, output io.Writer, sto
 		fmt.Fprintln(output, "Reset cancelled; no Targets changed.")
 		return nil
 	}
+	if mutationLock == nil {
+		return errors.New("mutation lock is not configured")
+	}
+	unlock, err := mutationLock.Lock(context.Background())
+	if err != nil {
+		return fmt.Errorf("lock proxyctl mutation: %w", err)
+	}
+	defer unlock()
 	state, err := store.Load()
 	if err != nil {
 		return err
 	}
-	result := app.NewMaintenance(state, targets, mutationLock, logger).Reset(context.Background(), true)
+	result := app.NewMaintenance(state, targets, heldMutationLock{}, logger).Reset(context.Background(), true)
 	for _, item := range result.Targets {
 		if item.Skipped {
 			fmt.Fprintf(output, "%s: skipped (%s) — %s\n", item.TargetID, item.Inspection.State, profile.RedactText(item.Inspection.Evidence))
@@ -160,6 +177,10 @@ func runMaintenanceCommand(args []string, input io.Reader, output io.Writer, sto
 	return result.Err
 }
 
+type heldMutationLock struct{}
+
+func (heldMutationLock) Lock(context.Context) (func(), error) { return func() {}, nil }
+
 func diagnosticChecks(configuration profile.Configuration) []target.Check {
 	identity := target.Check{Name: "identity resolution", OK: true, Evidence: fmt.Sprintf("configuration owner %s (uid %d, gid %d)", configuration.Owner.Username, configuration.Owner.UID, configuration.Owner.GID)}
 	ok, evidence := storagePermissions(configuration)