refactor(#2302): type socket wire fields as ident, validated by serde on deserialize

hivectl/src/util.rs

@@ -6,6 +6,16 @@ use std::path::Path;
 
 use anyhow::{Context as _, Result, bail};
 
+/// Parse a CLI-supplied agent/account name into a validated
+/// [`hive_types::Ident`], mapping the parse error to an `anyhow` error that
+/// names the offending input. Used at hivectl's `HostRequest` construction
+/// sites so the wire `Ident` fields are built from validated names (the daemon
+/// re-validates on deserialize; parsing here gives the operator an immediate,
+/// local error instead of a round-trip rejection).
+pub(crate) fn parse_ident(name: &str) -> Result<hive_types::Ident> {
+    hive_types::Ident::parse(name).map_err(|e| anyhow::anyhow!("invalid agent name {name:?}: {e}"))
+}
+
 /// Send a provisioning request to the daemon and print its result lines.
 /// The daemon owns the provisioning logic; hivectl just relays the outcome,
 /// prefixing any error with `label` (e.g. `forge` / `github`).
@@ -115,7 +125,7 @@ pub(crate) async fn query_hive_urls(socket: &Path) -> Option<hive_host_sock::Hiv
 /// "needs root" error fixes that first-run footgun, where running a
 /// privileged verb without sudo reported as a missing agent.
 pub(crate) fn agent_exists(name: &str) -> Result<bool> {
-    let Ok(name) = hive_host_sock::Ident::parse(name) else {
+    let Ok(name) = hive_types::Ident::parse(name) else {
         bail!("invalid agent name {name:?}");
     };
     let root = hive_host_sock::agent_state_dir(&name);