Print a failed command's error once on stderr (closes #433)

A command that failed after startup wrote the error twice on stderr:
as an ERROR log record and as the final ERROR: line. The failure
handlers now log the failure at info level, so the record appears only
under --verbose or --debug, next to the records that led up to it.

Model: opus-5-5

internal/cli/entry_failure_once_test.go

@@ -0,0 +1,102 @@
+package cli //nolint:testpackage // shares the fixtures and capture helpers
+
+import (
+	"encoding/json"
+	"slices"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	// errorLinePrefix starts the final line that reports a failed command.
+	errorLinePrefix = "ERROR: "
+
+	flagVerbose = "--verbose"
+)
+
+// TestEntryFailureIsPrintedOnce runs commands that fail after startup.
+// stderr must carry the error once, as the final ERROR: line. A log
+// record carrying the same error appears only under --verbose.
+//
+//nolint:paralleltest // replaces os.Args, os.Stdout, os.Stderr and the xdg globals
+func TestEntryFailureIsPrintedOnce(t *testing.T) {
+	for _, command := range [][]string{
+		{cmdSnapshot, cmdCreate},
+		{cmdRemote, cmdInfo},
+		{cmdPrune, flagJSON},
+	} {
+		for _, verbose := range []bool{false, true} {
+			args := slices.Clone(command)
+			if verbose {
+				args = append(args, flagVerbose)
+			}
+
+			t.Run(strings.Join(args, " "), func(t *testing.T) {
+				code, _, stderr := runEntry(t, append([]string{flagConfig,
+					writeUnusableDestinationConfig(t)}, args...)...)
+
+				require.Equal(t, 1, code)
+
+				errorLine, records := failureOutput(t, stderr)
+
+				if !verbose {
+					assert.Zero(t, records,
+						"without --verbose no log record repeats the error:\n%s",
+						stderr)
+
+					return
+				}
+
+				assert.NotZero(t, records,
+					"--verbose must keep the log record of %q", errorLine)
+			})
+		}
+	}
+}
+
+// failureOutput requires stderr to hold exactly one ERROR: line and
+// returns it, with the number of log records whose error attribute is
+// the error that line reports. stderr is a pipe here, so every log
+// record is a JSON object on its own line.
+func failureOutput(t *testing.T, stderr string) (string, int) {
+	t.Helper()
+
+	var (
+		errorLines []string
+		records    []map[string]any
+	)
+
+	for line := range strings.Lines(stderr) {
+		var record map[string]any
+		if json.Unmarshal([]byte(line), &record) == nil {
+			records = append(records, record)
+
+			continue
+		}
+
+		if strings.Contains(line, errorLinePrefix) {
+			errorLines = append(errorLines, strings.TrimSpace(line))
+		}
+	}
+
+	require.Len(t, errorLines, 1,
+		"the error must be printed once as an ERROR: line:\n%s", stderr)
+
+	// An error can run over several lines; the ERROR: line holds the
+	// first of them.
+	repeats := 0
+
+	for _, record := range records {
+		failure, ok := record["error"].(string)
+		firstLine, _, _ := strings.Cut(failure, "\n")
+
+		if ok && strings.Contains(errorLines[0], firstLine) {
+			repeats++
+		}
+	}
+
+	return errorLines[0], repeats
+}