oops-cli 0.1.0

data/lib/oops/recorder.rb

@@ -0,0 +1,416 @@
+require "pty"
+require "io/console"
+
+module Oops
+  # The pty relay behind `oops record`: runs the shell on a new pty, relays
+  # input and output between it and the user's terminal, strips the hook
+  # markers from the output and writes finished commands to the session log.
+  #
+  # Rule one is never to break the user's shell. Failing to set up the log
+  # only disables recording; any failure after the shell is running switches
+  # logging off and the relay goes on.
+  class Recorder
+    READ_SIZE = 65_536
+    # Input waiting for the shell beyond this stays in the kernel's tty
+    # buffer (it is not read) until the shell catches up.
+    MAX_PENDING_INPUT = 1_048_576
+    # Backstop for a missed SIGCHLD; normally the self-pipe wakes the loop.
+    POLL_INTERVAL = 1.0
+    # Pause after an unexpected error in the relay loop, so an error that
+    # repeats cannot spin the CPU.
+    ERROR_BACKOFF = 0.05
+
+    # The shell could not be started on the new pty.
+    class ChildStartError < StandardError; end
+
+    # Feeds child output through the StreamParser and appends records to the
+    # log. Failures never lose output: a failing log is dropped, and if the
+    # parser itself fails, bytes are forwarded unparsed from then on.
+    #
+    # A pause marker counts only while the log's pause flag file exists (and
+    # a resume marker only while it does not): `oops pause` creates the file
+    # before it prints the marker, while program output that merely contains
+    # the marker cannot.
+    class OutputFilter
+      def initialize(log:, on_error:, max_bytes: 1_048_576)
+        @log = log
+        @on_error = on_error
+        @parser = StreamParser.new(max_bytes: max_bytes, pause_gate: pause_gate(log)) { |record| store(record) }
+        @broken = false
+      end
+
+      # Returns the bytes to show on the terminal.
+      def feed(bytes)
+        return bytes.b if @broken
+
+        @parser.feed(bytes)
+      rescue StandardError => e
+        parser_failed(e)
+        bytes.b
+      end
+
+      # Returns held-back bytes; an unfinished command is logged with exit nil.
+      def finish
+        return "".b if @broken
+
+        @parser.finish
+      rescue StandardError => e
+        parser_failed(e)
+        "".b
+      end
+
+      private
+
+      def pause_gate(log)
+        return nil unless log
+
+        lambda do |kind|
+          paused = begin
+            log.paused?
+          rescue SystemCallError
+            false
+          end
+          kind == :pause ? paused : !paused
+        end
+      end
+
+      def store(record)
+        return unless @log
+
+        @log.append(record)
+      rescue StandardError => e
+        @log = nil
+        @on_error.call(e.message)
+      end
+
+      def parser_failed(error)
+        @broken = true
+        @log = nil
+        @on_error.call("stream parser failed: #{error.class}: #{error.message}")
+      end
+    end
+
+    def initialize(argv, env: ENV, stdin: $stdin, stdout: $stdout, stderr: $stderr)
+      @argv = argv.empty? ? [default_shell(env)] : argv
+      @env = env
+      @stdin = stdin
+      @stdout = stdout
+      @stderr = stderr
+      @raw = false
+      @log_failed = false
+    end
+
+    def run
+      tty = Tty.name(@stdin)
+      return exec_shell({}) if tty && @env["OOPS_TTY"] == tty
+
+      install_traps
+      log = open_session
+      master, pid = start_child
+      unless pid
+        discard_session
+        return exec_shell({ "OOPS_DISABLE" => "1" })
+      end
+
+      @master = master
+      @pid = pid
+      @filter = OutputFilter.new(log: log, on_error: method(:log_failed))
+      with_raw_mode { relay }
+      # Waited for with the terminal already restored: a shell that closed
+      # the pty but keeps running must not leave the terminal raw.
+      @status ||= Process.wait2(@pid)[1]
+      exit_code(@status)
+    ensure
+      restore_traps
+      @master.close if @master && !@master.closed?
+      @wake_r&.close
+      @wake_w&.close
+    end
+
+    private
+
+    def default_shell(env)
+      shell = env["SHELL"].to_s
+      shell.empty? ? "/bin/sh" : shell
+    end
+
+    # Replaces this process with the shell. Returns only when exec fails.
+    def exec_shell(extra_env)
+      Kernel.exec(extra_env, [@argv[0], @argv[0]], *@argv[1..])
+    rescue SystemCallError => e
+      @stderr.puts "oops: cannot run #{@argv[0]}: #{e.message}"
+      127
+    end
+
+    # --- session log ---
+
+    def open_session
+      dir = Paths.sessions_dir(env: @env)
+      @session_path = SessionLog.new_path(dir)
+      Paths.ensure_sessions_dir!(env: @env)
+      rotate_logs(dir)
+      File.open(@session_path, File::WRONLY | File::CREAT | File::APPEND, 0o600, &:itself)
+      write_status("ok")
+      SessionLog.new(@session_path)
+    rescue StandardError => e
+      @log_failed = true
+      warn_line "oops: warning: session log unavailable (#{e.message}); recording disabled"
+      write_status("log-error: #{e.message}")
+      nil
+    end
+
+    # The shell runs unrecorded, so an empty log would only mislead.
+    def discard_session
+      return unless @session_path
+
+      [@session_path, "#{@session_path}.status"].each do |f|
+        File.delete(f)
+      rescue SystemCallError
+        nil
+      end
+    end
+
+    # Rotation only frees space; failing to rotate must not stop recording.
+    def rotate_logs(dir)
+      SessionLog.rotate!(dir)
+    rescue SystemCallError
+      nil
+    end
+
+    def write_status(text)
+      return unless @session_path && File.directory?(File.dirname(@session_path))
+
+      File.open("#{@session_path}.status", File::WRONLY | File::CREAT | File::TRUNC, 0o600) do |f|
+        f.write(text)
+      end
+    rescue SystemCallError, IOError
+      nil
+    end
+
+    # Called at most once: the first log failure switches logging off.
+    def log_failed(message)
+      return if @log_failed
+
+      @log_failed = true
+      warn_line "oops: warning: session log write failed (#{message}); recording disabled"
+      write_status("log-error: #{message}")
+    end
+
+    def warn_line(message)
+      @stderr.write(message, @raw ? "\r\n" : "\n")
+      @stderr.flush
+    rescue SystemCallError, IOError
+      nil
+    end
+
+    # --- child process ---
+
+    # Returns [master, pid], or nil after printing why the pty or the shell
+    # could not be started.
+    def start_child
+      master, slave = PTY.open
+      copy_termios(slave)
+      copy_winsize(master)
+      [master, fork_child(slave.path)]
+    rescue SystemCallError, IOError, NotImplementedError, ChildStartError => e
+      master&.close
+      @stderr.puts "oops: recording disabled: #{e.message}"
+      nil
+    ensure
+      # Kept open until the child has opened the slave itself, so the pty is
+      # never without a slave in between (that would read as a hangup).
+      slave&.close
+    end
+
+    # Forks the shell as a session leader with the pty slave as its
+    # controlling terminal. A close-on-exec pipe reports whether exec
+    # succeeded: EOF means it did, otherwise it carries the error.
+    def fork_child(slave_path)
+      report_r, report_w = IO.pipe
+      child_env = { "OOPS_SESSION" => @session_path, "OOPS_TTY" => slave_path }
+      pid = fork do
+        report_r.close
+        begin
+          Process.setsid
+          File.open(slave_path, File::RDWR) do |tty|
+            Kernel.exec(child_env, [@argv[0], @argv[0]], *@argv[1..], in: tty, out: tty, err: tty)
+          end
+        rescue StandardError => e
+          report_w.write("cannot run #{@argv[0]}: #{e.message}")
+        ensure
+          exit!(127)
+        end
+      end
+      report_w.close
+      error = report_r.read
+      return pid if error.empty?
+
+      Process.wait(pid)
+      raise ChildStartError, error
+    ensure
+      report_r&.close
+      report_w&.close unless report_w.nil? || report_w.closed?
+    end
+
+    # The shell starts with the user's terminal settings (erase key, UTF-8
+    # input, ...), as script(1) does.
+    def copy_termios(slave)
+      return unless @stdin.respond_to?(:console_mode) && @stdin.tty?
+
+      slave.console_mode = @stdin.console_mode
+    rescue SystemCallError, IOError
+      nil
+    end
+
+    def copy_winsize(master)
+      return unless @stdin.respond_to?(:winsize) && @stdin.tty?
+
+      rows, cols = @stdin.winsize
+      master.winsize = [rows, cols] if rows.positive? && cols.positive?
+    rescue SystemCallError, IOError
+      nil
+    end
+
+    # --- signals ---
+
+    def install_traps
+      @wake_r, @wake_w = IO.pipe
+      wake = @wake_w
+      @old_traps = %w[WINCH CHLD].to_h do |sig|
+        [sig, trap(sig) { wake.write_nonblock(sig[0], exception: false) }]
+      end
+    end
+
+    def restore_traps
+      @old_traps&.each { |sig, old| trap(sig, old || "DEFAULT") }
+    end
+
+    # --- terminal ---
+
+    def with_raw_mode
+      return yield unless @stdin.respond_to?(:raw!) && @stdin.tty?
+
+      saved = @stdin.console_mode
+      begin
+        @stdin.raw!
+        @raw = true
+        yield
+      ensure
+        @raw = false
+        begin
+          @stdin.console_mode = saved
+        rescue SystemCallError, IOError
+          nil
+        end
+      end
+    end
+
+    # --- relay loop ---
+
+    def relay
+      @input = +"".b
+      @stdin_open = true
+      @output_open = true
+      @status = nil
+      step while @output_open && @status.nil?
+      drain_output if @output_open
+      write_terminal(@filter.finish)
+    end
+
+    # Errors the relay expects (EIO, EOF, EPIPE) are handled where they
+    # occur; anything else is reported once and the relay goes on, because
+    # ending it would hang up the shell.
+    def step
+      relay_step
+    rescue StandardError => e
+      unless @relay_error_reported
+        @relay_error_reported = true
+        warn_line "oops: warning: unexpected relay error (#{e.class}: #{e.message}); continuing"
+      end
+      sleep ERROR_BACKOFF
+    end
+
+    def relay_step
+      readers = [@master, @wake_r]
+      readers << @stdin if @stdin_open && @input.bytesize < MAX_PENDING_INPUT
+      writers = @input.empty? ? nil : [@master]
+      readable, writable = IO.select(readers, writers, nil, POLL_INTERVAL)
+      readable ||= []
+      handle_wakeup if readable.include?(@wake_r)
+      read_input if readable.include?(@stdin)
+      write_input if writable&.include?(@master)
+      read_output if readable.include?(@master)
+      reap_child
+    end
+
+    def handle_wakeup
+      signals = @wake_r.read_nonblock(READ_SIZE, exception: false)
+      copy_winsize(@master) if signals.is_a?(String) && signals.include?("W")
+    end
+
+    # The user's terminal went away: hang up the shell, as closing a
+    # terminal window does.
+    def read_input
+      @input << @stdin.readpartial(READ_SIZE).b
+    rescue EOFError, Errno::EIO
+      @stdin_open = false
+      hang_up_shell if @stdin.tty?
+    end
+
+    def write_input
+      written = @master.write_nonblock(@input, exception: false)
+      @input = @input.byteslice(written..) if written.is_a?(Integer)
+    rescue Errno::EIO, Errno::EPIPE
+      @input.clear
+    end
+
+    def read_output
+      data = @master.read_nonblock(READ_SIZE, exception: false)
+      return if data == :wait_readable
+
+      data.nil? ? (@output_open = false) : write_terminal(@filter.feed(data))
+    rescue Errno::EIO
+      # The child side closed the pty: the shell is gone.
+      @output_open = false
+    end
+
+    # After the shell exited, a background job may still hold the pty open;
+    # forward what is already there instead of waiting for it.
+    def drain_output
+      loop do
+        data = @master.read_nonblock(READ_SIZE, exception: false)
+        break if data.nil? || data == :wait_readable
+
+        write_terminal(@filter.feed(data))
+      end
+    rescue Errno::EIO
+      nil
+    end
+
+    def reap_child
+      _, status = Process.wait2(@pid, Process::WNOHANG)
+      @status = status if status
+    end
+
+    def write_terminal(bytes)
+      return if bytes.empty? || @terminal_gone
+
+      @stdout.write(bytes)
+      @stdout.flush
+    rescue Errno::EIO, Errno::EPIPE
+      # The terminal is gone; hang up the shell as closing it would.
+      @terminal_gone = true
+      hang_up_shell
+    end
+
+    def hang_up_shell
+      Process.kill("HUP", @pid)
+    rescue SystemCallError
+      nil
+    end
+
+    def exit_code(status)
+      status.exitstatus || (128 + status.termsig.to_i)
+    end
+  end
+end

data/lib/oops/secrets.rb

@@ -0,0 +1,85 @@
+module Oops
+  # Masks likely secrets in captured text. Each pattern replaces either its
+  # whole match or, when it defines a named group `secret`, only that group.
+  module Secrets
+    TOKEN = "[secret]".freeze
+
+    # Octet 0-255, used by the IPv4 pattern.
+    OCTET = "(?:25[0-5]|2[0-4]\\d|1?\\d?\\d)".freeze
+
+    # Order matters: specific token formats first, then URL userinfo before
+    # email, and the generic key/value rule last so it skips values that an
+    # earlier pattern already replaced.
+    BUILTIN = [
+      /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/,                                   # AWS access key id
+      /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_\w{20,})/,             # GitHub tokens
+      /\bxox[abprs]-[A-Za-z0-9-]+/, # Slack tokens
+      /\bsk-[A-Za-z0-9_-]{20,}/,                                        # OpenAI / Anthropic keys
+      /\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/,                         # Stripe secret keys
+      /\bglpat-[A-Za-z0-9_-]{20,}/,                                     # GitLab tokens
+      /\bAIza[0-9A-Za-z_-]{35}/,                                        # Google API keys
+      /\bnpm_[A-Za-z0-9]{36}/,                                          # npm tokens
+      %r{hooks\.slack\.com/services/(?<secret>[A-Za-z0-9/]+)},          # Slack webhook URLs
+      /\beyJ[\w-]+\.[\w-]+\.[\w-]+/, # JWT
+      %r{Authorization:[ \t]*(?:Bearer|Basic|token)[ \t]+(?<secret>[\w.~+/=-]+)}i,
+      # Without an END line (cut off by head, a failed command or the capture
+      # limit) everything after BEGIN is masked.
+      /-----BEGIN [A-Z ]*PRIVATE KEY-----.*?(?:-----END [A-Z ]*PRIVATE KEY-----|\z)/m,
+      %r{\b[a-z][a-z0-9+.-]*://(?<secret>[^\s/@:]+:[^\s/@]+)@}i, # URL userinfo
+      %r{[A-Za-z0-9._%+-]+@(?>[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)+)(?!:[\w~/])}, # email, not scp-style git@host:path
+      # Public IPv4: not private/loopback/unspecified, and not part of a longer
+      # dotted number such as a version string (1.2.3.4.5).
+      Regexp.new(
+        "(?<![\\w.])" \
+        "(?!127\\.|0\\.0\\.0\\.0|10\\.|192\\.168\\.|172\\.(?:1[6-9]|2\\d|3[01])\\.)" \
+        "(?<secret>#{OCTET}(?:\\.#{OCTET}){3})(?!\\w|\\.\\d)"
+      ),
+      # Passwords given as command-line arguments. The spans between the
+      # command name and the option are bounded so a long line of repeated
+      # command names cannot make matching quadratic.
+      /(?<![\w-])--(?:password|passwd|pwd)[ \t]+(?<q>["'])?
+        (?<secret>(?![-\[])(?(<q>)(?>\\.|(?!\k<q>)[^\\\n])++|[^\s"']+))\k<q>?/ix,
+      /\bcurl\b[^\n|;&]{0,200}?\s(?:-u|--user)[ \t]+(?<secret>[^\s:]+:\S+)/,
+      /\bmysql(?:dump|admin|pump)?\b[^\n|;&]{0,200}?\s-p(?<secret>[^\s"']+)/,
+      /\bdocker\b[^\n|;&]{0,200}?\blogin\b[^\n|;&]{0,200}?\s(?:-p|--password)[ \t]+(?<secret>\S+)/,
+      # name containing key/token/secret/password/passwd/pwd, then = or :
+      # Quoted values run to the matching closing quote (backslash escapes
+      # allowed) using an atomic body, so matching stays linear; an unterminated
+      # quote masks to the end of the line. Unquoted values stop at whitespace,
+      # quotes, , ; and & (so query strings keep each pair apart). The name
+      # parts are bounded: with unbounded repeats on both sides of the keyword,
+      # a long word that is full of keywords took quadratic time.
+      /(?<![\w.-])[\w.-]{0,64}(?:key|token|secret|password|passwd|pwd)[\w.-]{0,64}["']?[ \t]*[=:][ \t]*
+        (?<q>["'])?
+        (?<secret>(?!\[secret\])(?(<q>)(?>\\.|(?!\k<q>)[^\\\n])++|[^\s"',;&]+))
+        \k<q>?/ix
+    ].freeze
+
+    module_function
+
+    # Returns [masked_text, number_of_replacements]. `extra` regexps run first.
+    # Input is scrubbed (invalid UTF-8 bytes become U+FFFD) so regexps never
+    # raise on arbitrary captured output; the returned copy is always valid.
+    def mask(text, extra: [])
+      out = text.scrub
+      count = 0
+      (extra + BUILTIN).each do |pattern|
+        out = out.gsub(pattern) do
+          count += 1
+          replacement(Regexp.last_match)
+        end
+      end
+      [out, count]
+    end
+
+    def replacement(match)
+      return TOKEN unless match.names.include?("secret") && match[:secret]
+
+      # Byte offsets: char offsets would cost O(n) per match on long input.
+      whole = match[0]
+      start = match.byteoffset(0).first
+      from, to = match.byteoffset(:secret).map { |offset| offset - start }
+      whole.byteslice(0, from) + TOKEN + whole.byteslice(to..)
+    end
+  end
+end

data/lib/oops/session_log.rb

@@ -0,0 +1,213 @@
+module Oops
+  # Append-only JSONL log of captured commands for one shell session. A log
+  # that grows past its cap is rewritten to keep only its newest records.
+  class SessionLog
+    CHUNK_SIZE = 64 * 1024
+    DEFAULT_MAX_BYTES = 50 * 1024 * 1024
+    # When a log passes its cap it is cut to this share of the cap, so a busy
+    # tab is not rewritten on every command.
+    TRIM_TO = 0.75
+    LOG_NAME = /\A(\d{8}-\d{6})-(\d+)\.jsonl\z/
+
+    attr_reader :path
+
+    def self.new_path(dir, pid: Process.pid, now: Time.now)
+      stamp = now.strftime("%Y%m%d-%H%M%S")
+      File.join(dir, "#{stamp}-#{pid}.jsonl")
+    end
+
+    def self.process_alive?(pid)
+      Process.kill(0, pid)
+      true
+    rescue Errno::EPERM
+      true
+    rescue SystemCallError
+      false
+    end
+
+    # Deletes the oldest logs of finished sessions until the total size of
+    # all session logs is at most max_bytes. Logs of live sessions are kept.
+    def self.rotate!(dir, max_bytes: DEFAULT_MAX_BYTES, alive: method(:process_alive?))
+      logs = Dir.children(dir).filter_map do |name|
+        m = LOG_NAME.match(name)
+        next unless m
+
+        size = begin
+          File.size(File.join(dir, name))
+        rescue SystemCallError
+          next
+        end
+        { name: name, pid: m[2].to_i, size: size }
+      end
+      total = logs.sum { |l| l[:size] }
+      logs.sort_by { |l| l[:name] }.each do |log|
+        break if total <= max_bytes
+        next if alive.call(log[:pid])
+
+        remove_log(File.join(dir, log[:name]))
+        total -= log[:size]
+      end
+    rescue Errno::ENOENT
+      nil
+    end
+
+    def self.remove_log(file)
+      [file, "#{file}.paused", "#{file}.status", "#{file}.trim"].each do |f|
+        File.delete(f)
+      rescue Errno::ENOENT
+        nil
+      end
+    end
+    private_class_method :remove_log
+
+    def initialize(path, max_bytes: DEFAULT_MAX_BYTES)
+      @path = path
+      @max_bytes = max_bytes
+    end
+
+    # Raises if the record cannot be written. Trimming an oversized log is
+    # best effort and never raises.
+    def append(record)
+      line = record.to_json_line
+      size = File.open(@path, File::APPEND | File::CREAT | File::WRONLY, 0o600) do |f|
+        f.syswrite(line)
+        f.size
+      end
+      trim if size > @max_bytes
+    end
+
+    # Yields records newest first. Unparsable lines are skipped. The block can
+    # return :stop to end the iteration.
+    def each_backward
+      return enum_for(:each_backward) unless block_given?
+
+      File.open(@path, "rb") do |io|
+        each_line_backward(io) do |line|
+          record = parse(line)
+          next unless record
+          return nil if yield(record) == :stop
+        end
+      end
+      nil
+    rescue Errno::ENOENT
+      nil
+    end
+
+    # Newest count finished, non-oops records, oldest first.
+    def last(count, skip_oops: true)
+      found = []
+      each_backward do |r|
+        next if r.exit.nil? || (skip_oops && r.oops_self?)
+
+        found << r
+        :stop if found.size >= count
+      end
+      found.reverse
+    end
+
+    def last_failed
+      each_backward do |r|
+        return r if r.exit.is_a?(Integer) && r.exit != 0 && !r.oops_self?
+      end
+      nil
+    end
+
+    def paused?
+      File.exist?(pause_path)
+    end
+
+    def pause!
+      File.open(pause_path, File::CREAT | File::WRONLY, 0o600, &:itself)
+    end
+
+    def resume!
+      File.delete(pause_path)
+    rescue Errno::ENOENT
+      nil
+    end
+
+    private
+
+    def pause_path
+      "#{@path}.paused"
+    end
+
+    # Rewrites the log with the newest complete records that fit in TRIM_TO
+    # of the cap (always at least the newest one). The new file is written
+    # next to the log and renamed over it, so a reader sees either the old or
+    # the new log, never a mix.
+    def trim
+      keep = newest_lines((@max_bytes * TRIM_TO).to_i)
+      tmp = "#{@path}.trim"
+      remove_file(tmp)
+      File.open(tmp, File::WRONLY | File::CREAT | File::EXCL, 0o600) do |f|
+        keep.reverse_each { |l| f.write(l, "\n") }
+      end
+      File.rename(tmp, @path)
+    rescue StandardError
+      remove_file(tmp) if tmp
+      nil
+    end
+
+    # Newest lines first, as many as fit in limit bytes (newlines included),
+    # but at least one.
+    def newest_lines(limit)
+      lines = []
+      total = 0
+      File.open(@path, "rb") do |io|
+        each_line_backward(io) do |line|
+          next if line.empty?
+          break if !lines.empty? && total + line.bytesize + 1 > limit
+
+          lines << line
+          total += line.bytesize + 1
+        end
+      end
+      lines
+    end
+
+    def remove_file(file)
+      File.delete(file)
+    rescue SystemCallError
+      nil
+    end
+
+    def parse(line)
+      return nil if line.empty?
+
+      Record.from_json_line(line)
+    rescue Record::ParseError
+      nil
+    end
+
+    def read_chunk(io, offset, length)
+      io.seek(offset)
+      io.read(length)
+    end
+
+    # Yields complete lines (without newline) from the end of the file. An
+    # unterminated tail, if any, is ignored as a partial write.
+    def each_line_backward(io, &)
+      pos = io.size
+      return if pos.zero?
+
+      discard = read_chunk(io, pos - 1, 1) != "\n"
+      carry = "".b
+      while pos.positive?
+        len = [CHUNK_SIZE, pos].min
+        pos -= len
+        parts = (read_chunk(io, pos, len) + carry).split("\n", -1)
+        if discard
+          if parts.size > 1
+            parts.pop
+            discard = false
+          else
+            parts.clear
+          end
+        end
+        carry = pos.positive? && !parts.empty? ? parts.shift : "".b
+        parts.reverse_each(&)
+      end
+    end
+  end
+end