obvyr-cli 2.6.0__tar.gz → 2.7.0__tar.gz

{obvyr_cli-2.6.0 → obvyr_cli-2.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: obvyr-cli
-Version: 2.6.0
+Version: 2.7.0
 Summary: Command-line wrapper to allow Obvyr to capture evidence from any machine.
 License: Proprietary
 Author: Wyrd Technology Ltd
@@ -8,12 +8,13 @@ Requires-Python: >=3.14,<4.0
 Classifier: License :: Other/Proprietary License
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: click (==8.4.2)
+Classifier: Programming Language :: Python :: 3.15
+Requires-Dist: click (==8.5.0)
 Requires-Dist: httpx (==0.28.1)
-Requires-Dist: orjson (==3.11.9)
-Requires-Dist: pydantic (==2.13.4)
-Requires-Dist: pydantic-settings (==2.14.2)
-Requires-Dist: python-dotenv (==1.2.2)
+Requires-Dist: orjson (==3.12.0)
+Requires-Dist: pydantic (==2.13.5)
+Requires-Dist: pydantic-settings (==2.15.0)
+Requires-Dist: python-dotenv (==1.2.4)
 Requires-Dist: tenacity (==9.1.4)
 Requires-Dist: toml (==0.10.2)
 Requires-Dist: zstandard (==0.25.0)

{obvyr_cli-2.6.0 → obvyr_cli-2.7.0}/pyproject.toml

@@ -1,10 +1,10 @@
 [build-system]
-requires = ["poetry-core==2.4.1"]
+requires = ["poetry-core==2.5.0"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "obvyr-cli"
-version = "2.6.0"
+version = "2.7.0"
 description = "Command-line wrapper to allow Obvyr to capture evidence from any machine."
 authors = ["Wyrd Technology Ltd"]
 license = "Proprietary"
@@ -28,26 +28,26 @@ include = "obvyr_cli"
 
 [tool.poetry.dependencies]
 python = ">=3.14,<4.0"
-python-dotenv = "1.2.2"
-click = "8.4.2"
-pydantic = "2.13.4"
-pydantic-settings = "2.14.2"
+python-dotenv = "1.2.4"
+click = "8.5.0"
+pydantic = "2.13.5"
+pydantic-settings = "2.15.0"
 httpx = "0.28.1"
 tenacity = "9.1.4"
 toml = "0.10.2"
-orjson = "3.11.9"
+orjson = "3.12.0"
 zstandard = "0.25.0"
 
 [tool.poetry.group.dev.dependencies]
-ruff = "0.15.20"
+ruff = "0.16.10"
 mypy = "1.20.2"
 pytest = "9.1.1"
 pytest-cov = "7.1.0"
 black = "26.5.1"
-pyproject-fmt = "2.25.1"
+pyproject-fmt = "2.29.4"
 pytest-subprocess = "1.6.0"
 types-toml = "^0.10.8.20240310"
-poethepoet = "0.47.1"
+poethepoet = "0.48.0"
 
 [tool.poetry.scripts]
 obvyr = "obvyr_cli.cli:cli_run_process"

{obvyr_cli-2.6.0 → obvyr_cli-2.7.0}/src/obvyr_cli/archive_builder.py

@@ -9,7 +9,6 @@ import io
 import json
 import logging
 import mimetypes
-import os
 import pathlib
 import tarfile
 import tempfile
@@ -204,6 +203,7 @@ def build_artifacts_tar_zst(
     attachment_paths: Optional[list[pathlib.Path]] = None,
     tmp_dir: Optional[pathlib.Path] = None,
     tags: Optional[list[str]] = None,
+    env: Optional[Dict[str, str]] = None,
 ) -> pathlib.Path:
     """
     Build artifacts.tar.zst archive from command execution data.
@@ -218,6 +218,7 @@ def build_artifacts_tar_zst(
         attachment_paths: Optional list of attachment files to include
         tmp_dir: Optional temporary directory for output file
         tags: Optional list of tags to include in command.json
+        env: Environment variables to include in command.json (default: none)
 
     Returns:
         Path to the created artifacts.tar.zst file
@@ -246,7 +247,7 @@ def build_artifacts_tar_zst(
         "return_code": run_command_response.returncode,
         "execution_time_ms": round(run_command_response.execution_time * 1000),
         "executed": datetime.now(UTC).isoformat().replace("+00:00", "Z"),
-        "env": dict(os.environ),
+        "env": env or {},
         "tags": tags or [],
     }
 
@@ -329,3 +330,45 @@ def summarize_archive(archive_path: pathlib.Path) -> ArchiveSummary:
                         members[member.name] = {"bytes": member.size}
 
     return ArchiveSummary(archive_bytes=archive_bytes, members=members)
+
+
+def render_archive_preview(archive_path: pathlib.Path) -> str:
+    """
+    Render the contents of an archive as text for a dry run.
+
+    Reads the archive that would be uploaded, so the preview is exactly what
+    would be sent. command.json is pretty-printed and output.txt is shown in
+    full. Attachments are listed with their sizes only.
+
+    Args:
+        archive_path: Path to the artifacts.tar.zst file
+
+    Returns:
+        Human-readable preview of the archive contents
+    """
+    sections: list[str] = []
+    decompressor = zstd.ZstdDecompressor()
+
+    with open(archive_path, "rb") as archive_file:
+        with decompressor.stream_reader(archive_file) as reader:
+            with tarfile.open(
+                fileobj=reader, mode="r|"
+            ) as tar:  # pragma: no branch
+                for member in tar:
+                    content = tar.extractfile(member)
+                    assert content is not None  # nosec: members are files
+                    data = content.read()
+                    if member.name == "command.json":
+                        body = json.dumps(json.loads(data), indent=2)
+                        sections.append(f"--- command.json ---\n{body}")
+                    elif member.name == "output.txt":
+                        sections.append(
+                            f"--- output.txt ---\n{data.decode('utf-8')}"
+                        )
+                    else:
+                        sections.append(
+                            f"--- {member.name} ({member.size} bytes, "
+                            "content not shown) ---"
+                        )
+
+    return "\n\n".join(sections)

{obvyr_cli-2.6.0 → obvyr_cli-2.7.0}/src/obvyr_cli/cli.py

@@ -1,6 +1,7 @@
 import glob
 import logging
 import math
+import os
 import pathlib
 import time
 from datetime import datetime, timezone
@@ -9,7 +10,10 @@ from typing import List
 import click
 
 from obvyr_cli.api_client import ObvyrAPIClient
-from obvyr_cli.archive_builder import build_artifacts_tar_zst
+from obvyr_cli.archive_builder import (
+    build_artifacts_tar_zst,
+    render_archive_preview,
+)
 from obvyr_cli.command_wrapper import run_command
 from obvyr_cli.config import ProfileSettings, Settings, get_settings
 from obvyr_cli.error_handling import (
@@ -18,6 +22,7 @@ from obvyr_cli.error_handling import (
 )
 from obvyr_cli.jwt_utils import get_jwt_expiry
 from obvyr_cli.logging_config import configure_logging, get_logger
+from obvyr_cli.redaction import filter_environment, redact_response
 from obvyr_cli.schemas import (
     CommandExecutionConfig,
     OutputMode,
@@ -223,6 +228,51 @@ def display_output(response: RunCommandResponse) -> None:
     display_execution_summary(response)
 
 
+def prepare_archive(
+    active_profile: ProfileSettings, data: RunCommandResponse
+) -> pathlib.Path:
+    """
+    Build the archive to upload, applying the profile's capture controls.
+
+    Only allow-listed environment variables are included, and secrets are
+    redacted from the environment, command arguments and output.
+
+    :param active_profile: Profile configuration controlling what is captured.
+    :param data: Command execution result to be archived.
+    :return: Path to the temporary archive file.
+    """
+    attachment_paths = None
+    if active_profile.ATTACHMENT_PATHS:
+        resolved_paths = resolve_attachment_globs(
+            active_profile.ATTACHMENT_PATHS
+        )
+        fresh_paths = []
+        for path in resolved_paths:
+            if is_attachment_fresh(
+                path, active_profile.ATTACHMENT_MAX_AGE_SECONDS
+            ):
+                fresh_paths.append(path)
+                logger.debug(f"Including fresh attachment: {path}")
+            else:
+                logger.debug(f"Skipping stale attachment: {path}")
+
+        # Only set attachment_paths if we have fresh files
+        if fresh_paths:
+            attachment_paths = fresh_paths
+
+    return build_artifacts_tar_zst(
+        redact_response(data, active_profile.REDACT_PATTERNS),
+        attachment_paths=attachment_paths,
+        tags=active_profile.TAGS,
+        env=filter_environment(
+            os.environ,
+            mode=active_profile.ENV_MODE,
+            include=active_profile.ENV_INCLUDE,
+            extra_patterns=active_profile.REDACT_PATTERNS,
+        ),
+    )
+
+
 def send_to_api(
     active_profile: ProfileSettings, data: RunCommandResponse
 ) -> None:
@@ -239,30 +289,7 @@ def send_to_api(
 
     archive_path = None
     try:
-        # Create archive from command execution data
-        attachment_paths = None
-        if active_profile.ATTACHMENT_PATHS:
-            resolved_paths = resolve_attachment_globs(
-                active_profile.ATTACHMENT_PATHS
-            )
-            fresh_paths = []
-            for path in resolved_paths:
-                if is_attachment_fresh(
-                    path, active_profile.ATTACHMENT_MAX_AGE_SECONDS
-                ):
-                    fresh_paths.append(path)
-                    logger.debug(f"Including fresh attachment: {path}")
-                else:
-                    logger.debug(f"Skipping stale attachment: {path}")
-
-            # Only set attachment_paths if we have fresh files
-            if fresh_paths:
-                attachment_paths = fresh_paths
-
-        # Build archive with or without attachments
-        archive_path = build_artifacts_tar_zst(
-            data, attachment_paths=attachment_paths, tags=active_profile.TAGS
-        )
+        archive_path = prepare_archive(active_profile, data)
 
         with ObvyrAPIClient(
             api_key=active_profile.API_KEY,
@@ -294,6 +321,23 @@ def send_to_api(
             archive_path.unlink()
 
 
+def show_dry_run_payload(
+    active_profile: ProfileSettings, data: RunCommandResponse
+) -> None:
+    """
+    Print exactly what would be sent to the Obvyr API, without sending it.
+
+    :param active_profile: Profile configuration controlling what is captured.
+    :param data: Command execution result that would have been sent.
+    """
+    archive_path = prepare_archive(active_profile, data)
+    try:
+        click.echo("\nDry run: nothing was sent. Payload that would be sent:\n")
+        click.echo(render_archive_preview(archive_path))
+    finally:
+        archive_path.unlink(missing_ok=True)
+
+
 # ===================================
 # Click CLI
 # ===================================
@@ -351,6 +395,11 @@ def send_to_api(
     is_flag=True,
     help="Disable color output (don't set FORCE_COLOR environment variable).",
 )
+@click.option(
+    "--dry-run",
+    is_flag=True,
+    help="Run the command, then print exactly what would be sent instead of sending it.",
+)
 def cli_run_process(
     command: List[str],
     list_profiles: bool,
@@ -362,6 +411,7 @@ def cli_run_process(
     no_stream: bool,
     force_stream: bool,
     no_color: bool,
+    dry_run: bool,
 ) -> None:
     """
     Executes a system command while using the Obvyr CLI profile configuration.
@@ -404,7 +454,9 @@ def cli_run_process(
             config=execution_config,
         )
 
-        if active_profile.API_URL and active_profile.API_KEY:
+        if dry_run:
+            show_dry_run_payload(active_profile, response)
+        elif active_profile.API_URL and active_profile.API_KEY:
             send_to_api(active_profile, response)
 
         display_execution_summary(response)

{obvyr_cli-2.6.0 → obvyr_cli-2.7.0}/src/obvyr_cli/config.py

@@ -6,8 +6,9 @@ from environment variables, allowing environmental overrides.
 """
 
 import logging
+import re
 import secrets
-from typing import Dict
+from typing import Dict, Literal
 
 from dotenv import load_dotenv
 from pydantic import BaseModel, Field, field_validator, model_validator
@@ -29,22 +30,36 @@ class ProfileSettings(BaseModel):
     TIMEOUT: float = 10.0
     VERIFY_SSL: bool = True
     TAGS: list[str] = Field(default_factory=list)
-
-    @field_validator("TAGS", mode="before")
+    ENV_MODE: Literal["allowlist", "none"] = "allowlist"
+    ENV_INCLUDE: list[str] = Field(default_factory=list)
+    REDACT_PATTERNS: list[str] = Field(default_factory=list)
+
+    @field_validator(
+        "TAGS",
+        "ATTACHMENT_PATHS",
+        "ENV_INCLUDE",
+        "REDACT_PATTERNS",
+        mode="before",
+    )
     @classmethod
-    def parse_tags(cls, value: str | list[str]) -> list[str]:
-        """Parse tags from comma-separated string or return list as-is."""
+    def parse_comma_separated(cls, value: str | list[str]) -> list[str]:
+        """Parse a comma-separated string into a list, or return a list as-is."""
         if isinstance(value, str):
-            return [tag.strip() for tag in value.split(",") if tag.strip()]
+            return [item.strip() for item in value.split(",") if item.strip()]
         return value or []
 
-    @field_validator("ATTACHMENT_PATHS", mode="before")
+    @field_validator("REDACT_PATTERNS")
     @classmethod
-    def parse_attachment_paths(cls, value: str | list[str]) -> list[str]:
-        """Parse attachment paths from comma-separated string or return list as-is."""
-        if isinstance(value, str):
-            return [path.strip() for path in value.split(",") if path.strip()]
-        return value or []
+    def validate_redact_patterns(cls, value: list[str]) -> list[str]:
+        """Fail fast on patterns that are not valid regular expressions."""
+        for pattern in value:
+            try:
+                re.compile(pattern)
+            except re.error as error:
+                raise ValueError(
+                    f"Invalid REDACT_PATTERNS entry '{pattern}': {error}"
+                ) from error
+        return value
 
     @model_validator(mode="after")
     def migrate_attachment_path(self) -> "ProfileSettings":

obvyr_cli-2.7.0/src/obvyr_cli/redaction.py

@@ -0,0 +1,135 @@
+"""
+Controls what the CLI sends: environment filtering and secret redaction.
+
+All functions are pure. Callers pass in the environment and patterns
+explicitly so behaviour is predictable and testable.
+"""
+
+import re
+from typing import Mapping, Sequence
+
+from obvyr_cli.schemas import RunCommandResponse
+
+# Exact names only. Prefix matching is deliberately avoided: CI_JOB_TOKEN
+# and similar secrets share prefixes with harmless CI identifiers.
+ENV_ALLOWLIST = frozenset(
+    {
+        "CI",
+        "CONTINUOUS_INTEGRATION",
+        # GitHub Actions
+        "GITHUB_ACTIONS",
+        "GITHUB_RUN_ID",
+        "GITHUB_RUN_NUMBER",
+        "GITHUB_WORKFLOW",
+        "GITHUB_REPOSITORY",
+        "GITHUB_SHA",
+        "GITHUB_REF_NAME",
+        # GitLab CI
+        "GITLAB_CI",
+        "CI_PIPELINE_ID",
+        "CI_JOB_ID",
+        "CI_COMMIT_SHA",
+        "CI_COMMIT_REF_NAME",
+        # Jenkins
+        "JENKINS_URL",
+        "BUILD_NUMBER",
+        # Buildkite
+        "BUILDKITE",
+        "BUILDKITE_BUILD_NUMBER",
+        # CircleCI
+        "CIRCLECI",
+        "CIRCLE_BUILD_NUM",
+        "CIRCLE_SHA1",
+    }
+)
+
+
+# The CLI's own settings (including its API key) are never sent.
+ALWAYS_EXCLUDED_PREFIX = "OBVYR_"
+
+
+REDACTED = "[REDACTED]"
+
+# Variable and flag names that suggest the value is a secret.
+SECRET_NAME_PATTERN = re.compile(
+    r"token|key|password|passwd|secret|credential", re.IGNORECASE
+)
+
+# Value shapes that are secrets wherever they appear.
+SECRET_VALUE_PATTERNS = (
+    re.compile(r"\b(?:AKIA|ASIA)[0-9A-Z]{16}\b"),
+    re.compile(r"(?i)\bbearer\s+[A-Za-z0-9._~+/=-]+"),
+    # name=value or name: value; the prefix group keeps the name visible.
+    re.compile(
+        r"(?i)(?P<prefix>\b[\w-]*(?:token|key|password|passwd|secret|credential)"
+        r"[\w-]*\s*[=:]\s*)\S+"
+    ),
+)
+
+
+def keep_prefix_and_redact(match: re.Match[str]) -> str:
+    """Replace a match with the redaction marker, keeping a named prefix group."""
+    return (match.groupdict().get("prefix") or "") + REDACTED
+
+
+def redact_text(text: str, extra_patterns: Sequence[str] = ()) -> str:
+    """Replace anything in the text that matches a built-in or extra pattern."""
+    patterns = SECRET_VALUE_PATTERNS + tuple(
+        re.compile(pattern) for pattern in extra_patterns
+    )
+    for pattern in patterns:
+        text = pattern.sub(keep_prefix_and_redact, text)
+    return text
+
+
+def redact_command(
+    command: Sequence[str], extra_patterns: Sequence[str] = ()
+) -> list[str]:
+    """Redact secrets in command arguments, including a flag's separate value."""
+    redacted: list[str] = []
+    previous_was_secret_flag = False
+    for argument in command:
+        if previous_was_secret_flag:
+            redacted.append(REDACTED)
+        else:
+            redacted.append(redact_text(argument, extra_patterns))
+        previous_was_secret_flag = (
+            argument.startswith("-")
+            and "=" not in argument
+            and SECRET_NAME_PATTERN.search(argument) is not None
+        )
+    return redacted
+
+
+def redact_response(
+    response: RunCommandResponse, extra_patterns: Sequence[str] = ()
+) -> RunCommandResponse:
+    """Return a copy of the response with secrets removed from what is uploaded."""
+    output = response.output
+    return response.model_copy(
+        update={
+            "command": redact_command(response.command, extra_patterns),
+            "output": redact_text(output, extra_patterns) if output else output,
+        }
+    )
+
+
+def filter_environment(
+    environ: Mapping[str, str],
+    mode: str,
+    include: Sequence[str] = (),
+    extra_patterns: Sequence[str] = (),
+) -> dict[str, str]:
+    """Return the subset of the environment that is safe to send."""
+    if mode == "none":
+        return {}
+    permitted = ENV_ALLOWLIST | set(include)
+    return {
+        k: (
+            REDACTED
+            if SECRET_NAME_PATTERN.search(k)
+            else redact_text(v, extra_patterns)
+        )
+        for k, v in environ.items()
+        if k in permitted and not k.startswith(ALWAYS_EXCLUDED_PREFIX)
+    }