Skip to content

Copy as Report: reviewed Markdown/plain reports from command blocks - #360

Draft
raiseCatError wants to merge 23 commits into
feature/copy-selectionfrom
feature/copy-report
Draft

raiseCatError wants to merge 23 commits into
feature/copy-selectionfrom
feature/copy-report

Conversation

@raiseCatError

@raiseCatError raiseCatError commented Oct 10, 2026 •

Copy link
Copy Markdown
Owner

Copy as Report builds Markdown or plain text from stored command records and always opens explicit review. Enter copies exactly the displayed text; cancel preserves the clipboard; edited text is sanitized/rescanned and labelled as unredacted. Detection is best-effort.

The stabilization fixes redact source fragments before adding Markdown boundaries, keep hostile command/status/directory text enclosed, size backtick delimiters without an unbounded argument spread, keep document rows reachable in short/narrow terminals, and refuse approval when a body cannot fit. Raw program output and stored transcript bytes remain independent of authored review presentation.

Verification on published head 9fb09c975d1f4e07d34265793c78d34b7eea6cdc:

  • macOS arm64 / Node 26.10: npm run verify, one worker/private T7 roots: 2,224 runtime tests plus 8 ranking tests, zero failures/skips; build, cleanup and diff gates passed.
  • Actions 38204605757: Ubuntu/macOS shards, Quality, Node 22 and aggregate checks passed. Timing/Fedora skipped on this PR event.
  • Adversarial report/comparison checks and source build passed; real PTY tests exercised actual test clipboard bytes, review, redaction, cancellation and backend failure.
  • The added capture PID rewrite regression failed before the fixture correction and passes now. It validates a positive published PID before observing cleanup, without changing production behavior or cleanup budgets. The earlier dd9aa85 cleanup failure is retained; its missing PID prevents conclusive historical attribution.

Physical QA remains: actual clipboard bytes in Ghostty/Terminal.app, long/narrow/short review scrolling, hostile Markdown/control/Unicode data, edits, cancellation/backend failure and stored/restored reports. No complete-secret-detection guarantee. Draft PR; no release/master merge or physical validation implied. Whole-stack/Linux-Fish acceptance and the frontend freeze are tracked separately in #359.

Refs #351
Refs #363
Refs #359

…-text report

- /copy … --report (Markdown) or --report=plain, and /cp alike; the picker's r; Actions → Copy as
  report…. Built from the command records only: command, recorded status, exit code, duration, and
  optionally directory and start time; output in a fence longer than any backtick run inside it.
- Redaction (on by default) replaces common token, key and credential shapes, private-key blocks,
  email addresses and private paths (home as ~, other users' homes as <user>), and says what it
  changed. It is a pattern match, and the review says so.
- The review opens whenever the unredacted report looks sensitive (and always from the picker and
  Actions): the exact text to be copied, switches for redaction, format, directory and times, and e
  to correct it in VISUAL/EDITOR (a private temporary file, removed afterwards). Enter copies, Esc
  copies nothing.
- The same clipboard write, feedback and Auto-expand rule as every other copy; nothing is sent
  anywhere.
…dits are re-checked

A report is made to be shared and redaction is a pattern match, so a report never reaches the
clipboard unseen: /copy --report opens the review too (Enter copies). The review marks each line
redaction changed and lists their numbers, and text edited in VISUAL/EDITOR is scanned again and
called out when it still looks sensitive. Redaction also covers --password/--token style flags,
Cookie and Set-Cookie headers, PGP private-key blocks and Stripe secret keys.
- Invisible format characters (zero-width spaces and joiners, bidi overrides, soft hyphens) are
  removed from reports and from edits before scanning, so a secret cannot slip past redaction
  behind characters the review never shows.
- Token shapes are found when glued to a word character (build_ghp_..._done), not only at \b.
- The review wraps long lines instead of cutting them, and the more-below row no longer covers a
  line: every character Enter copies has been on screen. Enter copies exactly the reviewed text.
…sted and parsed

- U+2028/U+2029 become real line breaks before fences are sized: editors and Markdown readers
  treat them as newlines, so a separator inside output could otherwise close the fence on paste.
- Every default-ignorable code point is removed (variation selectors, fillers and other invisible
  characters, not only format characters).
- Patterns match a skeleton of the text (compatibility forms, combining marks dropped) mapped back
  to the original: full-width look-alikes or marks inside a token no longer hide it, and text outside
  a redacted span keeps its exact characters.
- The review counts any character a terminal may draw wider as two cells, so no row overflows and
  is cut.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant