client_agent.go

package shush

import (
	"fmt"
	"os"
	"os/exec"
	"strings"
	"time"
)

// Ping checks if an agent is running at the given socket path.
func Ping(socketPath string) error {
	return PingWithCapability(socketPath, ResolveCapability(nil))
}

// PingWithCapability checks if an agent is running with the provided capability.
func PingWithCapability(socketPath, capability string) error {
	client := &Client{SocketPath: socketPath, Capability: capability}
	_, err := client.do(request{Action: actionPing})
	return err
}

// Stop requests the agent to shut down.
func Stop(socketPath string) error {
	return StopWithCapability(socketPath, ResolveCapability(nil))
}

// StopWithCapability requests the agent to shut down with the provided capability.
func StopWithCapability(socketPath, capability string) error {
	client := &Client{SocketPath: socketPath, Capability: capability}
	_, err := client.do(request{Action: actionStop})
	return err
}

// ClearAll removes all cached secrets and tokens from the agent.
func ClearAll(socketPath string) error {
	client := &Client{SocketPath: socketPath, Capability: ResolveCapability(nil)}
	if _, err := client.do(request{Action: actionClear}); err != nil {
		return err
	}
	_, err := client.do(request{Action: actionClearToken})
	return err
}

// ClearPrefix removes all cached secrets whose keys start with the prefix.
func ClearPrefix(socketPath, prefix string) error {
	client := &Client{SocketPath: socketPath, Capability: ResolveCapability(nil)}
	return client.ClearPrefix(prefix)
}

// ClearByKeyPattern removes all cached secrets matching the glob pattern.
func ClearByKeyPattern(socketPath, pattern string) error {
	client := &Client{SocketPath: socketPath, Capability: ResolveCapability(nil)}
	return client.ClearByKeyPattern(pattern)
}

// StartProcess starts an agent server in a background process.
// serveArgs specifies the full command and arguments (the socket path is appended).
// If serveArgs is nil, defaults to [os.Executable(), "serve", "--socket"].
func StartProcess(socketPath string, serveArgs []string) error {
	return StartProcessWithCapability(socketPath, serveArgs, ResolveCapability(nil))
}

// StartProcessWithCapability starts an agent and configures capability protection.
func StartProcessWithCapability(socketPath string, serveArgs []string, capability string) error {
	return startProcess(socketPath, serveArgs, capability)
}

func startProcess(socketPath string, serveArgs []string, capability string) error {
	capability = strings.TrimSpace(capability)
	if err := PingWithCapability(socketPath, capability); err == nil {
		return nil
	} else if isCapabilityAuthError(err) {
		return err
	}

	if len(serveArgs) == 0 {
		exePath, err := os.Executable()
		if err != nil {
			return fmt.Errorf("resolve executable path: %w", err)
		}
		serveArgs = []string{exePath, "serve", "--socket"}
	}

	args := append(serveArgs[1:], socketPath)
	cmd := exec.Command(serveArgs[0], args...)
	cmd.Stdin = nil
	cmd.Stdout = nil
	cmd.Stderr = nil
	if capability != "" {
		cmd.Env = withCapabilityEnv(os.Environ(), capability)
	}
	if err := cmd.Start(); err != nil {
		return fmt.Errorf("start agent process: %w", err)
	}
	_ = cmd.Process.Release()

	var lastErr error
	for i := 0; i < 40; i++ {
		time.Sleep(25 * time.Millisecond)
		lastErr = PingWithCapability(socketPath, capability)
		if lastErr == nil {
			return nil
		}
	}
	return fmt.Errorf("wait for agent startup: %w", lastErr)
}

func withCapabilityEnv(env []string, capability string) []string {
	keyPrefix := EnvCapability + "="
	out := make([]string, 0, len(env)+1)
	for _, kv := range env {
		if !strings.HasPrefix(kv, keyPrefix) {
			out = append(out, kv)
		}
	}
	out = append(out, keyPrefix+capability)
	return out
}