[Test, do not merge] Claude review early exit and cancel

.buildkite/claude/audit-cut.py

@@ -0,0 +1,41 @@
+"""Copies the lines added to a growing log since the last call into a new file.
+
+Used to upload the Claude PR review's audit logs in parts while the review
+runs. Only whole lines are copied, unless --all is given (at the end, when
+nothing more will be written). The position reached is kept in <state file>.
+
+Exit status: 0 = a part was written, 1 = nothing new.
+
+Usage: audit-cut.py [--all] <log> <state file> <part>
+"""
+
+import os
+import sys
+
+args = sys.argv[1:]
+take_all = args[0] == "--all"
+if take_all:
+    args = args[1:]
+log_path, state_path, part_path = args
+
+try:
+    offset = int(open(state_path).read().strip() or 0)
+except (OSError, ValueError):
+    offset = 0
+
+try:
+    with open(log_path, "rb") as log:
+        log.seek(offset)
+        data = log.read()
+except OSError:
+    sys.exit(1)
+
+if not take_all:
+    data = data[: data.rfind(b"\n") + 1]
+if not data:
+    sys.exit(1)
+
+with open(part_path, "wb") as part:
+    part.write(data)
+with open(state_path, "w") as state:
+    state.write(str(offset + len(data)))

.buildkite/claude/audit-es-filter.py

@@ -0,0 +1,119 @@
+"""Filters eslogger's output for the Claude PR review audit log.
+
+Reads eslogger JSON lines on stdin (already narrowed by grep to lines that
+mention the reviewer's user ID) and writes the reviewer's events to gzip
+parts, starting a new part every <rotate seconds>. Each finished part is
+renamed to es-events.<n>.jsonl.gz, so the uploader only ever sees whole parts.
+
+To keep the log useful and safe:
+- `exec` events lose their environment, which holds the Anthropic key.
+- Any of this job's secrets, read one per line from file descriptor 3, is
+  replaced with "(redacted)" anywhere in an event, e.g. in a command's args.
+- `close` events for files that weren't changed are dropped.
+- Read-only opens of system files, Xcode, Homebrew and the reviewer's own
+  home and temporary folders are counted instead of logged. Reads anywhere
+  else (other users' files, /etc, /opt/ci, /Volumes) are kept.
+
+On exit it writes es-dropped.json with what was counted instead of logged.
+
+Usage: audit-es-filter.py <reviewer uid> <reviewer home> <output folder> <rotate seconds>
+"""
+
+import collections
+import gzip
+import json
+import os
+import sys
+import time
+
+uid, home, out_dir, rotate_seconds = int(sys.argv[1]), sys.argv[2].rstrip("/"), sys.argv[3], int(sys.argv[4])
+
+# Read-only opens under these are counted, not logged.
+QUIET_READS = (
+    "/System/", "/usr/", "/bin/", "/sbin/", "/dev/",
+    "/Library/Apple/", "/Library/Developer/CoreSimulator/", "/Library/Frameworks/",
+    "/Applications/Xcode", "/opt/homebrew/", "/private/var/db/", "/private/var/folders/",
+    home + "/",
+)
+FWRITE = 0x2
+
+try:
+    with os.fdopen(3) as secrets_file:
+        SECRETS = [line.strip() for line in secrets_file if line.strip()]
+except OSError:
+    SECRETS = []
+
+dropped = collections.Counter()
+kept = 0
+part_number = 0
+part = None
+part_started = 0.0
+
+
+def part_path(number, temporary=False):
+    return os.path.join(out_dir, f"es-events.{number:05d}.jsonl.gz" + (".tmp" if temporary else ""))
+
+
+def finish_part():
+    global part
+    if part is not None:
+        part.close()
+        os.rename(part_path(part_number, temporary=True), part_path(part_number))
+        part = None
+
+
+def write(line):
+    global part, part_number, part_started, kept
+    now = time.monotonic()
+    if part is not None and now - part_started >= rotate_seconds:
+        finish_part()
+    if part is None:
+        part_number += 1
+        part = gzip.open(part_path(part_number, temporary=True), "wt", compresslevel=1, encoding="utf-8")
+        part_started = now
+    part.write(line + "\n")
+    kept += 1
+
+
+def quiet_read(event):
+    body = event.get("open")
+    if not isinstance(body, dict) or (body.get("fflag") or 0) & FWRITE:
+        return None
+    path = (body.get("file") or {}).get("path") or ""
+    for prefix in QUIET_READS:
+        if path.startswith(prefix):
+            return "~/" if prefix == home + "/" else prefix
+    return None
+
+
+try:
+    for raw in sys.stdin:
+        try:
+            message = json.loads(raw)
+        except ValueError:
+            dropped["not JSON"] += 1
+            continue
+        token = (message.get("process") or {}).get("audit_token") or {}
+        if token.get("euid") != uid and token.get("ruid") != uid:
+            continue
+        event = message.get("event") or {}
+        if isinstance(event.get("exec"), dict):
+            event["exec"]["env"] = "(removed)"
+        close = event.get("close")
+        if isinstance(close, dict) and not close.get("modified"):
+            dropped["close of an unchanged file"] += 1
+            continue
+        prefix = quiet_read(event)
+        if prefix:
+            dropped[f"read-only open under {prefix}"] += 1
+            continue
+        line = json.dumps(message, separators=(",", ":"))
+        for secret in SECRETS:
+            if secret in line:
+                line = line.replace(secret, "(redacted)")
+                dropped["secret redacted"] += 1
+        write(line)
+finally:
+    finish_part()
+    with open(os.path.join(out_dir, "es-dropped.json"), "w") as f:
+        json.dump({"kept": kept, "parts": part_number, "counted_not_logged": dict(dropped.most_common())}, f, indent=2)

.buildkite/claude/audit-hook-listener.py

@@ -0,0 +1,51 @@
+"""Receives Claude Code hook records for the Claude PR review audit log.
+
+Runs as the build user, so the reviewer user can add records but can't change
+or delete them. Each connection carries one hook event; it is written as one
+JSON line, and only then acknowledged, so a tool never runs unlogged.
+
+Usage: audit-hook-listener.py <log file> <port file>
+"""
+
+import datetime
+import json
+import socket
+import socketserver
+import sys
+import threading
+
+MAX_RECORD_BYTES = 16 * 1024 * 1024
+
+log_path, port_path = sys.argv[1:3]
+log = open(log_path, "a", buffering=1, encoding="utf-8")
+lock = threading.Lock()
+
+
+class Handler(socketserver.StreamRequestHandler):
+    def handle(self):
+        data = self.rfile.read(MAX_RECORD_BYTES + 1)
+        try:
+            record = json.loads(data[:MAX_RECORD_BYTES])
+        except ValueError:
+            record = data[:MAX_RECORD_BYTES].decode("utf-8", "replace")
+        line = json.dumps({
+            "received_at": datetime.datetime.now(datetime.timezone.utc).isoformat(),
+            "bytes": len(data),
+            "truncated": len(data) > MAX_RECORD_BYTES,
+            "record": record,
+        })
+        with lock:
+            log.write(line + "\n")
+            log.flush()
+        self.wfile.write(b"ok\n")
+
+
+class Server(socketserver.ThreadingTCPServer):
+    daemon_threads = True
+    allow_reuse_address = False
+
+
+server = Server(("127.0.0.1", 0), Handler)
+with open(port_path, "w") as f:
+    f.write(str(server.server_address[1]))
+server.serve_forever()

.buildkite/claude/audit-hook.py

@@ -0,0 +1,32 @@
+"""Claude Code hook for the Claude PR review audit log.
+
+Installed root-owned next to the managed settings, so the reviewer can't
+change it. Sends the hook's input to the build user's listener
+(audit-hook-listener.py). A PreToolUse event that can't be logged blocks the
+tool (exit 2), so nothing runs without a record.
+
+Usage: audit-hook.py <listener port>
+"""
+
+import json
+import socket
+import sys
+
+port = int(sys.argv[1])
+data = sys.stdin.buffer.read()
+
+try:
+    event = json.loads(data).get("hook_event_name", "")
+except ValueError:
+    event = ""
+
+try:
+    with socket.create_connection(("127.0.0.1", port), timeout=20) as conn:
+        conn.sendall(data)
+        conn.shutdown(socket.SHUT_WR)
+        if conn.makefile("rb").readline().strip() != b"ok":
+            raise OSError("the audit log did not acknowledge the record")
+except OSError as error:
+    if event == "PreToolUse":
+        print(f"Blocked: this tool call could not be written to the audit log ({error}).", file=sys.stderr)
+        sys.exit(2)