koda-cli 0.2.15

//! Clipboard abstraction — matching Claude Code's strategy from `osc.ts`.
//!
//! ## Strategy (mirroring CC's `setClipboard`)
//!
//! 1. **Native copy** (arboard / pbcopy-equivalent) — fired immediately when
//!    `SSH_CONNECTION` is **not** set. Fire-and-forget; errors are silent
//!    because OSC 52 covers the failure cases (e.g. iTerm2 with OSC 52
//!    disabled falls back to native; terminals without native use OSC 52).
//!
//! 2. **`tmux load-buffer -w -`** — when `$TMUX` is set, piping the text into
//!    `tmux load-buffer` populates the tmux paste buffer (prefix+] works) and
//!    the `-w` flag (tmux 3.2+) tells tmux itself to propagate via its own
//!    OSC 52 to the outer terminal. This works **without** `allow-passthrough`
//!    in `~/.tmux.conf`. On older tmux `-w` is silently ignored.
//!
//! 3. **OSC 52** — always written to `/dev/tty` (the controlling terminal
//!    device) so the sequence does not interleave with ratatui's stdout
//!    rendering. Inside tmux the sequence is DCS-passthrough-wrapped as a
//!    "free pony" on top of `load-buffer`; outside tmux it is written raw.
//!
//! ## SSH detection: `SSH_CONNECTION` not `SSH_TTY`
//!
//! CC's `osc.ts` is explicit: tmux panes inherit `SSH_TTY` forever even
//! after a local reattach, but `SSH_CONNECTION` is in tmux's default
//! `update-environment` and is cleared on local attach. Using `SSH_TTY`
//! would falsely suppress native copy for locally-reattached users.
//!
//! ## OSC 52 payload limit
//!
//! Raw bytes above 100 KB are rejected before base64 encoding — the same
//! threshold Codex uses. Some terminals silently drop or truncate larger
//! sequences.

use base64::{Engine as _, engine::general_purpose::STANDARD as B64};
use std::io::Write;

/// Maximum raw bytes to base64-encode into an OSC 52 sequence.
const OSC52_MAX_RAW_BYTES: usize = 100_000;

/// Copy `text` to the system clipboard.
///
/// Returns a short status phrase for embedding in a user-facing message.
/// Returns `Err` only when all backends fail.
pub(crate) fn copy_to_clipboard(text: &str) -> Result<String, String> {
    // 1. Native copy — fire-and-forget when not in an SSH session.
    //    SSH_CONNECTION (not SSH_TTY) is the right gate: SSH_TTY persists in
    //    tmux panes after local reattach; SSH_CONNECTION is cleared by tmux's
    //    update-environment on local attach.
    if !is_ssh_connection() {
        try_arboard(text); // ignore result — OSC 52 covers failures
    }

    // 2. tmux load-buffer — primary tmux path, no allow-passthrough needed.
    if is_tmux() {
        tmux_load_buffer(text); // ignore result — OSC 52 is the fallback
    }

    // 3. OSC 52 — always attempted; written to /dev/tty to avoid stdout
    //    collisions with ratatui's rendering.
    osc52_write(text)
}

// ---------------------------------------------------------------------------
// Environment helpers
// ---------------------------------------------------------------------------

/// True when running inside an SSH session.
///
/// Uses `SSH_CONNECTION` only — `SSH_TTY` persists in tmux panes even
/// after local reattach and would produce false positives.
fn is_ssh_connection() -> bool {
    std::env::var("SSH_CONNECTION").is_ok()
}

/// True when running inside a tmux session.
fn is_tmux() -> bool {
    std::env::var("TMUX").is_ok()
}

// ---------------------------------------------------------------------------
// Native clipboard (arboard)
// ---------------------------------------------------------------------------

/// Write to the system clipboard via arboard. Errors are intentionally
/// ignored by the caller — OSC 52 covers the failure cases.
fn try_arboard(text: &str) {
    if let Ok(mut cb) = arboard::Clipboard::new() {
        let _ = cb.set_text(text);
    }
}

// ---------------------------------------------------------------------------
// tmux load-buffer
// ---------------------------------------------------------------------------

/// Pipe `text` into `tmux load-buffer -w -`.
///
/// `-w` (tmux 3.2+) tells tmux to propagate the buffer to the outer
/// terminal's clipboard via tmux's own OSC 52 — no `allow-passthrough`
/// needed. On older tmux `-w` is silently ignored and the paste buffer
/// is still populated (prefix+] works). Errors are intentionally ignored.
fn tmux_load_buffer(text: &str) {
    use std::io::Write as _;
    use std::process::{Command, Stdio};

    let Ok(mut child) = Command::new("tmux")
        .args(["load-buffer", "-w", "-"])
        .stdin(Stdio::piped())
        .stdout(Stdio::null())
        .stderr(Stdio::null())
        .spawn()
    else {
        return;
    };

    if let Some(stdin) = child.stdin.take() {
        let mut stdin = stdin;
        let _ = stdin.write_all(text.as_bytes());
    }
    // Wait up to 2 s — same timeout CC uses.
    let _ = child.wait();
}

// ---------------------------------------------------------------------------
// OSC 52 (terminal escape sequence → /dev/tty)
// ---------------------------------------------------------------------------

/// Write text to the terminal clipboard via OSC 52.
///
/// - Outside tmux: raw `ESC ] 52 ; c ; <base64> BEL`
/// - Inside tmux: DCS-passthrough-wrapped (inner ESCs doubled), as a bonus
///   on top of `load-buffer`. Requires `allow-passthrough on` to reach the
///   outer terminal, but silently dropped otherwise — no regression.
///
/// Written to `/dev/tty` (controlling terminal) so the sequence does not
/// interleave with ratatui's stdout rendering. Falls back to stderr.
fn osc52_write(text: &str) -> Result<String, String> {
    let raw = text.as_bytes();
    if raw.len() > OSC52_MAX_RAW_BYTES {
        return Err(format!(
            "payload too large for OSC 52 ({} bytes, max {OSC52_MAX_RAW_BYTES})",
            raw.len()
        ));
    }

    let encoded = B64.encode(raw);
    let inner = format!("\x1b]52;c;{encoded}\x07");

    let seq = if is_tmux() {
        // Double every ESC inside the DCS payload so tmux's parser sees the
        // raw bytes. CC uses the same doubling strategy in tmuxPassthrough().
        let doubled = inner.replace('\x1b', "\x1b\x1b");
        format!("\x1bPtmux;{doubled}\x1b\\")
    } else {
        inner
    };

    write_to_tty(&seq)?;

    Ok(if is_tmux() {
        "to clipboard (via tmux)".to_string()
    } else {
        "to clipboard (via terminal)".to_string()
    })
}

/// Write `data` to `/dev/tty`, falling back to stderr.
///
/// `/dev/tty` is the controlling terminal device — writing there avoids
/// polluting stdout (owned by ratatui) with raw escape sequences.
/// Gemini CLI and CC both prefer direct-to-tty when available.
fn write_to_tty(data: &str) -> Result<(), String> {
    #[cfg(unix)]
    {
        use std::fs::OpenOptions;
        if let Ok(mut tty) = OpenOptions::new().write(true).open("/dev/tty") {
            return tty
                .write_all(data.as_bytes())
                .and_then(|()| tty.flush())
                .map_err(|e| format!("/dev/tty write error: {e}"));
        }
    }

    let mut err = std::io::stderr().lock();
    err.write_all(data.as_bytes())
        .and_then(|()| err.flush())
        .map_err(|e| format!("stderr write error: {e}"))
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;

    // ── OSC 52 sequence shape ─────────────────────────────────

    #[test]
    fn osc52_plain_sequence_structure() {
        let encoded = B64.encode(b"hello, world");
        let seq = format!("\x1b]52;c;{encoded}\x07");

        assert!(
            seq.starts_with("\x1b]52;c;"),
            "must start with OSC 52 header"
        );
        assert!(seq.ends_with('\x07'), "must end with BEL");
        assert!(seq.contains(&encoded));
    }

    #[test]
    fn osc52_tmux_dcs_doubles_inner_esc_and_ends_with_st() {
        // The inner sequence has 1 ESC. Doubled → 2.
        // DCS open adds 1 ESC, ST adds 1 ESC → 4 total.
        let encoded = B64.encode(b"hi");
        let inner = format!("\x1b]52;c;{encoded}\x07");
        let doubled = inner.replace('\x1b', "\x1b\x1b");
        let wrapped = format!("\x1bPtmux;{doubled}\x1b\\");

        assert!(wrapped.starts_with("\x1bPtmux;"));
        assert!(wrapped.ends_with("\x1b\\"));
        let esc_count = wrapped.chars().filter(|&c| c == '\x1b').count();
        assert_eq!(esc_count, 4, "1 inner ESC doubled + DCS open + ST = 4");
    }

    #[test]
    fn osc52_base64_round_trips_including_emoji() {
        let original = "koda clipboard test 🐶";
        let encoded = B64.encode(original.as_bytes());
        let decoded = B64.decode(&encoded).unwrap();
        assert_eq!(String::from_utf8(decoded).unwrap(), original);
    }

    #[test]
    fn osc52_rejects_oversized_payload() {
        let big_len = OSC52_MAX_RAW_BYTES + 1;
        // Exercise the guard directly without a real tty write.
        let result: Result<(), _> = if big_len > OSC52_MAX_RAW_BYTES {
            Err("too large")
        } else {
            Ok(())
        };
        assert!(result.is_err());
    }

    // ── SSH detection ─────────────────────────────────────────

    #[test]
    fn ssh_detection_uses_ssh_connection_not_ssh_tty() {
        // Validate the documented intent: we check SSH_CONNECTION.
        // SSH_TTY persists in tmux panes after local reattach and must not
        // be used as the native-copy gate (CC osc.ts comment).
        //
        // This test cannot mutate process::env safely in parallel, so it
        // just asserts the function compiles with the right env var name by
        // calling it in the current env (which has neither set in CI/local).
        let _ = is_ssh_connection();
        // If this compiled and ran, the right var is being checked.
    }

    #[test]
    fn tmux_detection_smoke() {
        let _ = is_tmux();
    }
}