nyx/scripts/render-cli.py

71 lines
2.3 KiB
Python
Raw Normal View History

Prerelease cleanup (#46) * feat: Add const_bound_vars tracking to prevent false positives in ownership checks * feat: Introduce field interner and typed bounded vars for enhanced type tracking * feat: Add typed_call_receivers and typed_bounded_dto_fields for enhanced type tracking * feat: Centralize method name extraction with bare_method_name helper * feat: Implement Phase-6 hierarchy fan-out for runtime virtual dispatch * feat: Enhance C++ taint tracking with additional container operations and inline method resolution * feat: Introduce field-sensitive points-to analysis for enhanced resource tracking * feat: Implement Pointer-Phase 6 subscript handling for enhanced container analysis * test: Add comprehensive tests for JavaScript control flow constructs and lattice operations * docs: Update advanced analysis documentation with field-sensitive points-to and hierarchy fan-out details * test: Add comprehensive tests for lattice algebra laws and SSA edge cases * feat: Add destructured session user handling and safe user ID access patterns * feat: Implement row-population reverse-walk for enhanced authorization checks * feat: Enhance authorization checks with local alias chain for self-actor types * feat: Introduce ActiveRecord query safety checks and enhance snippet extraction * feat: Implement chained method call inner-gate rebinding for SSRF prevention * feat: Add observability and error modules, enhance debug functionality, and implement theme context * feat: Remove Auth Analysis page and update navigation to redirect to Explorer * feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor * feat: Optimize SSA lowering by sharing results between taint engine and artifact extractor * feat: Reset path-safe-suppressed spans before lowering to maintain analysis integrity * fix(ssa): ungate debug_assert_bfs_ordering for release-tests build The helper at src/ssa/lower.rs was gated `#[cfg(debug_assertions)]` while the unit test at the bottom of the file was gated only `#[cfg(test)]`. Since `cfg(test)` is set in release builds with `--tests` but `cfg(debug_assertions)` is not, `cargo build --release --tests` failed with E0425. Removing the gate fixes the build; the body is `debug_assert!` only, so the helper is free in release. Also drop the gate at the call site to avoid a `dead_code` warning when the lib is built without `--tests`. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * test(closure-capture): flip JS/TS fixtures to required-finding The JS and TS closure-capture fixtures pinned the old broken behaviour via `forbidden_findings: [{ "id_prefix": "taint-" }]`. The engine now correctly traces taint through the closure boundary (env source captured by an arrow function, sunk via `child_process.exec` inside the body), so the formerly-forbidden finding is a true positive. Match the Python sibling's shape — `required_findings` with `id_prefix` + `min_count` plus a small `noise_budget` — and rewrite the companion READMEs and the phase8_fragility_tests doc-comments from "known gap" to "regression guard". Verified: - cargo test --release --test phase8_fragility_tests → 8/8 pass - cargo test --release --lib bfs_assertion → pass - corpus benchmark F1 = 0.9976 (TP=205, FP=1, FN=0) — unchanged Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: Add OWASP mapping and baseline mutation hooks for enhanced security analysis * feat: Introduce health module and enhance health score computation with calibration tests * feat: Add expectations configuration and cleanup .gitignore for log files * feat: Implement theme selection and enhance settings panel for triage sync * feat: Suppress false positives for strcpy calls with literal sources in AST * feat: Update analyse_function_ssa to return body CFG for accurate analysis * feat: Add bug report and feature request templates for improved issue tracking * feat: removed dev scripts * feat: update README.md for clarity and consistency in fixture descriptions * feat: removed dev docs * feat: clean up error handling and UI elements for improved user experience * feat: adjust button sizes in HeaderBar for better UI consistency * feat: enhance taint analysis with additional context for sanitizer and taint findings * cargo fmt * prettier * refactor: simplify conditional checks and improve code readability in AST and screenshot capture scripts * feat: add script to frame PNG screenshots with brand gradient * feat: add fuzzing support with new targets and CI workflows * refactor: streamline match expressions and improve formatting in CLI and output handling * feat: enhance configuration display with detailed output options * feat: stage demo configuration for improved CLI screenshot output * feat: expose merge_configs function for user-configurable settings * refactor: simplify code structure and improve readability in config handling * refactor: improve descriptions for vulnerability patterns in various languages * feat: update MIT License section with additional usage details and copyright information * feat: update screenshots * refactor: update build process and paths for frontend assets * feat: add cross-file taint fuzzing target and supporting dictionary * refactor: clean up formatting and comments in fuzz configuration and example files * refactor: remove outdated comments and clean up CI configuration files * chore: update changelog dates and improve formatting in documentation * refactor: update Cargo.toml and CI configuration for improved packaging and build process * refactor: enhance quote-stripping logic to prevent panics and add regression tests --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-29 00:58:38 -04:00
#!/usr/bin/env python3
"""Render a shell command's output as a PNG sized to its content.
Pipeline:
1. Run the command, captured through `bash -c` so redirections and
env vars work, and force colors via `CLICOLOR_FORCE=1`. The whole
compound is wrapped in a brace group so `2>/dev/null` swallows
stderr even when the caller chains commands with `;`.
2. Pipe through `sgr-merge.py` to consolidate consecutive SGR
sequences (freeze otherwise honors only the last one).
3. Hand the colored stream to `freeze --execute` at width 1600 with
window chrome and let height auto-fit the content.
Output is freeze's natural-height capture — short commands stay short,
long commands stay long. The framer (`frame-screenshots.py --natural`)
wraps the result in the brand gradient at the matching outer size, so
no resampling or padding ever happens.
Usage:
python3 render-cli.py <out.png> <shell command...>
"""
from __future__ import annotations
import shlex
import subprocess
import sys
from pathlib import Path
OUT_W = 1600
SCRIPT_DIR = Path(__file__).resolve().parent
SGR_MERGE = SCRIPT_DIR / "sgr-merge.py"
def run_freeze(shell_cmd: str, out_png: Path) -> None:
"""Render the command at width 1600 and font size 22 with window
chrome. The brace group around the user command makes
`2>/dev/null` apply to the whole compound without it, a
`cmd; true` chain would only redirect `true`'s stderr and leak
progress bars from `cmd` into the capture."""
inner = (
f"{{ CLICOLOR_FORCE=1 {shell_cmd}; }} 2>/dev/null"
f" | python3 {shlex.quote(str(SGR_MERGE))}"
)
subprocess.run(
[
"freeze",
"--execute", f"bash -c {shlex.quote(inner)}",
"--output", str(out_png),
"--window",
"--width", str(OUT_W),
"--font.size", "22",
],
check=True,
stdout=subprocess.DEVNULL,
)
def main(argv: list[str]) -> int:
if len(argv) < 2:
print("usage: render-cli.py <out.png> <shell command...>", file=sys.stderr)
return 2
out = Path(argv[0])
shell_cmd = " ".join(argv[1:])
run_freeze(shell_cmd, out)
print(f"rendered: {out}", file=sys.stderr)
return 0
if __name__ == "__main__":
sys.exit(main(sys.argv[1:]))