Skip to content

[feature] CRW-11940: Expose CLI Activity Tracker configuration as environment variables - #376

Open
vrubezhny wants to merge 2 commits into
eclipse-che:mainfrom
vrubezhny:feature/cli-watcher-env-vars-and-flags
Open

[feature] CRW-11940: Expose CLI Activity Tracker configuration as environment variables#376
vrubezhny wants to merge 2 commits into
eclipse-che:mainfrom
vrubezhny:feature/cli-watcher-env-vars-and-flags

Conversation

@vrubezhny

@vrubezhny vrubezhny commented Aug 1, 2026

Copy link
Copy Markdown
Contributor

Note: This PR is based on #363 (CLI Watcher core implementation). The changes described below are additions on top of that PR.

This PR adds administrator-level configuration support for the CLI Watcher via environment variables, enabling cluster-wide control through the CheCluster CR without requiring users to create .noidle config files.

What does this PR do?

  • Adds 5 environment variables for admin-level CLI Watcher configuration: CLI_ACTIVITY_TRACKER_ENABLED, CLI_ACTIVITY_TRACKER_CHECK_PERIOD, CLI_ACTIVITY_TRACKER_ACTIVITY_WINDOW, CLI_ACTIVITY_TRACKER_GRACE_PERIOD, CLI_ACTIVITY_TRACKER_MAX_PROCESS_AGE
  • Env vars act as admin ceilings: .noidle can only tighten (shorten) timing params, never loosen beyond admin-set values
  • CLI Watcher works without .noidle file when env vars are set
  • Comprehensive logging of every resolved parameter with source and any rejected overrides
  • Rewrite CLI-WATCHER.md with CheCluster CR configuration, admin ConfigMap/DevWorkspace examples, adaptive defaults formulas, and admin testing scenarios

Breaking change

CLI Watcher enablement is now exclusively controlled by the CLI_ACTIVITY_TRACKER_ENABLED environment variable (set by the administrator via CheCluster CR or ConfigMap). The enabled field in .noidle is deprecated and ignored — if present, a deprecation warning is logged and the value is disregarded. Users who previously enabled the watcher via .noidle must ask their cluster administrator to set CLI_ACTIVITY_TRACKER_ENABLED=true.

What issues does this PR fix or reference?

How to test this PR?

See testing scenarios in timeout/CLI-WATCHER.md — covers env var configuration, ceiling enforcement, .noidle interaction, and hot-reload behavior.

CLI Watcher now automatically detects and tracks terminal-based development
activity, distinguishing between interactive CLIs (vim, REPLs) and work
processes (builds, deploys) without manual configuration.

Key Features:
- Fully automatic: Only requires 'enabled: true' - auto-detects ALL terminal processes
- Smart defaults: Adapts activityWindow and gracePeriod to workspace idle timeout
- Automatic classification: Interactive (vim, python REPL) vs work (builds, deploys)
- Backward compatible: Old configs continue working with deprecation warnings
- Safety mechanisms: Grace period (5min), max age limit (6h), activity monitoring
- Flexible duration parsing: Accepts 6h, 25m, 60 (seconds), or duration strings

Configuration:
- Minimal: enabled: true (that's it!)
- Smart defaults: Auto-calculated from workspace idle timeout
- Time settings: checkPeriod, activityWindow, gracePeriod, maxProcessAge
- Override options: watchedCommands (fix misclassification), ignoredCommands (skip entirely)

Technical Implementation:
- User process filtering: Parent TTY chain analysis (filters shells, system processes)
- Interactive detection: Foreground process group + TTY read analysis
- Activity tracking: TTY access time (Atime) monitoring for user input
- Multicall binary support: Uses /proc/comm for proper command detection
- Self-skip: che-machine-exec doesn't watch itself
- Config validation: Warns about misconfigurations without breaking
- Platform portability: Detects clock ticks from /proc/self/auxv with platform-specific fallbacks
- Performance: Boot time and clock ticks cached at startup (not per process)
- Robustness: Infinite loop protection, cycle detection, error checking on all parsing

Code Quality Improvements:
- Added comprehensive unit tests (79 test cases covering pure functions and concurrency)
- Tests cover: duration parsing, YAML unmarshaling, defaults, validation, platform detection, applyPolicy, race conditions
- Merged duplicate policy logic into single unified function
- Added error checking to all fmt.Sscanf calls for consistency
- Fixed comment-code mismatches for clarity
- Warning on breaking changes (globally-excluded commands)

Test Coverage:
- Added concurrent Start/Stop tests (catches race conditions)
- Added clock skew tests (documents negative age handling)
- Enhanced /proc parsing integration tests
- All 79 tests pass with -race flag
- No data races detected

All issues verified with test-driven approach: wrote tests first to
detect bugs, then fixed implementation. Thread-safety verified with
Go race detector (-race flag).

Documentation:
- timeout/CLI-WATCHER.md - Comprehensive guide with testing scenarios
- timeout/.noidle.minimal - Minimal config example
- timeout/.noidle.example - Full config with all options
- Added auto-detection test scenario for manual testing
- Added comprehensive upgrade guide for breaking behavioral changes
- Developer testing section added

Issue: https://redhat.atlassian.net/browse/CRW-11505

Assisted-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Victor Rubezhny <vrubezhny@redhat.com>
…ironment variables

DevWorkspace idling and better user activity tracking for long-running
CLIs is expected to be configured on the CheCluster CR level. This
change exposes CLI Watcher .noidle config parameters as environment
variables so cluster/DevWorkspace administrators can configure CLI
Watcher behavior without forcing users to create .noidle config files.

- Add 5 env vars: CLI_ACTIVITY_TRACKER_ENABLED, CLI_ACTIVITY_TRACKER_CHECK_PERIOD,
  CLI_ACTIVITY_TRACKER_ACTIVITY_WINDOW, CLI_ACTIVITY_TRACKER_GRACE_PERIOD,
  CLI_ACTIVITY_TRACKER_MAX_PROCESS_AGE
- Env vars act as admin ceilings: .noidle can only tighten (shorten)
  timing params, never loosen beyond admin-set values
- CLI_ACTIVITY_TRACKER_ENABLED is admin-only; .noidle 'enabled' is deprecated
- Comprehensive logging of every resolved parameter with source and
  any rejected overrides
- CLI Watcher works without .noidle file when env vars are set
- Rewrite CLI-WATCHER.md with admin ConfigMap/DevWorkspace examples,
  adaptive defaults formulas, and admin testing scenarios

Issue: https://redhat.atlassian.net/browse/CRW-11940

Signed-off-by: Victor Rubezhny <vrubezhny@redhat.com>
Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>
@openshift-ci-robot

openshift-ci-robot commented Aug 1, 2026

Copy link
Copy Markdown

@vrubezhny: This pull request references CRW-11940 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the feature to target the "5.0.0" version, but no target version was set.

Details

In response to this:

This PR adds administrator-level configuration support for the CLI Watcher via environment variables, enabling cluster-wide control through the CheCluster CR without requiring users to create .noidle config files.

What does this PR do?

  • Adds 5 environment variables for admin-level CLI Watcher configuration: CLI_ACTIVITY_TRACKER_ENABLED, CLI_ACTIVITY_TRACKER_CHECK_PERIOD, CLI_ACTIVITY_TRACKER_ACTIVITY_WINDOW, CLI_ACTIVITY_TRACKER_GRACE_PERIOD, CLI_ACTIVITY_TRACKER_MAX_PROCESS_AGE
  • Env vars act as admin ceilings: .noidle can only tighten (shorten) timing params, never loosen beyond admin-set values
  • CLI Watcher works without .noidle file when env vars are set
  • Comprehensive logging of every resolved parameter with source and any rejected overrides
  • Rewrite CLI-WATCHER.md with CheCluster CR configuration, admin ConfigMap/DevWorkspace examples, adaptive defaults formulas, and admin testing scenarios

Breaking change

CLI Watcher enablement is now exclusively controlled by the CLI_ACTIVITY_TRACKER_ENABLED environment variable (set by the administrator via CheCluster CR or ConfigMap). The enabled field in .noidle is deprecated and ignored — if present, a deprecation warning is logged and the value is disregarded. Users who previously enabled the watcher via .noidle must ask their cluster administrator to set CLI_ACTIVITY_TRACKER_ENABLED=true.

What issues does this PR fix or reference?

How to test this PR?

See testing scenarios in timeout/CLI-WATCHER.md — covers env var configuration, ceiling enforcement, .noidle interaction, and hot-reload behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants