feat: DTail fork — server/client feature development

Squashed development of the snonux/dtail fork's product code (internal/, cmd/)
since diverging from mimecast/dtail. Major areas:

- Read/output path: the former "turbo" channel-less path is now the single,
  default server-side read/output path for cat/grep/tail and MapReduce; the old
  channel-based path and its config/env toggles were removed.
- MapReduce: single aggregate implementation (server + serverless) fed directly
  by a processor pipeline, with input-exhausted finalization via the shutdown
  coordinator; high-concurrency and data-race fixes.
- Journal source reads (journal:unit.service) via journalctl, Linux-gated behind
  a journal-v1 capability.
- Auth-key fast reconnect: in-memory per-user public-key cache with TTL/max-keys,
  registered over an authenticated session (AUTHKEY), checked before
  authorized_keys.
- Interactive query reload (--interactive-query) with SESSION START/UPDATE
  generation boundaries and capability negotiation.
- Client-side deadlines: --timeout / --shutdownAfter as context deadlines;
  follow shutdown handling.
- Client logging: diagnostics-only daily log by default, opt-in payload tee via
  --log-payload.
- Numerous correctness fixes (buffer-pool double-recycle races, EOF-sentinel
  leaks, glob-expansion cap, TOCTOU in CSV parsing) with accompanying unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 40 insertions, 1 deletions

diff --git a/internal/config/client.go b/internal/config/client.go
index 9f4df97..61051f7 100644
--- a/internal/config/client.go
+++ b/internal/config/client.go
@@ -1,6 +1,11 @@
 package config
 
-import "github.com/mimecast/dtail/internal/color"
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/mimecast/dtail/internal/color"
+)
 
 type remoteTermColors struct {
 	DelimiterAttr color.Attribute
@@ -104,12 +109,26 @@ type termColors struct {
 type ClientConfig struct {
 	TermColorsEnable bool       `json:",omitempty"`
 	TermColors       termColors `json:",omitempty"`
+	AuthKeyPath      string     `json:",omitempty"`
+	AuthKeyDisable   bool       `json:",omitempty"`
+	// LogPayload opts in to teeing the full retrieved payload (the bulk
+	// dcat/dgrep/dtail output) into the daily client log file. Default false:
+	// the file keeps diagnostics/audit lines only, so a large read no longer
+	// grows the daily log by the full payload size. Payload always still goes
+	// to stdout/terminal regardless of this setting. Only affects the default
+	// "fout" logger (stdout+file); see docs for other loggers.
+	LogPayload bool `json:",omitempty"`
 }
 
 // Create a new default client configuration.
 func newDefaultClientConfig() *ClientConfig {
 	return &ClientConfig{
 		TermColorsEnable: true,
+		AuthKeyPath:      defaultAuthKeyPath(),
+		AuthKeyDisable:   false,
+		// Default: diagnostics-only client log file. Opt in with --log-payload
+		// / Client.LogPayload to restore the legacy full-payload tee.
+		LogPayload: false,
 		TermColors: termColors{
 			Remote: remoteTermColors{
 				DelimiterAttr: color.AttrDim,
@@ -198,3 +217,23 @@ func newDefaultClientConfig() *ClientConfig {
 		},
 	}
 }
+
+// defaultAuthKeyPath returns the default path for the SSH auth key based on
+// the user's home directory. It tries os.UserHomeDir() first, then falls back
+// to the HOME environment variable. If neither resolves to a non-empty path,
+// it returns "" so that callers can surface a clear error rather than silently
+// using a literal "~/.ssh/id_rsa" that the SSH stack cannot expand.
+func defaultAuthKeyPath() string {
+	homeDir, err := os.UserHomeDir()
+	if err != nil || homeDir == "" {
+		homeDir = os.Getenv("HOME")
+	}
+	if homeDir == "" {
+		// Return empty string; callers must check and emit a diagnostic
+		// (e.g. "set DTAIL_AUTH_KEY_PATH explicitly") rather than using a
+		// path that the SSH library will never find.
+		return ""
+	}
+
+	return filepath.Join(homeDir, ".ssh", "id_rsa")
+}