feat: Enhanced CLI Watcher with automatic terminal process monitoring

CLI Watcher now automatically detects and tracks terminal-based development
activity, distinguishing between interactive CLIs (vim, REPLs) and work
processes (builds, deploys) without manual configuration.

Key Features:
- Fully automatic: Only requires 'enabled: true' - auto-detects ALL terminal processes
- Smart defaults: Adapts activityWindow and gracePeriod to workspace idle timeout
- Automatic classification: Interactive (vim, python REPL) vs work (builds, deploys)
- Backward compatible: Old configs continue working with deprecation warnings
- Safety mechanisms: Grace period (5min), max age limit (6h), activity monitoring
- Flexible duration parsing: Accepts 6h, 25m, 60 (seconds), or duration strings

Configuration:
- Minimal: enabled: true (that's it!)
- Smart defaults: Auto-calculated from workspace idle timeout
- Time settings: checkPeriod, activityWindow, gracePeriod, maxProcessAge
- Override options: watchedCommands (fix misclassification), ignoredCommands (skip entirely)

Technical Implementation:
- User process filtering: Parent TTY chain analysis (filters shells, system processes)
- Interactive detection: Foreground process group + TTY read analysis
- Activity tracking: TTY access time (Atime) monitoring for user input
- Multicall binary support: Uses /proc/comm for proper command detection
- Self-skip: che-machine-exec doesn't watch itself
- Config validation: Warns about misconfigurations without breaking
- Platform portability: Detects clock ticks from /proc/self/auxv with platform-specific fallbacks
- Performance: Boot time and clock ticks cached at startup (not per process)
- Robustness: Infinite loop protection, cycle detection, error checking on all parsing

Code Quality Improvements:
- Added comprehensive unit tests (79 test cases covering pure functions and concurrency)
- Tests cover: duration parsing, YAML unmarshaling, defaults, validation, platform detection, applyPolicy, race conditions
- Merged duplicate policy logic into single unified function
- Added error checking to all fmt.Sscanf calls for consistency
- Fixed comment-code mismatches for clarity
- Warning on breaking changes (globally-excluded commands)

Test Coverage:
- Added concurrent Start/Stop tests (catches race conditions)
- Added clock skew tests (documents negative age handling)
- Enhanced /proc parsing integration tests
- All 79 tests pass with -race flag
- No data races detected

All issues verified with test-driven approach: wrote tests first to
detect bugs, then fixed implementation. Thread-safety verified with
Go race detector (-race flag).

Documentation:
- timeout/CLI-WATCHER.md - Comprehensive guide with testing scenarios
- timeout/.noidle.minimal - Minimal config example
- timeout/.noidle.example - Full config with all options
- Added auto-detection test scenario for manual testing
- Added comprehensive upgrade guide for breaking behavioral changes
- Developer testing section added

Issue: https://redhat.atlassian.net/browse/CRW-11505

Assisted-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Signed-off-by: Victor Rubezhny <vrubezhny@redhat.com>

Author: vrubezhny

.gitignore

@@ -23,5 +23,6 @@ _testmain.go
 *.test
 *.prof
 .idea/
+.claude/
 
 che-machine-exec

devfile.yaml

@@ -32,7 +32,7 @@ components:
             type: terminal-dev
             protocol: ws
             secure: false
-      image: registry.access.redhat.com/ubi9/go-toolset:1.25.5-1770596585
+      image: registry.access.redhat.com/ubi9/go-toolset:1.25.9-1778675823
       args:
         - tail
         - '-f'

timeout/.noidle.example

@@ -0,0 +1,74 @@
+# Example .noidle configuration for CLI Watcher
+#
+# This file shows all available configuration options.
+# For minimal config, see .noidle.minimal (just 'enabled: true' is enough!)
+#
+# Place this file in your project directory, or in $HOME/.noidle
+# You can also set CLI_WATCHER_CONFIG environment variable to specify a custom path.
+#
+# NOTE: Comments (lines starting with #) are part of YAML syntax and work fine.
+#       Copy any section below directly into your .noidle file.
+
+enabled: true
+checkPeriod: 30                     # How often to check for active processes (accepts: 30, 30s, etc.)
+activityWindow: 25m                 # How long to wait for activity from interactive processes
+gracePeriod: 5m                     # All processes prevent idling when this young
+maxProcessAge: 6h                   # Safety limit to prevent indefinite idling prevention
+
+watchedCommands:
+  # Simple string format (backward compatible)
+  # These commands will be auto-detected (interactive vs work process)
+  - claude     # AI assistant, will be auto-detected as interactive (checks for user input activities)
+  - gemini     # AI assistant, will be auto-detected as interactive (checks for user input activities)
+  - kubectl    # Kubernetes deployment, will be auto-detected as non-interactive (always prevents idling)
+
+  # Object format with explicit interactive mode control
+  - name: vim
+    interactive: auto              # Auto-detect based on foreground + TTY read behavior
+
+  # Force interactive mode (always check for user input activity)
+  - name: claude
+    interactive: true              # Force interactive even if auto-detection thinks otherwise
+
+  # Long-running build/deploy commands - force non-interactive (always prevent idling)
+  - name: npm
+    interactive: false             # Force non-interactive (always prevent idling)
+
+  - name: docker
+    interactive: no                # Same as 'false'
+
+  - name: gradle
+    interactive: false             # Force non-interactive (always prevent idling during builds)
+
+  # Override always-ignored commands (USE WITH CAUTION)
+  - name: watch
+    interactive: false
+    forceWatch: true               # Override always-ignored list to watch 'watch' command
+                                   # Normally 'watch', 'top', 'htop', 'tail' are always ignored
+
+  - name: top
+    forceWatch: yes                # Also accepts: true, yes, false, no (default: false)
+
+# Interactive mode options:
+#   - auto:  Auto-detect (foreground + has read from TTY → interactive, otherwise → work process)
+#   - true/yes:  Force interactive (always check for user input activity)
+#   - false/no:  Force non-interactive work process (always prevent idling, default)
+#
+# ForceWatch option (optional, defaults to false):
+#   - true/yes:  Override always-ignored list (tail, watch, top, htop) to monitor this command
+#   - false/no:  Respect always-ignored list (default behavior)
+#   WARNING: Use forceWatch with caution. Always-ignored commands are typically passive
+#           monitoring tools that shouldn't prevent workspace idling.
+#
+# Global settings:
+#   - activityWindowSeconds: How long to wait for input from interactive processes (default: 1500 = 25 min)
+#   - gracePeriodSeconds: All processes prevent idling when younger than this (default: 300 = 5 min)
+#   - checkPeriodSeconds: How often to scan for processes (default: 60 = 1 min)
+#
+# Unconfigured commands:
+#   - Auto-detected as interactive or work process during grace period
+#   - After grace period: interactive processes checked for activity, work processes always prevent idling
+#
+# Always-ignored commands (never prevent idling):
+#   - tail, watch, top, htop (passive monitoring tools)
+#   These are always ignored even if explicitly listed in watchedCommands.

timeout/.noidle.minimal

@@ -0,0 +1,32 @@
+# Minimal .noidle configuration
+#
+# This is the absolute minimum needed to enable CLI watcher.
+# All user processes will be watched with smart defaults.
+#
+# NOTE: Comments (lines starting with #) are supported in YAML.
+#       You can copy these examples directly into your .noidle file.
+
+enabled: true
+
+# That's it! With just this, the CLI watcher will:
+#
+# ✅ Watch ALL user-initiated processes (processes with TTY from user terminals)
+# ✅ Auto-detect interactive processes (vim, python REPL, etc.) vs work processes (builds, deploys)
+# ✅ Interactive processes: check for user input activity within 25 minutes
+# ✅ Work processes: always prevent idling while running
+# ✅ All processes: prevent idling for first 5 minutes (grace period)
+# ✅ Safety limit: stop preventing idling after 6 hours (catches hung/forgotten processes)
+# ✅ Ignore passive monitoring tools: tail, watch, top, htop
+#
+# You can override any defaults:
+#
+# checkPeriod: 45                  # Check every 45 seconds instead of default 60
+# activityWindow: 30m              # 30 minutes instead of default 25m
+# gracePeriod: 10m                 # 10 minutes instead of default 5m
+# maxProcessAge: 8h                # 8 hours instead of default 6h
+#
+# Explicitly configure specific commands only if you need to override auto-detection:
+#
+# watchedCommands:
+#   - name: myTool
+#     interactive: false           # Force non-interactive (always prevent idling)