feat(termserver): dedicated ANSI-art message viewer

Since 1.10.5, TerminalTextSanitizer strips absolute cursor positioning
from message bodies before the inline reader shows them, so genuine ANSI
art reflows into unreadable text. Add a dedicated full-screen art view
that renders such bodies with cursor positioning intact, while still
removing OSC (title/clipboard), DCS/APC/PM, private-mode sequences and
device-status/answerback queries -- the input-injection and clipboard
vectors stay closed; only in-screen drawing is restored.

- TerminalTextSanitizer::sanitize() gains a POLICY_POSITIONING mode and a
  hasPositionedAnsi() detector.
- New AnsiArtViewer (telnet/src/): full-screen render + dismiss prompt;
  mode() reads the TERM_ANSI_ART_MODE env setting.
- EchomailHandler / NetmailHandler message viewers detect art on the raw
  body, add an 'A' key (viewart) + Ctrl-K help item, and in 'inline' mode
  auto-launch the art view once per message open.
- TERM_ANSI_ART_MODE: viewer (default, press A) | inline (auto-launch).

i18n keys for all locales, unit tests, daemon include lists, and docs
(UPGRADING_1.10.6, TerminalServer, TerminalServerDevGuide) updated.

Author: awehttam

config/i18n/de/terminalserver.php

@@ -562,6 +562,8 @@
     'ui.terminalserver.message.help_headers'           => 'Nachrichtenkopfzeilen anzeigen',
     'ui.terminalserver.message.help_download'          => 'Anhang herunterladen (ZMODEM)',
     'ui.terminalserver.message.help_images'            => 'Eingebettetes Bild(er) anzeigen',
+    'ui.terminalserver.message.help_ansi_art'          => 'Als ANSI-Grafik anzeigen',
+    'ui.terminalserver.message.ansi_art_dismiss'       => 'ANSI-Grafikansicht - beliebige Taste zum Zurückkehren...',
     'ui.terminalserver.message.help_quit'              => 'Beenden / Nachricht schliessen',
     'ui.terminalserver.netmail.help_delete'            => 'Nachricht löschen',
     'ui.terminalserver.netmail.help_bookmark'          => 'Nachricht mit Lesezeichen versehen / entfernen',

config/i18n/en/terminalserver.php

@@ -563,6 +563,8 @@
     'ui.terminalserver.message.help_headers'           => 'View message headers',
     'ui.terminalserver.message.help_download'          => 'Download attachment (ZMODEM)',
     'ui.terminalserver.message.help_images'            => 'View inline image(s)',
+    'ui.terminalserver.message.help_ansi_art'          => 'View as ANSI art',
+    'ui.terminalserver.message.ansi_art_dismiss'       => 'ANSI art view - press any key to return...',
     'ui.terminalserver.message.help_quit'              => 'Quit / close message',
     'ui.terminalserver.netmail.help_delete'            => 'Delete message',
     'ui.terminalserver.netmail.help_bookmark'          => 'Bookmark / unsave message',

config/i18n/es/terminalserver.php

@@ -559,6 +559,8 @@
     'ui.terminalserver.message.help_headers'           => 'Ver encabezados del mensaje',
     'ui.terminalserver.message.help_download'          => 'Descargar adjunto (ZMODEM)',
     'ui.terminalserver.message.help_images'            => 'Ver imagen(es) incrustada(s)',
+    'ui.terminalserver.message.help_ansi_art'          => 'Ver como arte ANSI',
+    'ui.terminalserver.message.ansi_art_dismiss'       => 'Vista de arte ANSI - pulse cualquier tecla para volver...',
     'ui.terminalserver.message.help_quit'              => 'Salir / cerrar mensaje',
     'ui.terminalserver.netmail.help_delete'            => 'Eliminar mensaje',
     'ui.terminalserver.netmail.help_bookmark'          => 'Marcar / desmarcar mensaje',

config/i18n/fr/terminalserver.php

@@ -443,6 +443,8 @@
     'ui.terminalserver.message.help_headers'  => 'Afficher les en-têtes du message',
     'ui.terminalserver.message.help_download' => 'Télécharger la pièce jointe (ZMODEM)',
     'ui.terminalserver.message.help_images'   => 'Afficher la ou les images intégrées',
+    'ui.terminalserver.message.help_ansi_art' => 'Afficher en art ANSI',
+    'ui.terminalserver.message.ansi_art_dismiss' => 'Vue art ANSI - appuyez sur une touche pour revenir...',
     'ui.terminalserver.message.help_quit'     => 'Quitter / fermer le message',
     'ui.terminalserver.netmail.help_delete'   => 'Supprimer le message',
     'ui.terminalserver.netmail.help_bookmark' => 'Marquer / démarquer le message',

config/i18n/it/terminalserver.php

@@ -563,6 +563,8 @@
     'ui.terminalserver.message.help_headers'           => 'Visualizza intestazioni messaggio',
     'ui.terminalserver.message.help_download'          => 'Scarica allegato (ZMODEM)',
     'ui.terminalserver.message.help_images'            => 'Visualizza immagine/i incorporata/e',
+    'ui.terminalserver.message.help_ansi_art'          => 'Visualizza come arte ANSI',
+    'ui.terminalserver.message.ansi_art_dismiss'       => 'Vista arte ANSI - premi un tasto per tornare...',
     'ui.terminalserver.message.help_quit'              => 'Esci / chiudi messaggio',
     'ui.terminalserver.netmail.help_delete'            => 'Elimina messaggio',
     'ui.terminalserver.netmail.help_bookmark'          => 'Aggiungi / rimuovi segnalibro',

config/i18n/ru/terminalserver.php

@@ -564,6 +564,8 @@
     'ui.terminalserver.message.help_headers' => 'Просмотреть заголовки сообщения',
     'ui.terminalserver.message.help_download' => 'Скачать вложение (ZMODEM)',
     'ui.terminalserver.message.help_images' => 'Посмотреть встроенные изображения',
+    'ui.terminalserver.message.help_ansi_art' => 'Показать как ANSI-графику',
+    'ui.terminalserver.message.ansi_art_dismiss' => 'Просмотр ANSI-графики - нажмите любую клавишу для возврата...',
     'ui.terminalserver.message.help_quit' => 'Выход / закрыть сообщение',
     'ui.terminalserver.netmail.help_delete' => 'Удалить сообщение',
     'ui.terminalserver.netmail.help_bookmark' => 'Добавить в закладки / убрать из сохранённых',

docs/TerminalServer.md

@@ -101,6 +101,7 @@ Pipe-code rendering for plain bulletins and other ANSI/pipe text shared with the
 - Press `T` in the echomail viewer to download the current message as a plain-text `.txt` file via ZMODEM. The filename is derived from the message subject. Uses the built-in ZMODEM implementation by default; no additional software required.
 - Press `E` in the echomail viewer to forward the current message to the logged-in user's email address. Requires outbound email to be configured on the BBS; an error is shown inline if it is not.
 - Press `F` in the echomail viewer to forward the current message. A dialog prompts the user to choose **Echomail** (forward to another subscribed echoarea — opens compose pre-filled with a `Fwd:` subject, attribution header, and quoted body) or **Netmail** (forward as a netmail to an FTN address — uses the standard netmail compose flow). The source echoarea appears in the attribution header in both cases.
+- Press `A` in the echomail or netmail viewer to open the **ANSI art view** — a full-screen render of the message body with cursor positioning intact. `A` only appears (in the Ctrl-K help overlay) when the body is ANSI art. Message bodies are stripped of cursor-positioning sequences before the normal reader shows them (security hardening in 1.10.5), so art that draws itself with absolute cursor moves reflows into unreadable text there; the art view restores in-screen drawing while still blocking window-title/clipboard writes and answerback queries. The `TERM_ANSI_ART_MODE` setting selects the behaviour: `viewer` (default) is the press-`A` flow just described; `inline` makes the full-screen art view open automatically whenever an ANSI-art message is opened, with any key returning to the normal reader.
 - Press `G` in the echomail viewer to **add an ignore rule** for the current message's sender. A sub-menu offers three options: **By sender name** (hides all future messages from that name), **By FTN address** (hides messages from that name at that address — only shown if the message carries an FTN address), and **Subject keyword** (hides future messages from that sender whose subject contains the given keyword). Options 1 and 2 show a confirmation dialog pre-filled from the message header; option 3 prompts for a keyword string. The rule is saved via `POST /api/messages/echomail/ignore-rules`. `G` is available in the Ctrl-K help overlay only (not the status bar).
 - Press `G` from the **echoarea list** to open the **Ignore Rules** management screen. Rules are fetched from `GET /api/user/echomail-ignore-rules` and displayed in a paginated selectable list. Each row shows the sender name and, where set, the FTN address and subject keyword. Select a rule and press Enter or `D` to delete it after confirmation via `DELETE /api/user/echomail-ignore-rules/{id}`. `G` appears in the Ctrl-K help overlay on the echoarea list.
 - The **echoarea list** (the screen showing your subscribed areas) uses the same navigable list interface as message lists. Arrow Up/Down moves the highlight cursor; Arrow Left/Right (or `n`/`p`) changes pages; Enter selects the highlighted area; typing a number jumps the cursor to that row. A status bar at the bottom shows available actions. Press `/` to filter the list by tag or description, `C` to clear the filter, and (when Interests is enabled) `I` to open the interests browser. The list redraws immediately on terminal resize.

docs/TerminalServerDevGuide.md

@@ -317,6 +317,25 @@ stay intact. A line with no escape sequences and no high bytes takes a fast
 byte-oriented `wordwrap()` path. Do not reintroduce a raw `wordwrap(..., true)`
 on text that may contain colour codes or UTF-8.
 
+### ANSI art viewer
+
+For bodies that are genuine ANSI art, `AnsiArtViewer` (`telnet/src/`) renders the
+message full-screen with cursor positioning preserved.
+`TerminalTextSanitizer::sanitize($raw, TerminalTextSanitizer::POLICY_POSITIONING)`
+keeps a whitelist of cursor-movement and erase sequences on top of SGR, while
+still removing OSC, DCS/APC/PM, private-mode sequences, device-status/answerback
+queries and C0/C1 bytes — the input-injection and clipboard/title vectors stay
+closed.
+
+`AnsiArtViewer::isArt($rawBody)` (a wrapper over
+`TerminalTextSanitizer::hasPositionedAnsi()`) decides whether a message qualifies;
+it must be called on the **raw** body, before strict sanitization. The message
+viewers in `EchomailHandler` and `NetmailHandler` pass the raw body through, add
+an `a => 'viewart'` entry to `$extraKeys` plus a help item, and handle
+`case 'viewart'` by calling `AnsiArtViewer::show()`. `AnsiArtViewer::mode()`
+reads `TERM_ANSI_ART_MODE` (`viewer` default, or `inline` to auto-launch the view
+once per message open).
+
 ### Status Bar Discipline
 
 The bottom status bar has limited width. Keep it to the **most-used primary actions only** — typically scroll, prev/next, reply, and quit. Every other key belongs exclusively in the Ctrl-K help overlay.

docs/UPGRADING_1.10.6.md

@@ -32,6 +32,17 @@ changes are made.
   their absolute cursor positioning. Escape sequences are now treated as
   zero-width and are never split; wrapping only breaks on character boundaries.
 
+- **ANSI-art message viewer:** echomail and netmail whose body is ANSI art (it
+  positions the cursor to place its pieces) can now be viewed as art. The inline
+  reader still shows the escape-filtered, reflowed body; pressing `A` opens a
+  dedicated full-screen view that renders the art with cursor positioning
+  intact. That view still strips window-title/clipboard writes (OSC),
+  answerback/device-status queries and other input-injection sequences — only
+  in-screen drawing is restored. The `TERM_ANSI_ART_MODE` setting controls this:
+  `viewer` (default) is the press-`A` behaviour above; `inline` opens the
+  full-screen art view automatically whenever an art message is opened, and any
+  key drops through to the normal reader.
+
 ---
 
 ## Upgrade Instructions

src/TerminalTextSanitizer.php

@@ -14,38 +14,65 @@
  * honour them — OSC title/clipboard writes or answerback/device-status queries
  * that reflect input back into the session.
  *
- * The policy here is a whitelist: SGR (Select Graphic Rendition) sequences
- * (`ESC [ ... m`) are kept so ANSI colour survives; every other escape
- * sequence and every C0/C1 control byte except TAB, CR and LF is removed.
+ * Two policies are supported:
+ *
+ *  - {@see POLICY_STRIP} (default): a strict whitelist. Only SGR (colour/style)
+ *    sequences and TAB/CR/LF survive; every other escape sequence and C0/C1
+ *    control byte is removed. This is what the inline message reader uses.
+ *  - {@see POLICY_POSITIONING}: additionally preserves a whitelist of cursor
+ *    movement and erase sequences so genuine ANSI art renders. OSC, DCS/APC/PM,
+ *    private-mode sequences, device-status/answerback queries and C0/C1 bytes
+ *    are still removed — the input-injection and clipboard/title vectors stay
+ *    closed; only in-screen display spoofing becomes possible again. Used by the
+ *    dedicated full-screen ANSI art viewer.
  */
 class TerminalTextSanitizer
 {
+    /** Strict policy: keep SGR colour codes only. */
+    public const POLICY_STRIP = 'strip';
+
+    /** Permissive policy: also keep cursor-movement and erase sequences. */
+    public const POLICY_POSITIONING = 'positioning';
+
+    /**
+     * Well-formed SGR sequence: `ESC [ <params> m`.
+     */
+    private const SGR_PATTERN = '\x1b\[[0-9;:]*m';
+
     /**
-     * Strip terminal control sequences from untrusted text, keeping only SGR
-     * colour/style codes and the TAB/CR/LF whitespace controls.
+     * Cursor movement / erase / scroll / save-restore sequences that the
+     * positioning policy preserves: final byte in [A-H] (CUU/CUD/CUF/CUB/CNL/
+     * CPL/CHA/CUP), J/K (ED/EL), S/T (SU/SD), d (VPA), f (HVP), s/u (SCP/RCP).
+     * No private ('?','<','>','=') markers and no intermediate bytes are
+     * allowed, so mode changes and device queries never match.
+     */
+    private const POSITIONING_PATTERN = '\x1b\[[0-9;]*[A-HJKSTdfsu]';
+
+    /**
+     * Strip terminal control sequences from untrusted text.
      *
      * The input is expected to be UTF-8 (the canonical storage form for message
      * text); charset conversion to CP437/ASCII happens downstream and does not
      * reintroduce an ESC introducer.
      *
-     * @param string $text Raw untrusted text.
-     * @return string Text safe to word-wrap and write to a terminal.
+     * @param string $text   Raw untrusted text.
+     * @param string $policy One of {@see POLICY_STRIP} or {@see POLICY_POSITIONING}.
+     * @return string Text safe to write to a terminal.
      */
-    public static function sanitize(string $text): string
+    public static function sanitize(string $text, string $policy = self::POLICY_STRIP): string
     {
         if ($text === '') {
             return $text;
         }
 
-        // Split on well-formed SGR sequences, keeping them as captured
-        // delimiters. Odd-indexed parts are the SGR sequences to preserve;
-        // even-indexed parts are ordinary text that gets fully scrubbed.
-        $parts = preg_split(
-            '/(\x1b\[[0-9;:]*m)/',
-            $text,
-            -1,
-            PREG_SPLIT_DELIM_CAPTURE
-        );
+        $keep = $policy === self::POLICY_POSITIONING
+            ? '/(' . self::SGR_PATTERN . '|' . self::POSITIONING_PATTERN . ')/'
+            : '/(' . self::SGR_PATTERN . ')/';
+
+        // Split on the sequences to keep, retaining them as captured delimiters.
+        // Odd-indexed parts are the preserved sequences; even-indexed parts are
+        // ordinary text that gets fully scrubbed.
+        $parts = preg_split($keep, $text, -1, PREG_SPLIT_DELIM_CAPTURE);
 
         if ($parts === false) {
             return self::scrub($text);
@@ -59,9 +86,27 @@ public static function sanitize(string $text): string
         return $out;
     }
 
+    /**
+     * Whether $text contains an ANSI sequence that positions the cursor or
+     * erases part of the screen (i.e. a CSI sequence whose final byte is a
+     * letter other than `m`). Used to decide whether a message body is ANSI
+     * art that warrants the dedicated art viewer.
+     *
+     * Operates on the raw (pre-sanitize) text.
+     */
+    public static function hasPositionedAnsi(string $text): bool
+    {
+        if ($text === '') {
+            return false;
+        }
+
+        // CSI whose final byte is a letter other than 'm' (SGR).
+        return (bool)preg_match('/\x1b\[[0-9;<>=?]*[A-Za-ln-z]/', $text);
+    }
+
     /**
      * Remove every escape sequence and disallowed control byte from a fragment
-     * that is known to contain no SGR sequences worth keeping.
+     * that is known to contain no sequences worth keeping.
      */
     private static function scrub(string $text): string
     {
@@ -76,7 +121,7 @@ private static function scrub(string $text): string
         // DCS / SOS / PM / APC strings: ESC (P|X|^|_) ... ST.
         $text = preg_replace('/\x1b[PX^_][^\x1b]*(?:\x1b\\\\)?/', '', $text);
 
-        // Any CSI sequence (all non-SGR by construction, plus malformed or
+        // Any CSI sequence (all non-preserved by construction, plus malformed or
         // unterminated ones): cursor movement, erase, scroll region, mode
         // changes, device-status queries.
         $text = preg_replace('/\x1b\[[0-9;:?<>=]*[ -\/]*[@-~]?/', '', $text);