feat(termserver): virtual-canvas ANSI-art rendering (new default)

Add AnsiCanvasRenderer: resolves an ANSI-art byte stream against an
off-screen character grid (cursor moves, erase, SGR, save/restore) and
serialises the used rows back to SGR-only lines with no positioning.
Ported from the browser AnsiTerminal in public_html/js/ansisys.js.

TERM_ANSI_ART_MODE gains 'canvas' and it is now the default: art bodies
are canvas-rendered and shown inline in the normal reader, which scrolls,
repaints and resizes them like any other message -- no cursor-control
code reaches the terminal, only colour. 'viewer' (old default), 'inline'
and 'raw' remain. The full-screen positioned view is still on the 'A' key
in every mode.

- AnsiArtViewer::readerRenderMode() replaces readerSkipsWrap(); returns
  strict | canvas | raw and drives both the sanitize policy and the
  $buildView line-production branch in the Echomail/Netmail viewers.
- Height capped at 1000 rows; lines clipped to the reader width and
  re-rendered on resize.

Unit tests for the renderer and the mode helpers, daemon include lists,
.env.example and the three terminal-server docs updated.

Author: awehttam

.env.example

@@ -313,17 +313,21 @@ SIXEL_PIXELS_PER_COL=9
 SIXEL_PIXELS_PER_ROW=16
 
 # ANSI-art message handling on the Telnet/SSH reader.
-# Message bodies are stripped of cursor-positioning sequences before the inline
-# reader shows them (GHSA-4225-c933-76f3), so absolute-positioned ANSI art does
-# not render inline.
-#   viewer = inline reader shows the reflowed body; press A for a full-screen
-#            art view (default)
-#   inline = the full-screen art view opens automatically for art messages;
-#            any key returns to the normal reader
+# Message bodies are stripped of cursor-positioning sequences before the plain
+# reader would see them (GHSA-4225-c933-76f3), so absolute-positioned ANSI art
+# cannot be shown verbatim.
+#   canvas = art is rendered onto an off-screen character grid and the coloured
+#            result is shown inline in the normal reader; press A for a
+#            full-screen positioned render (default)
+#   viewer = inline reader shows the reflowed body; press A for the full-screen
+#            render
+#   inline = the full-screen render opens automatically for art messages; any
+#            key returns to the normal reader
 #   raw    = cursor-positioning/erase codes pass through to the normal reader
 #            for art messages (not word-wrapped); sysop accepts in-screen
-#            display spoofing. OSC/DCS/answerback vectors stay blocked in all modes.
-# TERM_ANSI_ART_MODE=viewer
+#            display spoofing
+# OSC/DCS/answerback vectors stay blocked in every mode.
+# TERM_ANSI_ART_MODE=canvas
 
 # Outbound File Requests (FREQ) feature - lets users request a file from a remote FTN node
 # via the web UI, terminal server UI, and /api/freq/requests.

docs/TerminalServer.md

@@ -101,7 +101,13 @@ Pipe-code rendering for plain bulletins and other ANSI/pipe text shared with the
 - Press `T` in the echomail viewer to download the current message as a plain-text `.txt` file via ZMODEM. The filename is derived from the message subject. Uses the built-in ZMODEM implementation by default; no additional software required.
 - Press `E` in the echomail viewer to forward the current message to the logged-in user's email address. Requires outbound email to be configured on the BBS; an error is shown inline if it is not.
 - Press `F` in the echomail viewer to forward the current message. A dialog prompts the user to choose **Echomail** (forward to another subscribed echoarea — opens compose pre-filled with a `Fwd:` subject, attribution header, and quoted body) or **Netmail** (forward as a netmail to an FTN address — uses the standard netmail compose flow). The source echoarea appears in the attribution header in both cases.
-- Press `A` in the echomail or netmail viewer to open the **ANSI art view** — a full-screen render of the message body with cursor positioning intact. `A` only appears (in the Ctrl-K help overlay) when the body is ANSI art. Message bodies are stripped of cursor-positioning sequences before the normal reader shows them (security hardening in 1.10.5), so art that draws itself with absolute cursor moves reflows into unreadable text there; the art view restores in-screen drawing while still blocking window-title/clipboard writes and answerback queries. The `TERM_ANSI_ART_MODE` setting selects the behaviour: `viewer` (default) is the press-`A` flow just described; `inline` makes the full-screen art view open automatically whenever an ANSI-art message is opened, with any key returning to the normal reader; `raw` lets the cursor-positioning and erase codes pass straight through to the normal reader for art messages (which are then not word-wrapped), so the art draws itself in place as you scroll. `raw` is the sysop opting in to in-screen display spoofing within the reader; the window-title/clipboard and answerback protections still apply in all three modes.
+- **ANSI-art messages** (echomail or netmail whose body positions the cursor to place its pieces) are rendered onto a virtual character canvas and shown inline in the normal reader — the reader scrolls, repaints and resizes the art like any other message, and no cursor-control code reaches your terminal. Message bodies are stripped of cursor-positioning sequences before the plain reader would otherwise see them (security hardening in 1.10.5), which is why the canvas exists: it resolves the cursor moves against an off-screen grid first. Press `A` (shown in the Ctrl-K help overlay only when the body is art) for a full-screen render with real cursor positioning for maximum fidelity.
+- The `TERM_ANSI_ART_MODE` setting selects how art is handled:
+  - `canvas` (default) — virtual-canvas render inline; `A` for the full-screen view.
+  - `viewer` — inline reader shows the escape-filtered, reflowed body; `A` for the full-screen view.
+  - `inline` — the full-screen view opens automatically whenever an art message is opened; any key returns to the reader.
+  - `raw` — cursor-positioning and erase codes pass straight through to the normal reader for art messages (which are then not word-wrapped), so the art draws itself in place as you scroll. This is the sysop opting in to in-screen display spoofing within the reader.
+  The window-title/clipboard (OSC) and answerback/device-status protections apply in every mode.
 - Press `G` in the echomail viewer to **add an ignore rule** for the current message's sender. A sub-menu offers three options: **By sender name** (hides all future messages from that name), **By FTN address** (hides messages from that name at that address — only shown if the message carries an FTN address), and **Subject keyword** (hides future messages from that sender whose subject contains the given keyword). Options 1 and 2 show a confirmation dialog pre-filled from the message header; option 3 prompts for a keyword string. The rule is saved via `POST /api/messages/echomail/ignore-rules`. `G` is available in the Ctrl-K help overlay only (not the status bar).
 - Press `G` from the **echoarea list** to open the **Ignore Rules** management screen. Rules are fetched from `GET /api/user/echomail-ignore-rules` and displayed in a paginated selectable list. Each row shows the sender name and, where set, the FTN address and subject keyword. Select a rule and press Enter or `D` to delete it after confirmation via `DELETE /api/user/echomail-ignore-rules/{id}`. `G` appears in the Ctrl-K help overlay on the echoarea list.
 - The **echoarea list** (the screen showing your subscribed areas) uses the same navigable list interface as message lists. Arrow Up/Down moves the highlight cursor; Arrow Left/Right (or `n`/`p`) changes pages; Enter selects the highlighted area; typing a number jumps the cursor to that row. A status bar at the bottom shows available actions. Press `/` to filter the list by tag or description, `C` to clear the filter, and (when Interests is enabled) `I` to open the interests browser. The list redraws immediately on terminal resize.

docs/TerminalServerDevGuide.md

@@ -317,34 +317,41 @@ stay intact. A line with no escape sequences and no high bytes takes a fast
 byte-oriented `wordwrap()` path. Do not reintroduce a raw `wordwrap(..., true)`
 on text that may contain colour codes or UTF-8.
 
-### ANSI art viewer
-
-For bodies that are genuine ANSI art, `AnsiArtViewer` (`telnet/src/`) renders the
-message full-screen with cursor positioning preserved.
-`TerminalTextSanitizer::sanitize($raw, TerminalTextSanitizer::POLICY_POSITIONING)`
-keeps a whitelist of cursor-movement and erase sequences on top of SGR, while
-still removing OSC, DCS/APC/PM, private-mode sequences, device-status/answerback
-queries and C0/C1 bytes — the input-injection and clipboard/title vectors stay
-closed.
-
-`AnsiArtViewer::isArt($rawBody)` (a wrapper over
-`TerminalTextSanitizer::hasPositionedAnsi()`) decides whether a message qualifies;
-it must be called on the **raw** body, before sanitization. The message viewers
-in `EchomailHandler` and `NetmailHandler` pass the raw body through, add an
-`a => 'viewart'` entry to `$extraKeys` plus a help item, and handle
-`case 'viewart'` by calling `AnsiArtViewer::show()`.
-
-`AnsiArtViewer::mode()` reads `TERM_ANSI_ART_MODE`:
-
-| Mode | Reader behaviour |
-|------|------------------|
-| `viewer` (default) | Body sanitized `POLICY_STRIP` and reflowed; press `A` for `AnsiArtViewer::show()`. |
-| `inline` | Same as `viewer`, plus `AnsiArtViewer::show()` auto-launches once per message open. |
-| `raw` | For art bodies: `AnsiArtViewer::readerBodyPolicy()` returns `POLICY_POSITIONING` so the handler sanitizes permissively, and `AnsiArtViewer::readerSkipsWrap()` returns true so `$buildView` splits the body on newlines instead of calling `wrapTextLines()`. The cursor codes reach the terminal from inside the normal scroll viewer. |
-
-The two `reader*` helpers take the `$isArt` flag and both no-op unless the mode
-is `raw` and the body is art, so every non-art message and every other mode keeps
-the strict path.
+### ANSI art
+
+Two pieces cooperate. `TerminalTextSanitizer::sanitize($raw, POLICY_POSITIONING)`
+keeps a whitelist of cursor-movement and erase sequences on top of SGR while
+still removing OSC, DCS/APC/PM, private-mode sequences,
+device-status/answerback queries and C0/C1 bytes — the input-injection and
+clipboard/title vectors stay closed regardless of mode.
+
+`AnsiCanvasRenderer::render($positioningSanitizedBody, $width)` (`telnet/src/`,
+ported from the browser `AnsiTerminal` in `public_html/js/ansisys.js`) resolves
+every cursor move against an off-screen cell grid (`$width` columns, height
+capped at 1000 rows) and serialises the used rows back to strings that carry
+**SGR codes only** — no positioning. The message viewers feed these straight in
+as `$wrappedLines`, so the scroll viewer, resize rebuild and repaint all work
+unchanged and nothing but colour reaches the terminal.
+
+`AnsiArtViewer::show()` is the alternative: a full-screen render of the
+positioning-sanitized body with real cursor moves, reached with the `A` key
+(`a => 'viewart'` in `$extraKeys` plus a help item; `case 'viewart'` in the
+switch). Maximum fidelity, at the cost of clearing the screen.
+
+`AnsiArtViewer::isArt($rawBody)` (over
+`TerminalTextSanitizer::hasPositionedAnsi()`) must be called on the **raw** body,
+before sanitization, to decide whether a message qualifies. `readerRenderMode()`
+then returns how `$buildView` should turn the body into lines:
+
+| `TERM_ANSI_ART_MODE` | `readerRenderMode($isArt=true)` | Body policy | `$buildView` lines |
+|----------------------|--------------------------------|-------------|--------------------|
+| `canvas` (default) | `canvas` | `POLICY_POSITIONING` | `AnsiCanvasRenderer::render()` |
+| `viewer` | `strict` | `POLICY_STRIP` | `wrapTextLines()` |
+| `inline` | `strict` | `POLICY_STRIP` | `wrapTextLines()` (plus `show()` auto-launches once per open) |
+| `raw` | `raw` | `POLICY_POSITIONING` | split on newlines, no wrap |
+
+For non-art bodies `readerRenderMode()` is always `strict`, so every ordinary
+message keeps the plain sanitize + wrap path.
 
 ### Status Bar Discipline
 

docs/UPGRADING_1.10.6.md

@@ -32,21 +32,29 @@ changes are made.
   their absolute cursor positioning. Escape sequences are now treated as
   zero-width and are never split; wrapping only breaks on character boundaries.
 
-- **ANSI-art message viewer:** echomail and netmail whose body is ANSI art (it
-  positions the cursor to place its pieces) can now be viewed as art. The inline
-  reader still shows the escape-filtered, reflowed body; pressing `A` opens a
-  dedicated full-screen view that renders the art with cursor positioning
-  intact. That view still strips window-title/clipboard writes (OSC),
-  answerback/device-status queries and other input-injection sequences — only
-  in-screen drawing is restored. The `TERM_ANSI_ART_MODE` setting controls this:
-  `viewer` (default) is the press-`A` behaviour above; `inline` opens the
-  full-screen art view automatically whenever an art message is opened, and any
-  key drops through to the normal reader; `raw` passes cursor-positioning and
-  erase sequences straight through to the normal reader for art messages (and
-  does not word-wrap them), so the art renders in place during normal scrolling.
-  `raw` reintroduces in-screen display spoofing inside the message reader — the
-  sysop opts into that tradeoff; the OSC/DCS/answerback vectors stay closed in
-  every mode.
+- **ANSI-art messages render on a virtual canvas:** echomail and netmail whose
+  body is ANSI art (it positions the cursor to place its pieces) are now drawn
+  onto an off-screen character grid and the resulting coloured lines are shown
+  inline in the normal reader. The 1.10.5 security fix strips absolute cursor
+  positioning from message bodies, which left ANSI art reflowing into unreadable
+  text; the canvas resolves every cursor move against the grid first, so the art
+  keeps its layout and the reader still scrolls, repaints and resizes it like
+  any other message. No cursor-control code reaches the terminal — only colour.
+  Pressing `A` in the reader opens a full-screen view that renders the art with
+  real cursor positioning for maximum fidelity; that view (like the inline
+  canvas) still strips window-title/clipboard writes (OSC),
+  answerback/device-status queries and other input-injection sequences.
+
+  The `TERM_ANSI_ART_MODE` setting selects the behaviour:
+
+  | Value | Behaviour |
+  |-------|-----------|
+  | `canvas` (default) | Art rendered on the virtual canvas inline; `A` for the full-screen view. |
+  | `viewer` | Inline reader shows the escape-filtered, reflowed body; `A` for the full-screen view. |
+  | `inline` | The full-screen view opens automatically when an art message is opened; any key returns to the reader. |
+  | `raw` | Cursor-positioning and erase codes pass straight through to the normal reader for art messages (not word-wrapped). Reintroduces in-screen display spoofing within the reader — the sysop opts in. |
+
+  The OSC/DCS/answerback protections apply in every mode.
 
 ---
 

ssh/ssh_daemon.php

@@ -8,6 +8,7 @@
 require_once __DIR__ . '/../telnet/src/BbsSession.php';
 require_once __DIR__ . '/../telnet/src/TelnetUtils.php';
 require_once __DIR__ . '/../telnet/src/TerminalMarkupRenderer.php';
+require_once __DIR__ . '/../telnet/src/AnsiCanvasRenderer.php';
 require_once __DIR__ . '/../telnet/src/AnsiArtViewer.php';
 require_once __DIR__ . '/../telnet/src/SixelImageRenderer.php';
 require_once __DIR__ . '/../telnet/src/TerminalBoxRenderer.php';

telnet/src/AnsiArtViewer.php

@@ -27,9 +27,18 @@
  */
 class AnsiArtViewer
 {
+    /**
+     * Art messages are rendered onto a virtual canvas (see
+     * {@see AnsiCanvasRenderer}) and the resulting SGR-only lines are shown
+     * inline in the normal reader, which scrolls and resizes them like any
+     * other message. Pressing `A` still opens the full-screen positioned view.
+     * Default.
+     */
+    public const MODE_CANVAS = 'canvas';
+
     /**
      * Inline reader shows the reflowed, escape-filtered body; the user presses
-     * `A` for the dedicated full-screen art view. Default.
+     * `A` for the dedicated full-screen art view.
      */
     public const MODE_VIEWER = 'viewer';
 
@@ -51,49 +60,61 @@ class AnsiArtViewer
 
     /**
      * Configured art-handling mode from `TERM_ANSI_ART_MODE`. Defaults to
-     * {@see MODE_VIEWER}; any unrecognised value also falls back to it.
+     * {@see MODE_CANVAS}; any unrecognised value also falls back to it.
      */
     public static function mode(): string
     {
-        $mode = strtolower(trim((string)Config::env('TERM_ANSI_ART_MODE', self::MODE_VIEWER)));
+        $mode = strtolower(trim((string)Config::env('TERM_ANSI_ART_MODE', self::MODE_CANVAS)));
 
         return match ($mode) {
+            self::MODE_VIEWER => self::MODE_VIEWER,
             self::MODE_INLINE => self::MODE_INLINE,
             self::MODE_RAW    => self::MODE_RAW,
-            default           => self::MODE_VIEWER,
+            default           => self::MODE_CANVAS,
         };
     }
 
     /**
      * Whether a raw (pre-sanitize) message body looks like positioned ANSI art
-     * that would not survive the inline reader intact.
+     * that would not survive the plain word-wrapping reader intact.
      */
     public static function isArt(string $rawBody): bool
     {
         return TerminalTextSanitizer::hasPositionedAnsi($rawBody);
     }
 
     /**
-     * The sanitize policy the normal reader should apply to a message body.
+     * How the normal reader should turn a message body into display lines:
      *
-     * {@see TerminalTextSanitizer::POLICY_POSITIONING} only when the body is
-     * art and the configured mode is {@see MODE_RAW}; otherwise the strict
-     * {@see TerminalTextSanitizer::POLICY_STRIP}.
+     *  - `strict` — sanitize `POLICY_STRIP`, word-wrap (all non-art bodies, and
+     *    art bodies in `viewer` / `inline` mode).
+     *  - `canvas` — sanitize `POLICY_POSITIONING`, render through
+     *    {@see AnsiCanvasRenderer} (art body, `canvas` mode).
+     *  - `raw` — sanitize `POLICY_POSITIONING`, split on newlines only (art
+     *    body, `raw` mode).
      */
-    public static function readerBodyPolicy(bool $isArt): string
+    public static function readerRenderMode(bool $isArt): string
     {
-        return ($isArt && self::mode() === self::MODE_RAW)
-            ? TerminalTextSanitizer::POLICY_POSITIONING
-            : TerminalTextSanitizer::POLICY_STRIP;
+        if (!$isArt) {
+            return 'strict';
+        }
+
+        return match (self::mode()) {
+            self::MODE_CANVAS => 'canvas',
+            self::MODE_RAW    => 'raw',
+            default           => 'strict',
+        };
     }
 
     /**
-     * Whether the normal reader should render this body without word-wrapping
-     * (raw mode, art body) so the art keeps its own line/column layout.
+     * The sanitize policy the normal reader should apply to a message body,
+     * derived from {@see readerRenderMode()}.
      */
-    public static function readerSkipsWrap(bool $isArt): bool
+    public static function readerBodyPolicy(bool $isArt): string
     {
-        return $isArt && self::mode() === self::MODE_RAW;
+        return self::readerRenderMode($isArt) === 'strict'
+            ? TerminalTextSanitizer::POLICY_STRIP
+            : TerminalTextSanitizer::POLICY_POSITIONING;
     }
 
     /**