feat(vm): switch ssh sessions to asciicast recording

Why:
- ttyvid needs raw PTY streams for accurate session playback
- host parsing keeps UI logs without double capture

Impact:
- writes `ssh-session-<ts>.cast` in VM logs for ttyvid
- UI lines now derived from raw stream; no `ssh-actions.ndjson`
- boot footer/help + cloud-init agent ISO handling included
- Tests: just check

Breaking:
- `ssh-actions.ndjson` is no longer generated

Author: icepuma

crates/intar-agent/src/unix.rs

@@ -210,6 +210,7 @@ fn record_command(real_shell: &str, command: &str) -> Result<i32, Box<dyn std::e
     let user = std::env::var("USER").unwrap_or_else(|_| "user".into());
     let mut sink = connect_actions_sink();
     if let Some(s) = sink.as_mut() {
+        send_cast_start_event(s, tty_size(std::io::stdout().as_raw_fd()));
         send_event(
             s,
             &ActionEvent::SshSessionStart {
@@ -219,11 +220,14 @@ fn record_command(real_shell: &str, command: &str) -> Result<i32, Box<dyn std::e
             },
         );
         if !command.is_empty() {
+            let mut input = command.to_string();
+            input.push('\n');
+            let b64 = base64::engine::general_purpose::STANDARD.encode(input.as_bytes());
             send_event(
                 s,
-                &ActionEvent::SshLine {
+                &ActionEvent::SshRawInput {
                     ts_unix_ms: unix_ms(),
-                    line: command.to_string(),
+                    data_b64: b64,
                 },
             );
         }
@@ -233,27 +237,23 @@ fn record_command(real_shell: &str, command: &str) -> Result<i32, Box<dyn std::e
     let code = output.status.code().unwrap_or(1);
 
     if let Some(s) = sink.as_mut() {
-        for line in String::from_utf8_lossy(&output.stdout).lines() {
-            if line.trim().is_empty() {
-                continue;
-            }
+        if !output.stdout.is_empty() {
+            let b64 = base64::engine::general_purpose::STANDARD.encode(&output.stdout);
             send_event(
                 s,
-                &ActionEvent::SshOutput {
+                &ActionEvent::SshRawOutput {
                     ts_unix_ms: unix_ms(),
-                    line: line.to_string(),
+                    data_b64: b64,
                 },
             );
         }
-        for line in String::from_utf8_lossy(&output.stderr).lines() {
-            if line.trim().is_empty() {
-                continue;
-            }
+        if !output.stderr.is_empty() {
+            let b64 = base64::engine::general_purpose::STANDARD.encode(&output.stderr);
             send_event(
                 s,
-                &ActionEvent::SshOutput {
+                &ActionEvent::SshRawOutput {
                     ts_unix_ms: unix_ms(),
-                    line: line.to_string(),
+                    data_b64: b64,
                 },
             );
         }
@@ -285,6 +285,10 @@ fn record_ssh(real_shell: &str) -> Result<i32, Box<dyn std::error::Error>> {
     close(slave_fd).ok();
 
     let (tx, writer_thread) = start_actions_event_stream();
+    send_cast_start(
+        &tx,
+        tty_size(stdout.as_raw_fd()).or_else(|| tty_size(stdin.as_raw_fd())),
+    );
     send_session_start(&tx);
 
     let proxy_result = proxy_pty_session(master_fd, &tx);
@@ -369,11 +373,6 @@ fn proxy_pty_session(
     let master_borrowed = unsafe { BorrowedFd::borrow_raw(master_fd) };
 
     let mut buf = [0u8; 4096];
-    let mut line = String::new();
-    let mut input_escape = false;
-    let mut output_line = String::new();
-    let mut output_escape = false;
-
     loop {
         let mut fds = [
             PollFd::new(stdin_borrowed, PollFlags::POLLIN),
@@ -392,7 +391,11 @@ fn proxy_pty_session(
                 Ok(n) => {
                     stdout.write_all(&buf[..n])?;
                     stdout.flush()?;
-                    derive_lines_from_output(&buf[..n], &mut output_line, &mut output_escape, tx);
+                    let b64 = base64::engine::general_purpose::STANDARD.encode(&buf[..n]);
+                    let _ = tx.send(ActionEvent::SshRawOutput {
+                        ts_unix_ms: unix_ms(),
+                        data_b64: b64,
+                    });
                 }
                 Err(Errno::EINTR) => {}
                 Err(e) => return Err(e.into()),
@@ -411,23 +414,13 @@ fn proxy_pty_session(
                         ts_unix_ms: unix_ms(),
                         data_b64: b64,
                     });
-
-                    derive_lines_from_input(chunk, &mut line, &mut input_escape, tx);
                 }
                 Err(Errno::EINTR) => {}
                 Err(e) => return Err(e.into()),
             }
         }
     }
 
-    let trimmed = output_line.trim();
-    if !trimmed.is_empty() && !is_prompt_line(trimmed) {
-        let _ = tx.send(ActionEvent::SshOutput {
-            ts_unix_ms: unix_ms(),
-            line: trimmed.to_string(),
-        });
-    }
-
     Ok(())
 }
 
@@ -438,107 +431,16 @@ fn is_fd_readable(fd: &PollFd<'_>) -> bool {
         || revents.contains(PollFlags::POLLERR)
 }
 
-fn derive_lines_from_input(
-    chunk: &[u8],
-    line: &mut String,
-    in_escape: &mut bool,
-    tx: &std::sync::mpsc::Sender<ActionEvent>,
-) {
-    for &b in chunk {
-        if *in_escape {
-            if (b as char).is_ascii_alphabetic() || b == b'~' {
-                *in_escape = false;
-            }
-            continue;
-        }
-
-        match b {
-            0x1b => {
-                *in_escape = true;
-            }
-            b'\r' | b'\n' => {
-                let trimmed = line.trim();
-                if !trimmed.is_empty() {
-                    let _ = tx.send(ActionEvent::SshLine {
-                        ts_unix_ms: unix_ms(),
-                        line: trimmed.to_string(),
-                    });
-                }
-                line.clear();
-            }
-            0x7f | 0x08 => {
-                let _ = line.pop();
-            }
-            b'\t' => line.push('\t'),
-            b if b.is_ascii_graphic() || b == b' ' => line.push(char::from(b)),
-            _ => {}
-        }
-    }
-}
-
-fn derive_lines_from_output(
-    chunk: &[u8],
-    line: &mut String,
-    in_escape: &mut bool,
-    tx: &std::sync::mpsc::Sender<ActionEvent>,
-) {
-    for &b in chunk {
-        if *in_escape {
-            if (b as char).is_ascii_alphabetic() || b == b'~' {
-                *in_escape = false;
-            }
-            continue;
-        }
-
-        match b {
-            0x1b => {
-                *in_escape = true;
-            }
-            b'\r' | b'\n' => {
-                let trimmed = line.trim();
-                if !trimmed.is_empty() && !is_prompt_line(trimmed) {
-                    let _ = tx.send(ActionEvent::SshOutput {
-                        ts_unix_ms: unix_ms(),
-                        line: trimmed.to_string(),
-                    });
-                }
-                line.clear();
-            }
-            0x7f | 0x08 => {
-                let _ = line.pop();
-            }
-            b'\t' => line.push('\t'),
-            b if b.is_ascii_graphic() || b == b' ' => line.push(char::from(b)),
-            _ => {}
-        }
-    }
-}
-
-fn is_prompt_line(line: &str) -> bool {
-    let trimmed = line.trim();
-    if trimmed.is_empty() {
-        return false;
-    }
-
-    if trimmed == "$" || trimmed == "#" {
-        return true;
-    }
-
-    let mut pos = trimmed.rfind('$');
-    if pos.is_none() {
-        pos = trimmed.rfind('#');
-    }
-
-    let Some(pos) = pos else {
-        return false;
-    };
-
-    if !trimmed[pos + 1..].starts_with(' ') && !trimmed[pos + 1..].is_empty() {
-        return false;
-    }
-
-    let prefix = &trimmed[..pos];
-    prefix.contains('@') && prefix.contains(':')
+fn send_cast_start_event(stream: &mut UnixStream, size: Option<(u16, u16)>) {
+    let (width, height) = size.unwrap_or((80, 24));
+    send_event(
+        stream,
+        &ActionEvent::SshCastStart {
+            ts_unix_ms: unix_ms(),
+            width,
+            height,
+        },
+    );
 }
 
 fn write_all_fd(fd: BorrowedFd<'_>, mut data: &[u8]) -> Result<(), Errno> {
@@ -588,6 +490,15 @@ fn send_session_start(tx: &std::sync::mpsc::Sender<ActionEvent>) {
     });
 }
 
+fn send_cast_start(tx: &std::sync::mpsc::Sender<ActionEvent>, size: Option<(u16, u16)>) {
+    let (width, height) = size.unwrap_or((80, 24));
+    let _ = tx.send(ActionEvent::SshCastStart {
+        ts_unix_ms: unix_ms(),
+        width,
+        height,
+    });
+}
+
 fn send_session_end(tx: &std::sync::mpsc::Sender<ActionEvent>, exit_code: i32) {
     let _ = tx.send(ActionEvent::SshSessionEnd {
         ts_unix_ms: unix_ms(),
@@ -637,6 +548,22 @@ fn is_tty(fd: RawFd) -> bool {
     unsafe { nix::libc::isatty(fd) == 1 }
 }
 
+fn tty_size(fd: RawFd) -> Option<(u16, u16)> {
+    let mut size = nix::libc::winsize {
+        ws_row: 0,
+        ws_col: 0,
+        ws_xpixel: 0,
+        ws_ypixel: 0,
+    };
+
+    let res = unsafe { nix::libc::ioctl(fd, nix::libc::TIOCGWINSZ, &mut size) };
+    if res == -1 || size.ws_row == 0 || size.ws_col == 0 {
+        return None;
+    }
+
+    Some((size.ws_col, size.ws_row))
+}
+
 fn to_io_err(e: nix::Error) -> std::io::Error {
     std::io::Error::other(e.to_string())
 }

crates/intar-probes/src/actions.rs

@@ -3,6 +3,11 @@ use serde::{Deserialize, Serialize};
 #[derive(Clone, Debug, Serialize, Deserialize)]
 #[serde(tag = "type", rename_all = "snake_case")]
 pub enum ActionEvent {
+    SshCastStart {
+        ts_unix_ms: u64,
+        width: u16,
+        height: u16,
+    },
     SshSessionStart {
         ts_unix_ms: u64,
         user: String,
@@ -12,6 +17,10 @@ pub enum ActionEvent {
         ts_unix_ms: u64,
         data_b64: String,
     },
+    SshRawOutput {
+        ts_unix_ms: u64,
+        data_b64: String,
+    },
     SshLine {
         ts_unix_ms: u64,
         line: String,

crates/intar-ui/src/app.rs

@@ -1,6 +1,6 @@
 use crate::widgets::{
-    BriefingScreen, CompletedScreen, ConfirmDialog, HelpOverlay, ProbeStatus, ScenarioTreeScreen,
-    VmStatus, VmTreeNode, VmTreeProbe,
+    BriefingScreen, CompletedScreen, ConfirmDialog, HelpMode, HelpOverlay, ProbeStatus,
+    ScenarioTreeScreen, VmStatus, VmTreeNode, VmTreeProbe,
 };
 use crate::{ColorLevel, Theme, ThemeMode, ThemeSettings};
 use crossterm::{
@@ -470,6 +470,9 @@ impl App {
         let is_ctrl = key.modifiers.contains(KeyModifiers::CONTROL);
 
         if self.is_briefing_phase() {
+            if self.handle_overlay_toggles(key) {
+                return Ok(false);
+            }
             if Self::should_quit(key, is_ctrl) {
                 self.initiate_shutdown(terminal).await?;
                 return Ok(true);
@@ -1018,7 +1021,17 @@ impl App {
         }
 
         if self.flags.show_help {
-            let help = HelpOverlay { theme: &self.theme };
+            let mode = if self.is_briefing_phase() {
+                HelpMode::Briefing
+            } else if matches!(self.phase, AppPhase::Completed) {
+                HelpMode::Completed
+            } else {
+                HelpMode::Running
+            };
+            let help = HelpOverlay {
+                theme: &self.theme,
+                mode,
+            };
             f.render_widget(help, area);
         }
     }

crates/intar-ui/src/colors.rs

@@ -1,17 +1,16 @@
+use crossterm::terminal::is_raw_mode_enabled;
 use crossterm::tty::IsTty;
 use ratatui::style::Color;
 use std::env;
 use std::io;
-
-#[cfg(unix)]
-use std::io::Write;
 use std::time::Duration;
 
 #[cfg(unix)]
-use std::time::Instant;
-
+use std::io::Write;
 #[cfg(unix)]
 use std::thread::sleep;
+#[cfg(unix)]
+use std::time::Instant;
 
 #[cfg(unix)]
 use nix::fcntl::{FcntlArg, OFlag, fcntl};
@@ -312,12 +311,14 @@ fn palette_light_ansi16() -> ThemePalette {
 }
 
 fn detect_theme_mode() -> Option<ThemeMode> {
-    if !io::stdin().is_tty() || !io::stdout().is_tty() {
+    if !io::stdout().is_tty() {
         return None;
     }
 
-    if let Some(rgb) =
-        query_osc_11(Duration::from_millis(120)).and_then(|resp| parse_rgb_response(&resp))
+    if io::stdin().is_tty()
+        && is_raw_mode_enabled().unwrap_or(false)
+        && let Some(rgb) =
+            query_osc_11(Duration::from_millis(200)).and_then(|resp| parse_rgb_response(&resp))
     {
         let luminance =
             (0.2126 * f64::from(rgb.0) + 0.7152 * f64::from(rgb.1) + 0.0722 * f64::from(rgb.2))