Console: polish + deferred items (consolidation of #89 phase tickets)

[sarg3nt]

Context

Issues #89, #120, #121, #122, #123, #124, #125 are all merged (see commits d7714b6, d924e75, 2bd772c, 8255bdd, 11f2b5d, f0c410a, 71e5be6, plus 49d18ca consolidation and 334c2e9 for #140 polish). The console works end-to-end:

• Real PTY on the host (Linux + macOS)
• ConPTY backend for Windows
• nsenter host-exec for containerized agents on Linux
• SSH bridge fallback for restricted containers
• NDJSON session recording (opt-in)
• Per-box console_enabled toggle (gate)
• Dashboard UI with multi-session tabs, drawer/dock/popout layouts, font slider, status dots
• WS TLS pinning, idle timeout, audit log

Closing the per-phase tickets in favor of this one consolidated issue tracking what's left.

Remaining items

A. Quality-of-life (small, ship together)

• Bracketed paste mode enabled in xterm by default. Today a multi-line clipboard paste can run arbitrary commands sequentially without confirmation. Bracketed paste makes the remote shell aware that input is a paste; combined with the next bullet, it gives the user a chance to abort.
• Large-paste confirm: when paste content has more than ~20 newlines, surface an inline modal "Paste 47 lines? [Cancel] [Paste]" before sending to the PTY. Standard terminal-app guardrail; cheap to add via term.attachCustomKeyEventHandler + term.onData filter.
• Search in buffer (Ctrl-F / Cmd-F). Vendor xterm-addon-search and wire to a small toolbar input. Replaces the browser's broken find-on-page behavior inside the terminal.
• Keyboard shortcut to open console from anywhere (e.g., Ctrl-Shift- `). Today the only paths are the bx-grid Tools icon and the command palette Console: <box> entries. A direct shortcut that defaults to the current box_id cookie would be faster for active operators.
• Rename tab (double-click the label, edit inline, persists for the session). Helps when you have several shells to the same box doing different things.

B. Recording playback UI

• Browse recordings: list <dataDir>/console-sessions/*.ndjson per agent, surfaced under a new Console gear or a "Recordings" subpage of an existing gear.
• Replay viewer: stream the NDJSON back through an xterm widget in playback mode (speed control, seek, jump-to-resize). Read-only — no input goes anywhere.
• Retention controls (optional): admin page to set a max-age / max-size policy. The agent itself doesn't rotate; today operators wire logrotate.

C. Container / future-Docker plumbing

• Exec-into-container session kind. The console manager already supports a kind: 'container' descriptor — adding the route + URL builder is mostly straightforward once the Docker gear lands. Out-of-band: figure out the security model (which users can exec, audit logging, whether to require Privileged: false containers, etc.).

D. Hardening / nice-to-haves

• Windows runAs / privilege drop. Today the Windows backend honors HAPROXY_AGENT_CONSOLE_SHELL but ignores runAs (the POSIX syscall.Credential{Uid:...} path has no direct ConPTY analog). Implement via STARTUPINFOEX + LogonUser if any operator asks. (No demand today.)
• Powerline-friendly defaults: ship a recommended PowerShell prompt + bash/zsh PS1 snippet in the docs so operators who want the powerline look know how to get there. The terminal already speaks the right escape sequences; this is documentation, not code.
• WSL-aware launch on Windows hosts. Defers to pwsh.exe today; could detect WSL and offer wsl.exe as the default shell.

Branching plan

One PR per work cluster. Per repo convention (and per Dave's stated preference: "fewer, larger PRs over many small split PRs"), bundle by cluster, not by checkbox:

• Cluster 1: Quality-of-life (A) — bracketed paste + paste confirm + search-in-buffer + global shortcut + rename tab. One PR.
• Cluster 2: Recording playback (B) — one PR for browse + replay; retention can land separately or together depending on scope.
• Cluster 3: Container exec (C) — lands alongside the Docker gear work.
• Cluster 4: Hardening (D) — opportunistic; doc updates batched together, Windows runAs only on operator request.

Cluster 1 first.

Closing the supplanted issues

This issue supersedes:

• #89 (umbrella — code merged across the phase tickets)
• #120, #121, #122, #123, #124, #125 (phase 1b → 3 — all merged)

Those will be closed with a back-pointer to this issue.

🤖 Generated with Claude Code