SSH and Replay

SSH & Session Replay

When the operator ssh's into a remote host, the local chain only sees the ssh command_end — everything typed afterwards belongs to the remote shell. RedLog handles this with three overlapping mechanisms:

1. Interactive ssh → pivot event

pivot-detector.ts fires a pivot event with subtype: 'interactive' and via: hostname on any plain ssh user@host (no -D/-L/-R). The timeline's pivot lane immediately shows attention moved to a remote box.

• Flag-only invocations (ssh -V, ssh -Q cipher) are filtered — they have no hostname.
• Existing detection for ssh -D/-L/-R, chisel, ligolo-ng, sshuttle, and proxychains continues to work.

2. Full-session replay (▶ Replay entire session)

Every built-in terminal pane produces an asciinema .cast file with SHA-256 stored on session_end. When you click on a shell.session_end event in the timeline, the detail panel shows a ▶ Replay entire session (from .cast) button. It reads the whole .cast from disk, ANSI-strips it, and shows the complete pty output — including everything typed after the ssh line.

Because chain integrity only depends on the SHA-256 of the .cast, the raw bytes stay on disk (bounded to 50 MB per session by default) without inflating the chain itself.

3. Per-command replay (▶ Replay stdout)

shell.command_end events grow a per-command ▶ Replay stdout button that slices the same .cast from event.timestamp - duration_sec to event.timestamp. Useful for the local pre-ssh commands where the chain already knows the command boundaries.

4. Deploying the hook to the VPS

If you want remote commands to land as first-class chain events (not just recoverable-via-replay), see VPS Deployment — a small script scp's the hook to the VPS and opens a reverse SSH tunnel so the hook can hit your local API.

Reference

• src/core/cast-slice.ts — the .cast parser and slice function.
• src/main/index.ts ipcMain.handle('terminal:replay' | 'terminal:replaySession')
• hooks/vps-deploy.sh — VPS install + tunnel automation.