feat(pam): ssh session log parsing in gateway

[x032205]

Description 📣

Moves SSH session log parsing to the gateway

Type ✨

• Bug fix
• New feature
• Improvement
• Breaking change
• Documentation

---

• I have read the contributing guide, agreed and acknowledged the code of conduct. 📝

[linear]

PAM-415

[infisical-review-police]

💬 Discussion in Slack: #pr-review-cli-371-feat-pam-ssh-session-log-parsing-in-gateway

Posted by Review Police — reviews, comments, new commits, and CI failures will stream into this channel.

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 3 · PR risk: 0/10

[greptile-apps]

Greptile Summary

This PR moves SSH terminal rendering and command-echo interpretation into the gateway and marks rendered session events for downstream replay.

• Adds a stateful ANSI terminal transcript and input escape-sequence filter.
• Adds echo-aware command recording intended to avoid storing unechoed secrets.
• Converts SSH session events to display-ready text and adds the rendered event field.
• Adds terminal parsing and session-recording tests.

Confidence Score: 3/5

The PR should not merge until terminal and echo-tracking state is isolated per SSH channel, because concurrent channels can bypass secret redaction.

A single SSH connection can run multiple channel goroutines against shared input, output, and echo state, allowing one channel to alter how another channel's buffered input is classified and recorded.

Files Needing Attention: packages/pam/handlers/ssh/proxy.go, packages/pam/handlers/ssh/terminal.go

Security Review

Concurrent SSH channels share terminal and echo-tracking state, allowing channel attribution races to bypass the new echo-off redaction and record shell secrets as raw non-shell input.

Important Files Changed

Filename	Overview
packages/pam/handlers/ssh/proxy.go	Integrates gateway-side rendering and echo-aware logging, but keeps channel-sensitive parser and buffer state on the connection-wide proxy.
packages/pam/handlers/ssh/terminal.go	Adds bounded ANSI rendering and echo suppression, although its state is unsafe when shared across concurrent SSH channels.
packages/pam/handlers/ssh/terminal_test.go	Covers parsing and single-channel recording behavior but does not exercise concurrent channels on one SSH connection.
packages/pam/session/logger.go	Extends the session-event schema with a backward-compatible rendered marker.
go.mod	Adds the ANSI parser dependency and its transitive dependency updates.

_{Reviews (1): Last reviewed commit: "feat(pam): ssh session log parsing in ga..." | Re-trigger Greptile}