Shell: the console's commands on the device's own screen and keyboard (#67)

An App in the Launcher that runs the same commands as USB serial and the
Debug Console, trusted like the first. It shows what the console prints
while it is open, through a second ring of the console's that exists only
meanwhile; Ctrl+b keeps only what follows your own commands. Tab completes
a command's name from the firmware's help text, Fn with up and down recalls
earlier lines, Alt with up and down scrolls back. `rm` asks first in the
Shell, `rm -f` doesn't. Nothing is kept once the App is left.

`screenshot [seconds]` saves the screen as a PNG in /screenshots on the
card, now or after a pause: written a row at a time, indexed colour with
RGB332 as the palette, in one stored deflate block.

487 host tests (11 new: the PNG writer, the Shell's log filter, Tab).
Checked on the device over the Debug Console: commands, Tab, history, a
screenshot fetched and decoded on the PC, rm with and without the question,
a delayed screenshot of another screen. 12 KB of flash; 7 KB of heap while
open. Decisions Q204 to Q212 in docs/milestones/S1.md. Safe Mode: #77.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EhqxQ49eCju4CzKYNjZzwT

src/main.cpp

@@ -7,7 +7,9 @@
 #include <memory>
 
 #include "app_manager.h"
+#include "png_rgb332.h"
 #include "apps/demo_app.h"
+#include "apps/shell_app.h"
 #include "apps/gemini_app.h"
 #include "apps/gnss_app.h"
 #include "apps/irc_app.h"
@@ -151,6 +153,8 @@ extern "C" bool verifyRollbackLater() { return true; }  // C linkage, or the wea
 size_t getArduinoLoopTaskStackSize() { return 6144; }
 
 static void setupSafeMode(int crashes);
+static const char* helpText();
+static void shellRun(const std::string& line);
 
 void setup() {
     nvs.begin();
@@ -209,6 +213,7 @@ void setup() {
     apps->registerApp({"lora", "LoRa Scanner", false, new LoraScannerApp(*radioService, *loraCapture, settings, *clockService)});
     apps->registerApp({"storage", "Storage", false, new StorageApp(*fileOps, *storageService, *clockService, *update, *power, bus)});
     apps->registerApp({"notes", "Notes", false, new NotesApp(*fileOps, *storageService, *clockService, *power)});
+    apps->registerApp({"shell", "Shell", false, new ShellApp(shellRun, helpText(), *apps)});
     // Leaving the foreground App makes it save: a note being typed, when the device is powered off.
     power->beforePowerOff = []() { apps->home(); };
     apps->registerApp({"system", "System", false,
@@ -553,10 +558,11 @@ static const char* const kHelp =
     "reboot            restart\n"
     "boot other        restart into the other app slot (manual Rollback)\n"
     "log level <0-5>   ESP-IDF log level (0 none ... 5 verbose)\n"
-    "ls [folder] | du <path> | mkdir <path> | rm <path> | cp [-f] <from> <to> | mv [-f] <from> <to> | cancel   the SD card, with the Storage App's rules\n"
+    "ls [folder] | du <path> | mkdir <path> | rm [-f] <path> | cp [-f] <from> <to> | mv [-f] <from> <to> | cancel   the SD card, with the Storage App's rules\n"
+    "screenshot [seconds]   the screen as a PNG in /screenshots on the card, now or after a pause\n"
     "lora probe | lora status | lora rx on|off | lora preset <name>   the LoRa radio, receive only\n"
     "lora capture start|stop   a LoRa Capture to /captures/lora (pcap, LoRaTap)\n"
-    "lora sweep on [from MHz] [to MHz] [step kHz] | off | dump   RSSI across a band (863 870 100)\n"
+    "lora sweep on [from MHz] [to MHz] [step kHz] | lora sweep off | lora sweep dump   RSSI across a band (863 870 100)\n"
     "lora custom <MHz> <BW kHz> <SF> <CR 5-8> <sync hex> [preamble]   e.g. 868.1 125 7 5 34 8 (LoRaWAN)\n"
     "gnss quiet on|off   pause the GNSS receiver while the LoRa radio listens (it costs the radio 8 dB)\n"
     "gnss status | gnss restart | gnss track start|stop | gnss nmea on|off | gnss send <sentence without $ and checksum>\n"
@@ -569,7 +575,7 @@ static const char* const kHelp =
     "gemini get <url>  fetch a Gemini page and report header, size, certificate, heap\n"
     "irc start | irc stop | irc dump | irc say <buffer> <text>\n"
     "install <path.ota>   Update from SD\n"
-    "update check | list | status | install <tag>   the project's releases on Gitea\n"
+    "update check | update list | update status | update install <tag>   the project's releases on Gitea\n"
     "sd card | sd list | cat <path> | log <text> | burst | sound on|off | short | normal\n"
     "debug status | debug off [seconds]   the Debug Console over Wi-Fi (Settings > Debug Console); with seconds, it comes back\n"
     "debug on | debug token <16 to 64 characters> | debug token new   (USB serial only) switch it on, set its token\n"
@@ -581,10 +587,61 @@ static const char* const kHelp =
     "sd fill <folder> <count>   makes that many small files there, to test a crowded folder\n"
     "coredump get      (Debug Console only) send the raw core dump: use scripts/rdbg.py coredump\n"
     "reset             (Debug Console only) restart at once, even if the main loop is stuck\n"
-    "get <path> | put <path> <size> <sha256> | screenshot   (Debug Console only) binary, see rdbg.py\n"
+    "get <path> | put <path> <size> <sha256> | screenshot   (Debug Console only) binary, see rdbg.py: there, a bare `screenshot` sends the screen instead of saving it\n"
     "quit              close the Debug Console connection\n"
     ;
 
+static const char* helpText() { return kHelp; }
+
+// `screenshot [seconds]` (issue #67, Q209): the frame as it is composed, as a PNG on the card. The
+// pause is for getting to the screen you want: from the Shell, "now" is always the Shell.
+static bool shotPending = false;
+static uint32_t shotDueMs = 0;
+static std::atomic<bool> shotSaved{false};
+
+static void saveScreenshot() {
+    if (!storageService || !storageService->state().present) return (void)console.println("screenshot: error no SD card");
+    char name[40];
+    int64_t now = clockService ? clockService->utcNow() : -1;
+    if (now >= 0) {
+        time_t t = static_cast<time_t>(now);
+        struct tm local;
+        localtime_r(&t, &local);
+        snprintf(name, sizeof name, "/screenshots/%04d%02d%02d-%02d%02d%02d.png", local.tm_year + 1900, local.tm_mon + 1, local.tm_mday,
+                 local.tm_hour, local.tm_min, local.tm_sec);
+    } else snprintf(name, sizeof name, "/screenshots/shot-%lu.png", (unsigned long)(millis() / 1000));  // no clock yet
+    std::string path = name;
+    storageService->runJob([path]() {
+        Canvas& frame = screen.canvas();
+        const uint8_t* pixels = static_cast<const uint8_t*>(frame.getBuffer());
+        int w = frame.width(), h = frame.height();
+        if (!pixels) return (void)console.println("screenshot: error no frame");
+        if (!SD.exists("/screenshots")) SD.mkdir("/screenshots");
+        File f = SD.open(path.c_str(), FILE_WRITE);
+        if (!f) return (void)console.printf("screenshot: error the card refused to make %s\n", path.c_str());
+        png::Rgb332Writer writer(w, h, [&f](const uint8_t* data, size_t len) { return f.write(data, len) == len; });
+        bool ok = writer.begin();
+        for (int y = 0; ok && y < h; y++) ok = writer.row(pixels + y * w);  // read as it stands: it may tear
+        ok = ok && writer.end();
+        f.close();
+        if (!ok) {
+            SD.remove(path.c_str());
+            return (void)console.println("screenshot: error the card refused a write");
+        }
+        console.printf("screenshot: saved %s (%u bytes)\n", path.c_str(), (unsigned)png::Rgb332Writer::fileSize(w, h));
+        shotSaved = true;  // the main loop says so on the screen, after the picture is taken
+    });
+}
+
+static void screenshotStep() {
+    if (shotPending && static_cast<int32_t>(millis() - shotDueMs) >= 0) {
+        shotPending = false;
+        saveScreenshot();
+    }
+    if (shotSaved.exchange(false))
+        bus.publish(Event::withText(EventType::Notification, "Screenshot saved in /screenshots", static_cast<int32_t>(NotificationLevel::Info)));
+}
+
 // Commands that only touch what Safe Mode starts.
 static bool safeModeCommand(const String& line) {
     return line == "help" || line == "info" || line == "tasks" || line == "net" || line == "reboot" || line == "boot other" ||
@@ -640,6 +697,16 @@ static void runCommand(String line, bool fromSerial = false) {
     if (safeMode && !safeModeCommand(line)) return (void)console.println("not available in Safe Mode");
     if (line == "help") console.print(kHelp);
     if (line.startsWith("debug ")) return debugCommand(line.substring(6), fromSerial);
+    if (line == "screenshot" || line.startsWith("screenshot ")) {
+        uint32_t seconds = constrain(line.substring(10).toInt(), 0, 60);
+        shotPending = true;
+        shotDueMs = millis() + seconds * 1000;
+        if (seconds) console.printf("screenshot: in %lu s\n", (unsigned long)seconds);
+        return;
+    }
+    // Over the Debug Console these never get here: its own task answers them.
+    if (line == "coredump get" || line == "reset" || line.startsWith("get ") || line.startsWith("put "))
+        return (void)console.println("Debug Console only: scripts/rdbg.py speaks it");
     if (line == "info") {
         system_info::printSystem(console);
         console.printf("wifi: %s, ip %s, rssi %d | sd: %s, %u write faults\n", wifi->ssid().c_str(), wifi->ip().c_str(),
@@ -1009,6 +1076,14 @@ static void runCommand(String line, bool fromSerial = false) {
     }
 }
 
+// What the Shell App runs (issue #67): trusted like USB serial (Q205), and echoed into the console so
+// that a session reads the same from afar, except a token being set (Q210).
+static void shellRun(const std::string& line) {
+    String l = line.c_str();
+    if (!l.startsWith("debug token ") || l == "debug token new") console.printf("> %s\n", line.c_str());
+    runCommand(l, true);
+}
+
 static void serialCommands() {
     if (upload.active()) return readUploadBytes();  // raw file bytes, not commands
     static String line;
@@ -1098,6 +1173,7 @@ static void loopPass() {
     serialCommands();
     remoteCommands();
     tasksStep();
+    screenshotStep();
     ipTrialStep();
     if (noiseTest) noiseTest->step(now);
     noteStableOnce(now);