⚡ OxideTerm

Zero Electron. Zero OpenSSL. Zero Telemetry. Zero Subscription. Pure Rust SSH.
One native binary — local shells, SSH, SFTP, remote IDE, AI, port forwarding, plugins, 30+ themes, 11 languages.

🌐 oxideterm.app — Documentation & website

English | 简体中文 | 繁體中文 | 日本語 | 한국어 | Français | Deutsch | Español | Italiano | Português | Tiếng Việt

SSH Terminal + OxideSens AI	SFTP File Manager
Built-in IDE (CodeMirror 6)	Smart Port Forwarding

OxideTerm separates terminal data from control commands into two independent planes:

┌─────────────────────────────────────┐
│        Frontend (React 19)          │
│  xterm.js 6 (WebGL) + 19 stores     │
└──────────┬──────────────┬───────────┘
           │ Tauri IPC    │ WebSocket (binary)
           │ (JSON)       │ per-session port
┌──────────▼──────────────▼───────────┐
│         Backend (Rust)              │
│  NodeRouter → SshConnectionRegistry │
│  Wire Protocol v1                   │
│  [Type:1][Length:4][Payload:n]      │
└─────────────────────────────────────┘

• Data plane (WebSocket): each SSH session gets its own WebSocket port. Terminal bytes flow as binary frames with a Type-Length-Payload header — no JSON serialization, no Base64 encoding, zero overhead in the hot path.
• Control plane (Tauri IPC): connection management, SFTP ops, forwarding, config — structured JSON, but off the critical path.
• Node-first addressing: the frontend never touches sessionId or connectionId. Everything is addressed by nodeId, resolved atomically server-side by the NodeRouter. SSH reconnect changes the underlying connectionId — but SFTP, IDE, and forwards are completely unaffected.

The entire SSH stack is russh 0.59 compiled against the ring crypto backend:

• Zero C/OpenSSL dependencies — the full crypto stack is Rust. No more "which OpenSSL version?" debugging.
• Full SSH2 protocol: key exchange, channels, SFTP subsystem, port forwarding
• ChaCha20-Poly1305 and AES-GCM cipher suites, Ed25519/RSA/ECDSA keys
• Custom AgentSigner: wraps system SSH Agent and satisfies russh's Signer trait, solving RPITIT Send bound issues by cloning &AgentIdentity to an owned value before crossing .await

pub struct AgentSigner { /* wraps system SSH Agent */ }
impl Signer for AgentSigner { /* challenge-response via Agent IPC */ }

• Platform support: Unix (SSH_AUTH_SOCK), Windows (\\.\pipe\openssh-ssh-agent)
• Proxy chains: each hop independently uses Agent auth
• Reconnect: AuthMethod::Agent replayed automatically

Most SSH clients kill everything on disconnect and start fresh. OxideTerm's reconnect orchestrator takes a fundamentally different approach:

1. Detect WebSocket heartbeat timeout (300s, tuned for macOS App Nap and JS timer throttling)
2. Snapshot full state: terminal panes, in-flight SFTP transfers, active port forwards, open IDE files
3. Intelligent probing: visibilitychange + online events trigger proactive SSH keepalive (~2s detection vs 15-30s passive timeout)
4. Grace Period (30s): probe the old SSH connection via keepalive — if it recovers (e.g., WiFi AP switch), your TUI apps (vim, htop, yazi) survive completely untouched
5. If recovery fails → new SSH connection → auto-restore forwards → resume SFTP transfers → reopen IDE files

Pipeline: queued → snapshot → grace-period → ssh-connect → await-terminal → restore-forwards → resume-transfers → restore-ide → verify → done

All logic runs through a dedicated ReconnectOrchestratorStore — zero reconnect code scattered in hooks or components.

Reference-counted SshConnectionRegistry backed by DashMap for lock-free concurrent access:

• One connection, many consumers: terminal, SFTP, port forwards, and IDE share a single physical SSH connection — no redundant TCP handshakes
• State machine per connection: connecting → active → idle → link_down → reconnecting
• Lifecycle management: configurable idle timeout (5m / 15m / 30m / 1h / never), 15s keepalive interval, heartbeat failure detection
• WsBridge heartbeat: 30s interval, 5 min timeout — tolerates macOS App Nap and browser JS throttling
• Cascade propagation: jump host failure → all downstream nodes automatically marked link_down with status sync
• Idle disconnect: emits connection_status_changed to frontend (not just internal node:state), preventing UI desync

Privacy-first AI assistant with dual interaction modes:

• Inline panel (⌘I): quick terminal commands, output injected via bracketed paste
• Sidebar chat: persistent conversations with full history
• Context capture: Terminal Registry gathers buffer from active pane or all split panes simultaneously; auto-injects IDE files, SFTP paths, and Git status
• 40+ autonomous tools: file operations, process management, network diagnostics, TUI app interaction, text processing — the AI invokes these without manual triggering
• MCP support: connect external Model Context Protocol servers (stdio & SSE) for third-party tool integration
• RAG Knowledge Base (v0.20): import Markdown/TXT documents into scoped collections (global or per-connection). Hybrid search fuses BM25 keyword index + vector cosine similarity via Reciprocal Rank Fusion. Markdown-aware chunking preserves heading hierarchy. CJK bigram tokenizer for Chinese/Japanese/Korean.
• Providers: OpenAI, Ollama, DeepSeek, OneAPI, or any /v1/chat/completions endpoint
• Security: API keys stored in OS keychain; on macOS, key reads gated behind Touch ID via LAContext — no entitlements or code-signing required, cached after first auth per session

CodeMirror 6 editor operating over SFTP — no server-side installation required by default:

• File tree: lazy-loaded directories with Git status indicators (modified/untracked/added)
• 24 language modes: 14 native CodeMirror + 10 legacy modes via @codemirror/legacy-modes
• Conflict resolution: optimistic mtime locking — detects remote changes before overwriting
• Event-driven Git: auto-refresh on save, create, delete, rename, and terminal Enter keypress
• State Gating: all IO blocked when readiness !== 'ready', Key-Driven Reset forces full remount on reconnect
• Remote agent (optional): ~1 MB Rust binary, auto-deployed on x86_64/aarch64 Linux. Other architectures must build the agent from source and upload it manually. Enables enhanced file tree, symbol search, and file watching.

Full local (-L), remote (-R), and dynamic SOCKS5 (-D) forwarding:

• Message-passing architecture: SSH Channel owned by a single ssh_io task — no Arc<Mutex<Channel>>, eliminating mutex contention entirely
• Death reporting: forward tasks actively report exit reason (SSH disconnect, remote port close, timeout) for clear diagnostics
• Auto-restore: Suspended forwards automatically resume on reconnect without user intervention
• Idle timeout: FORWARD_IDLE_TIMEOUT (300s) prevents zombie connections from accumulating

Dynamic ESM loading with a security-hardened, frozen API surface:

• PluginContext API: 8 namespaces — terminal, ui, commands, settings, lifecycle, events, storage, system
• 24 UI Kit components: pre-built React components (buttons, inputs, dialogs, tables…) injected into plugin sandboxes via window.__OXIDE__
• Security membrane: Object.freeze on all context objects, Proxy-based ACL, IPC whitelist, circuit breaker with auto-disable after repeated errors
• Shared modules: React, ReactDOM, zustand, lucide-react exposed for plugin use without bundling duplicates

Three-tier render scheduler that replaces fixed requestAnimationFrame batching:

Transitions are fully automatic — driven by data volume, user input, and Page Visibility API. Background tabs continue flushing data via idle timer without waking RAF.

Portable, tamper-proof connection backup:

• ChaCha20-Poly1305 AEAD authenticated encryption
• Argon2id KDF: 256 MB memory cost, 4 iterations — GPU brute-force resistant
• SHA-256 integrity checksum
• Optional key embedding: private keys base64-encoded into the encrypted payload
• Pre-flight analysis: auth type breakdown, missing key detection before export

• Unlimited chain depth: Client → Jump A → Jump B → … → Target
• Auto-parse ~/.ssh/config, build topology graph, Dijkstra pathfinding for optimal route
• Jump nodes reusable as independent sessions
• Cascade failure propagation: jump host down → all downstream nodes auto-marked link_down

Cross-platform local shell via portable-pty 0.8, feature-gated behind local-terminal:

• MasterPty wrapped in std::sync::Mutex — dedicated I/O threads keep blocking PTY reads off the Tokio event loop
• Shell auto-detection: zsh, bash, fish, pwsh, Git Bash, WSL2
• cargo build --no-default-features strips PTY for mobile/lightweight builds

• Native ConPTY: directly invokes Windows Pseudo Console API — full TrueColor and ANSI support, no legacy WinPTY
• Shell scanner: auto-detects PowerShell 7, Git Bash, WSL2, CMD via Registry and PATH

• Resource profiler: live CPU/memory/network via persistent SSH channel reading /proc/stat, delta-based calculation, auto-degrades to RTT-only on non-Linux
• Custom theme engine: 31 built-in themes, visual editor with live preview, 20 xterm.js fields + 24 UI color variables, auto-derive UI colors from terminal palette
• Session recording: asciicast v2 format, full record and playback
• Broadcast input: type once, send to all split panes — batch server operations
• Background gallery: per-tab background images, 16 tab types, opacity/blur/fit control
• CLI companion (oxt): ~1 MB binary, JSON-RPC 2.0 over Unix Socket / Named Pipe, status/health/list/session inspect/forward/config/connect/focus/attach/SFTP/import/AI with human or --json output
• WSL Graphics ⚠️ experimental: built-in VNC viewer — 9 desktop environments + single-app mode, WSLg detection, Xtigervnc + noVNC

📸 11 languages in action

English	简体中文	繁體中文
日本語	한국어	Français
Deutsch	Español	Italiano
Português	Tiếng Việt

Download the latest release from GitHub Releases.

OxideTerm supports a fully self-contained portable mode — all data (connections, secrets, settings) is stored beside the application binary, making it suitable for USB drives or air-gapped environments.

Option A — Marker file (simplest): create an empty file named portable (no extension) next to the app.

/my-usb/
├── OxideTerm.app   (or .exe / .AppImage)
├── portable        ← empty file you create
└── data/           ← created automatically on first launch

Option B — portable.json (custom data directory): place a portable.json in the same location:

{
  "enabled": true,
  "dataDir": "my-data"
}

• enabled defaults to true if omitted
• dataDir must be a relative path (no ..); defaults to data if omitted

1. First launch — a bootstrap screen prompts you to create a portable password. This password encrypts a local keystore (ChaCha20-Poly1305 + Argon2id) that protects all saved secrets.
2. Subsequent launches — enter the password to unlock. On macOS with Touch ID, you can optionally bind biometric unlock in Settings → General → Portable Runtime.
3. Instance lock — only one OxideTerm instance can use a portable data directory at a time (data/.portable.lock).
4. Management — change the portable password or toggle biometric unlock in Settings → General → Portable Runtime.
5. Portability — copy the entire folder (app + portable marker + data/) to another machine. The password travels with the keystore.

• Rust 1.85+
• Node.js 18+ (pnpm recommended)
• Platform tools:
  • macOS: Xcode Command Line Tools
  • Windows: Visual Studio C++ Build Tools
  • Linux: build-essential, libwebkit2gtk-4.1-dev, libssl-dev

git clone https://github.com/AnalyseDeCircuit/oxideterm.git
cd oxideterm && pnpm install

# Build CLI companion (required for CLI features)
pnpm cli:build

# Full app (frontend + Rust backend with hot reload)
pnpm run tauri dev

# Frontend only (Vite on port 1420)
pnpm dev

# Production build
pnpm run tauri build

• SSH Agent forwarding
• Full ProxyCommand support
• Audit logging
• Agent enhancements
• Quick commands
• Session search & quick-switch

GPL-3.0 — this software is free software licensed under the GNU General Public License v3.0.

You are free to use, modify, and distribute this software under the terms of the GPL-3.0. Any derivative work must also be distributed under the same license.

Full text: GNU General Public License v3.0

russh · portable-pty · Tauri · xterm.js · CodeMirror · Radix UI

_{271,000+ lines of Rust & TypeScript — built with ⚡ and ☕}