Oxideterm

<p align="center"> <img src="src-tauri/icons/icon.ico" alt="OxideTerm" width="128" height="128"> </p> <h1 align="center">⚡ OxideTerm</h1> <p align="center"> <a href="https://github.com/AnalyseDeCircuit/oxideterm/stargazers"> <img src="https://img.shields.io/github/stars/AnalyseDeCircuit/oxideterm?style=social" alt="GitHub stars"> </a> <br> <em>If you like OxideTerm, please consider giving it a star on GitHub! ⭐️</em> </p> <p align="center"> <strong>Zero Electron. Zero OpenSSL. Pure Rust SSH.</strong> <br> <em>One native binary — local shells, SSH, SFTP, remote IDE, AI, port forwarding, plugins, 30+ themes, 11 languages.</em> </p> <p align="center"> <img src="https://img.shields.io/badge/version-1.0.11-blue" alt="Version"> <img src="https://img.shields.io/badge/platform-macOS%20%7C%20Windows%20%7C%20Linux-blue" alt="Platform"> <img src="https://img.shields.io/badge/license-GPL--3.0-blue" alt="License"> <img src="https://img.shields.io/badge/rust-1.75+-orange" alt="Rust"> <img src="https://img.shields.io/badge/tauri-2.0-purple" alt="Tauri"> </p> <p align="center"> <a href="https://github.com/AnalyseDeCircuit/oxideterm/releases/latest"> <img src="https://img.shields.io/github/v/release/AnalyseDeCircuit/oxideterm?label=Download%20Latest&style=for-the-badge&color=brightgreen" alt="Download Latest Release"> </a> </p> <p align="center"> 🌐 <strong><a href="https://oxideterm.app">oxideterm.app</a></strong> — Documentation & website </p> <p align="center"> <a href="README.md">English</a> | <a href="docs/readme/README.zh-Hans.md">简体中文</a> | <a href="docs/readme/README.zh-Hant.md">繁體中文</a> | <a href="docs/readme/README.ja.md">日本語</a> | <a href="docs/readme/README.ko.md">한국어</a> | <a href="docs/readme/README.fr.md">Français</a> | <a href="docs/readme/README.de.md">Deutsch</a> | <a href="docs/readme/README.es.md">Español</a> | <a href="docs/readme/README.it.md">Italiano</a> | <a href="docs/readme/README.pt-BR.md">Português</a> | <a href="docs/readme/README.vi.md">Tiếng Việt</a> </p>

[!NOTE] License Change: Starting from v1.0.0, OxideTerm has changed its license from PolyForm Noncommercial 1.0.0 to GPL-3.0 (GNU General Public License v3.0). This means OxideTerm is now fully open source — you are free to use, modify, and distribute it under the terms of the GPL-3.0 license. See the LICENSE file for details.

---

<div align="center">

https://github.com/user-attachments/assets/4ba033aa-94b5-4ed4-980c-5c3f9f21db7e

🤖 OxideSens AI — "Open a local terminal and run echo hello, world!"

</div>

---

Why OxideTerm?

| Pain Point | OxideTerm's Answer | |---|---| | SSH clients that can't do local shells | Hybrid engine: local PTY (zsh/bash/fish/pwsh/WSL2) + remote SSH in one window | | Reconnect = lose everything | Grace Period reconnect: probes old connection 30s before killing it — your vim/htop/yazi survive | | Remote file editing needs VS Code Remote | Built-in IDE: CodeMirror 6 over SFTP with 30+ languages, optional ~1 MB remote agent on Linux | | No SSH connection reuse | Multiplexing: terminal, SFTP, forwards, IDE share one SSH connection via reference-counted pool | | SSH libraries depend on OpenSSL | russh 0.54: pure Rust SSH compiled against ring — zero C dependencies | | 100+ MB Electron apps | Tauri 2.0: native Rust backend, 25–40 MB binary | | AI locked to one provider | OxideSens: 40+ tools, MCP protocol, RAG knowledge base — works with OpenAI/Ollama/DeepSeek/any compatible API |

---

Screenshots

<table> <tr> <td align="center"><strong>SSH Terminal + OxideSens AI</strong><br/><br/><img src="docs/screenshots/terminal/SSHTERMINAL.png" alt="SSH Terminal with OxideSens AI sidebar" /></td> <td align="center"><strong>SFTP File Manager</strong><br/><br/><img src="docs/screenshots/sftp/sftp.png" alt="SFTP dual-pane file manager with transfer queue" /></td> </tr> <tr> <td align="center"><strong>Built-in IDE (CodeMirror 6)</strong><br/><br/><img src="docs/screenshots/miniIDE/miniide.png" alt="Built-in IDE mode with CodeMirror 6 editor" /></td> <td align="center"><strong>Smart Port Forwarding</strong><br/><br/><img src="docs/screenshots/PORTFORWARD/PORTFORWARD.png" alt="Smart port forwarding with auto-detection" /></td> </tr> </table>

---

Feature Overview

| Category | Features | |---|---| | Terminal | Local PTY (zsh/bash/fish/pwsh/WSL2), SSH remote, split panes, broadcast input, session recording/playback (asciicast v2), WebGL rendering, 30+ themes + custom editor, command palette (⌘K), zen mode | | SSH & Auth | Connection pooling & multiplexing, ProxyJump (unlimited hops) with topology graph, auto-reconnect with Grace Period. Auth: password, SSH key (RSA/Ed25519/ECDSA), SSH Agent, certificates, keyboard-interactive 2FA, Known Hosts TOFU | | SFTP | Dual-pane browser, drag-and-drop, smart preview (images/video/audio/code/PDF/hex/fonts), transfer queue with progress & ETA, bookmarks, archive extraction | | IDE Mode | CodeMirror 6 with 30+ languages, file tree + Git status, multi-tab, conflict resolution, integrated terminal. Optional remote agent for Linux (10+ architectures) | | Port Forwarding | Local (-L), Remote (-R), Dynamic SOCKS5 (-D), lock-free message-passing I/O, auto-restore on reconnect, death reporting, idle timeout | | AI (OxideSens) | Inline panel (⌘I) + sidebar chat, terminal buffer capture (single/all panes), multi-source context (IDE/SFTP/Git), 40+ autonomous tools, MCP server integration, RAG knowledge base (BM25 + vector hybrid search), streaming SSE | | Plugins | Runtime ESM loading, 8 API namespaces, 24 UI Kit components, frozen API + Proxy ACL, circuit breaker, auto-disable on errors | | CLI | oxt companion: JSON-RPC 2.0 over Unix Socket / Named Pipe, status/list/ping, human + JSON output | | Security | .oxide encrypted export (ChaCha20-Poly1305 + Argon2id 256 MB), OS keychain, Touch ID (macOS), host key TOFU, zeroize memory clearing | | i18n | 11 languages: EN, 简体中文, 繁體中文, 日本語, 한국어, FR, DE, ES, IT, PT-BR, VI |

---

Under the Hood

Architecture — Dual-Plane Communication

OxideTerm separates terminal data from control commands into two independent planes:

┌─────────────────────────────────────┐
│        Frontend (React 19)          │
│  xterm.js 6 (WebGL) + 18 stores    │
└──────────┬──────────────┬───────────┘
           │ Tauri IPC    │ WebSocket (binary)
           │ (JSON)       │ per-session port
┌──────────▼──────────────▼───────────┐
│         Backend (Rust)              │
│  NodeRouter → SshConnectionRegistry │
│  Wire Protocol v1                   │
│  [Type:1][Length:4][Payload:n]       │
└─────────────────────────────────────┘

• Data plane (WebSocket): each SSH session gets its own WebSocket port. Terminal bytes flow as binary frames with a Type-Length-Payload header — no JSON serialization, no Base64 encoding, zero overhead in the hot path.
• Control plane (Tauri IPC): connection management, SFTP ops, forwarding, config — structured JSON, but off the critical path.
• Node-first addressing: the frontend never touches sessionId or connectionId. Everything is addressed by nodeId, resolved atomically server-side by the NodeRouter. SSH reconnect changes the underlying connectionId — but SFTP, IDE, and forwards are completely unaffected.

🔩 Pure Rust SSH — russh 0.54

The entire SSH stack is russh 0.54 compiled against the ring crypto backend:

• Zero C/OpenSSL dependencies — the full crypto stack is Rust. No more "which OpenSSL version?" debugging.
• Full SSH2 protocol: key exchange, channels, SFTP subsystem, port forwarding
• ChaCha20-Poly1305 and AES-GCM cipher suites, Ed25519/RSA/ECDSA keys
• Custom AgentSigner: wraps system SSH Agent and satisfies russh's Signer trait, solving RPITIT Send bound issues in russh 0.54 by cloning &PublicKey to an owned value before crossing .await

pub struct AgentSigner { /* wraps system SSH Agent */ }
impl Signer for AgentSigner { /* challenge-response via Agent IPC */ }

• Platform support: Unix (SSH_AUTH_SOCK), Windows (\\.\pipe\openssh-ssh-agent)
• Proxy chains: each hop independently uses Agent auth
• Reconnect: AuthMethod::Agent replayed automatically

🔄 Smart Reconnect with Grace Period

Most SSH clients kill everything on disconnect and start fresh. OxideTerm's reconnect orchestrator takes a fundamentally different approach:

1. Detect WebSocket heartbeat timeout (300s, tuned for macOS App Nap and JS timer throttling)
2. Snapshot full state: terminal panes, in-flight SFTP transfers, active port forwards, open IDE files
3. Intelligent probing: visibilitychange + online events trigger proactive SSH keepalive (~2s detection vs 15-30s passive timeout)
4. Grace Period (30s): probe the old SSH connection via keepalive — if it recovers (e.g., WiFi AP switch), your TUI apps (vim, htop, yazi) survive completely untouched
5. If recovery fails → new SSH connection → auto-restore forwards → resume SFTP transfers → reopen IDE files

Pipeline: queued → snapshot → grace-period → ssh-connect → await-terminal → restore-forwards → resume-transfers → restore-ide → verify → done

All logic runs through a dedicated ReconnectOrchestratorStore — zero reconnect code scattered in hooks or components.

🛡️ SSH Connection Pool

Reference-counted SshConnectionRegistry backed by DashMap for lock-free concurrent access:

• One connection, many consumers: terminal, SFTP, port forwards, and IDE share a single physical SSH connection — no redundant TCP handshakes
• State machine per connection: connecting → active → idle → link_down → reconnecting
• Lifecycle management: configurable idle timeout (5m / 15m / 30m / 1h / never), 15s keepalive interval, heartbeat failure detection
• WsBridge heartbeat: 30s interval, 5 min timeout — tolerates macOS App Nap and brow