Documentation

What is SShvTerm

SShvTerm is a cross-platform desktop SSH client with zero-knowledge cloud sync. It manages hosts, identities, keys, groups, tags, snippets and port-forwarding rules, with a high-quality terminal. Sensitive fields are encrypted on the client, and the server never sees your password or your encryption key.

Architecture

SShvTerm is split into three layers. The frontend never talks directly to the cloud or to SSH: everything goes through a local agent that keeps the encryption key in memory only.

Security model

Encryption is zero-knowledge: the encryption key is derived from your password and lives only in the local agent's memory. Sensitive fields are encrypted with RNCryptor (AES-256-CBC + HMAC-SHA256) before any sync. SSH connections use TOFU host key verification — the fingerprint is pinned on the first connection and any mismatch blocks the session to stop MITM attacks.

AI agent

The agent is optional and starts disabled. When enabled, it can read (with your permission) the last lines of the focused terminal, suggest the next step and — with execution ⚡ turned on — drive the terminal: the command is typed into the visible session of your tab, never in a hidden shell. Each provider's API key is yours (BYOK) and stays encrypted in the vault, like any other secret.

How a command happens

1. 1. You ask

   In plain language, in the agent chat, with the tab's host selected.

2. 2. The model proposes

   Providers with function calling return a structured call (propose_command); text-only models use the text bridge (a ```run block). Both paths converge on the same executor.

3. 3. Your policy decides

   Allow, ask or deny rules, configurable in Settings. When in doubt, the agent shows the exact command and waits for your approval.

4. 4. You watch it happen

   The command is typed into the tab's terminal; the output (stdout, stderr, exit code) goes back to the model, which replies with the result. Conversations and commands are kept in the audit log.

Providers and models

Anthropic (Claude), ShvIA (Blue3) and any OpenAI-compatible endpoint — local Ollama, LM Studio, vLLM and the like. Native tools require a model that supports function calling (e.g. Claude, qwen3, llama3.1); when it doesn't, the text bridge takes over automatically.

Getting started

1. 1. Download the app

   Installers for macOS (.dmg), Windows (.msi) and Linux (.AppImage / .deb).

2. 2. Create your account

   Your password generates the encryption key. Keep it safe: without it, no one — not even the server — can recover your data.

3. 3. Add a host and connect

   Register the server, pick an identity or key and open the terminal. Everything syncs encrypted.

Local data directory

Hosts, identities, SSH keys and trusted host keys (TOFU) are stored in the app's local data directory, on your machine.

~/.sshvterm/

Cloud backend

By default the client talks to the hosted backend. If you prefer full control, you can point it at your own server — the reference implementation is self-hostable.

Public API

The site exposes a small, unauthenticated API for downloads and app auto-update. All responses are served over HTTPS by sshvterm.com.

GET /api/update/{target}/{arch}/{current_version}

$ curl https://sshvterm.com/api/update/darwin/aarch64/0.5.20

{
  "version":   "0.5.28",
  "notes":     "...",
  "pub_date":  "2026-06-11T21:30:00+00:00",
  "url":       "https://sshvterm.com/d/61",
  "signature": "...minisign signature of the installer..."
}

GET /d/{id}

The app sync uses a separate, token-authenticated API that carries only client-encrypted blobs (zero-knowledge) — the server cannot decrypt them. It is not a public API: its contract is versioned with the app and may change between releases.