Development

Development

ssm is a Rust binary crate.

Layout

Path	Role
src/main.rs	CLI parsing (clap) and command dispatch; launches the TUI when run with no subcommand.
src/lib.rs	Library root, re-exports public modules.
src/config.rs	config.toml loading, saving, and defaults.
src/storage.rs	Session JSON persistence and OS keychain (keyring) integration.
src/connect.rs	SSH and herdr connection logic, SSH_ASKPASS socket server.
src/askpass.rs	The askpass responder (re-exec'd by ssh as SSH_ASKPASS).
src/ssh_config.rs	OpenSSH config parser for session import.
src/probe.rs	Background TCP reachability probing with latency sparklines.
src/update.rs	Self-update: version check, download, checksum verify, binary swap.
src/security/	Biometric unlock (fprintd on Linux, Touch ID stub on macOS).
src/tui.rs	The main TUI loop, screen rendering, and keybinding dispatch.
src/tui_core/	Shared TUI chrome — header/footer bars, color theme, flash messages.

Build & test

cargo build --release                 # optimized binary at target/release/ssm
cargo test --all                      # unit + integration tests
cargo clippy --all -- -D warnings     # lints (CI treats warnings as errors)

Note: this repo uses a deliberate hand-aligned style (aligned struct fields, padded let bindings) that stock rustfmt would rewrite, so there is no cargo fmt gate.

CI

CI runs on both Linux and macOS via .github/workflows/ci.yml: build, clippy, and tests (with a real Secret Service keyring on Linux via dbus-run-session + gnome-keyring-daemon).

Release builds run via .github/workflows/build.yml, producing Linux binaries for x86_64 and aarch64. macOS is built and signed locally — see the "Releasing" section of the README.

Releasing

# 1. bump Cargo.toml version + CHANGELOG, commit, tag, push.
git commit -am "chore(release): vX.Y.Z"
git tag -a vX.Y.Z -m "ssm vX.Y.Z"
git push origin main --follow-tags     # → CI builds & attaches the Linux tarballs

# 2. on your Mac, build/sign/upload both darwin arches to the same Release.
scripts/release-macos.sh vX.Y.Z        # x86_64 + aarch64, signed with ssm-codesign

The two steps are order-independent — whichever runs second just adds its assets to the Release.