SecureShell Go 1.5.1

A smoother terminal, fewer popups, and trusted server keys that stay trusted.

Terminal copy and paste

• Selecting text with a mouse no longer brings up a bar that shrank the terminal and moved the text you were selecting. Copy with right-click, Ctrl+Shift+C, or turn on Copy on select (Settings › Terminal).
• On Linux, a middle click pastes, as in other terminals.
• Pasting several lines shows them before they run.
• A button jumps back to the latest output after scrolling up.
• On touch, the Copy bar floats over the terminal instead of resizing it.

Trusted server keys

• Trusted server keys are kept when the system keyring loses the key that protects them, after a keyring reset, a new login password or moving to another computer. Before, the app warned that they had failed an integrity check and asked about every server again.
• On a computer with no keyring, including the Snap Store app before it's allowed to reach one, trusted keys are now remembered between launches.

Fewer popups

• Messages no longer queue up behind each other, and the ones that only repeated what's on screen are gone.
• With a mouse, right-clicking a file and the host ⋮ button open a menu at the pointer.
• Closing the last session returns to the host list instead of an empty window.
• Quick connect goes to the password field and no longer opens a save dialog by itself.
• The host form saves with Ctrl+S and asks before discarding changes.
• New shortcuts: Ctrl+Shift+W closes a session, Ctrl+Shift+N and Ctrl+Shift+P move between split panes.

The full list is in CHANGELOG.md.

Install

• Linux: sudo snap install secureshellgo, the PPA ppa:dhiva-labs/apps, or the tarballs below.
• Android: SecureShellGo-1.5.1-android.apk (any phone), or -android-arm64.apk (smaller, for most phones). Google Play testing: https://play.google.com/apps/testing/com.dhivalabs.secure_shell_go
• Windows and macOS: the zips below.

SecureShell Go 1.5.0

A major update: remote desktop and virtual desktops, an IDE-like file editor, Mosh, sign-in with agents, security keys and certificates, agent and X11 forwarding, a terminal that survives network changes and sleep, commands on many servers, new file actions, Windows Hello, translations into eight languages, and layouts for tablets, foldables, touch and mouse.

Security

• On Android, the app lock stays shut when the device cannot show its unlock prompt, instead of letting the app open.
• On Windows, opening a downloaded file no longer goes through cmd, so a crafted file name cannot run a command.
• An RSA host key is recognised as the same key whichever signature algorithm the server uses with it, instead of being treated as a new or changed key.
• A direct server-to-server copy only goes ahead when the destination presents the host key this device already trusts.
• A locked system keyring no longer wipes the list of trusted host keys.
• Saved hosts, settings and trusted keys are written atomically and in order. A file that cannot be read is set aside, not overwritten.
• Replacing a file on upload writes the new copy first and swaps it in, so a failed upload no longer leaves the old file destroyed.
• A backup that demands an unreasonable amount of key-derivation work is refused instead of freezing the app.

Added

• Remote desktop: see and control a server's desktop from any device, phones included, over the SSH connection you already have. It works with GNOME on Wayland, X11 desktops and Windows. A small agent is copied to the server for the session and stopped afterwards; it listens on the server's loopback only, so no port is opened and SSH is the only login. The person at the server's screen is told while it is being viewed.
• Virtual desktops on servers with no screen: start a private desktop, such as Xfce, or a single program, and use it in the same viewer. Optionally keep it running after you disconnect and come back to it from Remote desktop later.
• Open an app in a window: run one graphical program on the server and have its window open on your own desktop, without a terminal and without turning on the host's X11 switch first. A server that turns it down for want of xauth gets it installed in one click, and the program starts. Where that cannot work — on a phone, or with no X server on Windows — it offers a virtual desktop instead.
• Show a Mac's screen through its built-in Screen Sharing, over the same SSH connection.
• On touch screens the viewer has a trackpad mode and a direct-touch mode, pinch to zoom, and a key bar with Esc, Tab, Ctrl, Alt, Super, arrows, function keys and Ctrl+Alt+Del. Clipboard text goes both ways.
• When a server is missing what a virtual desktop needs (the virtual screen, a desktop, or a program you typed), the app offers to install it and does, asking for your sudo password only if the server wants it. It is used for that install and not saved.
• VS Code, VSCodium, Cursor and Chromium-based browsers open in a virtual desktop, as root too: the app adds the options they need there and says so.
• The remote editor indents like a code editor. Tab and Shift+Tab indent and outdent, Enter keeps the indentation and goes a level deeper after a Python colon or an opening bracket, and each file's own style (tabs or 2, 4 or 8 spaces) is detected and shown in the status bar, where it can be changed.
• Line and comment shortcuts: toggle comment (Ctrl+/), move line (Alt+↑/↓), duplicate line (Shift+Alt+↑/↓), indent and outdent line (Ctrl+] and Ctrl+[).
• Show whitespace, and a warning when a Python, YAML or Makefile file mixes tabs and spaces.
• On phones and tablets, a row of keys over the keyboard with Tab, outdent, arrows, brackets and symbols, plus undo and redo.
• Zoom with a pinch or Ctrl + and Ctrl −. The editor keeps its own text size, also set in Settings.
• With several files open on a wide screen, they are listed in a side panel.
• Syntax colouring for C and C++, Go, Rust, Java, Kotlin, Ruby and PHP.
• A connection that has silently died (no answer to three keep-alives and nothing else heard from the server) is noticed and reconnected, instead of leaving the terminal frozen until the system gives up on it.
• Sessions check their connection straight away when the network changes, when the app comes back on screen and when a computer wakes from sleep, and reconnect over the new network at once.
• A disconnected session always has a Reconnect button, and one that stopped trying because there was no network tries again by itself when the network comes back.
• When the shell exits but the connection is fine, a "Shell ended" strip offers Restart: a new shell in the same tab, with no new login.
• Persistent sessions: a host set to tmux or GNU screen runs its shell inside one, named per tab (ssg-<host>-<tab>_, as tmux ls and screen -ls show it), so a reconnect — or reopening the app — lands back in the same shell with whatever was running in it. tmux falls back to screen, and either falls back to an ordinary shell with a one-line notice — when it is not installed, and also when it is installed but will not start. The host's startup command is only typed into a new shell, never into one left running.
• Mosh: a host whose terminal connection is set to Mosh (Advanced in the host editor) now gets its terminal over Mosh. The app starts mosh-server over the SSH connection it already has, then talks to it over UDP — no mosh program needed on the device. Sign-in, files, tunnels and server commands stay on SSH.
• A Mosh terminal carries on through what drops SSH: switching between Wi-Fi and mobile data, a new address, a phone or laptop asleep for hours. It picks up where the server is when the network comes back, with nothing to reconnect.
• When the server has been out of touch for a few seconds, a bar across the top of a Mosh terminal says how long ("mosh: Last contact 12 seconds ago."), and goes once it catches up.
• On a slow connection, what you type appears straight away, underlined until the server confirms it (Mosh's local echo). It only switches on when the link is slow, and never shows at a password prompt.
• If SSH drops while a Mosh terminal is open, the terminal keeps working; files and tunnels reconnect in the background, and the strip above the terminal says so. If reconnecting SSH gives up or is stopped, the strip says that too and offers Reconnect, and SSH is tried again by itself when the network comes back. Typing exit in the terminal meanwhile ends the session; nothing starts it again unless you press Reconnect.
• Where Mosh cannot be used — mosh-server not installed, no UTF-8 locale on the host, or UDP blocked by a firewall — the terminal opens over SSH instead, with one line saying why. A mosh-server started for a connection that never got through is stopped again.
• mosh-server is found in Homebrew and other common install locations as well as on the PATH.
• Hosts set to keep their shell in tmux or screen run it under Mosh too, so a Mosh terminal can also be re-attached after the app closes. If tmux or screen will not start there, the terminal falls back to an ordinary shell with a one-line notice, as it does over SSH.
• A Mosh terminal keeps a scrollback of what scrolled past while you watched. Mosh sends screens rather than every line of output, so a burst that flashed by between two screens is not in it.
• Closing a Mosh tab ends the session on the server, as Mosh's own Ctrl-^ . does. If the goodbye cannot get through over UDP, mosh-server is stopped over SSH instead, so neither it nor the shell under it is left running.
• Agent and X11 forwarding reach SSH terminals only; Mosh cannot carry them, so a Mosh terminal has neither.
• Sign in with your computer's SSH agent (ssh-agent, Pageant or the Windows OpenSSH agent) on Linux and Windows, including FIDO2 security keys such as a YubiKey (sk-ed25519, sk-ecdsa). The private key never leaves the agent. On Windows, SSH_AUTH_SOCK is used only when it names a pipe, and Pageant's pipe only when it belongs to you, as PuTTY checks, so another account on the same PC cannot stand in for your agent.
• SSH certificates: load a -cert.pub file or paste one in the host's sign-in settings, for servers that trust a certificate authority. The host shows the certificate's key ID, the users it is valid for, when it is valid, its critical options and what it permits, and says clearly when it is for a different key, is a host certificate, has expired or is not valid yet. It warns when the certificate forces a command (the server runs that instead of a shell), only works from certain addresses, carries an option OpenSSH does not know, or names no users, which a server trusting its CA through TrustedUserCAKeys refuses.
• Forward SSH agent, per host: git and ssh in the shell can use the keys in your computer's agent and the host's own key, without copying them to the server. Stats, logs and other server actions keep working on the same connection.
• Forward X11, per host, on Linux and Windows: graphical programs started on the server open their windows on your screen (needs an X server, such as VcXsrv or X410 on Windows). Only for servers you trust. On Linux they get limited access, as with ssh -X: each program is let in with a cookie of its own that keeps it away from your other windows. Where the display cannot do that, the server can see and control every window on this display while you are connected, as with ssh -Y: always on Windows, whose X servers have no limited mode (the host's X11 switch says so), and on a Linux display without xauth or the X SECURITY extension (the terminal says so when the shell opens).
• Importing from ~/.ssh/config now brings in ForwardAgent, ForwardX11 and CertificateFile, and finds a certificate saved next to an IdentityFile the way ssh does. Settings under a Match line are conditional, so they are skipped with a note rather than applied to the ...

SecureShell Go 1.4.4

Editing a server's config meant tapping from / down through four
levels of folders to find it — so most people gave up and used vim over
the terminal instead. This release is about not doing that.

Go straight to the file

Ctrl+L turns the breadcrumbs into a location bar. Type or paste a
path and go:

/etc/nginx/sites-available/default

A path to a file opens it in the editor and leaves the browser in that
file's folder, so its siblings are right there when you close it. ~
expands, a relative path resolves against the folder on screen, and a
path that cannot be reached shows the server's own message without
disturbing the listing you were looking at. Chips for /etc and
/var/log sit in the bar; the ordinary path bar keeps the width it had.

The editor takes the keyboard

Select all, copy, paste, cut and undo were never missing — they are what
a text field already does — but the editor did not take focus when a
file opened, so none of them did anything until you clicked into the
text. That is indistinguishable from the shortcuts being broken, and it
is fixed: opening a file on desktop puts the cursor in it. On a phone it
deliberately does not, because autofocus would throw the soft keyboard
over a file you may only be reading.

They are also reachable without a keyboard now — an Edit menu with
each chord written beside it, and a Keyboard shortcuts dialog
listing all eleven bindings, including the save, find, replace and
go-to-line that were already there.

One thing to know

In the side-by-side layout, clicking the file browser now gives it the
keyboard — the location bar needs somewhere for the keystroke to arrive.
Click the terminal to type there again. This is the ordinary split-pane
bargain, and the quieter of the two failures.

SecureShell Go 1.4.3

Connecting to a cloud box for the first time now works the way people
actually do it: copy the command the console gives you, paste it in.

Paste the command your console hands you

AWS gives you something like:

ssh -i "my-key.pem" ubuntu@ec2-3-111-164-59.ap-south-1.compute.amazonaws.com

Pasting that into quick connect used to make everything before the @
into the username, so the server rejected an account called
ssh -i "my-key.pem" ubuntu. Quick connect now reads the whole command:
quoted key paths (spaces included), -p, -l — which loses to a user@
on the operand, as OpenSSH does — bare switches like -v -A -T, flag
values that must not be mistaken for the host, a trailing remote command,
and ssh:// URLs. IPv6 keeps working throughout.

The file named by -i is remembered and shown, not opened: it is
relative to whatever directory you would have run the command in, which
this app has no way to know, and guessing could load the wrong key.

Import a key file, and keep the host

Quick connect gains the Import key file button it never had, so a
.pem no longer has to be pasted as text. The host editor's version of
that flow moved into one shared implementation rather than a second copy.

After a connection succeeds, quick connect offers to save the host
instead of leaving a button to be noticed. The offer never delays the
session, and declining is not asked twice.

Fixes

• The quick connect screen no longer freezes after a successful
  connection. The app theme gives every filled button an infinite
  minimum width so buttons fill a column; inside a row that fails layout
  for the whole subtree, leaving a title bar above a blank page with
  nothing on screen to explain it. The widget tests now build with the
  real app theme — the default one has no such rule, which is exactly why
  they passed while the screen was broken.
• If a key is in PKCS#8 format, which the SSH library cannot read, the
  message now names the command that converts it rather than only saying
  it is unsupported.

SecureShell Go 1.4.2

1.4.1 made "no system keyring" stop being a dead end, but it did so by
asking the user to choose how their credentials should be protected —
a mode setting, a dialog, a settings row and a first-run notice, all in
the way of simply saving a server. This release deletes that entirely.

One rule instead of a menu

Credentials go to the system keyring when it answers. When it does not,
they are encrypted into the app's own private file — automatically,
silently, without asking. There is no mode to pick and nothing to
configure, and there is still nowhere a secret is written unprotected.

Vaults written by 1.4.1 continue to open. Around 700 lines of the
machinery that existed only to let the user state which store held the
key are gone.

Saving is faster where it was slowest

Device encryption no longer runs Argon2id. That function exists to make
guessing a human-chosen password expensive; it was being applied to a
256-bit random key, where it protects nothing and cost roughly a second
on the first save and again on every app start. It landed on exactly the
machines the fallback exists for — snap installs without the keyring
interface connected, headless boxes, minimal desktops.

The key file now holds the vault key directly. The vault records which
of the two wrapping schemes it used in a byte covered by the
authentication tag, so an old file is still read as an old file and a
relabelled one is rejected.

Fixes

• A server with the sftp subsystem disabled no longer hangs the file
  browser. The SSH library returns a client without waiting to learn
  whether the server agreed to start the subsystem, so a refusal
  surfaced only on the first request — which never completed and never
  failed. The subsystem is now confirmed before the panel waits on it.

• Disconnecting the last session returns to the host list at once
  rather than showing an empty window until the connection has finished
  closing — worst against a server that had already stopped answering.

• The host actions menu and the copy-to-server picker scroll when
  they are taller than the window, instead of overflowing and hiding
  their last entries.

• A snap install is told how to fix its keyring access again. The
  host editor was picking a generic sentence and discarding the one the
  app had composed, which for a snap is the exact command to run:

  sudo snap connect secureshellgo:password-manager-service
  

SecureShell Go 1.4.1

Saving a password or key used to fail outright on any machine where no
system keyring answered — and then stop, with nothing the user could do
about it. 1.4.1 removes that dead end.

Credentials no longer depend on having a keyring

Where no Secret Service provider is reachable, SecureShell Go can now
protect credentials with an app passphrase instead, encrypting them
into its own private file with the same Argon2id + AES-256-GCM container
the encrypted-backup feature uses. The passphrase wraps a random vault
key, so the slow key derivation runs once when you unlock rather than on
every read and write.

There is still no plaintext fallback anywhere — this is a different
protection, not a weaker one.

The system keyring is still preferred whenever it answers, and there is
deliberately no path that silently moves an install with a working
keyring onto the passphrase vault. A keyring that is merely locked
means "unlock it", not "migrate everything"; the offer to create a vault
only appears where no keyring has ever worked, and that fact is
remembered across restarts.

The packaging gaps that caused it

• Debian/Ubuntu: the package depended on libsecret-1-0, which is
  only the client side of the Secret Service API — nothing pulled in a
  daemon to talk to. It now recommends gnome-keyring (accepting an
  existing kwalletd or keepassxc instead).

• Snap: password-manager-service is declared but snapd never
  connects it automatically, so every snap install hit this. The app now
  names the exact command instead of suggesting software you already
  have:

  sudo snap connect secureshellgo:password-manager-service
  

• Installing a downloaded .deb with dpkg -i skips Recommends
  entirely. Use sudo apt install ./secureshellgo_*.deb and the
  dependency comes along.

Honest diagnostics

The message no longer claims no keyring is installed. The Linux plugin
raises a single error code for three different situations — no provider
reachable, a provider with no collection aliased default, and a
default collection that would not unlock — and which one occurred is not
knowable from inside the app. It now says the keyring "could not be
reached or unlocked", which is true in all three cases.

Migration from the vault back to a keyring is deliberately not
implemented rather than half-built.

v1.4.0

Release 1.4.0

Four switchable UI styles with light and dark halves, each with its
own desktop host-list layout on top of the same underlying list
behaviour; the terminal colour-scheme swatch rendering bug is fixed
alongside it. Multi-select and a fleet-wide file push round out the
release: bounded concurrency, per-host pass/fail with its own
reason, and retry for just what failed.

1445 tests, analyzer clean.

v1.3.0

Release 1.3.0

Twenty-four features across six phases: the desktop split workspace
and broadcast input, server groups and colour tags, automatic
reconnection, jump hosts, the tunnel manager, in-app key generation
and installation, the remote editor, bookmarks and a cross-session
transfer panel, app lock and encrypted backup, and server stats,
log tailing and a service manager.

1392 tests, and two release blockers caught by running the built
application against a real server rather than a fake: session
connections carried an SSH agent handler, which made OpenSSH refuse
every exec channel after the shell claimed the connection's single
agent-forwarding grant, and the stats probe opened each section
with an unquoted # that sh swallowed as a comment.

v1.2.1

Name the desktop entry after the GTK application id

GNOME Shell matches a running Wayland window to its launcher by
looking up <app-id>.desktop; the entry was installed as
secureshellgo.desktop while the runner identifies as
com.dhivalabs.secure_shell_go, so the running app fell back to the
generic gear icon in the dock. Rename the installed entry to match
and fix StartupWMClass to the real WM_CLASS (prgname is set to the
application id — verified with xprop under XWayland: instance
com.dhivalabs.secure_shell_go), covering X11 sessions too.

Bump to 1.2.1.

v1.2.0

v1.2.0 — desktop, concurrent sessions, direct server-to-server transfer

Desktop
- New Linux, Windows and macOS builds alongside the Android app.
- CI packages tar.gz / zip / .app on every tagged release.
- Ubuntu PPA available at ppa:dhiva-labs/apps for `sudo apt install`.

Concurrent sessions
- Multiple servers open at once, one tab each.
- A background htop keeps running when you switch tabs; leaving the
  session screen no longer disconnects anything.
- Foreground service tracks the count and relabels ("2 sessions
  connected", then "srvB", then gone).

Move files between servers
- New "Copy to another server..." / "Move to another server..." in the
  file browser action sheet.
- On desktop, right-click the file, or drag it straight onto another
  session's tab.
- Two paths behind it: a relay through this device in RAM (no local
  disk touched), and a true direct A -> B via SSH agent forwarding
  where the bytes never even cross this machine. Direct is default
  when eligible; falls back to relay automatically if not.
- Move deletes the source only after four independent checks confirm
  the copy is intact on the destination.

Security
- Credentials on desktop go to the OS keyring: libsecret on Linux,
  DPAPI on Windows, login Keychain on macOS. No plaintext fallback
  anywhere - if the keyring is locked or missing, the save is refused
  and the user is told.
- App data on desktop lives in the platform's application-support
  directory, not the user's visible Documents folder.

Bug fixes
- Terminal buffer survives tab switching (Phase 12 regression fix).
- Retrying Save after a keyring failure no longer creates a duplicate
  host.
- Right-click on a file row now opens the action sheet on desktop
  (previously long-press only).