v4.0.0

V4 is stable, on npm and as a desktop application.

V4 adds the control plane: a local application — a browser tab or a desktop window — that shows what your agents are doing on your servers and lets you stop them before they do it, with an encrypted vault for credentials, human approval per server, live command output, a file browser and a shell on your own machine.

Everything in it is opt-in. With no vault, no approval set and nothing running, the engine behaves as 3.8.x — the release pipeline proves it by installing 3.8.5, 3.8.6 and 3.8.7 from the registry and upgrading each to this version. The one deliberate behaviour change is that SSH host keys are verified; read that section of the upgrade and rollback guide before upgrading.

Getting it

npm	npm update -g mcp-ssh-manager crosses the major version from 3.8.x. To stay on 3.8, pin mcp-ssh-manager@3 (3.8.7 is its latest).
Desktop app	ssh-manager app installs the one matching your engine, checked against this release — or download it below. Installed beta builds update to 4.0.0 by themselves.
Homebrew	brew upgrade ssh-manager

Platform	File	Signature
macOS, Apple silicon / Intel	SSH-Manager-4.0.0-arm64.dmg / -x64.dmg	Signed and notarized by Apple
Windows x64 / arm64	SSH-Manager-4.0.0-setup.exe	Not code-signed — see below
Linux x64	.deb, .AppImage	Unsigned, as Linux packages usually are

Windows: not code-signed in this release

The Windows installer and application are not Authenticode-signed in 4.0.0. Windows shows "Windows protected your PC": choose More info → Run anyway. The code-signing account exists; its public certificate waits on the company's registration, and later releases will be signed. Until then, check the installer against the SHA-256 published in release-manifest-win32.json on this release — ssh-manager app does it for you and installs only a file that matches.

npm, the application, or both

• Keep npm, change nothing. The engine runs headless from your .env, TOML or environment, as before. No invitation, no banner, no file written: the interface and the application are there for whoever asks (ssh-manager control, ssh-manager app) and silent for whoever does not.
• npm with the interface. Your agents keep starting the npm engine; the application (or ssh-manager control in a browser) is the window on top of it — approvals, live output, activity.
• The application without npm. The application carries the engine too. Options → AI tools lists Claude Code, Claude Desktop and Codex, shows which ssh-manager each one starts (npm's, the application's, another, or none) and switches it in one click. The application's engine runs under its own runtime: no Node, no npm. A switch rewrites that tool's one entry, keeps its environment variables, and takes effect when the tool next starts.
• Updates. The application checks at launch and every six hours, downloads when you click Update, and installs when it quits. The npm engine updates with npm.

Security

• Remote command execution through ssh_backup_restore's backupId (GHSA-2wjh-xm9c-7qf9, high, reported by @NYBaywatch), present in every preview up to 4.0.0-beta.3 as in 3.8.6. Fixed as in 3.8.7. The other 3.8.7 advisory (GHSA-mq9f-5385-rjf4) never affected the previews; its regression test runs here too.

Verifying

The npm package is published from CI with provenance and an attested SBOM (sbom.cyclonedx.json below). Each desktop platform has a release-manifest-*.json with every file's size and SHA-256.

Everything else — vault, approvals, host-key verification, the interface, the previews' changes — is in the CHANGELOG.