Android: reach environments over SSH with the app's own key

[nickypro]

The mobile app can only reach an environment's HTTP listener: on the LAN, over Tailscale, at a public URL, or through T3 Connect. Plenty of machines are only reachable over SSH: a server whose only open port is 22, a dev container behind a jump host, a work bastion. The desktop app already covers this with desktop-managed SSH environments. The phone has no equivalent.

Related reports:

• Access desktop-managed SSH environments through T3 Connect #12324: "The problem is mobile. I can connect my phone to the main machine with T3 Connect, but I can't access the SSH environments that the desktop already has configured."
• T3 Code Mesh / Less tunnels for t3 connect #14800: "the current limit of three hosts on T3 Connect is related to cost, and that Tailscale is the way to reach more machines today."
• An authenticating proxy in front of the server doesn't help the native apps either: [Bug]: Remote environment pairing cannot complete behind Cloudflare Access OAuth #3736 ("Remote environment pairing cannot complete behind Cloudflare Access OAuth"), Support connecting to remote environments behind SSO dev tunnels on iOS and Desktop #24876 ("In the iOS and Desktop apps, adding the same server via Add Environment fails") and Android: client certificates for servers behind an mTLS proxy #17218 ("pairing in the Android app fails with 'Transport error.'").

Would you approve this direction, with Android first?

The Android app keeps its own ed25519 key and a small SSH config, and implements the SshEnvironmentGateway client capability the desktop already implements. registerSsh, the connection supervisor and saved environments stay as they are, and so do the server and the contracts.

• Settings → SSH: create the key (sealed with an Android Keystore key, excluded from backup), copy or share the public key, edit a config subset (Host, HostName, User, Port, ProxyJump, HostKeyAlias; Match, Include, ProxyCommand and host patterns are flagged as unsupported), and review or remove trusted host keys.
• Add environment → Or connect over SSH: lists those hosts. Picking one asks you to confirm each new host key's fingerprint, then runs the desktop's own launch and pairing scripts over the app's SSH connection, forwards the server's port to 127.0.0.1 on the phone, and pairs through it.
• Reconnects follow the desktop's prepare: reuse the session while it's open and the server answers, otherwise reconnect, and keep the bearer token while it still has the standard scopes. A host key that is unknown or has changed blocks the reconnect with an explanation. New keys are only trusted while adding an environment.

Implementation:

• A small Expo module in Kotlin around sshj 0.40 and BouncyCastle: chained ProxyJump hops, SHA-1, CBC and DSA algorithms switched off, and keepalives so a dead network closes the forward.
• The launch and pairing scripts move from packages/ssh/src/tunnel.ts into a Node-free remoteScripts.ts the app can import. The desktop's generated scripts are byte-identical before and after.
• One Android trap: InetAddress.getLoopbackAddress() is ::1 there, so the forward binds 127.0.0.1 explicitly.

Prototype: compare view. The SSH part adds about 4,000 lines, of which roughly 1,300 are tests and 770 are the moved scripts. The branch also carries the client-certificate commit from #17218. An APK is in the fork's release, and it's what I use on my phone now.

Checked so far:

• Kotlin tests against real OpenSSH sshd processes: a tunnel-only jump key (restrict,port-forwarding,permitopen=…), fingerprints compared with ssh-keygen, unknown and changed host keys, and a blackholed network.
• An end-to-end test that runs the real scripts through a jump host, starts t3 0.1.5 in a throwaway home, pairs, gets an authenticated session, and stops the server.
• The SSH code on Android's own runtime, the add flow on an emulator (below), and daily use on my phone.
• vp run check:changed on the branch.

Settings → SSH	Add environment	Host key prompt

Not covered: iOS, which would need a Swift SSH library such as SwiftNIO SSH, and push notifications for these environments.

If the direction works for you, I'd split it into three PRs: the script move (no behavior change), the native module and gateway, then the Settings and Add environment UI. Would you take Android first, and is there a scope you'd rather see?

(Drafted with Claude Code / Claude Opus 5.5, which also wrote the implementation.)

[gskril]

+1 for SSH environments on mobile. My use case is Tailscale SSH, which doesn't use SSH keys, so it'd be great if generating a key were optional.

I'd like the same flow as desktop: connect over SSH, start the server, and tunnel to it only while I'm using it. I don't want a server always running and reachable on my VPS. Hoping iOS gets this too.