macOS · iPadOS · Rust core

The SSH workspace for people who live in production.

A native macOS & iPadOS client that folds the terminal, SFTP, a full PostgreSQL workspace, monitoring, and network tools into one window — running over a memory-safe Rust protocol core bridged to Swift with UniFFI.

View the source How it's built
  • 2 platforms one shared core
  • 8+ tool surfaces
  • Rust 1.95 edition 2024
  • 0 hand-edited FFI
agent-ssh app icon

What it does

One window, the whole operations surface.

Every panel is wired to the same Rust core through a typed event bus — no shelling out, no per-tool re-auth.

❯_

Terminal

SwiftTerm PTY rendering full xterm-256color, with regex search, tabbed sessions, split panes, and a ⌘K command palette over connections and saved queries.

  • SwiftTerm
  • split panes
  • ⌘K palette
⇄

Dual-pane transfer

Side-by-side local/remote browsing, drag-and-drop, chmod, and a three-way diff with snapshot-before-write so a typo in nginx.conf never takes a host down.

  • SFTP
  • safe-save
⌥

PostgreSQL workspace

Multi-database schema tree, per-tab query cursors, click-to-edit cells, and cursor-paginated CSV / JSONL / Parquet export over an SSH tunnel.

  • query tabs
  • Parquet
  • tunneling
◎

Network tools

Multi-perspective DNS, a listening-port inventory with PID + process, streaming tcpdump, and remote git deploy-state — all over an existing session.

  • tcpdump
  • DNS
  • ports
∿

Live monitoring

CPU, memory, disk, and load-average time series in SwiftUI Charts, plus a sortable remote process list with a kill action.

  • Charts
  • processes
🔒

Security model

Secrets live in the Keychain only. Host-key trust is TOFU and fails closed. On iPadOS, destructive actions sit behind a Face ID privacy gate.

  • Keychain
  • fail-closed
  • Face ID
⌘

Runbooks & an iPadOS-first surface

Repeatable command sequences with per-step recording and partial-failure triage. On iPad: a connection map by latency, an incident-report builder, SFTP that mounts into Files, and long tasks that survive backgrounding via BGTaskScheduler.

  • runbooks
  • incident reports
  • Files integration
  • BGTask

How it's built

A Swift shell over a Rust heart.

The UI is native SwiftUI/AppKit. Everything that touches the network is Rust — generated, checksum-verified bindings keep the boundary honest.

UI

SwiftUI + AppKit shell

Views, stores, SwiftTerm. macOS & iPadOS targets share a framework.

FFI

UniFFI generated bindings

Proc-macro exports → committed Swift bindings. Per-function checksums verified at init.

Runtime

Rust bridge · one tokio runtime

A typed event bus streams PTY output, transfer progress, and monitor samples back to Swift.

Core

ssh-commander-core

SSH (russh), PostgreSQL, and Parquet — the memory-safe protocol layer, published on crates.io.

Why it's a good reference

Engineering decisions worth a look.

Cross-language FFI, done safely

UniFFI proc-macros generate the Swift surface; bindings are committed and checksum-checked so a stale binding crashes loudly at init instead of corrupting silently.

One async runtime, one event bus

A single tokio runtime backs every feature. Streaming work — PTY, tcpdump, transfers, Parquet export — flows over one typed, back-pressured event bus.

Reproducible, signed pipeline

The Xcode project is generated from project.yml via XcodeGen; just drives build, sign, notarize, and Sparkle delta updates.

Multi-platform from one core

macOS, iPadOS, plus widgets, share, shortcuts, and a File Provider extension — all sharing the same Rust core and Swift models.

Read the code.

Architecture notes in AGENTS.md, the full feature catalog in TOOLS.md.

Open on GitHub