Skip to content
OxideTerm

Introduction

OxideTerm is a local-first SSH workspace, not just a terminal. Open a remote node once, then work around it in one place: shell, SFTP, port forwarding, trzsz transfers, lightweight editing, local shell, and BYOK-first OxideSens AI.

Built with Tauri 2.0 (Rust backend) and React 19 (TypeScript frontend), OxideTerm ships as a lightweight 25–40 MB native binary with zero Electron, zero OpenSSL, zero telemetry, zero core app subscription, and pure Rust SSH.

OxideTerm is not a cloud AI platform, hosted agent service, generic remote-protocol toolbox, or a terminal-rendering benchmark project. Many modern terminals are evolving around local shells, AI panels, or cloud agent platforms; OxideTerm focuses on the local-first SSH workspace.

Why OxideTerm?

Section titled “Why OxideTerm?”
Pain PointOxideTerm’s Answer
SSH workspace, not just a shellRemote node workspace: terminal, SFTP, port forwarding, trzsz, lightweight IDE, monitoring, and AI context live under the same node
You still need a local shellIntegrated local shell: zsh/bash/fish/pwsh/WSL2 beside SSH sessions, so local and remote tasks share one UI
Reconnect = lose everythingGrace Period reconnect: probes old connection 30s before killing it — your vim/htop/yazi survive when the TCP stream recovers
Remote file editing needs VS Code RemoteLightweight IDE: CodeMirror 6 over SFTP with 24 languages, optional ~1 MB remote agent on Linux
No SSH connection reuseMultiplexing: terminal, SFTP, forwards, and IDE share one SSH connection via a reference-counted pool
SSH libraries depend on OpenSSLrussh 0.59: pure Rust SSH compiled against ring — zero C dependencies
100+ MB Electron appsTauri 2.0: native Rust backend, system WebView, 25–40 MB binary
You do not want telemetry or app subscriptionsZero tracking, zero core app subscription: SSH/SFTP/port forwarding/local shell need no OxideTerm account or subscription; Cloud Sync is opt-in via plugin
You want AI without a platform accountBYOK-first OxideSens: target-first workspace AI for saved connections, live SSH sessions, terminal buffers, SFTP paths, settings, and knowledge base entries

Architecture at a Glance

Section titled “Architecture at a Glance”

OxideTerm uses a dual-plane architecture that separates latency-critical terminal I/O from management commands:

┌─────────────────────────────────────┐
│        Frontend (React 19)          │
│  xterm.js 6 (WebGL) + Zustand       │
└──────────┬──────────────┬───────────┘
           │ Tauri IPC    │ WebSocket (binary)
           │ (JSON)       │ per-session port
┌──────────▼──────────────▼───────────┐
│         Backend (Rust)              │
│  NodeRouter → SshConnectionRegistry │
│  Wire Protocol v1                   │
│  [Type:1][Length:4][Payload:n]       │
└─────────────────────────────────────┘
PlaneTransportPurpose
Data PlaneWebSocket (binary)Terminal I/O — Type-Length-Payload framing, no JSON/Base64 in the hot path
Control PlaneTauri IPC (JSON)Management: connections, SFTP, port forwarding, config, AI chat

Each SSH session gets its own WebSocket port with single-use, time-limited token authentication on the first frame. The frontend addresses remote resources by stable node identifiers; the backend resolves live connection state behind the scenes so reconnects do not invalidate SFTP, IDE, or port forwarding consumers.

Tech Stack

Section titled “Tech Stack”
LayerTechnologyDetails
FrameworkTauri 2.0Native binary, 25–40 MB
RuntimeTokio + DashMapAsync backend and concurrent registries
SSHrussh 0.59 (ring)Pure Rust, zero OpenSSL, SSH Agent
Local PTYportable-ptyConPTY on Windows, local zsh/bash/fish/pwsh/WSL2 workflows
FrontendReact 19 + TypeScriptVite, Tailwind CSS
StateZustandSpecialized stores for terminal, SSH, SFTP, plugins, AI, settings
Terminalxterm.js 6 + WebGL/CanvasAdaptive rendering with software-renderer fallback
EditorCodeMirror 6Lightweight remote editing
EncryptionChaCha20-Poly1305 + Argon2idEncrypted .oxide exports and local config sealing
StorageredbEmbedded local KV store
i18ni18next11 UI languages
PluginsESM RuntimeOfficial Cloud Sync, Telnet Client, and runtime extension APIs
CLIJSON-RPC 2.0Unix Socket / Named Pipe companion

Key Features

Section titled “Key Features”
CategoryFeatures
TerminalLocal PTY, SSH remote, split panes, broadcast input, session recording/playback, adaptive rendering, command palette, zen mode, themes + custom editor
SSH & AuthConnection pooling, ProxyJump topology, auto-reconnect with Grace Period, Agent Forwarding, password/key/certificate/SSH Agent/keyboard-interactive direct auth, Known Hosts TOFU
SFTPDual-pane browser, drag-and-drop, smart preview, transfer queue, bookmarks, archive extraction, directory transfer controls
IDE ModeCodeMirror 6 editing, file tree + Git status, multi-tab workflow, conflict detection, optional remote agent
Port ForwardingLocal (-L), Remote (-R), Dynamic SOCKS5 (-D), auto-restore on reconnect, status and process visibility
AI (OxideSens)Target-first BYOK assistant. It sees saved connections, live SSH sessions, terminal buffers, SFTP paths, settings, and knowledge base entries as workspace targets; it can diagnose remote output, run approved commands, inspect files, and explain failures without requiring an OxideTerm account
PluginsRuntime ESM loading, PluginContext APIs, sidebar/status/tab contributions, official optional workflows
SecurityOS keychain, encrypted local config at rest, encrypted .oxide exports, Touch ID gate on macOS, host key TOFU, sensitive memory zeroization
i18n11 languages: EN, 简体中文, 繁體中文, 日本語, 한국어, FR, DE, ES, IT, PT-BR, VI

SSH Connection Pool

Section titled “SSH Connection Pool”

OxideTerm uses a reference-counted SSH connection registry:

  • One connection, many consumers — terminal, SFTP, port forwards, and IDE share a physical SSH connection.
  • Runtime state machine — connecting → active → idle → link_down → reconnecting.
  • Lifecycle management — configurable idle timeout, keepalive, link-down detection, and recovery.
  • Cascade propagation — jump host failure marks downstream nodes and UI surfaces consistently.

Local-first Boundaries

Section titled “Local-first Boundaries”

OxideTerm’s core SSH workflow does not require an OxideTerm account or subscription:

  • SSH, SFTP, port forwarding, local shell, saved connections, and settings work locally.
  • Credentials and API keys live in the OS keychain.
  • AI is BYOK: provider costs belong to your chosen provider, not an OxideTerm app subscription.
  • Cloud Sync is an optional official plugin, not a requirement for using the workspace.

What’s Next?

Section titled “What’s Next?”