v0.4.2 - Themes and user experiance improvments

TetherSSH v0.4.2 is a customization + resilience release: bring your own terminal themes, keep sessions from timing out, and don't lose your place when one drops. It's a drop-in upgrade — existing settings and session files are untouched, and the new behaviors are opt-in.

Highlights

User-editable YAML themes

Themes are now pure data — a chrome palette (the app UI) plus a terminal palette (background/foreground and the 16 ANSI colors). The three built-ins are simply the first entries in a registry, and TetherSSH loads any number of additional themes from ~/.tetherssh/themes/*.yaml at startup. Adding a theme is dropping one YAML file in that folder — no rebuild. A file whose name matches a built-in replaces it; a new name adds one.

Both the App Theme and Terminal Theme selectors read the registry, so any chrome can wrap any terminal, and each theme carries its own full ANSI palette — htop renders in the active theme's colors rather than a shared dark/light pair. Sparse themes fill themselves in: set a handful of colors and the rest derive from their neighbors, so a dozen-line YAML still yields a complete, legible palette.

A ready-made pack of 30 themes — Dracula, Nord, Gruvbox, Solarized, Tokyo Night, amber/green CRT, Borland blue, and more — ships with this release as themes.zip.

Anti-idle keystroke

An optional timer sends a small, non-disruptive keystroke after a quiet interval to defeat device-side idle timeouts — Cisco exec-timeout, console servers, session managers — that an SSH/TCP keepalive does not reset. Keepalive keeps the transport up; the device still logs you out for lack of input, and a keystroke is what resets that clock.

Off by default. Enable it globally on the SSH settings tab (interval + keystroke), with an Inherit / On / Off override and an optional interval per session in every Add/Edit Session dialog. The keystroke defaults to Backspace (a no-op at an empty prompt); Space+Backspace is offered as a fully non-destructive option. It fires only after genuine idle and stops the instant you type.

Auto-reconnect on input

When a session drops, the tab stays put — and if you type into it, instead of silently swallowing your keystrokes TetherSSH offers to reconnect. Yes re-establishes the same transport (SSH, telnet, or serial) with the same parameters, reusing the tab and preserving its scrollback. The prompt is raised exactly once per drop, no matter how many keys you hit, and re-arms on the next clean connect.

Install / upgrade

Drop-in upgrade — your existing settings.json and session files are unchanged and forward-compatible. Anti-idle is off until you turn it on; nothing else changes by default.

To install the theme pack:

mkdir -p ~/.tetherssh/themes
unzip themes.zip -d ~/.tetherssh/themes/

Themes load on next launch and appear in both the App Theme and Terminal Theme pickers.

Notes

• Per-session anti-idle persists in session YAML as anti_idle / anti_idle_interval, omitted unless set, so existing session files stay byte-compatible.
• Same one-terminal, swappable-transport core as 0.4.0/0.4.1: SSH, telnet, and serial all share the read loop, renderer, theming, scrollback, and logging — so themes, anti-idle, and auto-reconnect work identically across all three.

Assets: themes.zip (optional 30-theme pack), plus the platform binaries below.

Full changelog: v0.4.1...v0.4.2

Telnet/Serial Release

TetherSSH Release Notes

v0.4.1

Telnet joins SSH and serial as a first-class transport, and the SSH side gets a real security and configuration pass: trust-on-first-use host keys, per-session terminal type and keepalive, a unified session editor, and a new logo and About screen.

Telnet transport

• Telnet sessions, in the same terminal. TetherSSH now opens telnet sessions alongside SSH and serial, in the same tabbed terminal with the same emulation, theming, scrollback, selection, and logging. Quick Connect's Transport selector is now SSH / Telnet / Serial. Telnet takes a host and port (default 23) and no credentials - a telnet device's own login prompt arrives as ordinary session data. Verified against telehack.com:23, a public host that does real option negotiation.
• Option negotiation handled in the backend. Telnet is raw TCP plus an in-band option protocol (RFC 854), every control sequence introduced by the IAC byte. A small state machine consumes that negotiation, answers it on the socket, and hands the emulator only the application data - so a DO SUPPRESS-GO-AHEAD never leaks into the screen as garbage. It advertises terminal type and window size, accepts echo and go-ahead suppression, answers a terminal-type query with XTERM, and replies to each option request only when the reply would change state, which avoids the classic negotiation loop.
• CRLF and window size on the wire. A lone carriage return (what the terminal emits on Enter) is expanded to CR LF as RFC 854 and most network gear expect; literal 0xFF bytes are doubled per the spec. The backend advertises NAWS and pushes the real terminal dimensions on connect and on every resize, so a device that honors window size lays out at the right width instead of a hardcoded 80 columns.
• One terminal, third transport. Telnet is not a parallel code path - it implements the same TerminalBackend interface as SSH and serial, so the read loop, renderer, paste pacing, and session logging are shared unchanged. A dropped telnet session surfaces a clean "connection lost"; closing the tab is a quiet teardown.

Host key verification (trust-on-first-use)

• Unknown hosts now prompt instead of auto-accepting. On first contact with a host not in known_hosts, TetherSSH shows the key type and SHA256 fingerprint and asks before connecting. On accept, the key is written to known_hosts in standard OpenSSH format and verified silently on every reconnect after that.
• A changed key is rejected. If a host's key no longer matches the pinned entry, the connection is refused as a possible man-in-the-middle, with a message telling you to remove the stale entry if the change is expected. The jump host uses the same policy, so a first connection through a bastion prompts for both the bastion and the target.
• Limitation worth knowing: a stored key of a different type than the one the server offers (for example an ed25519 entry when the host presents rsa) is treated as a mismatch and rejected - the same behavior as strict OpenSSH StrictHostKeyChecking. Recovery is to remove the stale entry and reconnect.

Per-session connection settings

• Terminal type per session. The TERM advertised in the pty request is now configurable per session - leave it blank to inherit a global default of xterm-256color. Set it from Add Session, Edit Session, or the Session Editor; the global default lives in Settings -> SSH.
• Keepalive per session. The keepalive interval that arrived in v0.3.3 is now a real setting: a global default in Settings -> SSH, with a per-session override (blank inherits the global default, 0 disables keepalive for that session).

Session editing

• Unified, consistent editors. Add Session, Edit Session, and the Session Manager now expose the same fields, including the new terminal type and keepalive. Previously, editing a session from the tree could silently reset overrides that had been set elsewhere; that no longer happens.
• Scrollable forms. The session forms scroll when they outgrow the dialog, so Save and Cancel stay anchored and reachable no matter how many fields are filled in.

Look and feel

• New logo. TetherSSH has a wireframe mark - a secure anchor tethering out to terminal nodes - used across the app and project.
• Redesigned About dialog. Help -> About now shows the logo, a short intro, and a feature ribbon, with the mark rendered in the active theme's accent color.

---

v0.4.0

Serial console support: the same terminal that reaches remote hosts over SSH now also drives directly-attached gear over a console cable.

Serial console transport

• Local serial ports, in the same terminal. TetherSSH now opens local serial ports (USB-serial adapters, console servers) alongside SSH, in the same tabbed terminal with the same emulation, theming, scrollback, selection, and logging. Quick Connect gained a Transport selector (SSH or Serial). Choosing Serial enumerates the attached ports - with USB vendor/product detail where the OS provides it - and lets you set baud, data bits, parity, and stop bits, defaulting to 9600 8N1 (the usual network-console settings). Verified against a Cisco 2911 console at 9600 8N1.
• One terminal, swappable transport. Serial is not a parallel code path - it implements the same TerminalBackend interface as the SSH client, so the read loop, renderer, paste pacing (already built for serial-style links), and session logging are shared unchanged. A console cable unplugged mid-session surfaces a clean "connection lost" rather than a silent or hung tab.
• serialterm diagnostic CLI. A small standalone command (cmd/serialterm) lists serial ports and opens a raw console session, sharing the exact serial backend the GUI uses - handy for confirming an adapter and its settings before connecting, or as a field diagnostic.

Notes

• Serial connections are ad-hoc and live in Quick Connect only; they are not written to the session tree (a serial port name is not worth persisting the way a stable host is).

v0.3.3 ProxyJump, SSH keepalive, and vault credential pickers

v0.3.3

Reach devices through a bastion, pick saved credentials by name in every dialog, and keep idle sessions alive.

Highlights

Jump host (ProxyJump)

Connect to a target through a bastion. Set a Jump Host (with optional port and username) on a session and the connection is tunneled over an SSH session to the jump host first, exactly like OpenSSH's ProxyJump. The jump host's credentials bind to the encrypted vault the same way the target's do — the session stores only a reference, never a secret. Validated end to end against a Cisco core reached through a Linux bastion.

Vault credential pickers everywhere

Every session dialog — Add Session, Edit Session, and the Session Editor — now has a credential dropdown for both the target host and the jump host. Pick a saved credential by name; TetherSSH stores the vault reference, prefills the visible auth fields for confirmation, and offers to unlock the vault if it's locked. Previously only the Edit Session dialog had a picker, and the others required typing a raw credential ID nobody memorizes.

Quick Connect is the primary button

The sidebar's main button now opens Quick Connect directly, dropping the redundant select-a-session-then-connect step — the session tree already connects on its own.

SSH keepalive

Sessions now send keepalive@openssh.com requests over TCP-level keepalive and drop only after several missed replies, so long-idle router and switch sessions no longer time out mid-task. The interval is a built-in default for now; a user-facing control is planned.

Notes

• Backward-compatible session files. The new jump-host fields are written only when set, so existing session YAML round-trips unchanged.
• Jump-host auth currently supports key and password (resolved from the vault). Agent-based and keyboard-interactive jump auth are not yet wired.

See the README for full details.

v0.3.2 — Faster alternate-screen rendering

Full-screen terminal apps now render through the same incremental, diff-based path as the standard shell view, instead of repainting the whole grid every frame. The result: htop, btop, and vim are responsive, including on Windows, where the old full-repaint approach issued roughly one GPU draw call per cell every frame and bogged down busy TUIs. If you read one line: open btop and it just works now.

What changed

• Incremental alternate-screen rendering — full-screen apps repaint only the cells that change between frames. An idle frame costs nothing; a meter tick updates a few dozen cells instead of thousands.
• Backgrounds render correctly in full-screen mode — SGR backgrounds, reverse-video cells, and the selection highlight are drawn by the shared seam-free overlay in both standard and full-screen modes, so htop's header/meter bars and btop's gradient blocks paint as intended.
• Unified color resolution — bold text resolves to its bright variant in both modes, with bold-black promoted to a legible color so htop's primary process rows stay readable on dark themes.

Docs

• New Rendering Architecture section in the README covering the two-layer draw model, the incremental diff, and how both modes share one render pipeline.
• README currency pass: corrected file names in the project layout, refreshed the rendering-related feature/roadmap/known-issue entries, and updated Appendix A (the dual render path).

Upgrade notes

No configuration or session-file changes. Drop-in replacement for v0.3.1.

Known issues

• At fractional display scaling (1.5x/2x) with a non-default per-tab font size, adjacent cell backgrounds can show faint seams; at the default font size there are none.
• SSH agent support and host-key verification are still not implemented.

Still in progress

• Consolidating the remaining legacy render path into the unified one and re-enabling repaint coalescing (see Appendix A in the README).

Full changelog: v0.3.1...v0.3.2

v0.3.1 — Terminal engine hardened (btop runs clean), faster rendering, menu-driven UI

TetherSSH v0.3.1

First release since v0.2.0 — this covers the full span. The headline is the
terminal engine itself: gopyte is now robust enough to run btop cleanly,
which exercises nearly every part of the emulation path at once (256-color and
truecolor, wide/combining characters, dense alternate-screen redraws). Getting
btop right is the proof point for the whole engine.

Terminal engine (gopyte)

• btop runs at full fidelity — the wide-character stress test that
  surfaced and then validated a stubborn wide-char handling bug. Clean btop
  rendering exercises the entire emulation path: alternate screen, truecolor,
  Braille sub-cell graphs, and high-frequency redraw.
• Major wide-character fixes. Correct UTF-8 rendering for multibyte glyphs,
  including those whose bytes overlap 8-bit C1 control codes (Braille, CJK,
  emoji). High bytes (0x80–0x9F) are treated as text rather than control
  introducers, and multibyte sequences split across network reads are
  reassembled instead of corrupted.
• Full color support — 16-color, bright/AIXTERM, 256-color (6×6×6 cube +
  grayscale ramp), and 24-bit truecolor, all mapped through the active terminal
  theme.

Rendering

• Incremental, flicker-free standard-mode rendering — each redraw diffs
  against the on-screen grid and repaints only changed cells, driven by a
  single coalesced update pass on a timer rather than one repaint per byte.
• Selection and SGR cell backgrounds rendered directly on the terminal grid,
  so the selection highlight is visible in both standard and full-screen
  (vim/htop) modes.

UI

• Menu-driven interface. The old toolbar button row is replaced by a
  window menu bar (File / Edit / Tools) — native top-of-screen on macOS,
  in-window on Windows/Linux.
• Session manager enhancements. Full folder/session management from the
  tree itself — right-click for Connect / Edit / Duplicate / Move to Folder /
  reorder / Delete on sessions, and New Session / New Folder / Rename / reorder
  / Delete on folders. Stable per-session identity means reordering, moving, or
  renaming never disturbs an open tab. Real-time search/filter, collapsible
  folders, and an optional compact (icon-less) tree.

v0.3.1 fixes (since v0.3.0)

• Backspace no longer corrupts the prompt. BS (0x08) is now a
  non-destructive cursor-left move. It previously cleared the cell it landed
  on, scrambling anything the shell emits as a run of backspaces (left arrow,
  Ctrl-A to line start, mid-line edits).
• Ctrl-A / Ctrl-Z / Ctrl-Y reach the remote shell on Linux and Windows.
  The GUI toolkit was capturing these as Select-All / Undo / Redo; they're now
  forwarded to the PTY (0x01 / 0x1A / 0x19), restoring readline
  beginning-of-line, job suspend, and yank.
• Edit Session dialog — restored a working Password field and correct
  auth-type toggling (it previously had no password field and could wipe
  stored auth on save), and added a Vault Credential picker that stores only a
  credsid reference.
• Close Other Tabs / Close All Tabs in the terminal right-click menu, with
  a single batch confirmation.
• Help menu with About; session tree now starts collapsed.

---

Full feature list and architecture notes: see README.

TetherSSH

v0.2.0

cleanup