01 / Perceive
Read the environment
Workspace, connected host, distribution family, recent terminal output and command blocks enter context before each turn.
Terminal · SSH · AI Agent
The AI works in
your real terminal
Commands are typed into your real shell and echoed at the prompt. Writes are classified, gated by an approval card, and reported with their real exit code. Local, WSL and SSH — one window.
- 25
- operations tools
- 8
- Linux skills
- 15
- terminal themes
- 3
- processes
Remote file tree · real terminal · AI operations assistantWindows x64 · Tauri 2 + Rust · Strands Agent
Execution Loop
From one sentence to one real command — no black box in between
The agent does not hand you a command to copy. It writes into the PTY / SSH channel of the current session, lets the remote shell echo it, then ties the real output back to the tool card that produced it.
02 / Plan
Planning is visible
Multi-step work starts as a task list synced to the top of the conversation; the loop shows "turn N · M tools used".
03 / Act
Typed into the real shell
In visible mode the command is written character by character and echoed at the prompt; a background SSH channel is also available.
04 / Verify
Writes are re-checked
Every write asks for a read-only verification; output, exit code and duration join the evidence chain, and a non-zero exit is always a failure.
05 / Remember
Kept in the workspace
Conversations in one workspace share long-term memory: session summaries and successful troubleshooting cases are stored and recalled later.
Capabilities
Everything operations needs, in the same window
Terminal, remote hosts, AI assistant, knowledge base and teaching flow share one environment context — no copying facts between tools.
01
Agent runtime
- A single main agent driven by Strands Agents; the tool registry is the single source of truth for implementation, schema and policy
- 25 built-in tools: SSH execution, remote file read/write, log analysis, process inspection, network diagnostics, service / package / firewall management, security audit, performance analysis, knowledge search, config diff, backup and restore, Python execution
- At most 50 tool calls per turn, with a circuit breaker after 3 consecutive failures
- Falls back to a read-only notice when the model is unavailable; 10 minutes without output aborts the turn, the session stays alive
02
SSH management
- Pure-Rust SSH client (russh); password and public-key authentication, credentials in the OS key store
- TOFU host-key verification: unknown hosts raise an approval prompt, a changed key raises an alarm
- SFTP browsing and editing, drag-and-drop upload, a remote tree that follows
cwd - Local / remote / dynamic (SOCKS5) port forwarding; live server monitor for CPU, memory, disk, network and processes
03
Safety boundary
- Impact levels currently L0 / L2 / L3 / L4 (L1 kept for compatibility); unrecognised commands fail closed
- A hard denylist for catastrophic operations — blocked outright, with no "approve anyway" path
- Per-session approval FIFO: the next card is not shown until the previous command has returned
- Output is redacted before it reaches the UI, model context and logs; the SSH exit code is the hard result boundary
04
Local knowledge
- Indexes documents and notes already on this machine or imported by you; content volume depends on the device
- Session summaries and successful troubleshooting cases can be stored per workspace tag and recalled later
- FTS5 keyword search plus sqlite-vec semantic search, fused with RRF
- Retrieval runs locally; model reasoning still uses the provider you configure (local models excepted)
05
Workspaces and sessions
- A workspace is the isolation unit: it keeps its own windows, tabs and environment (local / WSL / SSH)
- The agent is isolated per workspace: a conversation only sees its own workspace and host
- Local memory is tagged per workspace; later conversations can recall stored summaries and successes
- The agent does not run outside a workspace — create one, then start the conversation
06
Terminal and editor
- Local PTY / WSL / SSH terminals share one xterm.js render pool, with split panes and multiple tabs
- Command prediction: bundled spec index, carapace completion, Chinese tldr descriptions, the remote shell's own command set
- CodeMirror 6 editor with LSP and remote file editing
- Offline selection translation, command snippets, 15 built-in themes
Trust Modes
One switch decides how far the agent may go
Modes are not prompt-level suggestions: observe mode removes write-capable tools from the schema, so the model cannot call a tool it never received.
| Mode | What the agent may do | Where it fits |
|---|---|---|
| Observe | Read-only analysis; write-capable tools removed from the toolset | Production inspection |
| Confirmdefault | Full toolset; recognised read-only queries run directly, unknown and state-changing calls raise an approval card each | Day-to-day operations, human in the loop |
| Auto | Low-risk (L0–L2) runs directly; L3/L4 still need approval and the hard rules cannot be bypassed | Trusted sandbox |
| Teach | Observe permissions plus the teaching UI; one single-step command card at a time, continuing after the real result returns | Classroom and self-study |
Safety Model
"The AI said it worked" is not evidence
Blocking, approval, circuit breaking and redaction are four independent lines of defence. None of them relies on the model's good intentions.
- Hard rules come first: a denylist hit is blocked, and rewriting the command does not help.
- Confirm is the default: each write waits for approval, and the card shows the real command, its purpose and its impact level.
- Exit codes are the fact: a non-zero or missing exit code is reported as failure, never dressed up as success.
- Evidence can be checked: tool calls are grouped as collect → act → verify, and the evidence comes from real tool events.
Risk classification and approval are not an operating-system sandbox: the local Python tool runs in a subprocess, and setting its working directory does not restrict all of its filesystem or network access.
In Action
The whole chain, end to end
Connect a server → the agent types the command into the real terminal → the approval card gates it → real output returns to the tool card → teaching mode runs it one step at a time.
The demo video could not load. Please refresh and try again.
- Create an SSH workspace and connect to the server
- Ask the agent to troubleshoot; the command is typed into the real terminal
- An approval card appears → confirm
- Remote output flows back into the tool card
- The file tree follows
cwd; drag a file to upload - Switch to teaching mode and run one command card at a time
Architecture
Three processes, one job each
System capability stays in Rust, interaction stays in the frontend, and AI reasoning plus knowledge retrieval live in a Python process that can be restarted on its own.
React 19Agent panel · terminal · workspaces · editor (TypeScript · Vite · Tailwind v4 · zustand)interaction
│ Tauri invoke / events
Rust (Tauri 2)PTY · SSH / SFTP · port forwarding · human-typing engine · sidecar supervisionthe only system surface
│ JSON-RPC over stdio
Python sidecarStrands agent · tool registry · approvals · knowledge · evidence chainrestartable on its own
Verification
Automated gates and native acceptance stay separate
Test counts move with the implementation, so no single run's numbers are treated as a feature claim.
| Gate | Scope | Release requirement |
|---|---|---|
| pytest | Python sidecar (agent, tools, approvals, knowledge) | Full suite passes |
| vitest | Frontend state, interaction and render contracts | Full suite passes |
| cargo test | Rust shell (PTY, SSH, typing engine, tunnels) | Full suite passes |
| tsc / eslint | Types and static checks | Zero errors, zero warnings |
Pending native desktop acceptance (requires a real SSH server and saved connection profiles): connect and history restore, per-session approval FIFO, the teaching command closed loop across success / non-zero exit / timeout / parallel cards, and distribution-aware completion.
Get Started
Run it from source
Requirements: Node.js ≥ 20, pnpm ≥ 9, stable Rust, Python ≥ 3.12.
# 1. install frontend dependencies pnpm install # 2. start the desktop app (first build takes 2–5 min) pnpm tauri:dev # on Windows you can also double-click 启动.bat
- Configure a model: Settings → Models, add an API key (DeepSeek, Zhipu, Qwen, Kimi, Doubao, Ollama or a custom OpenAI-compatible endpoint).
- Create a workspace: local, WSL or an SSH server; SSH credentials go to the OS key store.
- Start a conversation inside it: the agent only sees that workspace, and conversations in the same workspace share memory.
Runs from source today, with a Windows installer available. The installer is not Authenticode-signed yet, so SmartScreen may warn on first run — verify the SHA-256 first. See Releases for the latest build.
Documentation