rootshell: Local Terminal, SSH

rootshell is a desktop-class terminal emulator built on libghostty — the GPU-accelerated engine behind the Ghostty desktop terminal. A local shell on every platform, native SSH, mosh-compatible roaming, tssh, system-wide VPN, native git, and Metal rendering in a single app.

METAL-ACCELERATED TERMINAL
Built on libghostty's Zig core with direct Metal rendering via CAMetalLayer. Smooth scrolling, zero-flicker synchronized output, and full mouse capture for tmux, vim, and zellij. Tabs, split panes, and persistent scrollback across app restarts.

THREE REMOTE PROTOCOLS, ONE APP
• SSH — Native Swift SSH client with Ed25519, ECDSA, RSA, and post-quantum ML-KEM + ML-DSA for harvest-now-decrypt-later protection. Jump hosts, port forwarding, agent forwarding with per-request approval, and Keychain password storage.
• Rootshell Roam — Mosh-compatible sessions survive network changes and app restarts. Multipath TCP bonds WiFi and cellular so you never drop a link. Predictive local echo keeps typing responsive on high latency. STUN-based NAT traversal punches through firewalls.
• tssh integration with QUIC (TLS 1.3) and KCP transport for lower latency, full native scrollback, and server-side session resumption.

SSH VPN
Turn any SSH or tssh session into a system-wide VPN. Route all device traffic through your remote server over standard SSH, QUIC, or KCP transport. No extra software on the server — if you can SSH to it, you can VPN through it.

NATIVE GIT
Clone, commit, diff, log, blame, branch, fetch, pull, push, cherry-pick, rebase, and worktree — all implemented in native Swift with SSH transport. Syntax-highlighted pager output, Helix integration for commit messages, and optional AI-generated commit messages from staged diffs.

VOICE AI AGENT
Talk to an always-on assistant over Gemini Live with sub-second latency. The agent reads scrollback, runs commands over SSH hands-free, searches the web, and asks permission before anything risky — debug a server by voice.

OPTIONAL TEXT AI
Chat with Claude, ChatGPT, Gemini, or 400+ models via OpenRouter. Execute commands and analyze output. Optional — bring your own API key.

HARDWARE SECURITY KEYS
Private keys never leave hardware. FIDO2/WebAuthn authentication with touch-to-sign.

SANDBOXED LOCAL SHELL
A full local shell with vim 9.1, Helix, SFTP, SCP, curl, jq, mtr, and standard Unix utilities. The rf br