Host Editor and Encrypted Secrets
Edit hosts in a clean form; passwords are sealed with AES-256-GCM and a key kept in the macOS Keychain.
New Host, or Edit in the menu of a host, opens the host form, a dialog over the workbench. The fields are label, host, port, user, password, key (a private key or an .env file, picked with the system panel, with a hint of what it accepts), parent, Connect through parent (a switch), group ("Follows its parent" for a host that has one), VPN, color and icon. Save keeps it; Cancel or Escape leaves everything as it was.
Every other editor of the app is the same kind of form: VPNs, AI sessions (Edit, Move or Rename), groups and Settings. A new group gets the folder icon unless another is picked.
The password is masked; the eye at its end shows it. Before it reaches the local database it is sealed by the app's vault with AES-256-GCM. The master key of release builds is created once and kept in the macOS Keychain. Nothing secret is ever written to the log.
Group, VPN and parent are drop-downs. The color uses the system color picker, and the icon comes from a grid of server, database, cloud, web, security and other symbols.
What it does
- A form dialog, the same for hosts, VPNs, AI sessions, groups and Settings.
- Password or key file per host; .env key files with KEY= and PASS=.
- AES-256-GCM sealing, master key in the Keychain.
- Parent, jump-through-parent, group, VPN, color and icon per host.
How it behaves
- Editing or deleting a host closes its file connection, so new settings apply at once.
Why it matters
- Credentials stay encrypted at rest and never touch a command line.