Release Notes: GETSSH v2.0.0_R7K4S - Physical-Layer Security & The Rust Rebirth
⚠️ NOTE: This massive v2.0 cross-version update contains an overwhelming amount of underlying refactoring and security hardening. This document only highlights the core features. For the most detailed, hardcore changelog, please refer to the Full Changelog page.Welcome to the new era of GETSSH v2.0.
If the 1.x era was our ultimate exploration of terminal aesthetics and multi-protocol control, v2.0 is a complete, radical rebirth of GETSSH from its underlying logic to its security architecture. We introduced a Rust native core and completely refactored the foundation for one single goal: To build the most secure modern SSH client in history.
🦀 The Rust Native Core — Fully Completed
This is a milestone version that completely overhauls the underlying architecture of GETSSH. We have officially decoupled the core performance-sensitive paths of GETSSH from Node.js / V8 and handed them over to Rust Native Extensions (N-API).
- Sector 1: Process Guardian (Watchdog)
- Independent Daemon:
rust-core/watchdogruns as an independent binary daemon, communicating with the main process via Unix Domain Sockets/Named Pipes for heartbeat monitoring. - 60-Second Physical Kill: If intercepted by RASP or if the main process freezes and times out, the Watchdog will use OS-level APIs to physically kill the Node.js process—completely bypassing the JS layer, accompanied by a system notification.
- Independent Daemon:
- Sector 2: Local Credential Encryption (Vault)
- AES-256-GCM Hardware-level Encryption: The underlying
getssh-vaultN-API extension implements physical-layer encryption/decryption ofprofiles.enc, completely eradicating the vulnerabilities of the Node.jscryptomodule. - Master Password & Biometric Dual Gate: Integrated PBKDF2 (100,000 iterations for key derivation) with the macOS Touch ID verification chain.
- AES-256-GCM Hardware-level Encryption: The underlying
- Sector 3: System Metrics Probe (Sysprobe)
- Collects CPU, memory, network, and disk metrics directly at the OS level, completely stripping away the
node:osdependency. This eliminates V8 serialization overhead, reducing UI stutter rate to zero.
- Collects CPU, memory, network, and disk metrics directly at the OS level, completely stripping away the
- Sector 4: Hybrid SFTP Engine
- Zero-Copy Network Stream: Takes over large file transfers. Node.js handles network negotiation, while Rust handles heavy I/O streaming directly to disk, entirely bypassing V8 heap memory and ending OOM crashes once and for all.
🔥 Eradication of the adm-zip Memory Cancer (getssh-unarchive)
- New
getssh-unarchiveRust N-API: Completely deprecated the pure JS libraryadm-zip. Files are now streamed directly to disk. No matter how large the plugin package is, the memory peak is constantly suppressed below 10MB. - Military-Grade Zip Slip Physical Block: The Rust layer strictly inspects path traversal characters (
../). If malicious entries are found, it immediately triggers a circuit breaker and destroys the remaining extracted files.
🛡️ V2.0 Plugin SDK Security Sandbox (Plugin Sandbox)
ctx.net.fetchDual Network Defense: Injected a secure fetch interface into the background VM sandbox. The underlying Fetch interceptor absolutely forbids requests to local loopback addresses and private IPs (SSRF Prevention).ctx.host.clipboardAudited Visual Clipboard: When a plugin reads the clipboard, it forces a native OS notification to pop up, preventing silent data theft.ctx.ui.registerSettingsForm Injection: Allows background plugins to register strongly-typed Schemas and dynamically render hot-reloaded forms on the frontend.- Immersive Webview Panels: Introduced sandboxed fullscreen rendering for plugins, deeply taking over the main workspace view.
- Codebase-Wide Security Hardening: Blocked IPC path traversal vulnerabilities (
../../backtracking attacks), fixed arbitrary directory installation vulnerabilities for plugins, and forcibly locked SFTP write paths (preventing malicious autostart script injections).
🏗️ Ultimate Leap in Infrastructure
- React 19 Core Engine Hot Replacement: Fully upgraded to the React 19 concurrent rendering model, refactored the entry point, completely purged
forwardRefwrappers, and upgraded Lucide icons and testing libraries. - Tailwind CSS v4 Engine Leap: Deprecated
tailwind.config.jsand switched to a pure CSS native configuration scheme, unleashing the next-generation lightning-fast build engine. - Electron 42 & Node 22 Ultimate Crossover: The foundation was raised to Electron 42.3.0 and Node 22, comprehensively dealing with API breaking changes and unlocking the latest V8 features.
📟 Xterm.js and TypeScript Hardline Defense
- N-API PTY Reborn: Abandoned obsolete cross-compilation solutions and fully returned to the official
node-ptyN-API pre-built library. - WebGL/Canvas Smart Fallback: Prioritizes WebGL. If the GPU context is lost, it seamlessly falls back to the Canvas renderer without disruption.
- TypeScript 6.0 Strict Defense: Locked the global Target to ES2023, enforced
strict: true, fixed 70+ historical implicitanyand null pointer hazards, achieving a 100% zero-error compilation.
📦 Cross-Platform Production Package Size Limit
- The 101 MB (ARM64 DMG) Miracle: By stripping out useless multi-language
.pakpackages inelectron-builder, physically tree-shaking pure JS dependencies into native fusions, and shielding N-API build waste, we squeezed out the physical size limit of a package containing the massive Electron 42 core. - ASAR Physical Stripping: Completely stripped all Rust
.nodeextensions out ofapp.asarto ensure no DLL dynamic loading errors occur. - macOS Hardened Runtime: Injected entitlements, perfectly circumventing sandbox crashes and execution blocks on macOS 10.15+ systems.
📦 Artifacts Matrix
| Operating System (OS) | CPU Architecture (Arch) | Filename | Target Notes |
|---|---|---|---|
| 🪟 Windows | x64 (Standard 64-bit) |
GETSSH-Setup-2.0.0_R7K4S-x64.exe |
Universal installer for most Intel / AMD desktop devices |
ARM64 (Microsoft New Ecosystem) |
GETSSH-Setup-2.0.0_R7K4S-arm64.exe |
Natively optimized for Windows ARM laptops like Snapdragon X Elite / X Plus | |
| 🍏 macOS | ARM64 (Apple Silicon) |
GETSSH-2.0.0_R7K4S-arm64.dmg |
Highly Recommended! Native max-performance experience for M1/M2/M3/M4 chips |
x64 (Intel Architecture) |
GETSSH-2.0.0_R7K4S-x64.dmg |
For older Macs ( |
|
| 🐧 Linux | x64 (Standard 64-bit) |
GETSSH-2.0.0_R7K4S-x64.AppImage |
Portable version for modern Linux distros (Ubuntu, Fedora, Arch, etc.) |
ARM64 (Mobile/Embedded) |
GETSSH-2.0.0_R7K4S-arm64.AppImage |
Portable version for ARM64 Linux laptops, Raspberry Pi, etc. |
💻 Compatibility Base (Hardware & OS)
To ensure that the Rust native N-APIs, Watchdog, and extreme glassmorphism rendering can squeeze out every last drop of hardware performance, GETSSH v2.0.0 sets the following hardcore baselines. Please verify your machine configuration before deployment:
| Operating System (OS) | Min OS Version | Arch Base | Recommended RAM / Disk |
|---|---|---|---|
| 🪟 Windows | Windows 10 (22H2 / Build 19045+) Windows 11 21H2 or higher |
x64: Intel Core 10th Gen / AMD Ryzen 3000 and above ARM64: Snapdragon X Elite / X Plus |
Min 4GB RAM 250MB Free Disk Space |
| 🍏 macOS | macOS 11 (Big Sur) Recommended macOS 14 (Sonoma)+ |
ARM64: Full native support for M1 / M2 / M3 / M4 series x64: Intel Core i5 / i7 ( |
8GB Unified Memory 300MB Free Disk Space |
| 🐧 Linux | Ubuntu 22.04 LTS / Debian 12+ Fedora 39+ (Glibc 2.35+) |
x64: Standard 64-bit Intel/AMD processors ARM64: Raspberry Pi 4/5 or ARM64 soft routers |
Min 4GB RAM 200MB Free Disk Space |
⚠️ Ultimate Execution Tip: Given that GETSSH is powered by a high-performance Chromium container, Node.js runtime, and Rust physical memory guards, the system has completely cut off compatibility for all 32-bit (x86/ARM32) legacy systems. Do not forcibly double-click on "antique" machines or streamlined systems below the baseline, as this may trigger physical crashes of Native binary drivers or Watchdog self-destruction!
🍏 macOS Users Exclusive: Gatekeeper Bypass Guide
Since independent open-source projects do not pay Apple "protection fees" (unpurchased official developer certificate signatures) during packaging and distribution, macOS's default malware protection mechanism (Gatekeeper) will intercept you upon your first double-click, popping up a breaking warning: "Developer cannot be verified" or "App is damaged and should be moved to the Trash".
This is a normal security policy. Please use the following two geek methods to easily bypass it and pass smoothly:
🛠️ Method 1: Right-Click Breach & System Settings Overload (GUI)
- Hardcore Right-Click Open: After downloading and extracting (or mounting the DMG and dragging into Applications), do not double-click directly. Find
GETSSH.appin Finder, hold down the Control key while right-clicking, and select "Open" in the context menu. In the subsequent warning popup, the system will make an exception and expose an additional "Open" button. Click it to permanently write to the trust chain. - Security Panel Release: If the above operation fails, directly open the system's "System Settings" -> "Privacy & Security", scroll all the way down to find the "Security" core section. You will see an exclusive prompt: "GETSSH.app was blocked from use because it is not from an identified developer". Fearlessly click "Open Anyway" below it and verify your Mac lock screen password/fingerprint to unlock full blood.
💻 Method 2: Terminal One-Liner Attribute Stripping (Destroy "App is damaged" error)
If you double-click after dragging the app into the system's Applications directory and it still forcibly reports an error prompting "App is damaged and cannot be opened", this is the local Quarantine attribute forcibly imposed by the Apple system on unsigned assets.
Directly open your Mac's Terminal, copy, and type the following command:
sudo xattr -rd com.apple.quarantine /Applications/GETSSH.app⚠️ Ultimate Warning: macOS Intel Architecture & Rosetta 2 End-of-Life Countdown
Developers who always stand at the forefront of technology, please note that Apple has officially announced the final timeline for its years-long architecture migration. This change will directly affect all Mac users and the cross-platform compilation ecosystem:
- Hardware Retirement: The current macOS 26 (Tahoe) has been officially confirmed as the last operating system to support Intel chip Mac hardware. Future macOS 27 and subsequent systems will completely transition to Apple Silicon (M-series chips) exclusively, and older Intel Macs will miss out on new system updates.
- Translation End: Although the upcoming macOS 27 will continue to retain the Rosetta 2 runtime to allow Apple Silicon users to trans-run traditional x64 applications, Apple has clearly notified that the universal Rosetta 2 architecture translation layer will be completely removed/disabled in macOS 28, scheduled for release at the end of 2027. By then, all Intel architecture binary programs that have not been natively adapted for ARM will be completely unopenable on the latest macOS systems.
GETSSH Official Important Notice:
- Complete Physical Migration Early: We strongly recommend that all geeks still using old Intel machines upgrade their physical devices to Apple Silicon (M-series ARM architecture) as soon as possible to obtain the ultimate performance, complete protocol bus, and future highly scalable plugin sandbox experience.
- Deprecation Countdown Normalized: As upstream bottom-layer compilation dependencies gradually cut off cross-compilation support for the x86-64 architecture on the macOS platform, GETSSH will conduct its final lifecycle maintenance while maintaining basic stability. Once the upstream open-source chain completely cuts supply, GETSSH will synchronously go offline and permanently stop compiling and distributing macOS Intel (x64) standalone installer packages.
🔮 Roadmap Foresight
GETSSH never stops at just being a terminal; our journey is the sea of stars. Regarding future plans such as Workspace physical isolation in version 2.1, the plugin ecosystem market, and SSH jump servers, please head over to the complete roadmap page:
(对于中文用户：请访问我们的 中文路线图)