# ClawSSH MVP

Windows-first SSH client prototype with encrypted cloud-sync plumbing.

## What works in this MVP

- Host list with groups, notes, username, port, password/private-key auth metadata.
- Interactive SSH terminal powered by Electron + `ssh2` + xterm.js.
- Local vault persistence via Electron Store.
- AES-GCM client-side vault encryption using PBKDF2-SHA256.
- Cloud sync API contract: upload/download encrypted vault only. The sync server never sees plaintext host passwords or private-key passphrases.
- Tiny development sync server: `npm run sync-server`.

## Run locally

```bash
npm install
npm start
```

## Build

On Windows:

```bash
npm run dist:win
```

On Linux/macOS without Wine you can still create `dist/win-unpacked` but NSIS/portable packaging requires Wine. In this workspace the unpacked Windows app was zipped manually as:

```text
dist/ClawSSH-win-unpacked.zip
```

Unzip on Windows and run `ClawSSH.exe`.

## Sync server for testing

```bash
SYNC_TOKEN='replace-this-token' npm run sync-server
```

Client sync settings:

- Endpoint: `http://server-ip:8787`
- Token: `replace-this-token`
- Master password: user-chosen encryption password

Endpoints:

- `GET /health`
- `GET /api/v1/vault` with `Authorization: Bearer <token>`
- `PUT /api/v1/vault` with body `{ "encryptedVault": {...} }`

## Security notes

This is a prototype. Before production use:

- Add OS keychain integration for local secrets.
- Add host key verification UI and known_hosts persistence.
- Do not store raw passwords in the unencrypted local vault by default; make locked mode the normal mode.
- Add sync conflict resolution and device metadata.
- Add automatic lock timeout.
- Add signed Windows builds.