Built for people who live in a terminal.

Real SSH

A genuine SSH connection — PTY + shell, password and key auth (Ed25519, ECDSA, RSA), and live terminal resize. Verified end-to-end against a real sshd.

Mosh

A first-party, clean-room Mosh transport — SSH-bootstrapped UDP sessions that stay responsive on high-latency links, roam across Wi-Fi and cellular, and resume after the app is backgrounded or restarted. Outbound datagrams are padded to fixed-size buckets so an on-path observer can't read activity off packet lengths.

Eternal Terminal

A first-party, clean-room Eternal Terminal (ET) transport — it bootstraps over SSH, then survives socket drops and IP changes by re-attaching the same session and replaying exactly the gap, with no byte lost. Choose SSH, Mosh, ET, or auto per host.

SFTPPro

A built-in SFTP file browser — upload, download, make, rename, and delete on the host, with honest transfer progress, cancel, and safe filenames.

Port forwardingPro

Local (-L) and remote (-R) TCP forwards per host — over the SSH channel, or natively over an ET session — with a live per-session panel showing the bound port and connection count.

Add a host, five ways

By hand, from Bonjour on your LAN, by scanning a QR code, from your SSH config, or straight from Tailscale — paste a tailnet token and every machine on your tailnet is one tap away, with a TAILNET badge.

Reliability

The whole connect runs under a deadline so a stalled server can't pin the UI. TCP keepalive plus an SSH-level probe detect silently dead connections, a wrong credential is reported instantly, and every dead end has a reconnect affordance.

Trust & safety

Host-key trust-on-first-use with a loud changed-key warning, per-host permission for OSC 52 remote clipboard writes, and confirmations before destructive deletes.

Remote approve / denyPro

A host-side permission hook blocks your AI coding agent and long-polls Termoire's relay; you approve or deny from the notification, inbox, Fleet, or the lock screen — sealed end-to-end, the relay never reads the decision. There is no auto-approve: every answer is a manual human tap.

FleetPro

A live board of every agent session across your hosts — terminal thumbnails on every row, Needs-you / Working / Done filters, search, and per-row actions (focus, approve/deny, rename, reconnect), on iPhone, iPad, and Mac.

ChatPro

Read an agent's session as native chat, tailed live from the host, with markdown rendering. Reply from a composer that drives the running process (never a separately-billed headless call), dictate replies on-device, and optionally have them read aloud.

15 agent CLIsPro

Claude Code, Codex, OpenCode, Gemini, Factory Droid, Grok, Qwen, Copilot, Cursor, Kimi, pi, Oh My Pi, Amp, Goose, and Crush — each integrated on an honest capability tier (full remote approve/deny, notify-only, or read-only), never faked.

Usage & costPro

Per-provider context and rate rings — including Codex's real server-reported rate limits — plus session cost from each CLI's own token usage against a bundled models.dev price table. Unknown models show tokens only, never a guessed dollar.

Live ActivityPro

The active agent turn on your Lock Screen and in the Dynamic Island — Working, Needs you, Done — in the filament house style; tap to jump straight to that session.

On-device AIPro

Apple Foundation Models, entirely on-device: natural-language → command, explain & fix the last error, AI commit messages, session names, and away summaries. Every result lands un-submitted for review, and nothing leaves the phone.

AutomationsPro

Rules that react to agent-attention events and run a snippet or insert a command — always shown with a 5-second cancel before they fire, and deliberately never an auto-approve.

Session recordingPro

Record any terminal tab to a standard asciinema cast, straight off the shared output tap. Typed input is not recorded unless you explicitly opt in.

Send to AgentPro

One tap pastes a git diff, a file's contents, or the scrollback's last error into the agent's prompt — as a single bracketed, un-submitted paste that can never execute line-by-line.

Diff, repo & previewPro

A git diff viewer (unified or side-by-side), a read-only repo browser at any branch/tag/commit, and a one-tap localhost web preview — each over a dedicated, non-interactive SSH channel.

Metal engine

A fully native app: a Metal-rendered terminal (the Ghostty engine, now on iOS and macOS, with SwiftTerm as an automatic fallback) themed to match the chrome exactly, with GPU-smooth pixel-scrolling, low-latency input, and live font-size control.

31 themes

31 palettes — Filament Dark/Light, Dracula, Nord, Gruvbox, Tokyo Night, Catppuccin, Solarized, Rosé Pine, Everforest, Kanagawa, Synthwave, Matrix, plus accessibility sets (AAA High Contrast and the color-blind-safe Wong palette), with paired light/dark variants and a follow-system option. The whole app re-tints live.

Themed app iconsPro

Alternate Home-Screen icons tuned to the palette — Dracula, Nord, Gruvbox, Synthwave, Matrix, Solarized.

Custom fontsPro

Import your own monospace fonts for the terminal, alongside the bundled defaults.

Tabs

Multiple concurrent sessions that stay alive across switches, with per-session status. Hardware shortcuts throughout: ⌘T, ⌘W, ⌘K, and ⌘1–9.

Keyboard row

A themed, data-driven accessory bar with esc, a sticky ctrl, tab, arrows, the pipe / tilde / slash / dash cluster, ^C, and paste. The ribbon arrows and backspace press-and-hold to auto-repeat, mode-aware for full-screen TUIs like vim and htop.

AI-agent keys

A compact AI cluster on the keyboard bar — esc esc to interrupt, ⇧Tab to cycle agent modes, and / — purpose-built for driving CLI coding agents from the soft keyboard by touch.

Predictive echo

Speculative local echo: typed characters paint instantly as a dim, theme-tinted ghost before the remote echo round-trips, then reconcile against authoritative output — hiding latency on slow or cellular links, invisible on a fast one. On iOS and macOS.

Voice dictationPro

A mic on the keyboard ribbon and in the chat composer, with Apple's on-device recognition and a staged-review overlay. A privacy mode forces recognition entirely on-device.

Snippets

Reusable commands with {{placeholder}} prompts, inserted from a searchable palette and managed in Settings.

Hosts

Grouped, searchable host cards with recents; add, edit, delete; per-host icon, accent, tags, and auth method. Corrupt library files are quarantined, never silently reset.

Keys

Generate Ed25519 keys or import existing ones — Ed25519, ECDSA P-256/384/521, and RSA, in OpenSSH, PEM, or PKCS#8 containers, encrypted or not. Keys live in the Keychain with SHA256 fingerprints and public-key export, and key-based connect is Face-ID-ready.

Secure Enclave keysPro

Generate a non-extractable P-256 key inside the device's Secure Enclave, with an optional per-signature Face ID binding — the private scalar never leaves the chip.

iCloud syncPro

Opt-in iCloud sync keeps your hosts and preferences in step across devices via CloudKit. Biometry-gated secrets stay device-bound and are never synced.

App LockPro

Lock the whole app behind Face ID / Touch ID on iPhone, iPad, and Mac; deep links and Shortcuts that arrive while locked are deferred until you unlock.

Settings

Reorganized into short category subscreens — Appearance, Keyboard & Snippets, Keys & Security, Sync, Agents & notifications, and Connection.

Universal

Compact width gets a navigation-stack layout; iPad keeps the split view and adds Stage Manager, multi-window, and drag-a-tab-into-its-own-window. Ghostty runs natively on Apple-Silicon Macs. Sessions stay alive across width changes.

Widgets & Shortcuts

A Quick Connect widget (free) and an Agent Status widget (Pro) on the Home and Lock Screen, plus App Intents, App Shortcuts, and cross-device Handoff.

Apple WatchPro

A companion app for glanceable agent status and Approve/Deny from the wrist. The watch never holds SSH credentials — decisions round-trip through the phone's sealed approval path.

Dynamic Type

Chrome fonts scale with the system Larger Text setting; the terminal keeps its own size control. Accessibility is covered by automated VoiceOver, Dynamic Type, and Reduce Motion tests.

Private by default

Keys and passwords live in the device Keychain, and the terminal has no backend. Background agent push and iCloud sync are strictly opt-in — and even then only what an agent hook already emits leaves your host.