Conchshell

What it refuses to do

Most of this page is about a single idea: a program that holds your production credentials should be built so that a bug in its interface cannot hand them out. Everything below is enforced in the Rust core, not by the interface agreeing to behave.

Four refusals — on the left, what the app actually prints; on the right, what it saves you from

// the app, when a stored key changes The identity of prod.example.com:22 has CHANGED Previously trusted: SHA256:Kkz0CCPBnHsPKEmiy2XisyDgW8bem/j8shCgWfqL4yA Offered now (ssh-ed25519): SHA256:fMHSkV5cnwiy+ETp4qYLKLjWIEC2RrVWngecUi88WvM [ Cancel ] [ Replace key ]

Approving a host key is not the app's decision

That box is drawn by your operating system, not by the application window. A compromised interface cannot repaint it, cannot click it, and cannot make a key replacement look like a first connection. The safe button is the one the keyboard reaches first.

// every IPC command the interface may call vault_store_secrets → ok vault_delete_secrets → ok vault_has_secrets → true | false // there is no vault_get_secret. There never was.

The interface can store a password and delete it — never read one

Credentials are decrypted in the Rust core, at the moment a connection opens, and handed to the socket. No interface code path can enumerate your vault, because no command exists that would answer.

// a saved credential, asked to go somewhere else Refusing to use this connection's saved credentials for root@10.0.0.5:22. They were saved for a different address.

A stored password only goes where it was stored for

Every credential is bound to its whole route — host, port, user, proxy and jump host. Redirect the connection and the credential stays behind, even when the request comes from inside the app.

// a window that renders a remote file window: file-viewer-1754239900 7 commands window: rdp-prod-1a2b3c4d 7 commands window: main all of them Refusing IPC command `trust_server_identity` from window `file-viewer-1754239900`.

A window showing a remote file gets seven commands, not ninety-five

Pop-out windows render content that arrived from a machine you do not control. They are allowed exactly what they need and nothing else — a rule enforced in the core, not by the window agreeing to behave.

Checkable, not promised

The vault format is documented, the source is public, and every claim on this page corresponds to code you can read. Nothing here has been audited by anyone outside the project — that is worth knowing before you decide how much to trust it.

Vault format →