Community

Hatoba: Open-Source SSH Client with AI Assistant and Encrypted Sync

Hatoba is an open-source SSH client that integrates an AI assistant and end-to-end encrypted sync through a user's Cloudflare account, centralizing management of hosts, keys, and terminal sessions.

AI-generated editorial illustration of the article topic; not a photograph, product screenshot or measured result.

Overview of Hatoba's Features

Hatoba is an open-source desktop SSH client that integrates an AI assistant and end-to-end encrypted sync through your own Cloudflare account, as described on its website. The tool centralizes management of hosts, keys, and terminal sessions, allowing users to sync these across devices securely. A notable feature is the AI assistant, which appears as a panel beside each terminal. This assistant can read the screen, execute commands, edit files, and even search the web, according to the documentation. Additionally, Hatoba supports port forwarding, enabling local forwards that initiate with the connection, as noted in the project's details.

Security and Encryption Implementation

Security and encryption are central to Hatoba's design, ensuring user data remains protected at all times. According to Hacker News Show, all data is encrypted on the user's device before transmission, meaning even if a Worker, D1 database, or Cloudflare account were compromised, only ciphertext would be exposed. Hacker News Show highlights that keys are derived from the user's master password using Argon2id, and every item is encrypted with AES-256-GCM prior to storage or syncing. This approach minimizes the risk of sensitive information being accessed by unauthorized parties. Additionally, Hacker News Show notes that host addresses, passwords, and keys are only sent to the provider when they appear on the screen, in a tool result, or as part of an attachment. This ensures that sensitive data is not unnecessarily exposed during normal operation.

Deployment and Sync Backend

Deployment of Hatoba's sync backend involves setting up a Worker and a D1 database on your Cloudflare account. According to Hacker News Show and Hacker News Show, this process is typically handled once and is compatible with the free Cloudflare plan for personal use. Hacker News Show notes that Hatoba can automate this deployment using a Cloudflare API token, or users can deploy the components manually via a one-click browser option or the wrangler tool. After deployment, the first device must connect to the Worker URL using a setup token generated during the process. This approach ensures that users maintain control over their infrastructure while leveraging Cloudflare's scalable backend services.

AI Assistant Functionality and Privacy Considerations

Hatoba, an open-source SSH client, integrates an AI assistant that operates alongside each terminal session. This assistant can read terminal output, execute commands, edit files, and even search the web, providing a hands-free approach to remote server management. According to the project's documentation, the AI assistant sends messages, attachments, and terminal screen content to the model provider unless the user disables this feature. Additionally, host addresses, passwords, and keys are only transmitted to the provider if they appear on the screen, in tool results, or in attachments sent by the user. Privacy considerations are central to the design, with users having control over what data is shared. However, the project explicitly states that these privacy measures depend on the model provider's handling of the data, and users are advised to review the provider's policies for full transparency.

Installation and Build Requirements

To install Hatoba, developers must first ensure their system meets the necessary requirements. The project requires Rust stable, Node.js 22 or later, and pnpm. On Windows, additional dependencies such as WebView2 are required, which is included in Windows 11. macOS users need the Xcode Command Line Tools, while Linux users must install Tauri system dependencies, including libwebkit2gtk-4.1-dev. Once the prerequisites are met, users can proceed with the installation by running pnpm install, followed by pnpm tauri dev to start the development server. For building the application, the command pnpm tauri build --no-sign generates platform-specific installers: an NSIS installer for Windows, a deb package, and an AppImage for Linux. Note that these builds do not include update signatures, which are only present in official release builds.