Changelog

Desktop, phone and the sync server. This is the team-policy release (E1). A self-hosted sync server must be updated (migrations 0014–0016), and every member of a team that upgrades should be on this version (see “Upgrading a team”).

Team policies

• A team’s owner (and admins the owner allows) can set policies that every member’s device follows for the team’s data: keys only (no saved passwords on team hosts), no plain-text export, items stay in the team, a clipboard clearing limit, app lock required (and how soon it locks), recording required, AI on/off and allowed providers, legacy SSH algorithms, agent forwarding, host-key checking, port forwards only on this computer, local terminals, session sharing limits, folder sync of team data, how long access grants last, passkey or single sign-on required, a minimum app version, and how long recordings, logs and audit events are kept. Each setting a policy controls shows “Managed by <team>” (or “Suggested by <team>”) with the reason.
• Policies are signed by the owner (or an admin with that permission) and checked on every device; the server can’t change them. When a device can’t read a team’s policy (signed out, offline before it ever read it), it refuses actions on that team’s data instead of ignoring the policy.
• Loosening a policy can wait a delay the owner chooses, so members see it coming; the owner can revert an admin’s relaxation (“Relaxed by <admin>”, Revert).
• Your own data: a policy applies to the team’s hosts and keys. On each team’s page you can choose to apply the team’s policy to your own hosts and keys on this device too.

Roles, governance and proposals

• Owner, admin, member and custom roles with exact permissions; roles that sign changes need the member’s safety number verified first.
• The owner can require approval for admin changes and deletions; admins then send proposals the owner approves or turns down.
• Deleting a team vault keeps a copy for 30 days and can be undone; deleted vault ids are never reused.

Reports and audit

• 12 team reports (who can access what, two-step sign-in, devices and their app versions, key age, unverified members, access ending soon, policy compliance, the audit log, change history, size headroom, lockouts and key problems) as CSV on desktop and phone and a compliance PDF on desktop; each export is recorded in the team’s audit log.
• Members whose role allows it can export the audit log (desktop and phone). Pushing audit events to your SIEM needs a licence that includes it.
• Devices report which policy they apply and whether anything was refused (“N devices report …”): evidence the owner can read, not proof.

Licences (self-hosted Business and Enterprise)

• Plans and features follow the licence installed on your server; the app shows the licence’s status, seats and expiry. A licence is tied to your server’s address (up to 5 per licence). The self-service licence portal is built but not online yet; until then, moving a licence to a new address is done by us on request.

Security fixes and hardening in this release

• Independent security reviews of every phase (the signed team format went through four review rounds), with all findings fixed. Notable: the server now refuses a team change that doesn’t follow the latest one (one admin could otherwise have blocked the team), a lost connection during a key rotation no longer loses the new key, policies keep applying offline, backups and key exports respect “items stay in the team”, and a team’s certificate authority signs only the team’s own keys.
• Request limits are per account for signed-in requests (an office behind one address no longer shares one limit), with a per-address ceiling.
• The app makes fewer requests to the server (a team page refresh went from about 411 to about 272 requests in our test).

Upgrading a team

• Existing teams keep working as before. The owner can upgrade a team to the new signed format (Teams › the team › Upgrade); there’s no way back. Members’ apps older than this version show “Update Sternway” for an upgraded team and keep the last team state they verified.

Server: migrations 0014–0016 (roles, policies, proposals, attestations, licence state). A self-hosted server must be updated; tested from alpha.54 to this version on the same database. The Docker image now includes everything the team checks need.

Checked: typecheck, lint, every unit suite on the release commit (desktop 4492, phone 3066, core-model 1753, core-sync 1473, session-services 1238, security 803, server 477, terminal 401, core-crypto 231, core-rpc 228, core-services 227, team-authority 207, cli 198, and the rest, including the licence portal, signer and tool; the phone suite was run on its own after the full run ran out of memory in its test runner), the Go core tests (22 packages), the full desktop e2e suite (187 passed, 8 skipped), AppImage start, Windows headless start and upgrade from alpha.54 with the pre-update snapshot restored, Linux upgrade from alpha.54, the sync server’s Docker image upgrading an alpha.54 database (migrations 0014 to 0016 applied, the same account signs in and reads its vaults) and starting on a fresh database, Android terminal smoke (21 of 21) and folder-sync smoke (6 of 6) on the final APK. The app files were built from the commit before the release commit’s last change, which only adds checks to a security test. Not checked: the licence portal against a real deployment (it isn’t online), the arm64 packages on an ARM machine, real phones (emulator only). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone, plus Linux on ARM. This release includes fixes from a security review of its new code (see the end).

App themes and an accent colour

• Settings › Appearance › Colour theme: Sternway (as before), Arctic, Solar, Graphite, Forest or High contrast, each in light and dark, plus an accent colour (presets or your own). This is the look of the app around the terminal; terminal colour themes are unchanged. A colour that would be hard to read is nudged just enough to stay readable. Synced between your devices.

Terminal background image (desktop)

• Terminal › Background image: pick a PNG, JPEG or WebP picture, with opacity and blur. A dim layer keeps text readable (at least 4.5:1) in every theme. The picture stays on this computer: it’s never synced, and goes into backups only if you turn that on. Animated images move.

Easier host and group editing on the phone

• Settings a host or group can inherit are now one row each: tap the row to choose from a searchable list, with “Inherit (from <group>: <value>)” first so you can see what you’d get. Short choices (on/off/inherit) are one compact control instead of rows of buttons. The same in bulk edit.

tmux from the picker (desktop)

• The tmux picker can create a session, split a pane either way and rename sessions and windows. Names are quoted for the shell and kept literal for tmux (a name can’t run anything); control characters and text-direction overrides are refused.

Security review An independent review of the background image and the tmux changes found no medium or high issues; the low ones are fixed: a file that isn’t a regular file is refused, the stored copy is always private, very large pictures are refused sooner, a name ending in “;” stays whole, and host-supplied tmux names are cleaned.

Server: no migration in this release.

Checked: typecheck, lint, every unit suite on the release commit (desktop 4313, session-services 1216, security 746, terminal 401, cli 198, and the rest; core-model 1594 of 1595 in the full run, where one 8 MiB timing test exceeded its 5 s limit under load and passed 3 of 3 on its own), phone jest 2980, the Go core tests (22 packages), the full desktop e2e suite (183 passed, 8 skipped), AppImage start, Windows headless start and upgrade from alpha.53 with the pre-update snapshot restored, Linux upgrade from alpha.53, Android terminal smoke (21 of 21) and folder-sync smoke (6 of 6) on the final APK, and the new phone editors on the emulator (screenshots). Not checked: the terminal background on a real GPU, tmux versions other than this machine’s, the arm64 packages on an ARM machine, real phones (emulator only). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone, plus Linux on ARM. This release includes security fixes for features new in this release (see the end).

Macros (snippets that answer prompts)

• A snippet can be a macro: lines that send text, wait for a word or pattern, pause, or send secret a password, passphrase or token from your vault. Runs in one terminal on desktop and phone, with Cancel at any time and a clear message when a wait times out.
• A secret is typed only after its wait matched a real password prompt on the last line (ending in “:”), only into a session whose host, jump host or identity it belongs to, and never in a local terminal. It never goes to scrollback, recordings, AI, local echo, shared sessions or logs.
• If the host asks again right after a secret (a wrong password), the macro stops (“secret refused”) and types nothing more; it also stops if no answer comes within 10 seconds. A macro that answers two different prompts in a row needs a wait for the second prompt’s own text in between.
• Wait patterns are limited in size and cost so a pattern can’t freeze the app. Macros stop when the app locks.

Your own SSH certificate authority

• A key can be made a certificate authority, kept end-to-end encrypted in your vault. “Sign a certificate” for a key: principals, validity (up to the CA’s maximum), force-command, source address, extensions. Signing happens on your device, after a confirmation that names the CA, the key, the principals and the validity.
• Export the CA’s public key for TrustedUserCAKeys, and trust a host CA (@cert-authority) for host-key checks; a revocation in your own vault or the team’s applies to both. ssh-rsa (SHA-1) host certificates are refused.
• A CA key is never forwarded to a host through the agent, and can’t be one a host logs in with. Serials are random 64-bit numbers. The list of issued certificates is kept on the device that signed them in this release; the server’s audit records each signing of a team CA.
• Desktop only for managing a CA; phones use the certificates it signs.

Step CA and OPKSSH

• A key can get short-lived certificates from your step-ca server (JWK or OIDC provisioner), with the root pinned by its fingerprint, https only (plain http only to this computer), and the issued certificate checked (dates, principals, signature) before it is used. OIDC sign-in happens in your browser.
• For a key in a shared vault, this device asks once before using a teammate’s Step CA settings, and again whenever they change, naming the CA host and the browser sign-in host.
• OPKSSH: import a key and certificate made by opkssh. Step CA setup is on desktop; JWK provisioner keys must be EC P-256.

Command line (sternway-cli)

• Scoped tokens from Settings › CLI tokens (shown once, stored hashed, with an expiry, revocable): list hosts, open a terminal in the app, run a snippet on hosts, copy files. Read-only narrows any of them.
• It talks only to the running app on this computer through a user-only socket or pipe; the app proves itself before the token is sent. File copies stay inside one folder chosen per token (never your home folder or settings folders). Needs Node.js 18 or later. Not tried on Windows or macOS yet.

Linux on ARM

• AppImage and .deb for arm64 (built here, not yet run on an ARM machine).

Smaller fixes

• Open as administrator: resuming a copy of a file only root can read now checks it as root.
• Snippet built-ins in a terminal or fleet run use that connection’s own system check, never another connection’s.
• Apps skip synced item types they don’t know instead of failing the sync.

Security fixes An independent security review of this release’s new code, with re-reviews of every fix round, found 6 medium and several low issues. All are fixed:

• A macro could type a password at an ordinary shell prompt, into the wrong host, or into sudo after a wrong password.
• A CA key could be forwarded to a host and used to sign certificates there; a personal revocation didn’t override team trust in a CA.
• A teammate could point a shared key’s Step CA settings at their own server to capture your sign-in.
• The command line could have handed its token to a program pretending to be the app, or written files outside its folder (for example into ~/.ssh). Known limits: stated above.

Server: no migration in this release.

Checked: typecheck, lint, every unit suite on the release commit (desktop 3844, phone 2557, core-model 1519, session-services 1179, security 743, cli 198, server 289, core-sync 236, terminal 398, and the rest), the Go core tests (22 packages), the full desktop e2e suite (178 passed, 8 skipped; one security-key test failed once on a duplicate on-screen announcement and passed 3 of 3 re-runs), AppImage start, Windows headless start and upgrade from alpha.52 with the pre-update snapshot restored, Linux upgrade, the Go core stamped with this commit and no build paths (x64 and arm64), Android terminal smoke (21 of 21) and folder-sync smoke (6 of 6) on the final APK. Not checked: macros against real sudo and PAM timing, real step-ca and OIDC providers, the CLI on Windows and macOS, the arm64 packages on an ARM machine, real phones (emulator only). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone. This release includes security fixes for features new in this release (see the end).

Open as administrator (file manager)

• On desktop and phone, the file manager can open a host’s files as root: Open as administrator. A badge says “as root” while it’s open, and leaving administrator mode closes the root connection again.
• It runs the host’s own SFTP server under sudo over the connection you already have open. Your password goes only to sudo’s input, and only after sudo asks for it.
• Sternway sends a saved password to sudo without asking only if this host already received it when you logged in (typed at its login in this session, or the saved one when the login used it). Otherwise sudo’s prompt shows “Use saved password”. Three wrong passwords end the attempt. Save stores it as this host’s own password, never a shared identity.
• Available on hosts whose own system check shows a POSIX system. If sudo asks through its own prompt (two-factor, some SSSD or Kerberos setups, sudo-rs), no password is sent and the open stops after 20 seconds with a message saying so. Hosts without an SFTP server program aren’t supported yet.

Local echo for slow connections

• Terminal › Local echo: off (default), auto (when the echo takes more than 100 ms) or always. What you type shows at once, underlined, until the host echoes it.
• Like Mosh, nothing is shown until the host has echoed a key typed on that line, pastes are never shown early, and it never shows at password, passphrase, PIN or token prompts. Guesses are never written to the terminal, scrollback, recordings, AI selections or shared sessions.

Snippets

• A snippet can have its own keyboard shortcut on desktop, kept per device. Shortcuts that the terminal needs (Ctrl or Alt with a single key, word-movement keys) or the app already uses are refused.
• Host built-ins ({{$HOST}}, {{$NAME}}, …) that need quoting now go in only when this connection’s own system check found a POSIX shell (or fish); a host that only presents an SSH banner no longer counts. A backslash inside single quotes no longer blocks later built-ins, except in a terminal and on fish hosts.
• In a tab that types into several panes at once, each pane gets its own host’s values, and nothing is typed anywhere if any pane refuses. “Run in all open tabs” no longer sends twice.

Headscale

• Tailscale import can read from your own Headscale control server: give its address (https only; http only to this computer) and an API key, kept on this device.

Security fixes An independent security review of this release’s new code, and a re-review of the fixes, found 2 medium and several low issues. All are fixed:

• Local echo could show text typed at prompts it didn’t recognise, or typed ahead before a password prompt arrived.
• “Open as administrator” could send a saved password the host had never received, and Save could overwrite a shared identity’s password.
• Leaving administrator mode didn’t close the root connection; snippet shortcuts could take terminal keys; built-ins in broadcasting tabs used one host’s values for all panes.
• The Headscale response is now size-limited. Known limits: stated above.

Server: no migration in this release.

Checked: typecheck, lint, every unit suite on the release commit (desktop 3763, phone 2551, core-model 1462, session-services 1144, terminal 398, security 729, and the rest), the Go core tests (21 packages), the full desktop e2e suite (179 passed, 8 skipped), AppImage start, Windows headless start and upgrade from alpha.51 with the pre-update snapshot restored, Linux upgrade, Android terminal smoke (21 of 21) and folder-sync smoke (6 of 6) on the final APK. Not checked: real slow links, real two-factor sudo prompts, fish shells, a real Headscale server, real phones (emulator only). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone. This release includes security fixes for features new in this release (see the end).

Host status

• Each host has a status card: up or down, CPU, memory, disks, uptime and failed system services, read over SSH with nothing installed on the host. Desktop shows it in the host’s details pane (refreshed every minute while that pane is open on a connected host); on the phone it’s Status in the host’s menu.
• It only reads over a connection you already have open. Refresh is the only thing that connects, once, and closes that connection again. It never logs in by itself, so it never triggers a two-factor prompt.
• Linux hosts only for now; other systems show “Not available”.

AI: secrets are hidden before anything is sent

• Before any AI provider is asked (the Sternway server provider included), Sternway hides anything that looks like a password, key or token, and the exact values of passwords, keys and tokens saved in your vaults.
• “Always preview before sending” (on by default) shows exactly what will go, with the hidden parts marked, then Send or Cancel.
• Limits: a secret that isn’t saved in a vault and doesn’t look like one can’t be found; saved values shorter than 4 characters, and saved values written in another encoding (base64, URL or JSON escapes), aren’t matched by value. docs/what-leaves-your-device.md lists the forms that aren’t caught.

Snippets: host names go in safely

• {{$HOST}}, {{$USER}}, {{$PORT}} and {{$NAME}} now go into a command as one shell word, also inside your own quotes and in fleet runs, so a host name like x; rm -rf ~ stays text.
• This holds for the shell that reads the snippet (sh, bash, zsh, dash, BusyBox). A command that runs its argument again (sh -c ‘…’, ssh host ‘…’, eval, su -c, watch) or as arithmetic (let, $(( )), [[ -eq ]]) reads it a second time: use a plain name there.
• A value that needs quoting goes in only on a host whose live SSH connection shows a POSIX system; otherwise, and where the snippet’s own quoting can’t be followed safely (backquotes, ${…}, here-documents, arithmetic, comments), Sternway refuses it and says why. Running such a snippet on a host that isn’t connected now asks you to connect first.
• A network device whose CLI runs on OpenSSH (Junos, Arista EOS, NX-OS) needs its operating system set on the host.
• A value starting with - is still read as an option by the command: put – before it.

Phone

• Every icon is now a proper drawing (Settings, terminal tools, SFTP, Teams and the small buttons), and icon-only buttons are named for screen readers.

Devices

• Each device reports its app version, shown on the Devices screen (“Version 0.1.0-alpha.51”, or “Version not reported”).

Server: migration 0013 (app version per device). A self-hosted sync server must be updated.

Security fixes An independent security review of this release’s new code, and two re-reviews of the fixes, found 1 high, 4 medium and several low issues. All are fixed:

• High: a host name placed inside a snippet’s own quotes could run commands (introduced while adding the new quoting, never released).
• Shell quoting now follows the snippet’s own quoting and the host’s real shell; control characters and direction-override characters in host names are refused.
• More secret formats are hidden (database and ODBC passwords, cloud and kubeconfig keys, Docker and .netrc credentials, several token types, URL passwords containing @), long secrets are hidden whole, and large pastes no longer slow the phone down.
• Host status cards stay readable with unusual host output (many disks, very long names, out-of-range figures). Known limits: stated above for AI and snippets.

Checked: typecheck, lint, every unit suite on the release commit (desktop 3745, phone 2546, security 729, server 287, core-model 1455, session-services 1129, core-sync 233, and the rest), the full desktop e2e suite (179 passed, 8 skipped), AppImage start, Windows headless start and upgrade from alpha.50 with the pre-update snapshot restored, Linux upgrade, Android terminal smoke (21 of 21) and folder-sync smoke (6 of 6) on the final APK. Not checked: real AI providers, fish and tcsh shells, real network devices, the server migration on Postgres (tested on PGlite), real phones (emulator only). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone. This release also contains security fixes for features new in this release (see the end).

Sessions that don’t give up

• A dropped session makes its five quick tries (1, 2, 4, 8, 16 s), then keeps trying every minute for as long as its tab is open. The box shows the attempt number and a “Stop trying” button.
• A network change or waking the computer makes every waiting session try at once.
• It still stops by itself when it needs you: a host key it refuses, a login waiting for an answer, or a password or key the host refuses.
• On the phone, tries pause in the background unless “Keep sessions alive in background” is on.

Access that ends

• A team owner can give vault access until a date (1, 7, 30 or 90 days, or never), on desktop (a new “Give access” dialog) and on the phone. Rows say “Until …” or “Ended …”.
• The end is part of the owner-signed member list. Members’ apps close the vault at the end on their own, and the server refuses it too. When an access ends, the owner’s app asks you to rotate the vault key: until you do, the removed person still holds the old key for items written before the rotation.
• Share links for a live session now end after 1 hour, 24 hours (default) or 7 days, and are read-only unless you choose “Type too”.
• Members on older apps: once a team’s owner signs the first access with an end, members on apps older than alpha.50 stop seeing changes to that team’s member list until they update. The owner’s app warns before this happens.

Audit log

• New events: sign-ins (how, the second factor, the device) and item changes in team vaults (which item, vault, action and revision; never the contents).
• A self-hosted server can stream the audit log to your SIEM as NDJSON (STERNWAY_AUDIT_PUSH_URL, optional _TOKEN; https only, except to the same machine). Events are sent at least once, about a minute after they happen; deduplicate by id. See docs/audit-export.md. Live streaming will be part of the paid Enterprise plan once plans launch.

Fleets

• Run on hosts, push a file and the new pull a file can pick hosts by tag (any or all of the tags); the rule is read again on every run.
• “Collect results” runs a command on each host, four at a time, and shows status, exit code, time and the last lines, with “Run again on failed”.
• Pull a file from many hosts into one zip, with a folder per host and a size limit per host.
• Inventory: OS, version, architecture and last connected for every host, with CSV export (desktop) and Share CSV (phone).

tmux on desktop

• “tmux sessions” in a host’s menu lists its sessions with previews, windows and panes, and searches the last 200 lines of each pane. Attach opens a tab that attaches again by itself after a reconnect. Rename and end sessions, windows and panes.

Devices

• Proper icons for phones, tablets, laptops and desktops, readable platform names (“Phone · Android”), and a phone’s maker and model as its name (for example “Samsung SM-S931B”).

Server: migrations 0011 (access ends) and 0012 (audit events and push). A self-hosted sync server must be updated.

Security fixes An independent security review of this release’s new code found 1 high, 4 medium and 7 low issues. All are fixed:

• High: a teammate could name a host so that “Pull a file” deleted the computer’s temp folder, and the zip could write outside the folder you unzip into.
• A malicious server could make the owner’s app re-sign a longer access end when changing someone’s permission; the app now always uses the end it signed.
• The audit stream could skip events saved out of order.
• Ended accesses: the server now tells both apps at once, and no new key goes to an ended member.
• A reconnect no longer keeps retrying a login the host refused (it could lock your account on hosts that ban repeated failures).
• A remote file that grows past the size limit while it downloads is stopped; the download only writes where you chose to save; access ends far in the future are refused; device names lose hidden direction and invisible characters. Known limits: an access end is fully enforced only after the vault key is rotated; a device that stays offline keeps its local copy until it next syncs; the quick round of five tries right after a drop can still meet a refused login; snippet placeholders such as {{$HOST}} are not yet quoted when inserted into commands.

Checked: typecheck, lint, every unit suite on the release commit (desktop 3729, phone 2532, security 727, server 286, core-model 1306, session-services 1106, core-sync 232, terminal-ui 386, and the rest), desktop e2e (full run before the security fixes: 179 passed; team-trust, team-ownership, reconnect, shared-tabs and discover specs after them: 10 passed), AppImage start, Windows headless start and upgrade from alpha.49 with the pre-update snapshot restored, Linux upgrade, Android terminal smoke (21 of 21) and folder-sync smoke (6 of 6) on the final APK. Not checked: real SIEM receivers, the server migrations on Postgres (tested on PGlite), real phones (emulator only). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone.

Port forwards recover on their own. A forward that drops retries at 1, 2, 4… up to 60 seconds apart, 10 times, and shows “Reconnecting… try n of m”. Forwards are also re-armed when your network changes or the computer wakes up (desktop and Android). A forward that needs your approval still asks; a retry never approves itself.

Hosts

• Wake-on-LAN, sent from your own device: a Wake action on the host, and “wake before connecting”, which waits until the machine’s SSH port answers (checked without logging in).
• Port knocking: a host can have a knock sequence (TCP or UDP ports, in order, with a delay) sent before connecting; behind a jump host, the jump host knocks for you.
• Reachability dots (off by default; Settings): a dot shows whether each host’s SSH port answers. It never logs in, so it can’t trigger two-factor prompts. Hosts behind jump hosts or proxies show “unknown”. Frequent checks can trip intrusion blockers such as Fail2Ban; the setting says so.
• Edit several hosts at once: select hosts and change tags, identity, port or group in one step you can undo.

Workspaces (desktop): pull a pane out into its own tab with Move to new tab (pane menu, terminal right-click menu, or drag it onto “+” or the empty part of the tab strip), or turn a workspace back into separate tabs with Split into separate tabs. The session keeps running, with its scrollback and folder.

Snippets: built-in variables {{$HOST}}, {{$USER}}, {{$PORT}} and {{$NAME}} filled in for each host; paste-only notes; import and export as JSON.

SSH agents (desktop): Settings › Connections & SSH › SSH agent lets you choose the system agent, 1Password, Bitwarden, or any agent socket or pipe, shows which are running, and has a Test button that lists the agent’s key fingerprints (never the keys). Fixed: approval prompts from 1Password or Bitwarden no longer run into the connection timeout. The 1Password and Bitwarden choices were checked against their documented paths and with test agents, not with the real apps.

Also

• Warpgate: its approval link is shown with an Open button; nothing is answered automatically.
• Open in browser on a running local port forward.
• Fixed: “Auth key” agent forwarding after logging in with an agent key never worked; it now forwards nothing and says so in the connection log.
• New tests for the phone keyboard, covering keyboard bugs other SSH apps have had.

Checked: typecheck, lint, every unit suite, Go tests, the full desktop e2e (179 passed), AppImage start, Windows headless start and upgrade from alpha.48 with the pre-update snapshot restored, Linux upgrade, Android smoke and folder-sync smoke on the final APK. Not checked: Wake-on-LAN on a real sleeping machine, a real port-knocking server, a real Warpgate server, network-change handling on a real phone, pane dragging on real Windows or macOS, the real 1Password and Bitwarden apps. Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone.

Sync through a folder on Android. Settings › Account & Sync › Sync through a folder now works on the phone too: pick a folder that a sync app keeps in step (Syncthing, a Drive or Dropbox app folder, or the phone’s own storage), enter the sync passphrase once, and the phone syncs with your desktops through it, encrypted. The folder permission is kept across restarts, and Turn off gives it back to Android.

• Tested on the emulator against a folder written by the desktop’s own sync engine: join, hosts arriving both ways, restart, turn off. Not tested with a real Google Drive, Dropbox or Syncthing folder on a phone.

Passkeys on the phone. Sign in with a passkey, and manage passkeys in Account › Security (add, rename, remove; adding or removing asks for your password). The passkey step opens in your browser, as on desktop, and your encryption password is still asked once per device.

• Tested end to end through the real sign-in page and the return to the app, with a computer’s browser standing in for the security key (the emulator has no Google account). Not tested: a passkey stored on the phone itself, a security key or another phone, and “Use a passkey instead” at log-in.

Design review. An internal review of every screen on desktop and phone found 31 issues; all high and medium ones are fixed, plus several smaller ones:

• Recordings no longer pushes its buttons off a 1280-pixel window; Settings › SFTP › Open with has a usable field.
• Team members no longer see owner-only buttons.
• Grey text on selected rows, field and card borders now meet WCAG contrast in both themes; a test measures it.
• Phone buttons and chips take a 48 dp touch.
• New host puts the cursor in the Label field; long sidebar labels in other languages keep their text and drop the shortcut hint instead.
• Details in docs/design-review.md.

Wording: Sternway’s Mosh support is called “Mosh-compatible session” (it still uses the mosh-client installed on your computer; a built-in client is planned).

Checked: typecheck, lint, every unit suite, desktop e2e (full run with the design fixes; sidebar, settings and contrast specs after the last changes), AppImage start, Windows headless start and upgrade from alpha.47 with the pre-update snapshot restored, Linux upgrade, Android smoke and the new folder-sync smoke on the final APK. Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone. Security release for teams: please update, and read “Upgrading existing teams” below.

This release closes the last high finding from the internal security review: until now the app trusted the team keys and member list the sync server handed it, so a malicious or compromised server could have read team vaults. Team data is now protected even from the server. The design went through five review-and-fix rounds by an independent reviewer; its final verdict is “ship with noted limits”, listed at the end. Full design: docs/team-trust.md; threat model: docs/threat-model.md.

How teams work now

• The owner signs the member list. The team owner’s app signs who is in the team, their keys, and who can open which vault. The server stores it but cannot change it; your app checks every new version against the last one it trusted, and only accepts team keys the signed list allows.
• Safety numbers. Every account has a safety number (Account › Security and every member row). Compare it with the person (in person or another channel) and mark it verified. If a member’s or the owner’s number changes, the team pauses until you compare the new one (“Verify and continue”) or refuse it (“Keep the old key”; “Compare again” undoes that).
• New teams and vaults wait for you. Nothing from a team or vault you haven’t accepted on this device is used.
• Changes to a team host ask first. If another member changes where a team host connects, as whom, what runs on login, what is recorded, its jump hosts or its host key, your next connection shows who changed what and asks once.
• Accepting a new host key for a team host now only counts for you (saved in your personal vault); teammates confirm it themselves.
• Older copies are refused. Each item carries a sealed version number, so the server can’t roll items back or quietly delete known hosts.
• Ownership hand-over completes only after the new owner accepts on their own device, and only after the old owner has verified the new owner’s safety number.
• Members the server stops listing are shown to the owner (“Members the server no longer lists”) and never removed automatically.
• Account emails show whether they’re verified; email codes are now protected against guessing.

Upgrading existing teams

• The first time the owner’s updated app syncs, it signs the team’s list with only the members and vault access that device can vouch for. Members it can’t vouch for see “Waiting for the owner” until the owner restores them.
• The owner restores them with Restore access the server lists (on the device that signed first): it lists exactly who and what the upgrade left out, with each person’s safety-number state. “Restore all” covers verified members; anyone else needs a tick “I compared this number with <name>”. Nothing you revoked is ever offered again.
• Editors start as view-only after the upgrade, until the owner gives edit back.
• Once a member appears in any signed list (for example after one vault was shared with them), their other left-out vaults are no longer offered for restore; the owner shares those by hand. The same applies if a restore stops partway.
• Update the sync server (migrations 0010 and later) before or with the apps. This build can’t create teams on a server that doesn’t store signed lists.

Known limits (from the final review)

1. A brand-new device trusts the server once for teams it has never seen signed; on a member’s new device, against a server that never stores signed lists, the owner’s key is the one the server shows.
2. A server can freeze a device in the past (withhold new changes); it can’t forge them. The owner’s devices notice unless the server also withholds their sync record.
3. Upgraded teams lock members out until the owner restores them; restoring from another of the owner’s devices is by hand.
4. Restoring an unverified member rests on the owner really comparing the number.
5. If you chose to leave on hand-over, the server decides when your device’s copies go.
6. At most 600 signed team changes per hour.
7. The server keeps the newest 10,000 signed changes per team.

Checked: typecheck, lint, every unit suite, the team-trust attack tests (every attack from five review rounds has a malicious-server test), desktop e2e, AppImage start, Windows headless start and upgrade from alpha.46 with the pre-update snapshot restored, Linux upgrade, Android smoke on the final APK. Not checked: real teams across several real devices, the server migrations on Postgres (tested on PGlite). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone. Security release: please update.

An internal security review of the whole product found 4 high, 5 medium and 10 low issues. This release fixes three of the high ones and most of the rest; a re-review of the fixes found two gaps, which are fixed here too. The remaining high issue (how the app trusts team-vault keys the sync server hands it) needs a design change and comes in the next release, together with two medium ones about team vaults. If you use teams with a server you don’t run yourself, keep that in mind until then.

What changes for you

• Reopening a workspace no longer runs commands. Local panes open their shell directly in the saved folder; host panes return to their folder. A pane’s last command is not re-run any more, because terminal output could fake it.
• Port forwards from a team vault, and any forward reachable from other devices, wait for your approval on each device (“Waiting for approval”) before they start, and again after anyone changes them.
• Team workspace templates can only start shells Sternway found on this computer; anything else opens your default shell with a notice.
• Importing a file lists every key file it refers to, with a checkbox (off when importing into a team vault). Key files outside your home folder or the import file’s folder are read only after you confirm; network paths are never opened.
• Phone: a server must ask before replacing your clipboard (as on desktop); links from the terminal and sign-in screens open only as web or mail links; opening a host from a link or shortcut outside the app asks before connecting.
• Copied passwords are marked sensitive so clipboard history and cloud clipboard skip them (Android, Windows, macOS; KDE and CopyQ on Linux).
• CSV exports neutralise spreadsheet formulas and warn that they contain passwords in plain text.
• Sync refuses plain http except to a server on this computer.

Under the hood

• The app refuses to derive your keys with weaker settings than it should, so a malicious server can’t make your password cheap to crack.
• Live connections use a one-time 60-second ticket instead of putting your session token in the address.
• SFTP downloads are checked to stay inside the chosen folder; downloaded files don’t get group or world write permission from the server.
• Go 1.26.9 and x/net 0.60.0 (no known vulnerabilities in the code Sternway runs); shell-quote 1.11.0.
• Android packaging for Google Play: the core uses 16 KB pages, only the three supported phone types are packaged, and the unused “display over other apps” permission is gone.

Server: a self-hosted sync server should be updated (connection tickets); old apps keep working with it for one release.

Also: the phone smoke test now checks that the clipboard question appears.

Checked: typecheck, lint, every unit suite (desktop 3574, phone 2436, security 665, server 256), Go tests, 45 targeted desktop e2e tests (restore, templates, terminal, forwards, import, account), AppImage start, Windows headless start and upgrade from alpha.45 with the pre-update snapshot restored, Linux upgrade, Android smoke on the final APK. Not checked: the clipboard markers on real Windows and macOS, Android sensitive copy on a real phone. Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone.

Sternway in five more languages: Spanish, German, French, Brazilian Portuguese and Japanese, on desktop and phone, including field help, menus, notifications and error messages.

• Choose it in Settings › Appearance › Language. “System default” follows your computer or phone. The setting is per device and is not synced.
• Dates, times, numbers and file sizes follow the chosen language.
• Japanese uses Japanese fonts on desktop.
• Bundled documents (third-party notices and the privacy and data pages shown in the app) stay in English and say so.
• Translation quality: the translations are machine-written and have not been checked by native speakers yet. An independent review read about 700 strings per language against the English, with priority on security wording such as host-key warnings, encryption versus account password, and “never leaves this device”. It found 3 serious and about 40 smaller wording problems, and all are fixed in this release. If something reads wrong in your language, please report it.

Checked: typecheck, lint (including a new check that fails on missing translations, changed placeholders, wrong plural forms or English left behind), every unit suite, the full desktop e2e (before the review fixes; the language specs after them), AppImage start, Windows headless start and upgrade from alpha.44 with the pre-update snapshot restored, Linux upgrade, Android smoke on the final APK. Not checked: every screen in every language on a real display; right-to-left languages are not supported. Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone.

Single sign-on with SAML (teams)

• A team owner connects the team’s identity provider (Okta, Entra ID, Google Workspace, Keycloak and others; setup steps in docs/sso-saml.md) on desktop: provider metadata, up to two signing certificates for rotation, an “SSO organization” name, and optionally “Require SSO for members”.
• Members choose Sign in with SSO, type the organization name, check the team name and provider shown, and sign in in their browser. They still type their encryption password once on each device: the provider proves who you are, it never gets your vault.
• Turning on Require SSO signs members out (not the owner). A member who recovers their account with a recovery kit is sent back through SSO. Require SSO is not a way to remove someone: remove them from the team.
• Each team’s provider can only sign in that team’s owner, members and invitees.

Passkeys for your Sternway account (desktop)

• Account › Security › Passkeys: add, rename and remove. Adding or removing one asks for your password (and your authenticator code if two-factor is on), is recorded in the audit log, and your other devices show “A passkey was added to your account”. Servers with email set up also send an email.
• Sign in with a passkey, or use one instead of the two-factor code. The passkey step opens in your browser, which supports Windows Hello, a phone nearby, security keys and password managers.
• A passkey replaces typing your email and code, never your encryption password; see docs/passkeys.md for why.
• The phone cannot use passkeys yet.

Audit log: new events for SAML sign-ins, refused sign-ins under Require SSO, and passkey add, remove and use.

Server: migrations 0008 and 0009. A self-hosted sync server must be updated for SAML and passkeys.

An independent security review of the SAML and passkey code found 7 issues (none critical or high; one medium: a signed-in session could add a passkey without the password). All are fixed in this release.

Checked: typecheck, lint, every unit suite (desktop 3543, phone 2419, security 661, server 253), the SAML sign-in against a real Keycloak, desktop e2e (full run before the security fixes: 166 passed; account, passkey, team and recovery specs after them: 13 passed), AppImage start, Windows headless start and upgrade from alpha.43 with the pre-update snapshot restored, Linux upgrade, Android smoke on the final APK. Not checked: Okta, Entra ID or Google Workspace; a real Windows Hello or security-key passkey; email delivery; the server migrations on Postgres (tested on PGlite). Windows builds are unsigned.

Verify downloads against SHA256SUMS.

Desktop and phone.

Session recording (desktop)

• Record a session: per host (“Record sessions”) or from the session menu (“Record this session…”); a red “Recording” badge shows on the pane. Off by default.
• What is recorded: what the server prints, with timing and window resizes (asciicast v2). What you type is recorded only if you turn on “Also record what I type”, and never while a password, passphrase or PIN prompt is waiting. That includes sudo prompts that show * as you type and prompts in 16 other languages, among them German, French, Spanish, Russian, Japanese and Chinese. docs/session-recording.md lists exactly what is detected.
• Storage: recordings are encrypted on this computer and never synced or uploaded. Limits for part size, days to keep and total storage are in Settings › Logs; the newest recording is never removed to make room.
• Recordings screen: play, pause, 0.5–4× speed, seek, skip idle time, search the text (a match jumps to its moment), export as a .cast file (after a warning that it is not encrypted), delete.
• Teams: owners can turn on “Record sessions on team hosts”. Members’ apps then record every session on team hosts, including ones already open, and the session menu cannot stop it. The phone does not record yet.

Audit export (teams)

• Teams › Audit › Export…: the team’s audit log as CSV or NDJSON, filtered by dates and event types. Owner only, and the export is itself logged. Spreadsheet formulas in cells are neutralised. See docs/audit-export.md.
• Settings › Logs › Export my activity…: your own connection history, session logs and recordings list, from data the app already keeps. No new tracking.

Server: migration 0007 adds the team recording setting. A self-hosted sync server must be updated for the team recording switch and audit export.

Fixed: the Linux package names the maintainer correctly.

An independent review of the recording and export code found 12 issues, including the password-with-asterisks case above. All are fixed in this release.

Checked: typecheck, lint, unit suites (desktop 3506, phone 2413, session services 1037, server 186), desktop e2e (full run before the review fixes: 164 passed; recordings, settings and teams specs after them: 9 passed), AppImage start, Windows headless start and upgrade from alpha.42 with the pre-update snapshot restored, Linux upgrade, Android smoke on the final APK. Not checked: a real Windows window, recording with a real localized sudo. Windows builds are unsigned.

Verify downloads against SHA256SUMS.