SSH, local PTY, SFTP transfer, and port forwarding live in the same tab bar. Split any pane horizontally or vertically, and the layout restores on the next launch. There is no silent auto-connect. Every reconnect is a deliberate choice.

Status-colored tabs for local, SSH, SFTP, and port-forward, each with a live status dot.
Layout restore saves your last split layout in local SQLite and reopens it on relaunch.
Confirm-before-disconnect on every manual close, even when there are running processes.

Bastion Terminal · workspace

Bastion Terminal

Local-first SSH workspace

local · pty1 row

Contabo Serverroot@10.2.44.18

Contabo Server · sftp/var/www/api

pf · 5432 → localL · 5432

Contabo Server· SSH · keychainconnected

80×24●idle 8s

root@workshop-01 ~$ tail -n 5 /var/log/nginx/error.log

[2026-07-25 14:02] [error] 502 upstream connect error (php-fpm:9000)

[2026-07-25 14:03] [error] 502 upstream connect error (php-fpm:9000)

root@workshop-01 ~$ █

bash · 5,218 lines scrollback · utf-8Ctrl+T new tab · Ctrl+\ split

/var/www/api· sftp

12 entries

▸..
-
▸routes/
-
▸middleware/
-
·.envexcluded
124 B
·package.json
1.2 KB
·index.js
4.6 KB
·composer.json
0.5 KB
▸vendor/
-

sftp · bastion.db tracking.env excluded

Contabo Serverpf · 5432 (connecting)local

layout restored · 4 tabsAI closed

Local terminal

Your shell. On this machine.

Run a local PTY alongside your remote sessions. Same split, same keybindings, same theme. No scrollback sync and no auth. It is a shell on the machine you are using.

Per-session shell

Default to your $SHELL, or pin Bash / Zsh / PowerShell per session.
Same theme quirks

Color, font, cursor, and scrollback settings apply to local panes too.
No secrets leave

Local panes never see the AI redaction path or the Plan Card.
Status bar tracks it

Each pane shows its own session id and idle timer in the status bar.

Bastion Terminal

Local-first SSH workspace

local · bash · 80×24

ops@workshop ~$ ls -la ~/projects

drwxr-xr-x api bastion-website bastion-terminal

drwxr-xr-x infra notes .config

ops@workshop ~/projects$ cd api && git status

On branch main

Your branch is up to date with 'origin/main'.

nothing to commit, working tree clean

ops@workshop ~/projects/api$ █

Snippets

Reusable commands with placeholders.

Save a command once, invoke it from the palette, and fill in the variables. Destructive snippets get a confirmation preview before they run. Pinned snippets always surface at the top.

$1–$9 placeholders, filled in the Run dialog.
Tags + full-text search, with type-and-Enter to add.
Destructive snippets show a preview before run; per-host override available.

Bastion Terminal · snippets · 5 saved

Bastion Terminal

Local-first SSH workspace

Search snippets, tags…

Tags#logs#nginx#ops#deploy#git

tail-nginx
Tail nginx access log for a host
#logs#nginx$1
restart-nginxdestructive
Validate config, restart, and health-check
#ops#nginx
disk-top
Top 10 directories by size under a path
#storage$1
deploy-api
Git-aware deploy with Plan Card
#deploy#git$1
tail-fpm
Tail php-fpm journal
#logs#php$1

Edit snippet

restart-nginx

Name

restart-nginx

Description

Validate config, restart, and health-check

Body

sudo nginx -t
sudo systemctl restart nginx
curl -fsS http://localhost/healthz

placeholders:$1–$9 supported

Destructive snippet

Will be shown a confirmation preview before it runs. Override per-host via the host editor.

created 2026-01-04 · 12 runsCtrl+K to invoke

Bastion Terminal · run snippet

Bastion Terminal

Local-first SSH workspace

Snippet

tail-nginx

Tail nginx access log for a host

Ctrl+K palette

Placeholders

$1 · pattern

POST /api/v1/login

scope

Contabo Server

Preview

sudo tail -n 200 -f /var/log/nginx/access.log \
  | grep -E 'POST /api/v1/login'

Read-only · no plan card

This snippet does not mutate remote state. It will run as soon as you confirm.

Target: Contabo Server

Active session: Contabo Server⏎ to run

Run dialog

Fill, preview, run.

Run from the palette or the manager. The dialog shows the body with placeholders, asks for the values, and previews the resolved command. Read-only snippets skip the Plan Card.

Target host is the active session, with a manual override.
⏎ to run, Esc to cancel. Pinned snippets get a hot key.

Command palette

One keystroke. Anywhere.

Ctrl/Cmd+K opens a fuzzy-search palette that knows about your hosts, snippets, themes, and AI modes. No menus, no mouse. The same shortcut also opens the symbol & file palette inside a session.

Hosts, snippets, AI modes, theme switching, and layout actions, all in one place.
Fuzzy score across name, command, tags, and group.
AI modes are palette entries, the same as hosts and snippets.

contaboesc

Actions

Open local terminalCtrl+T

New hostCtrl+N

Manage groups

Hosts

Connect · Contabo Server

Connect · Harbor Gate

Connect · Scanner Server

AI · Ask

AI · Fix

Snippets

Snippet · restart-php-fpm

Snippet · tail-nginx

↑↓ navigate⏎ run15 results

Themes

Dark by default. Yours if you want it.

System, light, dark, Solarized Dark, and One Dark. Per-session font, cursor, and scrollback settings. The appearance toggle (Light / Dark / System) applies to the whole app surface.

The theme picker is a real preview. Each tile renders the actual palette.
Per-session font, size, cursor style, and scrollback cap.
All settings live in bastion.db.

Theme5 available

Appearance

Terminal font

Preview · Dark

JetBrains Mono·14 px

Contabo Server

root@workshop-01:~$ tail -n 1 /var/log/nginx/error.log
502 upstream connect error (php-fpm:9000)
root@workshop-01:~$ systemctl status php8.3-fpm
Active: active (running) since Sat 2026-07-25 14:02:11 UTC
root@workshop-01:~$ 

bash · 80×24connected

bg#0b1220

fg#ffffff

prompt#22d3ee

selection#172337

One product. Five surfaces.

SSH sessions, host organization, snippets, the palette, and themes share the same local-first security model. Try it on your fleet and see the difference.

Download

Read the security model