Buzz

Your infrastructure. One secure workspace.

Local terminals, SSH, SFTP, port forwarding, and an AI shell agent
in one secure, open-source desktop app.

Website · Download · Contributing

One workspace for local and remote operations

Buzz brings daily shell work and remote infrastructure into a single desktop workspace. Credentials, known-host keys, AI provider keys, inventory fields, and AI history stay encrypted at rest, while every AI-proposed command passes through a risk gate in the Electron main process.

	Capability	What it gives you
01	Local terminals	Native PTY-backed shell sessions powered by node-pty and xterm.js.
02	Remote SSH	Password or private-key authentication with explicit, fail-closed host-key trust.
03	SFTP	Browse remote files, transfer data, resolve conflicts, and open files locally.
04	Port forwarding	Start and stop local or remote forwarding rules for each host.
05	AI shell agent	Inspect a live session and propose actions through Anthropic, OpenAI, DeepSeek, Zhipu GLM, or Moonshot Kimi endpoints.
06	Encrypted vault	Protect sensitive application data at rest with AES-256-GCM.

Ask. Inspect. Act. With a gate in the middle.

The agent can work with the context of a live terminal, but it cannot silently execute a risky action.

1 · Agent proposes	2 · Main process checks	3 · You stay in control
Buzz prepares the exact shell command for the active task.	The Electron main process evaluates the command and its execution context.	High-risk actions require a short-lived, single-use approval bound to the task, session, host, working directory, and command.

Security by design

• Sandboxed renderer — sandbox, contextIsolation, and webSecurity stay enabled; nodeIntegration stays disabled.
• Typed IPC boundary — src/renderer/app/ipc.ts is the renderer's only desktop command seam. Electron checks a static allowlist and routes commands through Zod-validated domain handlers.
• Fail-closed host trust — unknown SSH hosts require explicit approval, while changed host keys stop the connection.
• Encrypted at rest — inventory fields, SSH credentials, known-host keys, AI API keys, and AI history use AES-256-GCM encryption.
• Secrets stay out of the UI — encryption keys and protected values remain in the Electron user-data directory with owner-only permissions and never cross the IPC boundary.
• Sanitized failures — provider and transport errors do not expose credentials, private keys, raw host keys, prompts, decrypted vault fields, or API keys.

The 256-bit vault master key is protected by an app-managed AES-256-GCM key. Buzz does not use macOS Keychain or Electron safeStorage for this vault.

Install Buzz

Download a packaged build from GitHub Releases, or use the platform links served by the official Buzz download service.

Platform	Package	Download
macOS	Universal · DMG / ZIP	Download for macOS
Windows	x64 · NSIS installer	Download for Windows
Linux	x64 · AppImage / DEB	Download for Linux

The packaged application checks for updates automatically on startup.

Build from source

You will need Node.js 22+ and pnpm 10+.

git clone https://github.com/foooag/Buzz.git
cd Buzz
pnpm install
pnpm dev

Development

Command	Purpose
pnpm dev	Start electron-vite (renderer HMR + main/preload rebuild) and launch the desktop app.
pnpm dev:web	Start only the renderer at http://127.0.0.1:1420.
pnpm typecheck	Validate strict TypeScript (renderer + main/preload) without emitting files.
pnpm test	Run Vitest unit and component tests.
pnpm test:e2e --project=chromium	Run Playwright browser scenarios.
pnpm test:electron	Run the real Electron and preload smoke tests.
pnpm build	Type-check and build main, preload, and renderer into out/ via electron-vite.
pnpm package	Create platform installers with electron-builder.

Project structure

Buzz/
├── src/
│   ├── main/            Electron main process (index.ts), domains, and IPC dispatcher
│   │   └── domains/     inventory, terminal, ssh, sftp, forwarding, ai, agent
│   ├── preload/         Sandboxed preload bridge (contextBridge only)
│   ├── renderer/        React 19 renderer, features, stores, and xterm.js UI
│   └── shared/          Cross-process IPC contract (command names, result types)
├── build/               Build tooling (electron-builder hooks, dev watcher)
├── resources/           Packaging icons
├── tests/               Vitest unit and component tests (renderer/, main/)
├── e2e/                 Deterministic Playwright browser tests
├── e2e-electron/        Real Electron integration scenarios
└── docs/                Architecture, design, and release documentation

Releases

Push a semantic-version tag to build macOS universal, Windows x64, and Linux x64 installers and publish them to GitHub Releases:

git tag v0.1.0
git push origin v0.1.0

Prerelease tags such as v0.1.0-beta.1 are supported. The release workflow derives the application version from the tag, runs the test and build gate, packages every platform, and creates the release only after all platform jobs succeed.

Contributing

Contributions are welcome. Read CONTRIBUTING.md before opening an issue or pull request, and keep behavior changes covered by tests.

License

Buzz is open source under the Apache License 2.0.

_{Built for the shell. Designed to keep you in control.}