Overview
A terminal made of particles
AmberSSH is a native Windows 11 terminal and remote-desktop client in which every character in the viewport is drawn as a constellation of GPU particles. It keeps a familiar PuTTY-style connection workflow, and behind it there is no Electron, no browser engine, no Qt and no third-party terminal widget.
Each glyph is 96 particles by default, adjustable from 32 to 256 across five presets, drawn in four layers: a wide diffuse glow, the character body, a sharp detail pass and a sparse HDR sparkle. Brightness breathes on a slow sine with a faster low-amplitude flicker, and when a cell changes the particles disperse and reconverge under whichever motion style is active.
The important part is what sits underneath. The particles are presentation, not truth: the grid holds real characters, so selection, copy and scrollback stay exact no matter what the renderer is doing. It is a genuine VT100 and xterm-256color state machine with scrollback, an alternate screen, truecolor and X10 and SGR mouse reporting, which is why vim, tmux, htop and mc all behave.
Built in C++20 on Win32 and DirectX 12, with HLSL compute shaders, DirectWrite and libssh2. Shaders compile to DXIL as a build step, so a shader error fails the build rather than surfacing at runtime.
Specification
Tech spec
| Platform | Windows 11, native Win32 |
|---|---|
| Language | C++20 |
| Graphics | DirectX 12 with HLSL compute shaders, compiled to DXIL by DXC |
| Text | DirectWrite; SSH through libssh2 |
| Particles per glyph | 96 by default, 32 to 256 across five presets |
| Glyph layers | Four: diffuse glow, body, detail pass, HDR sparkle |
| Motion styles | 23 |
| Interface skins | 15, plus 4 appearances and 8 colour themes |
| Protocols | SSH, Telnet, Rlogin, Raw, Serial, local shell, and VNC |
| VNC | RFB 3.3, 3.7 and 3.8; VeNCrypt and TLS; ZRLE, Hextile, Raw and CopyRect |
| Terminal | VT100 and xterm-256color, scrollback, alternate screen, truecolor, X10 and SGR mouse |
| File transfer | SFTP with resume and SHA-256 verification |
| Shell integration | OSC 133 semantic command blocks keyed to exit code and duration |
| Credentials | Windows Credential Manager; profiles.json stores only a boolean |
| Tests | 137,728 assertions |
Features
What it does
- Seven ways in. SSH, Telnet, Rlogin, Raw, Serial and a local shell over PowerShell, cmd or WSL, plus a seventh that is not a terminal at all.
- Real SSH. Password, public-key and keyboard-interactive authentication over libssh2, with host-key verification and an explicit accept step for anything unknown or changed. OpenSSH-format keys are read directly; PuTTY
.ppkfiles are refused with an instruction to convert rather than a cryptic failure. - 23 motion styles. How a changed cell travels from its old state to its new one: burn, dissolve, shatter, light-speed streak, digital rain, cyclone, glitch and seventeen more.
- Sessions that cannot block each other. Each tab gets its own worker thread, grid and scrollback, so a stalled connection stays a stalled tab.
- A recursive pane tree with broadcast sets, which replaced an earlier fixed two-pane split.
- SFTP with resume. SHA-256 verification and a sync planner written so every risky decision is a pure, testable function rather than a side effect buried in a transfer loop.
- Correct text, not approximately correct text. Grapheme clusters and inline images with cell-width handling matched against the server's own
wcwidth. - Session Guardian. Structural reconnect, restore and reattach handling, with security gates arranged so there is no code path from a gated state into an actual reconnect attempt.
- Secrets never touch disk. Remembered passwords and passphrases live in the Windows Credential Manager. No telemetry, no log upload, and no secret written to a log or a JSON file.
Remote desktop
A Linux desktop, drawn not screenshotted
The seventh protocol is a full VNC client, and it runs through the same particle engine as the terminal. A remote framebuffer arrives over RFB, and instead of being blitted as a bitmap it is drawn as particles.
That distinction is the whole feature. Window edges glow. A click sends a visible shockwave through the field. A repaint rematerialises under one of the 23 motion styles rather than simply appearing. You are watching a real Linux desktop, frame by frame over the wire, reconstructed in particles.
It speaks RFB 3.3, 3.7 and 3.8, handles VeNCrypt and TLS, and decodes ZRLE, Hextile, Raw and CopyRect. For a VNC connection the default port fills itself in; for a local shell you press Open and nothing else is required.
The look
Readable first
Pure black ground and #FFB000 amber glyphs by default. Seven other colour themes ship with it: Emerald CRT, Ice Cathode, Violet Haze, Blood Cell, Paper White, Brass Gaslight, and one you build yourself from three picked colours.
On top of those sit 15 interface skins, including Cyberpunk, Classic, LCARS, Nostromo, Steampunk and Solder Mask, and four appearances: Dark, Light, a warm Paperwhite e-ink look and a 16-colour Pixel Art mode. Selected text switches to a drifting Miami Sunset gradient.
Every effect is subtle by default and every one can be switched off. A terminal that is beautiful and unreadable has failed at being a terminal, and that constraint is the reason the text grid is kept separate from the thing drawing it.
Security
The audit is published
Host keys are verified and require an explicit decision on first contact. A changed key is treated as a serious failure and never a silent continue. There is no telemetry, no log upload and no automatic key acceptance.
The project went through an adversarial security audit against its own source rather than a checklist pass. It found a path traversal in the SFTP browser, where a malicious server could write outside the intended download directory by controlling the remote filename. The first pass caught it in the recursive download path; a follow-up pass found two more sites the first had missed, in the sync planner and the Save-dialog prefill. It also found an ungated remote-clipboard write and a paste-escape injection vector. All are fixed, each with its own test coverage, and the parsers a hostile server can actually reach are fuzzed under AddressSanitizer.
The audit document is published in the repository in full: what was found, what changed and what remains unverified, including the parts that reflect badly on an earlier version of the code. An unresolved crash does not get to lie about what it can prove.
Honesty check
What is not in 0.1.0
AmberX, a first-party X11 server, exists in the source tree across eight phases: a DACL'd pipe with an HMAC-authenticated handshake at the host process boundary, a job-confined sandboxed host, rootless window framing, a minimal window manager, keyboard, monitor, wheel and clipboard integration, and a fuzzed, conformance-tested X.Org core running inside it. xeyes was the first real application to run against it.
- AmberX is not in the 0.1.0 release build. No real-world X11 application beyond that first conformance test has been run against it.
- OSC 8 hyperlinks highlight on hover but are not clickable yet.
- No screen-reader support. The terminal grid is particles with no text layer exposed to accessibility APIs. This is a real limitation, not a styling preference.
- Interoperability is tested against one real SSH and VNC server family, not a wide matrix.
- Released unsigned unless a certificate is supplied. The packaging script signs binaries when given a code-signing certificate and says plainly when it has not. Public distribution needs a certificate from a CA already in the Windows trust store.
Media
Gallery
