Shellit Logo
Shellit v0.9.5
Back to Chronicle Timeline
v0.3.0 — v0.6.0 Mobile & Sync 10 min September 18, 2026, 19:30 — September 19, 2026, 03:40

Act IV: Zero-Knowledge — Self-Hosted E2EE & Android Renaissance

Rejecting proprietary clouds: building a self-hosted Zero-Knowledge E2EE relay for VPS, honest Argon2id master-password rotation, IndexedStack GlobalKey traps, and Android touch bar.

BUG-015 BUG-018 BUG-021 #e2ee #sync #argon2id #android #zero-knowledge
Crypto-Audit Transcript: Zero-Knowledge End-to-End Verification
September 19, 2026, 02:25
Expand
Architect
I do not get it, is the password stored in plain text?
Antigravity
Passwords are never stored or transmitted in plain text. The user’s master password never leaves the local machine. From it, Argon2id (memory: 64MB, iterations: 3, parallelism: 4) derives a 256-bit key that encrypts the local database with AES-256-GCM. The sync server receives only encrypted ciphertexts — even with full access to the sync backend, decrypting user credentials without the master password is computationally impossible.
Act Context: Zero credentials surrendered to corporate cloud silos. In this act, Shellit introduces a lightweight self-hosted E2EE sync relay deployed on personal VPS nodes, eliminates a deceptive master-password rotation stub, fixes duplicate GlobalKeys inside Flutter's IndexedStack, and launches an Android client equipped with haptic terminal controls.

Entry 18. Self-Hosted Zero-Knowledge E2EE Relay for VPS

⏱️ Timestamp: September 18, 2026, 19:30 — 20:30 (~60 minutes)

Commercial SSH tools enforce cloud lock-in: your connection inventories and metadata live on external vendor servers. We chose an unyielding Zero-Knowledge architecture:

  • Built the lightweight shellit-sync-server Docker container (2-minute spin-up on any VPS).
  • Client-Side End-to-End Encryption (E2EE): Everything (hosts, snippets, environment tags) is encrypted locally via AES-256-GCM. Encryption keys derive from a user sync passphrase via Argon2id.
  • The VPS relay handles solely encrypted binary blobs. A compromised relay yields only random cipher text.
  • Conflict resolution managed seamlessly via Vector Clocks.

Entries 21–25. Argon2id Password Rotation (BUG-018) & The GlobalKey Pitfall

⏱️ Timestamp: September 18, 2026, 21:00 — 23:30 (~150 minutes)

Deep security regression testing revealed critical architectural discrepancies:

  1. BUG-018 (Fictitious Master Password Rotation): In initial drafts, the change-password dialog displayed a success notification, but the underlying Drift/SQLCipher database retained the old encryption key! We engineered an authentic rotation routine: dumping plain records into volatile memory buffers, re-encrypting the database with fresh Argon2id salts, and cycling secure OS Keychain entries.
  2. BUG-021 (GlobalKey Collision in IndexedStack): Switching between terminal sessions and SFTP tabs triggered a red Flutter screen: Duplicate GlobalKey detected in widget tree. The IndexedStack kept background widgets alive with identical generated keys. Replaced fragile global references with contextual ValueKey(sessionId).

Entries 26–28. The Mobile Renaissance: Shellit on Android

⏱️ Timestamp: September 19, 2026, 01:00 — 03:40 (~160 minutes)

Mobile SSH apps often degrade into frustration without physical keys like Ctrl, Esc, Tab, and arrow keys.

We tailored Shellit for Android workflows:

  • Dedicated Touch Accessory Bar: An ergonomic row positioned directly above the soft keyboard exposing Esc, Tab, Ctrl, Alt, history navigation arrows, pipes |, and tildes ~.
  • Haptic Feedback: Every tap produces a crisp mechanical vibration impulse, simulating physical key travel.
  • Desktop Hygiene: Heavy Windows WebView2 and FFI desktop loaders are strictly decoupled via conditional imports, keeping the APK lean and lightning-fast.
📖 Article typography justified using the Knuth-Plass algorithm via mcp-typography-server powered by Justif.
Knuth-Plass • TeX Style