secure-terminal

A terminal where paste is safe by design.

Paste a command copied from the web, or read text a program printed, without worrying about invisible characters, bidi overrides or escape sequences. secure-terminal accepts plain printable ASCII and, in its default display mode, shows only that -- so a pasted or printed lie has nothing to hide in. The other display modes trade some of that back deliberately (see below); what holds in every mode is that no invisible, bidi or control character reaches you unmarked.

This is the problem output lies documents, removed at the source.

Threat model (what this does, and does not, protect)

secure-terminal does not sandbox the programs you run. If you choose to run something harmful, it runs, exactly as in any terminal; nothing at the terminal layer can change that.

What it guards is viewing untrusted data. The danger in a normal terminal is that bytes you did not author, and did not choose to execute, can act rather than merely display: a crafted file you open, a program's output, an SSH login banner, a filename in a listing or a commit message can carry escape sequences. On a normal terminal, merely reading such output can quietly change your clipboard (so a later paste inserts text you never copied), draw a link whose visible text lies about its destination, put text onto your input line, or paint text invisibly. A passive, low-suspicion action causes a side-effect you never intended, without you running anything.

secure-terminal removes those escapes so that reading untrusted output is safe, and sanitizes paste so untrusted text cannot smuggle a hidden command into your shell. It does nothing about the programs you deliberately run.

How it stays safe

• Printable-ASCII display by default. Program output is passed through a sanitizer: ANSI/OSC escape sequences are removed and every byte that is not printable ASCII (plus tab and newline) is dropped, the way stcat does for logs. A hostile filename or a Trojan-Source comment cannot reorder what you read, and nothing a program prints can reach a line you have already scrolled past.

• No escape-sequence parser to attack. CLI mode runs no ANSI/OSC/APC/DCS parser. Two narrow exceptions are honored, both deliberate: safe, contrast-guarded colour (SGR), and the four line-local editing ops a shell's line editor emits -- cursor forward/back, cursor-to-column, and erase-in-line -- and those only within the line being written. Vertical and absolute movement, alternate screens and OSC hyperlinks are stripped, so a program can never reach an earlier line or the scrollback. The worst it can do is redraw its own current line, exactly as a carriage return already does -- so a forged status line can overwrite itself before you read it, the same way a progress bar does. Those four ops are what tab completion needs: Tab makes the shell rewrite the line you are typing in place. The Line editing setting (Settings -> Text rendering) chooses how much of the current line a program may redraw: full (the default), read-safe (drop the four escapes; carriage return and backspace still act), or append-only (also neutralize those, so the current line can never be overwritten -- each neutralized redraw is flagged in the left gutter). See the line_editing entry in usr/lib/secure-terminal.d/30_defaults.conf for what each gains and costs.

• Sanitized paste, with a review. When a paste contains unicode or control characters, a review bar opens inside the window and holds the paste before it reaches the shell. The paste opens FULLY REVEALED in one editable box -- nothing is silently pre-dropped, so a trap cannot hide by being cleaned away before you see it: every hidden character stays in place, named and risk-class-coloured by the terminal's own renderer (a look-alike tinted, an invisible or a bidi override shown as a named badge). While any hidden character is present the Deliver button is disabled and red ("blocked -- N hidden"), so nothing unreviewed can cross. You clear the trap with one of the labelled transforms -- Strip unicode (ASCII only), ASCII-fold (replace look-alikes with the plain letter they imitate) or Keep printable unicode (drop the invisible/reordering characters, keep the rest) -- or by editing the box directly; Deliver then enables, amber for printable unicode or uncoloured for plain ASCII. Restore original re-reveals the untouched paste at any time. While the paste is held, terminal input is suspended and the paste's Deliver is countdown-gated (configurable; Enter or Esc rejects), so a stray key cannot wave a hostile paste through. In CLI mode a plain-ASCII paste is not interrupted; the warning is configurable to always, only-on-unicode (the default), or never.

• The same review for copy, going the other way. Text leaving via copy is reviewed too, with the same revealed box: after cat evil-log, selecting and copying in Show mode (where real glyphs are kept) would otherwise put a look-alike straight on the system clipboard, so the copy opens fully revealed and the same transforms clean it before it crosses -- stripped to ASCII, with printable unicode kept, or not at all. Configured separately from the paste warning (copy and paste are opposite trust directions): always, only-on-unicode (the default), or never.

• Tiny input allowlist. You type printable ASCII plus a small set of control keys that the pseudo-terminal turns into signals:

  Key	Signal
  Ctrl+C	SIGINT
  Ctrl+Z	SIGTSTP
  Ctrl+\	SIGQUIT
  Ctrl+D	EOF

  We only write the control byte; the kernel line discipline does the rest. Backspace is honored so you can rub out a typo; it erases one character and never crosses a line, so it cannot rewrite earlier output.

Everyday comforts

The safety model above does not cost you the usual conveniences:

• Tabs. Each tab is its own shell over its own pseudo-terminal. Open with Ctrl+Shift+T, close with Ctrl+Shift+W; closing a shell closes its tab.
• Copy and paste. Toolbar buttons and Ctrl+Shift+C / Ctrl+Shift+V (plain Ctrl+C stays SIGINT). Paste is still sanitized before it reaches the shell.
• Text zoom. Ctrl+wheel, Ctrl+plus / Ctrl+minus, or the percentage box in the top right (Up/Down keys or type a value). Ctrl+0 resets to 100%.
• Themes. White-on-black and black-on-white, under View -> Theme. Plain, high-contrast, no syntax coloring.
• Unicode display mode (top bar, per tab, default Detail). Detail names every non-ASCII character inline as <U+XXXX NAME> (the codepoint plus its official Unicode name, what unicode-show annotates), so a homoglyph reads as its identity rather than a bare number. Box replaces every non-ASCII character with a coloured box, one per character, tinted by risk class (a bidi override, a zero-width character and a plain foreign letter get different colours); safe and hard to miss. The on-screen box is lossy, but a saved transcript names each byte inline (<U+XXXX NAME>) so the record is not; a copied box still maps to a plain ASCII _. Show renders legitimate unicode as glyphs so you can read a log, but still tints each one by risk class -- a homoglyph confusable with ASCII wears a louder colour than honest foreign text, and the invisible, bidi and control classes (which have no visible glyph) still show as a coloured placeholder. Reveal shows every non-ASCII character as a <U+XXXX> badge to inspect exactly what is there (and badges the control chars BS/CR too; Detail names them, e.g. <U+000D CARRIAGE RETURN>). State goes further, badging EVERY character (printable ASCII included) as <U+XXXX>, each tinted by the program's OWN SGR attributes (codepoint + attributes) -- the live sibling of Save Screen State Dump. It renders inline in CLI mode; a TUI tab freezes the frame and renders the snapshot as badges, since a badge cannot fit a fixed grid cell. Escapes are stripped in every mode.
• Freeze / Unfreeze (Freeze toolbar button, the File menu, /freeze, or Ctrl+Shift+B). Pauses the live view in any mode so a fast or scrolling frame can be read -- the program keeps running (output is still read; only the repaint is suspended), and unfreezing catches up. Mainly a debugging aid: freeze a frame that looks wrong and inspect it (while frozen, / return exactly the frozen frame). Reveal/Detail/State auto-freeze in a TUI tab because their badges cannot fit the grid; CLI never auto-freezes.

TUI mode (opt-in, run full-screen programs)

The strict line mode above cannot run curses apps, because they are driven entirely by the escape sequences it refuses to parse. TUI mode (top bar and View -> TUI mode, per tab, default off, needs python3-pyte) relaxes that so you can run ssh, an editor, htop, the Claude Code CLI, and use the shell's own completion menus and progress displays. A yellow indicator and a hover tooltip flag it while it is active, because it is a deliberate, lower-guarantee mode:

• Escapes are interpreted, but inside an isolated in-memory screen model (pyte) that has no OS reach: it cannot touch the system clipboard, so that exfil vector stays closed. A program MAY set the tab title (default on), but the title is reduced to plain ASCII and shown on a separate, visibly-untrusted line of the tab, so a spoofed title can never pose as the trusted, app-set label.
• Every character placed on the screen is still ASCII/unicode-filtered, so a program can position and colour text but cannot smuggle an invisible, bidi or homoglyph character into what you read.
• Colours use the same contrast guard, so nothing can be painted invisibly.

TUI mode renders through the confined screen model at all times (with its own scrollback), so a program that positions the cursor renders faithfully: a completion menu, a progress bar, or a full-screen program on the alternate screen (which is snapshotted and restored so it normally leaves your scrollback untouched).

What you give up: because the cursor can be positioned, a program can draw a misleading interface (a fake prompt, say) or overwrite a line you already read, so only run programs you trust. This is "restricted-emulator safe," not "safe by design."

Security comparison with CLI mode. The line (CLI) mode, and everything the project's guarantees rest on, is unchanged: it runs no escape parser beyond safe colour and four line-local edits, the confined screen model is never fed in CLI mode, and vertical/absolute cursor movement is stripped, so a program can never reach back to an earlier line or the scrollback. Transcript integrity is therefore per-line: anything already scrolled past is append-only, while the line a program is currently writing can be redrawn by it (exactly as a carriage return does). TUI mode is the one place escapes are interpreted; the only change from earlier versions is that it now does so uniformly (at a shell prompt too, not only while a full-screen program holds the alternate screen). No new class of side-effect is enabled -- clipboard (OSC 52) and hyperlink escapes remain neutralized in both modes, and a program-set title is shown only on the quarantined, untrusted tab line -- and every on-screen cell is still filtered. The extension is contained entirely within the opt-in, clearly indicated TUI mode.

What it does not do (on purpose)

• No non-ASCII by default. Additional character sets may become opt-in much later, always as an explicit allowlist, never a general decoder.
• No terminal side-effects. No window-title control, no clipboard escape (OSC 52), no hyperlink escapes, in either mode.

The default is a deliberately minimal, line-oriented display. Backspace works, but because line mode neutralizes the escapes readline uses to redraw, richer in-line editing (mid-line cursor movement, history recall, completion menus) is intentionally basic there; compose or paste a line, read the exact bytes, then run it. Turn on TUI mode when you want those interactive features to render.

Review status

The guarantees above are enforced by an extensive automated suite; independent human review is still pending. secure-terminal follows a three-stage review path: (1) written by AI and checked by that automated suite -- the current status; (2) human non-malicious review, confirming it works as intended with no backdoors; (3) a full human security audit of the whole design, the gold standard. See the review status page.

Run

secure-terminal

Built with Python and Qt6. AI-assisted (see org-ai-assisted and the review status above).

How to install secure-terminal

A standard Debian source package. Build it from source (below) and install the resulting .deb, or run it in place from a checkout (./usr/bin/secure-terminal).

How to Build deb Package from Source Code

Can be built using standard Debian package build tools such as:

dpkg-buildpackage -b

See instructions. (Replace generic-package with the actual name of this package secure-terminal.)

• A) easy, OR
• B) including verifying software signatures

Contact

• Free Forum Support
• Professional Support

Donate

secure-terminal requires donations to stay alive!