Session Transcripts

Session transcripts record everything that appears in your terminal during an SSH session. Start recording when you begin a maintenance task, and export the transcript later for audit logs, documentation, or troubleshooting.

Starting a Recording

Tap the record button in the terminal toolbar to start recording. A small indicator shows that the session is being captured. All terminal output (stdout and stderr as rendered by the terminal emulator) is appended to the transcript in real time.

Each transcript entry is timestamped relative to the recording start, so you can see exactly when each piece of output was produced.

Stopping and Exporting

Tap the record button again to stop. You can then:

• Export as text — get the full transcript as a plain text string, suitable for pasting into a document or sharing.
• Save to file — write the transcript to disk.

On desktop, saving asks first whether to encrypt the file (so only ZestSSH can open it) or save it as plain text you can read in any editor. Plain text carries a warning, because a transcript can contain passwords, keys, or other sensitive output the session printed. You then choose exactly where the file goes, and a Show in folder shortcut opens its location once it is written. On mobile, transcripts save into the app’s documents directory (ZestSSH/transcripts/), encrypted in release builds.

The exported text includes a header with the connection label, session ID, start time, and duration, followed by the raw terminal output.

Encrypted Storage

Encrypted transcript files carry a .zesttx extension. On desktop you choose encryption each time you save; on mobile, release builds encrypt automatically. When a file is encrypted:

• Encryption: A non-AES, custom construction. An HMAC-SHA256 keystream is used in a counter-mode-like way and XORed with the plaintext (not AES). A random 16-byte IV is generated for each file.
• Integrity: A separate HMAC-SHA256 tag (encrypt-then-MAC, under an independent key) is appended to the file. On read, the HMAC is verified using constant-time comparison before any decryption occurs. If the tag does not match, decryption is refused.
• Key management: A 256-bit key is generated on first use via Random.secure() and stored in FlutterSecureStorage (Keychain on iOS, EncryptedSharedPreferences on Android, OS credential store on desktop). Independent keystream and MAC subkeys are derived from it.
• File format: [1-byte version] [16-byte IV] [ciphertext] [32-byte HMAC-SHA256], saved with a .zesttx extension (files written by older builds omit the leading version byte).

Saving as plain text (a desktop option, and the default in debug builds) writes a readable .txt file with no encryption, clearly flagged as “not encrypted” when it saves.

Reading Saved Transcripts

The transcript reader detects the file extension to determine the format:

• .txt files are read as plain text (debug or legacy files).
• .zesttx files are decrypted using the stored encryption key, with HMAC verification before decryption.

If the encryption key is lost (e.g., app data cleared without backup), encrypted transcripts cannot be recovered.

Capacity

Each recording session buffers up to 50,000 entries. When the limit is reached, the oldest entry is dropped to make room for new output. For typical interactive sessions, this covers many hours of use.

Limitations

• Transcripts capture rendered terminal output, not raw SSH channel data. ANSI escape sequences are included in the raw recording.
• Recordings are per-session and stored in memory during capture. If the app is killed before you stop recording and save, the transcript is lost.
• Transcript files are stored locally. They are not included in cloud sync.