Settings

What each field, switch and setting does, 140 controls in all on this page. This is the text behind the ⓘ beside each label in the apps: hover or click it on the desktop (or press F1 in the field), tap it on the phone.

The line under each name gives the id the code uses for it, and says when only one of the apps has it.

Settings: Appearance

Where: Settings › Appearance.

App theme

settings.appTheme

Light or dark colours for the app itself. “System” follows the light or dark setting of your computer or phone.

• Default: System.
• Choices: system System; light Light; dark dark

Colour theme

settings.appThemeName

The colours of the app itself: Sternway (deep blue), Arctic (cool blue-grey), Solar (warm cream and teal), Graphite (neutral grey), Forest (green) or High contrast (black and white with strong colours). Each has a light and a dark version, and “App theme” picks which. Every theme keeps text readable on its backgrounds. The terminal has a theme of its own.

• Default: Sternway.
• Choices: sternway Sternway; arctic Arctic; solar Solar; graphite Graphite; forest Forest; contrast High contrast

Accent colour

settings.appAccent

The colour of buttons, links, the selected row and the outline around what has the keyboard. “Theme colour” uses the colour theme’s own; a swatch or “Custom colour” puts any other in its place. A colour that would be hard to read on the theme’s backgrounds is made just light or dark enough to read.

• Default: Theme colour.

Language

settings.language

The language of menus, buttons and messages: English, Spanish, German, French, Brazilian Portuguese or Japanese, each listed in its own name. “System default” follows the language of your computer or phone, and English is used when Sternway does not speak it. Dates, times, numbers and file sizes follow the language too. Kept per device.

• Default: System default.
• Choices: system System default; en English; es Spanish; de German; fr French; pt-BR Brazilian Portuguese; ja Japanese
• Caution: Long generated documents, such as the third-party notices, stay in English.

Interface size

settings.interfaceSize · Desktop only

The size of text, buttons and spacing across the app: Compact, Default or Large. The terminal’s font size is separate (Settings › Terminal). Kept per computer, because screens differ.

• Default: Default.

Use the system title bar

settings.systemTitleBar · Desktop only

Sternway draws its own bar at the top of the window, with the menu, the tabs and the window buttons in it. Turn this on to get your operating system’s title bar and menu bar back instead, for example when the window does not move, resize or snap the way your other windows do. Kept per computer. It takes effect when Sternway is started again.

• Default: Off.

Forms open as

settings.forms.defaultMode

How “New host” and the other editors open. A wizard asks one thing at a time; the full form shows every field at once. Either can switch to the other while open.

• Default: Full form on desktop, wizard on mobile.
• Choices: wizard wizard; form full form

Terminal theme

settings.terminalThemeId

The colours of terminals that have no theme of their own. “Match app theme” follows the app’s light or dark look. A host or group can set its own theme, and a theme picked inside a session wins for that session.

• Default: Match app theme.

Keep text readable

settings.keepTextReadable

Lifts text whose colour is too close to the colour behind it until it can be read (a contrast of 3:1). Some themes have such colours on purpose: Solarized’s black and bright black are tones of its background, and a program that prints in them would be invisible. Colours that are already readable are not changed, and the theme itself is not changed. Turn it off to see every colour exactly as the theme defines it.

• Default: On.

Name

theme.name

What the custom theme is called in theme lists. Required, up to 64 characters.

• Example: Solarized, my way

Colour

theme.color · also shown as “Hex colour”

One colour of the theme, as a hex value. Background and foreground are required; a colour left at “Default” is worked out from those two (the cursor takes the foreground) or from the standard 16-colour palette.

• Example: #1a2b3c

Paste JSON

theme.paste · Phone only

Paste a theme to import it: a theme exported from Sternway as JSON, or the XML text of an iTerm2 .itermcolors file (open the file in a text editor and copy all of it). The colours are checked first, and the theme is added to your custom themes without replacing one of the same name.

Settings: Terminal

Where: Settings › Terminal.

Font

settings.fontFamily

The typeface of the terminal. Bundled: JetBrains Mono, Fira Code, Cascadia Code, Source Code Pro and Hack. On desktop you can also type the name of any font installed on the computer.

• Default: JetBrains Mono.

Font size

settings.fontSize

The size of terminal text in whole pixels, 6 to 72. A host or a single session can use its own. Until you set a size each device uses its own default; a size you set here is used on all your devices.

• Default: 10 on a phone, 12 on a tablet, 14 on a computer.

Line height

settings.lineHeight

The space each terminal line takes, as a multiple of the font size, 0.8 to 2. Raise it if lines feel cramped.

• Default: 1.2.

Bold text

settings.boldText

Whether text that programs mark as bold is drawn bold. Turn it off if bold looks blurry in your font.

• Default: On.

Bold text uses bright colours

settings.boldIsBright

Draws bold text in the bright variant of its colour, as older terminals did. Off, bold text keeps its colour and is only heavier, which is what most terminals do now and what themes are designed for: in Solarized, for example, the bright colours are greys, so a bold blue folder name would turn grey. Turn it on if a program you use relies on bold to mean “brighter”.

• Default: Off.

Cursor

settings.cursorStyle

The shape of the text cursor: a filled block, an underline or a thin bar.

• Default: Block.
• Choices: block block; underline underline; bar bar

Blinking cursor

settings.cursorBlink

Whether the cursor blinks. Turn it off if the movement distracts you.

• Default: On.

Autocomplete

settings.autocomplete

Shows suggestions while you type at a prompt: the commands installed on the host, their subcommands and options, values that fit the argument (branches after “git checkout”, services after “systemctl restart”, files and folders), your saved one-line snippets and commands you ran on this host before. The most likely whole command from your history is shown greyed after the cursor; the list under the cursor holds the alternatives. Choosing one types it without pressing Enter. Nothing is suggested in a full-screen program such as vim or at a password prompt. Telnet, serial and Mosh sessions get history, snippets and the built-in command descriptions only, and so does a local terminal on Windows running Git Bash or a WSL distribution (the app has no shell of its own there to ask); in PowerShell and Command Prompt nothing is suggested. On desktop it also offers the host’s saved password at a password prompt. A host can turn suggestions off for itself.

• Default: On.
• Caution: A server that allows only one channel per connection cannot be asked anything, so suggestions are switched off for that host on this device, with a notice.

Look up commands and options on the host

settings.autocompleteHostLookup

Lets autocomplete ask the host what it has: which commands are installed, the options in a command’s manual page, and values such as git branches, services, containers, users and file names. The questions are fixed, read-only commands (for example “ls”, “man”, “git for-each-ref”, “systemctl list-units”) run in the background over the connection the session already has, never typed into your terminal. What you type is only ever handed to them as a quoted name or path, and no program is started just to read its help. The list of installed commands is kept on this device for a day so the next session has it at once. With this off, suggestions come from your history, your snippets and the built-in command descriptions only.

• Default: On.
• Caution: The lookups run as the user you are logged in as and are visible to the host like any other command (a process list or an audit log shows them). Turn it off for a host where even read-only commands must not run unasked.

Tab key

settings.autocompleteTab · Desktop only

What Tab does while the suggestion list is showing. “Sternway suggestions first” inserts the highlighted suggestion, or the first one. “Shell completion first” sends Tab to the shell as usual, and only inserts a suggestion after you moved into the list with the Down arrow. With no list showing, Tab always goes to the shell.

• Default: Sternway suggestions first.
• Choices: suggestions Sternway suggestions first; shell shell completion first

Copy on select

settings.copyOnSelect

Copies text to the clipboard as soon as you select it in the terminal, as Linux terminals do.

• Default: Off.
• Caution: Every selection silently replaces whatever was on the clipboard.

Warn before pasting

settings.pasteWarning

Asks before pasting text that has several lines or is large (5 KB or more), because each pasted line can run as a command the moment it arrives.

• Default: Multi-line pastes.
• Choices: multiline several lines; never Never
• Caution: With “Never”, a pasted block of commands runs at once. Commands written by the AI assistant are always asked about when they have several lines.

Right-click

settings.rightClick · Desktop only

What the right mouse button does in a terminal: open the menu, or paste the clipboard straight away as PuTTY does.

• Default: Show menu.
• Choices: menu menu; paste paste

Bell

settings.bell

What happens when a program rings the terminal bell (a failed Tab completion, for example): a brief flash, a sound on desktop or a vibration on mobile, or nothing.

• Default: Flash.
• Choices: visual flash; audible sound; none nothing

Scrollback

settings.scrollback

How many lines of past output each terminal keeps for scrolling back, 1,000 to 100,000. More lines use more memory per open terminal.

• Default: 10,000 lines.

Default TERM

settings.defaultTermType

What the app tells servers it is (the TERM variable), which decides the colours and keys programs use. A host or group can override it. Change it only if full-screen programs misbehave everywhere. The choices are xterm-256color, xterm, vt100 and linux (the Linux console).

• Default: xterm-256color.
• Choices: xterm-256color xterm-256color; xterm xterm; vt100 vt100; linux linux

Word separators

settings.wordSeparators

The characters that end a word when you double-click (double-tap on mobile) to select one. Remove a character to have it selected as part of the word.

• Default: A space and ( ) [ ] { } ’ “ , ; :

Font ligatures

settings.ligatures · Desktop only

Draws pairs such as -> and != as one joined symbol, in fonts that have them. It changes only how they look, not what is sent.

• Default: Off.

Smart highlighting

settings.smartHighlight

Sternway colours things it recognises in plain output: addresses, paths, sizes, dates, log levels, the columns of a file listing and more, each in a colour of the terminal theme, so another theme recolours them. Programs’ own colours are never changed: only text a program printed in the default colour is painted. It is display only, so copying, searching, logs and what is sent are unaffected. Full-screen programs such as vim and less, and the line you are typing on, are left alone. Each kind can be switched off below; a host can set its own, and a session can be switched from its menu.

• Default: On.

File listings (ls -l)

settings.smartSet.listing

In a long file listing: the permission letters, owner and group, size and date, and the name by what it is (a folder, a link, a program), where ls did not colour the name itself.

• Default: On.
• Example: ls -l | head

Diffs

settings.smartSet.diff

Added and removed lines and the @@ headers of a unified diff that was printed without colour. A line that starts with + or - is only coloured inside a diff.

• Default: On.
• Example: git diff –no-color

Web server logs

settings.smartSet.http

In access-log lines: the request method, and the status code by its class (2xx, 3xx, 4xx, 5xx).

• Default: On.
• Example: “GET /health HTTP/1.1” 200

Links and email addresses

settings.smartSet.links

Web and other addresses that start with a scheme (https://, ssh://, …) and email addresses, underlined. Links stay clickable as before.

• Default: On.
• Example: https://example.com

IP and MAC addresses

settings.smartSet.addresses

IPv4, IPv6 and hardware (MAC) addresses. Four numbers that are part of a version (version 1.2.3.4, curl-8.5.0.1) are not taken for an address.

• Default: On.
• Example: 10.0.0.5, fe80::1, 00:15:5d:0a:1b:2c

IDs and hashes

settings.smartSet.ids

UUIDs, commit and digest hashes and 0x numbers, stepped back so the text around them reads more easily.

• Default: On.
• Example: 9fceb02d, 0x7ffe

Dates and times

settings.smartSet.dates

Dates and timestamps (ISO, syslog, file listings, web logs), stepped back. A time counts only with its seconds: 19:36:01, not 19:36.

• Default: On.
• Example: 2026-10-07 19:36:01, Apr 15 19:36

Log levels and results

settings.smartSet.levels

ERROR, WARN, INFO, OK, DEBUG and the like, and words that say how something ended: failed, denied, refused, deprecated, passed, active (running). A lower-case level word counts only where it is marked as one (error:, [warn], level=info), not in a sentence.

• Default: On.
• Example: ERROR, [warn], Permission denied

JSON and YAML keys

settings.smartSet.data

The key at the start of a “key: value” line, the quoted keys of JSON, and true, false and null on such a line.

• Default: On.
• Example: “name”: “web-01”

File paths

settings.smartSet.paths

Absolute paths and paths under ~/. A path that ends in / is coloured as a folder. A single component counts only for a system folder (/etc, /var), so “and/or” and “n/a” are left alone.

• Default: On.
• Example: /var/log/nginx/, ~/src/app.conf

Sizes and numbers

settings.smartSet.numbers

Numbers with a unit (12K, 3.4G, 85%, 340ms) and numbers standing in a column. A number in a sentence, a version or a name is left alone.

• Default: On.
• Example: 3.4G, 85%

Quoted text

settings.smartSet.strings

Text between double quotes, single quotes or backticks. An apostrophe inside a word does not start a quote.

• Default: On.
• Example: echo “hello world”

Command options

settings.smartSet.options

Long options (–verbose), a short option at the start of an indented help line, and the name in name=value.

• Default: On.
• Example: –verbose, TERM=xterm

Highlight keywords

settings.keywordHighlight

Colours matches of your own rules below in terminal output, each in the colour you gave it. Your rules win over smart highlighting and also colour text a program coloured itself. Like smart highlighting it is display only and paints the normal screen, not full-screen programs such as vim. The rules sync to your other devices; they are edited on desktop.

• Default: Off.

Regular expression

settings.keywordPattern · Desktop only

The text to colour, as a regular expression, matched without regard to capitals. Where two rules match the same text, the one higher in the list wins. The editor takes up to 64 rules; a rule whose pattern is not a valid expression is skipped.

• Example: error|failed, or \bWARN(ING)?\b

Local shell

settings.localShellPath · Desktop only

The program a local terminal (one on this computer, not a server) runs. Leave it empty for the system default: your login shell on Linux and macOS, PowerShell on Windows (PowerShell 7 when it is installed, otherwise Windows PowerShell). The list holds the shells found on this computer (on Windows: PowerShell, Command Prompt, Git Bash and each WSL distribution); “Custom…” takes any other program by its full path. “New local terminal in”, in the + menu of the tab strip, starts any listed shell for one tab without changing this setting. Autocomplete is not offered in PowerShell or Command Prompt, and a restored workspace does not change folder in a local terminal on Windows.

• Default: System default.
• Example: /bin/zsh, or C:\Program Files\PowerShell\7\pwsh.exe

Shell program

settings.localShellCustom · Desktop only

The full path of the program local terminals run, for a shell that the list above does not show. “Browse…” picks the file. Empty it to go back to the system default.

• Example: /usr/bin/fish, or D:\tools\nu.exe

Option as Meta

settings.optionAsMeta

Makes the Option (Alt) key work as the Meta key that shells and editors expect, so Option+B jumps back a word instead of typing a special character. On mobile it applies to a hardware keyboard.

• Default: Off.

Background image

settings.terminalBackground · Desktop only

A picture behind the text of every terminal. “Choose image…” takes a PNG, JPEG or WebP file of at most 8 MB, 8,192 pixels a side and 24 million pixels in all; an animated PNG or WebP moves as it does elsewhere. Sternway keeps a copy of it in this computer’s profile, so moving or deleting the original changes nothing. Where the picture would make text hard to read, the terminal’s own background colour is laid over it just enough to keep every readable colour of the theme at 4.5:1. Kept on this computer only: it is not synced, and a backup carries it only when “Include in backups” is on.

• Default: No image.
• Caution: A file is checked by what it contains, not by its name: an SVG, a GIF or anything that is not one of the three is refused, and so is a picture too big to draw.

Image opacity

settings.terminal.backgroundOpacity · Desktop only

How strongly the background image shows, 5 to 100 percent in steps of 5. Where that would make text hard to read the picture is dimmed further, so the text always stays readable. Kept on this computer.

• Default: 30 %.

Image blur

settings.terminal.backgroundBlur · Desktop only

Blurs the background image, 0 to 20 pixels, so that its details do not compete with the text. Kept on this computer.

• Default: No blur (0).

Include in backups

settings.terminal.backgroundInBackups · Desktop only

Puts the background image, its opacity and its blur into the encrypted backups you export (Settings › Backups), so restoring one on another computer brings the picture back. A backup of some vaults only, such as a team’s, never carries it.

• Default: Off: the picture stays on this computer.

Settings: Connections & SSH

Where: Settings › Connections & SSH; Settings › Background & keep-alive.

Connect timeout

settings.ssh.connectTimeoutSec

How long to wait for a server to answer, and then for the login handshake, before giving up. Raise it for slow or distant links. 1 to 300 seconds; a host or group can set its own.

• Default: 15 seconds.

Auto-reconnect

settings.ssh.autoReconnect

When a session drops unexpectedly, connect again without asking: 5 quick tries, waiting 1, 2, 4, 8 and 16 seconds, then one try a minute for as long as its tab is open, and at once when the network changes or the device wakes. On the phone it waits while the app is in the background, unless Keep sessions alive in background is on. A running port forward whose connection drops tries again too: up to 10 tries over about 5 minutes, and at once when the network of this computer or phone changes. A host or group can set its own.

• Default: On.

Unknown host keys

settings.ssh.hostKeyPolicy

Every server proves who it is with a host key, and the app remembers it (Known hosts). This decides what happens the first time a server is seen: “Ask” shows its fingerprint and lets you accept it; “Strict” refuses any server not already known. A server whose key has changed is always stopped with a warning, whichever you choose. You can go on only by choosing Replace key.

• Default: Ask.
• Choices: ask Ask; strict Strict
• Caution: With “Ask”, accepting a fingerprint without checking it is how a connection gets intercepted. Compare it with what the server’s administrator gives you.

Agent forwarding

settings.ssh.agentForwarding

Lets a server you are on use your keys to log in to a further server, without the private keys leaving this device. This is the default for hosts that do not set their own. “Auth key” offers only the key that signed you in; “All keys” offers the keys of the host and its jump hosts. It is asked for in terminal sessions only, not for SFTP or port forwards. “Auth key” offers nothing when you logged in with a password or with a key of this computer’s SSH agent. “All keys” leaves out security-key (hardware) keys and encrypted keys whose passphrase is neither saved nor remembered; it does not ask for them.

• Default: Off.
• Choices: off Off; auth-key Auth key; all-keys All keys
• Caution: While you are connected, anyone with administrator rights on the server can log in elsewhere as you. Leave it off here and turn it on per host for servers you trust.

Use this computer’s SSH agent

settings.ssh.systemAgent · Desktop only

Also logs in with the keys held by an SSH agent on this computer, for every host, next to the key or password the host has in Sternway. The keys stay in the agent: Sternway only asks it to sign. Which agent is set under “SSH agent”: the system one, 1Password, Bitwarden or a socket you name. Nothing happens when that agent is not running. This setting belongs to this computer and is not synced.

• Default: Off.
• Caution: A server that allows only a few login attempts can refuse the connection when the agent holds many keys: each one offered counts as an attempt.
• More: Read more

SSH agent

settings.ssh.agentSource · Desktop only

The agent “Use this computer’s SSH agent” logs in with. “System agent (SSH_AUTH_SOCK)” is the one your terminal uses: on Linux and macOS the agent SSH_AUTH_SOCK names; on Windows the OpenSSH Authentication Agent service, or Pageant when SSH_AUTH_SOCK names its pipe. “1Password” and “Bitwarden” are the agents of those password managers once turned on in their settings: Sternway finds their socket itself. On Windows both use the OpenSSH agent pipe, the same as the system agent. “Custom socket or pipe” uses the path under “Agent socket or pipe”. Each choice says whether its agent is running; Test lists the keys it holds.

• Default: System agent (SSH_AUTH_SOCK).
• Choices: system System agent (SSH_AUTH_SOCK); 1password 1Password; bitwarden Bitwarden; custom Custom socket or pipe
• Caution: A password manager asks you to approve each login with one of its keys, in its own window. The connection waits for your answer.
• More: Read more

Agent socket or pipe

settings.ssh.agentPath · Desktop only

The socket of another SSH agent, for “Custom socket or pipe”: a full path such as /run/user/1000/gnupg/S.gpg-agent.ssh, or on Windows a named pipe such as \\.\pipe\openssh-ssh-agent. Only a socket or pipe on this computer is used, never a network address. Typing a path here chooses “Custom socket or pipe”. Left empty, Custom uses the system agent.

• Default: Empty.
• More: Read more

Keep in step with ~/.ssh/config

settings.ssh.configLink · Desktop only

Shows every host of your OpenSSH config file (and the files it includes) in an “SSH config” folder, and keeps it up to date: a change to the file appears within seconds. Editing one of these hosts in Sternway writes the change back into the file, line by line, leaving your comments, the order and the settings Sternway does not use as they were. ProxyCommand, ProxyJump, IdentityFile, IdentitiesOnly, User, Port, ForwardAgent, the forwards and ServerAliveInterval are used when you connect; a host’s details list what else the file says that Sternway does not use. Hosts from included files are shown but never changed. The folder stays on this computer: it is not synced.

• Default: Off.
• Caution: A ProxyCommand runs a program on this computer each time you connect to that host, exactly as ssh would. Edits are written to your real ~/.ssh/config.

Show which hosts answer

settings.hosts.reachability

A dot beside each host in the list says whether its SSH port takes connections now: green with the time it took, red when it does not answer. The app checks only the hosts on screen, each one about once a minute, by opening a TCP connection to the SSH port and closing it at once: no SSH handshake, no login, no password or key, so it never sets off a two-factor prompt or counts as a failed login. A host behind a jump host or a proxy, or one that needs port knocking, shows as unknown: checking it would mean logging in to the hops or knocking.

• Default: Off.
• Caution: Each check is a connection the server sees and may log. Many hosts on screen, or a list left open for hours, add up: a strict Fail2Ban or firewall rule that counts connections (not failed logins) could block this device.

Allow legacy algorithms

settings.ssh.legacyAlgorithms

Also offer old encryption methods (SHA-1 key exchange and signatures, CBC ciphers, ssh-rsa host keys) to every server. Prefer turning it on for the one old host that needs it, in that host’s Advanced settings on desktop.

• Default: Off.
• Caution: These methods are weak.

Post-quantum key exchange

settings.ssh.pqc

Prefer a newer way of agreeing on the encryption keys of the session (the method called mlkem768x25519) that also resists a future quantum computer, where the server supports it. The usual methods are still offered. Turn it off only if servers misbehave with it.

• Default: On.

Keepalive interval

settings.ssh.keepaliveIntervalSec · also shown as “SSH keepalive interval”

A keep-alive is a tiny “are you there?” message sent while a connection is quiet, so routers do not drop it and a dead link is noticed. This is the time between them, 0 to 3600 seconds. It applies from the next connection; a host or group can set its own.

• Default: 30 seconds.
• Caution: Off means a silently dead connection is not noticed until you type.

Missed keepalives allowed

settings.ssh.keepaliveCountMax

How many keep-alives in a row may go unanswered before the connection is declared lost and closed (auto-reconnect then takes over, if on). With the defaults that is about a minute and a half. 1 to 100.

• Default: 3.

Keep sessions alive in background

settings.background.keepAlive · Phone only

Keeps your connections running after you leave the app, by running an Android service with a notification that also has buttons to disconnect. On iOS the system only allows a short grace period.

• Default: On.
• Caution: With it off, the system may close your connections soon after you switch away.

Show the connecting screen

settings.terminal.connectScreen

While a session connects, a screen in its place shows the way from this device to the host (through each jump host or proxy), the step it is on, and anything it has to ask: an unknown host key, a password, a passphrase, a code. “Always” shows it for every connection, and how long it stays for a fast one is the “Connecting animation” setting below. “Only when it takes longer than a moment” leaves a fast connection without it, and still shows it at once when there is a question or a failure. “Never” goes back to the small state text in the session’s header, and questions are asked in dialogs.

• Default: Always.
• Choices: always Always; slow Only when it takes longer than a moment; never Never

Connecting animation

settings.terminal.connectPace

How the connecting screen shows the way to a host. A connection on a local network is up in a fraction of a second, too soon to see, so the screen sails the way at its own pace: from this device through each jump host to the host, each check in turn, pausing a moment as each one is ticked in the list, and for about a second at each jump host, where the list shows that machine finished and the next one starting before it moves on; then it shows the finished state and hands over to the terminal. “Full” takes about 5 seconds for a direct connection, about 8 seconds through one jump host and about 11 through two, long enough to read both the picture and the list; a long chain of jump hosts never takes more than 12 seconds. “Quick” takes about 3 seconds for a direct connection and about 4.5 seconds through one jump host, with half a second at each jump host, never more than 8. “Off” shows the screen only while the connection is really being made. The connection itself is never slowed: the session is ready underneath as soon as it would be anyway, what you type in the meantime reaches it, and any key, a click or a tap ends the animation once the session is ready. A reconnect is never slower than Quick, a local terminal skips the screen, and with reduced motion switched on in the system nothing moves: each step is simply shown for a moment.

• Default: Full.
• Choices: full Full; quick Quick; off Off

Local echo on slow links

settings.terminal.localEcho

Shows what you type at once, underlined, instead of waiting for the host to send it back, the way Mosh does; the host’s own echo then takes its place. “When the link is slow” starts once typing takes more than 100 ms to come back from this host, measured as you type; “Always” from the first key. Only plain typing at the end of a line is shown ahead, one key at a time, and only once the host has echoed a key typed on that line: a control key, an arrow, Backspace or a paste waits for the host, and so does everything in a full-screen program such as an editor.

• Default: Off.
• Choices: off Off; auto When the link is slow; always Always
• Caution: Never at a password or passphrase prompt, and never for what is typed before the host echoes anything on the line: typing ahead of a prompt that does not echo is not shown. A guess the host has not echoed within about a second (or three echo times on a slow link) is taken back, and nothing more is guessed until the program writes a new line. When the host shows something else (a shell that completes or colours the line), the guesses are taken back at once.

Predictive text and swipe typing

settings.terminal.predictiveText · Phone only

Lets the on-screen keyboard treat the terminal as an ordinary text field: it suggests words, corrects them and accepts swipe typing. Each letter is still sent as it appears, and a correction arrives as erases followed by the corrected word. Off, “Keyboard mode” decides what the keyboard is asked for, and in its “Plain text” mode a correction the keyboard makes on its own is not applied. A password prompt on the host makes the field a password-style one whether this is on or off.

• Default: Off.
• Caution: With it on, an autocorrection rewrites what you typed at the prompt, and a keyboard may delay a letter while it decides on a word.

Keyboard mode

settings.terminal.keyboardMode · Phone only

What kind of field the terminal says it is to the on-screen keyboard, while “Predictive text and swipe typing” is off. Keyboards decide from it what they offer. “Plain text (recommended)” says ordinary text with suggestions asked off: the keyboard keeps its emoji, its clipboard, its suggestion bar where it has one, and swipe typing. The terminal guards what that could cost. While the host asks for a password or a passphrase the field becomes the Strict one by itself, and a line over the keys says “Password entry: suggestions off”; it goes back when the prompt is answered, cancelled or gone. The keyboard is asked not to capitalise and not to open a full-screen editor; while a password is asked for it is also asked not to learn what is typed. And a command arrives as it was typed: a word the keyboard corrects on its own when you press space or punctuation is not changed on the command line, two spaces stay two spaces, and only a suggestion you tap replaces the word before the cursor. “Terminal (like Termux)” names no kind of field at all, which is what Termux does by default: key presses only, nothing is suggested or corrected. “Strict” says a password-style field: a keyboard sends every key at once, hides its emoji and suggestions there and does not learn what is typed. In every mode the key row, Ctrl and Alt, Backspace, Enter and the emoji key work the same, and what is typed is sent as UTF-8. The change applies at once, also to sessions that are open; “Keyboard” in a session’s Terminal tools changes the same setting without leaving the session. Android only.

• Default: Plain text (recommended). An install that had never changed this setting moves from Strict to Plain text with the update; a mode that was chosen stays.
• Choices: text Plain text (recommended); terminal Terminal (like Termux); strict Strict
• Caution: A password prompt is recognised by its words (“password”, “passphrase”, “PIN”, “passcode” before a colon at the end of the line). A program that asks for a secret in other words is not recognised: switch to Strict first, or use Compose with “Hide what I type”. Keyboards differ; if typing goes wrong in one mode, try another.

Shake

settings.terminal.shakeAction · Phone only

What a firm shake of the phone sends to the terminal that is on screen, like the volume buttons, which send Up and Down. “Up arrow” recalls the previous command, “Tab” completes, “Esc” and “Ctrl+C” are the keys of those names. The motion sensor is read only while a terminal is open and this is not Off, and at most one shake a second counts. Android only.

• Default: Off.
• Choices: off Off; up Up arrow; tab Tab; escape Esc; ctrl-c Ctrl+C
• Caution: A shake also happens by accident (walking, a bumpy ride). “Ctrl+C” stops whatever is running.

Disconnect after leaving the app

settings.background.disconnectAfterMin · Phone only

Closes every session, file browser and port forward once the app has been in the background this long. Use it so a forgotten session does not stay open all day. 0 to 1440 minutes; 0 never disconnects.

• Default: Never.
• Caution: Anything still running in those sessions, and unsaved work in them, is cut off.

Hold wake lock while sessions are active

settings.background.wakeLock · Phone only

Stops the phone’s processor from sleeping while connections are open, so they are not frozen with the screen off. It costs battery.

• Default: On.

Hold Wi-Fi lock while sessions are active

settings.background.wifiLock · Phone only

Stops the phone from putting Wi-Fi to sleep while connections are open. It costs battery.

• Default: On.

Settings: links

Where: Settings › SSH.

Open ssh:// links with Sternway

settings.links.handleSsh

Makes this app the one your system opens when you click an ssh:// link in a browser, a wiki or a chat. A link never connects by itself: the app shows the host, the user and the port it names and waits for you to choose Connect. A password in a link is never used, and nothing in a link is run. While this is off the app is not registered and ignores any link it is started with.

• Default: Off.
• Caution: Anyone can put an ssh:// link on a page. Read the host in the confirmation before you connect: a link can name a server that only looks like yours.

Settings: SFTP

Where: Settings › SFTP.

Show hidden files

settings.sftp.showHidden

Lists files whose names start with a dot (.bashrc, .ssh) in a new file pane. Each pane’s own menu can switch it for that pane.

• Default: Off.

When a file already exists

settings.sftp.conflictDefault

What a transfer does when the destination already has a file of that name: ask each time, replace it, skip it, or keep both (the new one gets a number).

• Default: Ask.
• Choices: ask ask; replace replace; skip skip; keepBoth keep both
• Caution: “Replace” overwrites existing files without asking.

Verify transfers that were continued

settings.sftp.verifyResumed

When a transfer goes on after a pause, a retry or a lost connection, the finished file is compared with the original before it gets its name: a SHA-256 of both copies. This device computes its own; a host is asked to run “sha256sum” on its copy, and nothing else. Where the host has no such command or allows no second channel, and when this is off, only the size is compared; the transfer then says “checked by size”.

• Default: On.
• Caution: A checksum reads the whole file again on both sides, so a very large file takes longer to finish. A transfer that was never interrupted is not checked this way, except a copy from one host straight to another (two panes on two hosts), whose every file is checked by SHA-256 where both hosts have “sha256sum”, by size otherwise, whatever this says.

Discard unfinished transfers after

settings.sftp.unfinishedDays

A transfer that fails, or is paused or still copying when the app closes, leaves the file it was writing beside its destination as “name.sternwaypart”, and is listed under Unfinished in Transfers with Resume and Discard. After this many days the partial file is removed and the entry goes. A partial file on a host is removed the next time that host’s files are open; one on a host that was only quick-connected is not tracked and has to be removed by hand.

• Default: 7 days. It can be 0 to 365.
• Example: 0 (shown as “Never”) keeps unfinished transfers until you discard them.
• Caution: Discarding removes what was copied so far; the transfer then starts from the beginning.

Move deleted files to the trash

settings.sftp.trash · Desktop only

Deleting files or folders on a host moves them into a folder named .sternway-trash in your home folder on that host, where Trash (in the pane’s menu) lists them with Restore and Delete permanently. Moving is a rename on the host: nothing is copied, so a large folder goes at once. Files on this computer are not affected.

• Default: On.
• Caution: Items in the trash still take space on the host until you empty it. An item on another disk than your home folder cannot be moved there; you are then asked whether to delete it for good. Off: deleting removes files for good, with no way back.

Download folder

settings.sftp.downloadDir · Desktop only

Where Download puts files on this computer, and where the local pane opens. Kept per computer. With no folder set, Download asks for one each time, starting in your Downloads folder, and the local pane opens in your home folder.

• Default: None: ask each time.

Open with

settings.sftp.openWith · Desktop only

Which program “Open with” starts for a file extension. Type the extension (with or without the dot; capitals do not matter) and the program: its full path or a command on your PATH. The program gets the downloaded file as its only argument. On Windows it must be a program (.exe), not a .cmd or .bat launcher.

• Default: No programs set.
• Example: .log → /usr/bin/code, or .log → C:\Windows\System32\notepad.exe

Settings: Security

Where: Settings › Security.

Auto-lock

settings.security.autoLockMinutes

Locks the app after this long without use, when an app lock is set. Sessions keep running behind the lock. 0 to 1440 minutes; 0 turns auto-lock off.

• Default: 5 minutes.

Lock on system sleep

settings.security.lockOnSleep · also shown as “Lock when backgrounded”

On desktop: lock the app when the computer sleeps or its screen is locked. On mobile: lock as soon as you leave the app. It has an effect only when an app lock is set.

• Default: On.

Clear clipboard after copying a secret

settings.security.clipboardClearSec

When you copy a password or other secret from the app, the clipboard is emptied after this long, if it still holds that secret. 0 to 3600 seconds; 0 never clears it.

• Default: 60 seconds.
• Caution: “Never” leaves copied secrets on the clipboard, where other apps and clipboard managers can read them. A copied private key is cleared within 60 seconds on desktop regardless.

Sync keys and identities

settings.sync.syncCredentials

Whether the private keys, identities, certificates and saved passwords of your personal vault travel to your other devices, encrypted, through your server. Team vaults always sync. This switch is per device.

• Default: On.
• Caution: Off means those keys and passwords exist on this device only: lose the device and they are gone.

Breach check for new passwords

settings.security.leakedPasswordCheck

When you set an account password, checks whether it appears in known data breaches. Only the first 5 characters of a scrambled form of the password (its hash) are sent to api.pwnedpasswords.com, which answers with every breached hash that starts that way; the comparison happens here, and the password itself never leaves the device. A match only warns you.

• Default: Off.

Block screenshots

settings.security.blockScreenshots · Phone only

On Android, blocks screenshots and screen recording everywhere in the app and blanks its preview in the app switcher. A private key being imported, the recovery kit and the lock screen are protected even with this off.

• Default: Off.

Settings: AI

Where: Settings › AI.

AI assistant

settings.aiEnabled

Shows the AI controls: “Write a command” and “Explain or ask” in the terminal, and “Generate” in the snippet editor. Nothing is sent anywhere until you use one of them, and it needs a provider below.

• Default: Off.

Always preview before sending

settings.ai.previewBeforeSend

Before each AI request, shows what will be sent: your request, any selected terminal text and the host’s system and shell when the request carries them, with secrets already replaced by [REDACTED] (Sternway’s fixed instructions for the request go with them). Nothing goes until you press Send. Secrets are masked on this device whether or not this is on: passwords, keys and tokens by their look, and the passwords, private keys, passphrases and API keys saved in your vaults by their exact value.

• Default: On.
• Caution: Off, a request goes as soon as you ask. Masking cannot know a secret it has never seen: one that is not saved in a vault and does not look like a secret is sent as typed.

Use an AI provider

settings.ai.enable

Connects the assistant to a model you choose, with your own API key or your own server. Kept per device.

• Default: Off.
• Caution: Turning it off forgets the address, model and saved API key.

Provider

settings.ai.kind

Which service answers. “Anthropic” and “OpenAI” speak those companies’ APIs; “OpenAI” also fits most local and self-hosted servers (Ollama, LM Studio, OpenRouter). “Sternway” uses the AI of the server you are logged in to and needs no key.

• Default: Anthropic.

Base URL

settings.ai.baseUrl

The address of the provider’s API. The app looks under /v1 unless the address already has a version in its path, such as /v1 or /v1beta. A whole endpoint pasted in (ending in /chat/completions, /messages or /models) is cut back to its base. 0.0.0.0 is connected to as 127.0.0.1.

• Default: https://api.anthropic.com or https://api.openai.com, by provider.
• Example: https://api.openai.com, or http://localhost:1234 for a model on this computer
• Caution: Plain http:// is accepted only for this device and private networks; over it, your key and prompts travel unencrypted.

Model

settings.ai.model

The exact name of the model to ask, as the provider lists it. “Test connection” shows the names the provider offers.

• Example: claude-sonnet-5-5, or the name your local server lists

API key

settings.ai.apiKey

The secret your provider gave you to bill and authorise requests. A local server usually needs none.

• Caution: Stored on this device only, not synced. On desktop it is never shown again once saved; type a new key to replace it.

Settings: Updates, Logs, Profiles

Where: Settings › Updates, Logs, Profiles (desktop).

Allow update checks

settings.updater.enabled · Desktop only

Allows the “Check for updates” button below to ask your update feed whether a newer version exists. The app never checks by itself, at startup or later: a check happens only when you press the button. Nothing is ever downloaded or installed; a newer version is shown with a link to its download page.

• Default: Off.

Update feed URL

settings.updater.feedUrl · Desktop only

The https address of the signed update feed. Sternway publishes its own at downloads.sternway.dev. The feed’s signature is checked against a key built into the app.

• Default: https://downloads.sternway.dev/feed/stable.json
• Example: https://updates.example.com/sternway.json

Log sessions in …

settings.logging.vault · Desktop only

Records what sessions of this vault’s hosts print, so you can read it later in Logs. A host can opt out, and Mosh sessions are never recorded. For a shared vault the switch applies to everyone using it. Logs stay on the device that recorded them unless “Sync session logs” is on.

• Caution: Turning it off deletes every log already stored for the vault, on this device and on the server. A log holds whatever appeared on screen, including secrets a command printed.

Sync session logs

settings.sync.syncLogs

Whether the session logs this device records leave it. Off, a log and what it recorded stay on this device only. On, while you are logged in, the logs of your synced vaults are sent to your server encrypted with the vault’s key, and can be read on your other devices and, for a team vault, by its members. This switch is per device. Logs another device chose to sync are still received here either way.

• Default: Off.
• Caution: A log holds whatever appeared on screen, including secrets a command printed. Turning this off later stops new logs from being sent; the ones already on the server stay there until you delete them.

Show my activity to my team

settings.team.sharePresence

While this is on and you are connected to a host that lives in a team vault, the other members of that vault see that you are on it (your initials on the host). Only the host’s id and the vault’s id are sent, through your sync server, and only to members who can open that vault; nothing about what you type or see. It is forgotten within a minute of you disconnecting. Hosts in your personal vault are never reported. You still see your teammates’ activity when this is off.

• Default: On.
• Caution: Off: nothing about your activity is sent. What was already shown is taken back at once.

New profile name

settings.profileName · Desktop only

A profile is a completely separate copy of the app’s data: its own hosts, keys, account and settings. Use one for work and one for home. Up to 64 characters, at most 32 profiles.

• Example: Work

Settings: Notifications

Where: Settings › Notifications.

Notifications

settings.notifications.enabled

The master switch. On, Sternway lists what happened under the bell and hands the kinds switched on below to your system as notifications. Off, nothing is listed or shown, with one exception: a changed host key or a connection refused for security reasons is still listed under the bell.

• Default: On.

Also when Sternway is in front

settings.notifications.whenInFront

Normally a system notification is shown only when you are not looking: the app is behind another window (on a phone: not on screen), or the session it is about is on another tab. Turn this on to get the system notification every time.

• Default: Off.

Play a sound

settings.notifications.sound · Desktop only

Whether a system notification plays your system’s notification sound. Your system may still mute it (Do Not Disturb, Focus Assist).

• Default: On.

Hide details in system notifications

settings.notifications.hideDetails

A system notification then says only what kind of thing happened (“Terminal activity”, “A session needs attention”): no host name, no file name and no text from a terminal. The list under the bell still has the details. On an Android lock screen the text of a notification is hidden either way; with this on the host name is hidden there too.

• Default: Off: the host name shows, also on the lock screen.
• Caution: A matched line or a message from a remote program can show whatever that line says. Passwords, keys and tokens Sternway recognises are replaced, but it cannot know every secret.

Quiet hours

settings.notifications.quietHours

A span of the day in which no system notification is shown or sounded. What happens meanwhile is still listed under the bell.

• Default: Off.
• Example: From 22:00 until 07:00.

Quiet from

settings.notifications.quietFrom

When the quiet hours start, in your local time. A start later than the end means the hours run over midnight.

• Default: 22:00.

Quiet until

settings.notifications.quietUntil

When the quiet hours end, in your local time. The same time as the start means no quiet hours at all.

• Default: 07:00.

Long-running command

settings.notifications.longCommandSec

“Notify me when this command finishes” speaks only for a command that ran at least this long, so that every ls does not notify. 1 to 3600 seconds.

• Default: 10 seconds.

Quiet for

settings.notifications.quietMin

“Notify me when it goes quiet” speaks once a session has printed nothing for this long: a build that finished without a prompt, a download that stalled, a program that sits waiting. One notification per quiet spell; new output starts the count again. 1 to 240 minutes.

• Default: 5 minutes.

A session was disconnected

settings.notifications.sessionDisconnected

A session that was connected lost its connection without you closing it. Said once, also while Sternway tries to reconnect; the notification has Reconnect.

• Default: On.

A session reconnected

settings.notifications.sessionReconnected

Automatic reconnect got a dropped session back. Off by default, because the session simply works again.

• Default: Off.

Reconnecting failed

settings.notifications.sessionReconnectFailed

Sternway stopped trying to reconnect a dropped session because a try needs you: the host key was refused, or the login was cancelled or needs an answer. The notification has Reconnect.

• Default: On.

A transfer finished

settings.notifications.transferFinished

A file transfer finished while you were not looking (Sternway was not in front) or after running for more than 10 seconds. Several that finish together are one notification.

• Default: On.

A transfer failed

settings.notifications.transferFailed

A file transfer stopped with an error. The notification says why and has Retry.

• Default: On.

A transfer needs an answer

settings.notifications.transferNeedsAnswer

A transfer is waiting for you to say what to do with a file that already exists. It stays until you answer.

• Default: On.

A port forwarding rule stopped

settings.notifications.forwardStopped

A rule that was running stopped by itself (its connection was lost), or a rule could not start. A rule you stop yourself says nothing.

• Default: On.

A port forwarding rule started by itself

settings.notifications.forwardAutoStarted

A rule set to start with the app, or with its host’s connection, was started.

• Default: Off.

Sync needs attention

settings.notifications.syncFailed

Syncing stopped in a way that does not mend itself: the password was changed elsewhere, this device was removed from the account, or the server refuses. Being offline is not this; it is shown in the sidebar.

• Default: On, while logged in.

A new device logged in

settings.notifications.newDevice

A device that was not on your account before is on it now. Sternway finds out when this device next checks the account (after a sync, and every 15 minutes while it runs), not at the moment it happens.

• Default: On, while logged in.
• Caution: If it was not you, revoke the device in Account › Devices and change your password.

Added to a team

settings.notifications.teamJoined

Your account is in a team it was not in before. An invitation itself arrives by email and cannot be shown here: the app learns of a team only once you are a member.

• Default: On, while logged in.

Team access changed

settings.notifications.teamAccessChanged

Your role in a team changed, you were offered its ownership, or your access to one of its vaults was given, changed or taken away.

• Default: On, while logged in.

Removed from a team

settings.notifications.teamRemoved

Your account is no longer in a team; its vaults are gone from this device.

• Default: On, while logged in.

A shared session needs an answer

settings.notifications.shareRequest

Someone is waiting to be let into a session you share, or asks to type in it.

• Default: On.

An update is available

settings.notifications.appUpdate · Desktop only

A newer version of Sternway was found. Only while update checks are on in Settings › Updates; Sternway then looks once a day.

• Default: On.

Unfinished transfers at start

settings.notifications.unfinishedTransfers

When the app opens and finds transfers an earlier run left unfinished, it says so once, so they can be resumed or discarded.

• Default: On.

Locked while transfers run

settings.notifications.lockedWithTransfers

The app locked while file transfers are still running. They go on behind the lock.

• Default: Off.

Rule name

settings.notifications.ruleName

What the notification is called when the rule matches (“Errors matched on web-01”). Up to 60 characters.

• Example: Errors

Line matches

settings.notifications.rulePattern

A regular expression. A session that has “when a line matches” switched on notifies when a line of its output matches it. The notification shows only the matched line, cut short, with passwords, keys and tokens Sternway recognises replaced. A pattern that could take forever on some lines (a repeat inside a repeat, such as (a+)+) is refused, only the first 1,000 characters of a line are looked at, and a rule that turns out slow is switched off until you change it.

• Example: error|failed (either word), or ^Deploy finished (a line that starts with it).
• Caution: Lines inside a full-screen program (an editor, a pager) are not matched.

Match case

settings.notifications.ruleCase

On, the pattern only matches text in the same upper and lower case. Off, ERROR, Error and error are the same.

• Default: Off.

Settings: CLI tokens

Where: Settings › CLI tokens (desktop).

Token name

settings.cli.tokenName · Desktop only

What the token is for, so you know which one to revoke later: the script, the machine or the job that uses it. Up to 64 characters. The name is never part of the token itself.

• Example: Backup script on build-01

List hosts

settings.cli.scope.hosts · Desktop only

Lets sternway-cli hosts list your saved hosts: each one’s name, address and id. Nothing else about a host is given out: no user name, password, key or note.

Open terminals

settings.cli.scope.connect · Desktop only

Lets sternway-cli connect <host> open a terminal to a saved host in this app, as if you had double-clicked it. The terminal opens in the app, in front of you: the command cannot type into it or read it.

Run snippets

settings.cli.scope.run · Desktop only

Lets sternway-cli run <snippet> --hosts … run one of your saved snippets on the hosts named and print what each host printed, as Snippets › Run on hosts does (the run shows in the app as well). It runs only saved snippets, never a command the script makes up; a note is never run.

• Caution: Whoever has the token can run any of your saved snippets on any of your hosts. Give it only to a script you trust, and only for as long as it needs.

Copy files (SFTP)

settings.cli.scope.sftp · Desktop only

Lets sternway-cli cp copy one file from a host into a folder on this computer, or (unless the token is read-only) from this computer into a folder on a host, over the host’s SFTP. A file that is already there is left alone unless the command says –overwrite.

• Caution: A copy to a host can replace files on it with –overwrite. Tick Read-only as well if the script only needs to fetch files.

Read-only

settings.cli.scope.readOnly · Desktop only

Limits the other choices to what changes nothing: listing hosts and copying files from a host. With it, the token can never open a terminal, run a snippet, copy a file to a host or replace a file on this computer (–overwrite), even when those are ticked. It is not a scope of its own: on its own it allows nothing.

Folder for files

settings.cli.folder · Desktop only

The one folder on this computer the token’s downloads go to and its uploads come from, set when it is made. Everything stays inside it: no path with .., no symbolic link, no hidden file or folder (a name that starts with a dot). So a token can never create ~/.ssh/authorized_keys, /.bashrc or an autostart entry, or upload a private key. The folder is made 0700. It must be a new or empty folder (or another token’s): never the home folder, a folder above it, or a folder programs read from (/.config, ~/Library, %APPDATA%).

• Default: Sternway in your Downloads folder.

Expires after

settings.cli.expiry · Desktop only

When the token stops working by itself. Every token expires; a year is the longest. After that the command is refused and you create a new token. You can revoke a token at any time before.

• Default: 30 days.