bridgesessions
Single binary containing client, server, and doctor. Static-linked OpenSSL + zstd, ~5 MB.
Architecture
One protocol. One binary. One mesh. Replace mosh → ssh → zellij with bs-client ⚡ bs-server.
Overview
BridgeSessions is written in C++23, uses TLS 1.3 over TCP for transport, zstd per-frame compression, and ed25519 mutual TLS plus TOFU for authentication. The build system is CMake 3.25+.
┌─────────────────────────────────────────────────────────────────┐
│ macOS / Linux / Windows client │
│ ┌─ Pane A ───────────────────────────┐ ┌─ Pane B ───────────┐│
│ │ bridgesessions shell dev --name=hms │ │ bridgesessions ... ││
│ │ stdin/stdout relay │ │ ││
│ └──────────────┬──────────────────────┘ └──────────┬─────────┘│
└──────────────────┼────────────────────────────────────┼──────────┘
│ bs:// over TLS 1.3 / TCP (19949) │
┌────────┴──────────┐ ┌─────────┴──────────┐
│ INTERNET │ │ │
└────────┬──────────┘ └─────────┬──────────┘
│ │
┌──────────────────┼────────────────────────────────────┼──────────┐
│ Linux / macOS server │
│ bridgesessions (daemon, TCP 19949) │
│ ┌──────────────────────────────────────────────────────┐ │
│ │ Session Multiplexer (replaces zellij) │ │
│ │ ┌─ session: hms ──────────────────────────────────┐ │ │
│ │ │ PTY → shell │ │ │
│ │ │ Output buffer (zstd, last 16K lines) │ │ │
│ │ └─────────────────────────────────────────────────┘ │ │
│ │ Clipboard relay (OSC 52 → protocol message) │ │
│ └──────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────┘
The client is a relay, not a terminal emulator. It sits between the local PTY and the network, translating stdin/stdout to and from bs:// protocol messages.
Components
bs-client
Stdin/stdout relay. Loads the ed25519 keypair, dials the server, performs mTLS, and attaches to a named session.
bs-server
Linux/macOS daemon. Manages PTY lifetimes, buffers output, forwards signals, and relays clipboard.
Protocol layer
Shared message types, binary codec, and zstd compression. Header-only where possible.
Transport layer
TLS 1.3 over TCP v1. Future v2 swaps to QUIC via msquic with the same protocol codecs.
Bridge Panel
Web surface for long Markdown reviews. Edit, Save, Copy — not chat paste.
The bs:// protocol
Reliable, secure, compressed, low-latency, firewall-friendly, and multiplexed.
Frame: [stream_id: u16] [type: u8] [flags: u8] [length: u16] [data] flags: bit 0 = compressed (zstd), bit 1 = control frame Stream ID 0: Control channel (Attach, Detach, SessionList, Ping/Pong) Stream ID 1-N: Session channels (Keystroke, Output, Clipboard, Signal)
Key message types
Keystroke / Output
Raw key bytes to the server; PTY stdout back to the client.
Attach / Detach
Start or preserve a session. Detach keeps the PTY alive.
ClipboardGet / ClipboardPut / ClipboardEcho
Two-way clipboard with hash echo to prevent races.
Scrollback / ScrollbackAck
Replay last output in paced, client-ACK'd chunks.
Signal
Forward ^C, ^Z, and ^\ to the foreground process group.
SessionDied / ExitCode
Notify the client when a PTY exits or a foreground process ends.
Security stack
Application: bs:// protocol messages
Transport: TLS 1.3 over TCP
├── Forward secrecy (X25519 key exchange)
└── TLS session tickets (ephemeral)
Compression: zstd per-frame
Identity: ed25519 keypair (no CA infrastructure needed)
Authentication uses ed25519 mutual TLS plus TOFU. Each client has a keypair stored in ~/.bridgesessions/id_ed25519.pem. Servers pin authorized public keys in ~/.bridgesessions/authorized_keys.