Files and storage
Where Bast writes SSH config, keys, and metadata on your system.
Bast keeps things in predictable places on your machine. Cloud sync only writes local SSH config from provider APIs. Vault stores an encrypted backup of Bast-managed state remotely, never plaintext.
Managed SSH config
~/.ssh/bast/configHost blocks you create through Bast are written here. Your main ~/.ssh/config gets one Include line pointing at this file. External hosts can be copied here with promote.
GCP sync config
~/.ssh/bast/sync/gcp/configHosts imported from GCP are written here. Bast includes this file from ~/.ssh/bast/config while GCP sync is enabled. Disconnecting removes the Include and the generated file. See GCP.
AWS sync config
~/.ssh/bast/sync/aws/configAmazon EC2 hosts imported through AWS sync are written here. Bast includes this file from ~/.ssh/bast/config while AWS sync is enabled. Disconnecting removes the Include and the generated file. See AWS.
Azure sync config
~/.ssh/bast/sync/azure/configAzure Linux VMs imported through Azure sync are written here. Bast includes this file from ~/.ssh/bast/config while Azure sync is enabled. Disconnecting removes the Include and the generated file. See Azure.
Box sync config
~/.ssh/bast/sync/box/configASCII Box sandboxes imported through box.ascii.dev sync are written here. Bast includes this file from ~/.ssh/bast/config while Box sync is enabled. Disconnecting removes the Include and the generated file. See box.ascii.dev.
Upstash Box sync config
~/.ssh/bast/sync/upstash/configUpstash Box sandboxes are written here. The API key is stored separately at ~/.config/bast/upstash-box-api-key and is not written into SSH config. See Upstash Box.
Vercel Sandbox sync config
~/.ssh/bast/sync/vercel/configVercel Sandboxes are written here as picker records (HostName vercel.sandbox.invalid). Connect uses Bast’s WebSocket PTY, not OpenSSH. The access token is stored separately at ~/.config/bast/vercel-token. See Vercel Sandbox.
Managed keys
~/.ssh/bast/keys/Generated, imported, and promoted keys live here. Private keys use mode 0600 on macOS/Linux and a protected Windows DACL on native Windows. Sync also checks keys under ~/.ssh.
GCP falls back to ~/.ssh/google_compute_engine when no local key matches VM metadata or an OS Login profile. AWS checks for a private key matching the EC2 key-pair name, then falls back to ~/.ssh/bast/aws_compute through EC2 Instance Connect. Box uses ~/.ssh/ascii_box_ed25519. Upstash Box uses password authentication with the stored API key.
Azure checks deployment public keys against local keys. Microsoft Entra key and certificate material generated by Azure CLI is stored under:
~/.ssh/bast/azure/Metadata
~/.config/bast/state.jsonStores presentation metadata, cloud sync settings, pending history suggestions, and per-file history scan checkpoints. Bast does not store the original shell history commands.
Vault session
~/.config/bast/vault-session.json
~/.config/bast/vault-passphraseDevice bearer token and vault revision live in vault-session.json. The local encryption passphrase is stored in vault-passphrase (mode 0600 on macOS/Linux and a protected DACL on Windows) so Bast can unlock without prompting every launch. Treat that file like an unlocked private key on disk: anyone who can read it can decrypt your vault ciphertext. Log out clears both. The passphrase is never sent to Bast servers.
On native Windows, ~ is %USERPROFILE%. WSL has a separate Linux home directory and does not share these files automatically.
What stays in OpenSSH
Connection settings (hostname, user, port, identity and certificate files, proxy jump, and cloud tunnel ProxyCommands) live in SSH config files. Bast does not duplicate them in its metadata store.
Backups
Back up ~/.ssh before testing unreleased builds against a production config. Never paste real private keys into issues or bug reports.