It's not entirely trivial. The javascript must be served from a trusted source.
As described in its FAQ, it uses websocketproxy[1] for network access. This is a separate server application running on https://relay.widgetry.org/ . JSLinux absolutely cannot access raw TCP sockets, and ergo cannot terminate SSH connections, without it connecting to this websocket proxy. You can see this even in the Network tab of devtools.
Sure, you could spin up a websocketproxy yourself, but as I explained in a previous response to you, the value proposition of Shellvault is that you don't need to spin up any servers and host them yourself - this service does it for you.
> JSLinux absolutely cannot access raw TCP sockets,
Agreed.
> and ergo cannot terminate SSH connections
No. The SSH application layer is terminated in the browser.
It does work.
I'm suggesting that Shellvault could operate an untrusted intermediary by terminating SSH in the browser instead of on their server.
If you don't believe it's possible, load this: https://bellard.org/jslinux/vm.html?url=https://bellard.org/... and use the SSH client. It works already.
You do have to trust Fabrice Bellard not to ship a compromised client to the browser, but a.) that's much less trust than you'd be giving to Shellvault, and b.) there's no reason you couldn't self-host the files for jslinux.