AuraTerm User Manual

Overview & Installation

Welcome to AuraTerm — a modern, cross-platform terminal emulator that runs on Windows, macOS, and Linux. Whether you're SSH-ing into remote servers, debugging a serial device, reaching a Telnet host, or just opening a local shell, AuraTerm aims to make it smooth and pleasant.

What AuraTerm is

AuraTerm is a unified terminal workbench that brings the connections you reach for every day into a single app. It supports six connection types: SSH2, Telnet, a local serial port, a network serial port (RFC 2217), raw TCP, and a local shell. On top of that it offers multi-tab and split-pane layouts, a bookmark sidebar and a full bookmark manager, a command palette, file transfer (SFTP and Zmodem), port-forwarding tunnels, quick buttons, output rules, an AI assistant, and Live Share — all built around real-world workflows.

Technically, AuraTerm is built with Tauri v2, a Vue 3 frontend, and a Rust core backend. SSH connections are powered by the Rust russh library. This architecture keeps the installer small and startup fast, while handling security-sensitive work — credential encryption, host-key verification — in the native Rust layer.

Supported platforms

• Windows: install via the installer (.exe).
• macOS: install via the disk image (.dmg).
• Linux: shipped as an AppImage — download it, make it executable, and run it directly.

Download & install

Get the installer for your platform from the AuraXLabs website or the project's releases page, then follow the steps below. All platforms share the same version number, so prefer the latest release.

Windows: double-click the setup installer (its filename looks like the example below) and follow the prompts. Once installed, launch AuraTerm from the Start menu or its desktop shortcut.

AuraTerm_0.2.8_x64-setup.exe

macOS: open the downloaded .dmg, drag AuraTerm into your Applications folder, then open it from Launchpad or Applications.

AuraTerm_0.2.8_aarch64.dmg

Linux: after downloading the AppImage, give it execute permission and run it — no system-wide installation required.

chmod +x AuraTerm_0.2.8_amd64.AppImage && ./AuraTerm_0.2.8_amd64.AppImage

First launch

The first time you open AuraTerm, you'll see the main window with its custom titlebar and an empty workspace. There are no saved connections yet — you can create one right away, or add your frequently used hosts to the bookmark sidebar for quick reconnects later.

AuraTerm does not force you to set a master password up front. When no master password is set, credentials are encrypted with a device-local random key (mode v3); you can enable a master password at any time in Settings to derive the key from it instead (mode v2) for stronger protection. All of this can be adjusted later in Settings — no decision is required on first launch.

Where config is stored

AuraTerm keeps all of your settings, connections, credentials, and security data in the operating system's app-config directory, named after the application identifier com.auraxlab.auraterm. The location per platform is shown below.

Windows:  %APPDATA%\com.auraxlab.auraterm

macOS:    ~/Library/Application Support/com.auraxlab.auraterm

Linux:    ~/.config/com.auraxlab.auraterm

Inside that directory you'll typically find these files:

• settings.json — application settings (theme, fonts, renderer, and so on).
• connections.json — saved connection and bookmark metadata (no plaintext secrets).
• credentials.enc — encrypted credentials (passwords, keys, passphrases); in device-local key mode there is also a credentials.key.
• ssh_known_hosts.json — records the SHA-256 host-key fingerprints per host:port.
• sync_config.enc — encrypted cloud-sync configuration (created once cloud sync is enabled).
• security_audit.log — a security audit log, e.g. records of host-key mismatch overrides.

Interface & Tabs

The AuraTerm main window is built around a custom titlebar and a multi-tab terminal area. This section covers how to manage tabs, split panes, use the bookmark sidebar and the command palette, and adjust display-related features such as find, font size, fullscreen, and the renderer.

The custom titlebar

On Windows, macOS, and Linux, AuraTerm uses a single unified custom titlebar instead of the native window frame. The titlebar hosts the tabs and window controls, keeping the look consistent across all three platforms.

Working with tabs

Each connection opens in its own tab. You can create new tabs, close tabs, and switch between the tabs you have open at any time.

• Create / close / switch: open new tabs, close ones you no longer need, and switch among the tabs you have open.
• Drag to reorder: drag a tab to change the order in which your tabs appear.
• Right-click to rename: right-click a tab to give it a custom name.
• Automatic NATO-letter suffixes: when you open multiple tabs to the same connection, AuraTerm automatically appends NATO-letter suffixes (Alpha, Bravo, Charlie, and so on) so you can tell them apart.

Split panes

Within a single tab you can split the terminal area into multiple panes, letting you view several sessions side by side on the same screen — handy for watching a log in one pane while typing commands in another.

The bookmark sidebar

The bookmark sidebar lets you save your frequently used connections and reconnect to them quickly. Bookmarks can be organized into nested folder groups of arbitrary depth, and the sidebar includes a filter/search box so you can locate an entry quickly even in a large list.

• Collapse state is persisted — the next time you open AuraTerm, each folder is expanded or collapsed exactly as you left it.
• You can import an OpenSSH config file and PuTTY .reg files; duplicates are automatically de-duplicated on import.

The command palette

The command palette is the fastest way to reach features without leaving the keyboard. Press Ctrl/Cmd+Shift+P to open it, then type a keyword for fuzzy matching to jump straight to the command you want.

Terminal find

Press Ctrl/Cmd+F to search within the current terminal's output. Find supports case-sensitive matching, whole-word matching, and regular expressions.

Font zoom and fullscreen

• Increase font size: Ctrl + +
• Decrease font size: Ctrl + -
• Reset font size: Ctrl + 0
• Toggle fullscreen: F11

Renderer setting (WebGL / DOM)

AuraTerm offers a choice between a WebGL and a DOM terminal renderer in its settings. The WebGL renderer is generally better suited to high refresh rates and heavy output; if you run into display glitches on certain GPUs or drivers, switch to the DOM renderer for broader compatibility.

Making Connections

AuraTerm supports six session types: SSH (SSH2 via russh), Telnet, serial port, network serial (RFC 2217), raw TCP, and local shell. For any of them you can connect immediately or save the connection as a bookmark for fast reconnection later. This section explains how to create each kind of connection, configure authentication and reconnection, and automate what happens once you are connected.

Creating an SSH session

SSH is the most common connection method. Enter the host, port, and username, choose an authentication method, and connect. AuraTerm offers three authentication methods: password, private key, and SSH agent.

• Password: enter the login password directly. The password is stored as an encrypted credential, kept separate from the connection metadata.
• Private key: authenticate with a local private key file; if the key is protected by a passphrase, AuraTerm prompts for it and can store it securely.
• SSH agent: reuse keys held by the SSH agent already running on your system, without configuring the private key again in AuraTerm.

Multi-factor authentication (MFA)

When the server requires keyboard-interactive authentication (for example a one-time code, token, or extra security question), AuraTerm shows an interactive MFA prompt during connection, displaying each challenge sent by the server and waiting for your input. Complete the prompts to continue logging in.

Jump hosts

If the target host is on an internal network and only reachable through one or more intermediate hosts, configure a jump host. AuraTerm supports a ProxyJump chain, letting you hop through multiple jump hosts in sequence to reach the final target without manually building nested tunnels.

Agent forwarding and host-key trust

Agent forwarding lets a remote session use the keys from your local SSH agent (for example to hop from the remote host onward to a third host). For safety, agent forwarding is off by default and should only be enabled for hosts you trust.

AuraTerm uses a TOFU (trust-on-first-use) policy for host keys: on the first connection to a host it records the key fingerprint, then verifies it on every subsequent connection. Known-host fingerprints are stored as SHA-256 per host:port.

Reconnect modes

After an SSH session disconnects, press R to reconnect. AuraTerm offers four reconnect modes that determine how the session state is restored:

• manual: reconnects only when you trigger it, with no extra handling.
• simple: automatically re-establishes the SSH connection and starts a fresh shell.
• tmux: after reconnecting, reattaches to a remote tmux session, restoring the programs and windows that were running.
• screen: similar to tmux, but reattaches to a remote GNU screen session.

Telnet sessions

A Telnet connection needs only a host and port. Note that Telnet is a plaintext protocol with no encryption; use it only on trusted local networks or to reach legacy devices that do not support SSH.

Serial sessions

When creating a serial session, AuraTerm auto-enumerates the available ports on your system for you to pick from. You can configure baud rate, data bits, stop bits, parity, and flow control independently.

To save you from setting each value by hand, AuraTerm includes three common presets you can apply in one click:

• 115200-8N1: 115200 baud, 8 data bits, no parity, 1 stop bit (the most common).
• 9600-8N1: 9600 baud, 8 data bits, no parity, 1 stop bit.
• 57600-8N1: 57600 baud, 8 data bits, no parity, 1 stop bit.

Network serial (RFC 2217) sessions

The serial port does not have to be plugged into the machine in front of you. Network serial connects over TCP to a serial device server and negotiates port settings with the Telnet Com Port Control Option (RFC 2217, option 44) — meaning the baud rate, data bits, parity, stop bits, and flow control you choose in AuraTerm actually take effect on the physical port at the far end, rather than being local decoration. In the New Session dialog, Network Serial sits alongside SSH, Telnet, and Serial as a peer choice.

Common peers include:

• ser2net — a small Linux box in the server room with a few USB-serial adapters, acting as a console server for the whole team (accepter: telnet(rfc2217),tcp,2217).
• Moxa NPort, Digi Connect, Lantronix and similar industrial device servers, which ship with an RFC 2217 mode.
• pyserial's rfc2217_server.py reference implementation, handy for verifying things locally first.

When creating a network serial session, a few network-related settings join the usual serial parameters:

• Host and port: enter them separately, or paste rfc2217://192.168.1.50:2217 (pyserial's URL form) or tcp://192.168.1.50:4001 straight into the host field — AuraTerm splits it up and switches to the matching protocol for you.
• Adopt the server's configured parameters (on by default): negotiate but send nothing, leaving the device server's existing configuration untouched. Only when you clear this checkbox does AuraTerm push the parameters below to the far end — on a shared console server, that changes the settings someone else is using.
• Reconnect automatically (on by default): device servers reboot as a matter of routine, so AuraTerm retries with a 1 / 2 / 4 / 8 / 15 / 30-second backoff; leave it off and the session simply ends. TCP keepalive makes sure a far end that loses power or drops off the network is noticed promptly.

If the peer refuses or ignores COM-PORT-OPTION, the session does not fail — it degrades to a plain byte pipe and says so in the terminal. You still see the device's output; you just cannot change its port settings. And if the server clamps a parameter to a different value (you ask for 115200, it only does 57600), the status bar shows the effective value, highlighted.

Raw TCP sessions

Some device servers expose a bare port and negotiate nothing at all. Raw TCP is exactly that: a plain byte pipe to a host and port, sent and received verbatim, with no Telnet or RFC 2217 negotiation. Because the port settings are decided entirely by the device server's own configuration, this session type offers no baud rate settings and has no control channel — BREAK, DTR/RTS, and live baud changes explain why they are unavailable rather than failing silently. It is also where an RFC 2217 session lands when negotiation fails.

The serial control plane (local and network)

Local and network serial sessions share one control surface, reachable from the status bar and the command palette:

• Change the baud rate live — pick a new value from the status bar dropdown without dropping the session. While you are guessing at a baud rate, whatever the device prints in the meantime is not lost.
• Send BREAK — for devices that are not reading characters: U-Boot, Cisco ROMMON, the Solaris OK prompt.
• Toggle DTR / RTS — typically to reset an ESP32 or Arduino and drop it into its bootloader.
• Modem line status — the status bar shows CTS / DSR / CD / RI as the port reports them.
• Line error indicators — framing errors, parity errors, receive overruns. These are the most direct evidence that the baud rate is wrong.
• Purge buffers — discard bytes buffered in both directions.

Local shell sessions

A local shell opens your machine's command line directly inside AuraTerm. You can choose which shell to use:

• Auto-detect: prefers Git Bash and falls back to CMD if it is not present.
• PowerShell or cmd.exe: pick the corresponding Windows shell directly.
• Custom path: point to the full path of any executable shell to use a different one.

Post-connect commands and auto-login

Once a session is established, AuraTerm can automatically send predefined commands, saving you from typing them every time. Common uses include changing directory, setting environment variables, or launching a monitoring program after connecting, as well as auto-responding to steps in an interactive login flow according to rules.

For logins that require step-by-step interaction (for example devices where you connect first and then type a username/password), combine this with the auto-response capability of output rules: when the terminal output matches a given keyword or regex, AuraTerm automatically sends the corresponding response text, achieving auto-login. Rules can be scoped globally or to a specific host.

Saving as a bookmark

Any connection can be saved as a bookmark and organized into folder groups nested to arbitrary depth, making it easy to search and quickly reconnect. Bookmarks support filter search and remember each group's collapse state. You can also import an OpenSSH config or a PuTTY .reg file directly, with automatic deduplication on import.

Bookmarks

Bookmarks let you save the connections you use often so you can reconnect with a single click, without re-entering the host, port, authentication method, and other parameters every time. Bookmarks work for every connection type — SSH, Telnet, serial, network serial, raw TCP, and local shell. Saved bookmarks appear in the bookmark sidebar on the left, where you can open, search, or organize them at any time; once you have a lot of them, a dedicated bookmark manager page handles bulk maintenance.

Saving a connection as a bookmark

When you create or edit a connection, save its configuration as a bookmark. A bookmark records all of that connection's metadata — host address, port, username, authentication method, jump-host chain, reconnect mode, serial baud rate, and so on. For SSH you can also store port-forwarding tunnels in the bookmark (with autoStart), and they are rebuilt automatically after a reconnect.

Nested folder groups

Bookmarks can be placed into folder groups, and groups nest to arbitrary depth — so you can organize them into a clean tree by team, environment (production / staging), data center, customer, or any other dimension you like. Each group's expanded / collapsed state is persisted, so the next time you open AuraTerm your layout looks exactly as you left it.

Filter and search

As your bookmark list grows, use the filter / search box at the top of the sidebar to find a connection fast. Type a keyword to filter by bookmark name and quickly pin down the one you want in a long list.

Quick reconnect

Once you've located a bookmark in the sidebar, open it (e.g. by double-clicking) to immediately start a connection with the saved configuration, opening the session in a new tab. This is the core value of bookmarks: collapsing a repetitive daily connection routine into a single click.

The bookmark manager

The sidebar is for one-click reconnects; once you have dozens or hundreds of bookmarks, open the full-size bookmark manager from View ▸ Bookmark Manager (searching the command palette for “bookmark manager”, or the ⚙ button on the bookmark bar, does the same). It has three columns: a group tree on the left (All / Recent / Ungrouped plus your own groups, sharing its collapsed state with the sidebar), a sortable table in the middle (name, protocol, target, authentication, group, last used), and an embedded bookmark editor on the right.

• Multi-select and bulk actions: click the checkboxes, Ctrl/Cmd-click, Shift-click for a range, or select all from the header. The action bar at the bottom then moves the selection into a group (creating one on the spot if needed), deletes it (always behind a confirmation), or clones it — clones carry the credentials across too.
• Group maintenance: create an empty group from the left column; right-click a group to rename it, add a subgroup, dissolve it (its bookmarks and subgroups move up one level), or delete it together with its bookmarks. Dragging a row onto a group moves it there.
• Import and export: export everything, or just the current selection, as AuraTerm JSON — without credentials by default, with a separate option for a version that includes passwords and private keys. Imports auto-detect OpenSSH config, PuTTY .reg, and AuraTerm backups, and you can choose which group they land in.
• Keyboard: / or Ctrl/Cmd+F focuses the search box, ↑↓ move through the list, Enter connects, and Esc clears the search first and only closes the page on a second press. Double-clicking a row connects.
• Password authentication is flagged in a warning colour, making it easy to work through the hosts still using passwords and move them to keys.

Importing OpenSSH config and PuTTY .reg

If you already maintain a large set of host configurations in other tools, there's no need to rebuild them by hand. AuraTerm can import a standard OpenSSH config file as well as a .reg registry file exported from PuTTY, converting the host definitions inside into bookmarks in bulk.

• OpenSSH config: parses Host entries along with their hostname, port, user, identity file, and related settings.
• PuTTY .reg: reads saved sessions exported from PuTTY and converts them into matching bookmarks.

Imports are automatically de-duplicated: entries that duplicate an existing bookmark are not added again, so you can safely import repeatedly or merge configurations from different sources without piling up duplicates in the sidebar.

Where bookmark metadata vs. secrets are stored

By design, AuraTerm keeps connection metadata and sensitive secrets in separate places. The bookmarks themselves — host, port, username, group structure, tunnel definitions, and other non-sensitive configuration — are stored in connections.json in the app config directory.

Secrets such as passwords, private keys, and key passphrases are never written into the bookmark file. They live separately in the encrypted credentials.enc file: AES-256-GCM encryption with a key derived by Argon2id from your master password (mode v2), or from a device-local random key when no master password is set (mode v3, in which case a credentials.key file is also present). In-memory secrets are zeroized after use.

File Transfer (SFTP & Zmodem)

AuraTerm offers two ways to move files over an SSH session: the graphical SFTP browser, ideal for browsing directories, batch upload/download, and in-place text editing; and inline Zmodem (rz/sz), ideal for quickly sending or receiving a single file straight from the terminal command line. The two complement each other.

The SFTP browser

The SFTP browser gives you a visual file-management panel over the remote host's filesystem. You can configure it to open automatically once an SSH connection is established, so the file view is ready immediately; this auto-open behavior is optional and can be turned on or off as you prefer.

Within the browser you can perform these common operations:

• Browse directories, enter subfolders, and navigate the remote filesystem.
• Upload local files into the current remote directory and download remote files to your machine.
• Create a new directory (mkdir).
• Delete files or directories.

Uploads also support drag-and-drop: just drag local files into the SFTP browser to begin uploading, without first clicking an upload button.

Transfer queue and resume

Multiple transfers are placed in a sequential queue and run one at a time rather than concurrently, keeping the transfer rate steady and predictable. For larger files you can enable optional resume, which continues an interrupted transfer from where it left off instead of restarting from the beginning.

In-place text editing

Double-click a text file in the SFTP browser to open it for editing directly, skipping the download-then-reupload round trip. When you are done, press Ctrl/Cmd+S to save, and the changes are written back to the remote file.

Inline Zmodem (rz / sz)

AuraTerm has built-in Zmodem support for sending and receiving files inline within a terminal session. When you run rz (receive — upload from local to remote) or sz (send — download from remote to local) on the remote host, AuraTerm auto-detects the Zmodem transfer and takes over, with no extra menu steps required.

rz

sz <filename>

During a transfer, progress is shown, and you can cancel an in-flight Zmodem transfer at any time.

Files received via sz are saved to a configurable download path. If the default location does not suit you, adjust this path in the settings to control which local directory incoming files land in.

Port Forwarding & Tunnels

AuraTerm can build port-forwarding tunnels on top of an SSH connection, routing local or remote network traffic securely through the encrypted channel. It supports the three classic forwarding modes — local (-L), remote (-R) and dynamic (-D, a SOCKS5 proxy) — and provides a centralized tunnel manager to add, edit, start, stop and monitor each tunnel.

The three forwarding modes

Local forwarding (-L) maps a port on your own machine to a target address reachable from the SSH server. Connections to that local port are forwarded through the tunnel to the remote target. It's commonly used to reach a database, web admin panel or other service that is only accessible from inside the server's network.

Remote forwarding (-R) goes the other way: it opens a port on the SSH server, and connections to that server-side port are forwarded back to a target address reachable from your machine. It's typically used to temporarily expose a service you're developing locally to the remote environment.

Dynamic forwarding (-D) starts a SOCKS5 proxy on your machine. Point a browser or any other application's proxy at that port, and its traffic will egress through the SSH server — effectively a lightweight, on-demand VPN.

The tunnel manager

All tunnel creation and operation happens in the tunnel manager. You can open it from the Tools menu, or by searching for it in the command palette (Ctrl/Cmd+Shift+P).

Inside the manager you can perform the following actions on tunnels:

• Add / edit / delete tunnels, choosing the forwarding type for each (-L, -R or -D).
• Start / stop each tunnel individually, independently of the others.
• Watch the status of each tunnel: starting, active, or error.

When a tunnel shows error, it usually means the local port is already in use, the target address is unreachable, or the server does not permit that forwarding. Fix the configuration and start it again.

Saving tunnels to a bookmark

Tunnels can be saved to a bookmark, persisted alongside the connection details. That way you don't have to recreate them by hand every time you connect from that bookmark.

• With autoStart enabled, the matching tunnels start automatically as soon as the connection is established.
• Tunnels saved to a bookmark are rebuilt after reconnect, so when a dropped session comes back under the simple, tmux or screen reconnect modes, the tunnels are restored for you.

Input Toolbar & Automation

AuraTerm's input toolbar turns repetitive day-to-day keystrokes into reusable, parameterizable, and auto-responding actions. This section covers three tools that work together: the input bar at the bottom for composing and sending multi-line commands; quick buttons / snippets, which collect your common commands into one-tap toolbars; and output rules, which let the terminal automatically highlight, alert, or reply when a keyword matches. The section closes with shell integration based on OSC 133, which lets AuraTerm understand command boundaries and exit codes.

The input bar

The input bar sits at the bottom of the terminal window and is a multi-line editor. You can assemble a long command or a short script here in full, review it, and then send it to the session in one go, instead of typing and correcting directly in the terminal.

• Send: press Ctrl+Enter to send the current contents to the session. A plain Enter inserts a newline inside the input bar so you can compose multiple lines.
• Resize: drag the edge of the input bar to change its height and make room for longer content.
• Collapse: double-click the input bar to collapse it and give more space to the terminal output; do it again to expand it.
• History: use PageUp / PageDown to step backward / forward through previously sent entries and quickly reuse past commands.

Quick buttons / snippets

Quick buttons (also called snippets) pin your frequent commands as one-tap buttons. You can create multiple toolbars and organize buttons within a toolbar into groups, keeping a large set of buttons tidy.

• Host / bookmark-group binding: a button or toolbar can be bound to a specific host or bookmark group, so it only appears on the relevant connections and unrelated sessions aren't cluttered with buttons that don't apply.
• {{variable}} parameters: include placeholders written as {{variable}} in a button's content; before sending, AuraTerm prompts you to fill in the actual values, letting you reuse one command template across different targets or parameters.
• Raw control characters: a button can send raw control characters (such as Ctrl-combinations or escape sequences), which is handy for sending interrupt signals or interacting with full-screen programs.

Output rules

Output rules continuously watch the terminal output and fire an action automatically when text matches the condition you set. This is invaluable for watching logs, waiting on long-running jobs, or answering predictable interactive prompts.

• Matching: match by keyword or by regular expression.
• Actions: on a match, you can highlight the text, ring the bell, raise a desktop notification, or send an auto-response (a preset piece of text back to the session).
• Cooldown: set a cooldown on a rule to avoid repeated triggering in a short window, which would otherwise cause notification spam or duplicate responses.
• Scope: a rule can apply globally or be limited to a particular host (per-host scope).

Shell integration (OSC 133)

When the remote shell emits OSC 133 escape sequences, AuraTerm can recognize where each command starts and ends—this capability is called shell integration. Once active, the terminal is no longer just a stream of characters but understands the output as structured "commands."

• Command marks and exit codes: each command is marked and its exit code is recorded, making it easy to tell successful commands from failed ones at a glance.
• Command navigation: use Ctrl/Cmd+Shift+Up / Down to jump between the previous / next command marks and quickly traverse long output.
• Rerun and copy: for a marked command, you can rerun it or copy the command itself.

AI Assistant

AuraTerm ships with an AI assistant: a streaming chat panel plus a handful of shortcuts that read the terminal's context directly. It is off by default and needs you to configure a provider and supply an API key — AuraTerm neither proxies nor relays anything, so conversations go straight from your machine to the endpoint you name.

Configuring a provider

Enable the assistant under Settings ▸ AI, then pick a provider and fill in the base URL, model, and maximum token count, and save your API key. There are two kinds of provider:

• Anthropic Messages API — Anthropic's own endpoint.
• Any OpenAI-compatible endpoint — DeepSeek, Kimi, a locally running Ollama, and so on: just give it the right base URL.

Once configured, “Test connection” makes a real request to verify the setup. When the button is disabled it tells you why — the assistant is not enabled, or no key has been saved yet.

The chat panel

The ✨ button on the tab bar toggles the chat panel. It streams multi-turn conversations, lets you cancel generation at any point, copies a code block from an answer or inserts it straight into the terminal in one click, and shows the token usage for the conversation.

Terminal context actions

A row of shortcut chips at the top of the panel hands the assistant whatever is happening in the terminal right now:

• Explain / Analyze the error — about the last command and its output, based on the command block marked out by OSC 133 shell integration. The command palette carries the same two actions.
• Improve the command — ask for a better way to write it.
• Summarize the output — reads xterm's currently visible viewport, so it does not depend on shell integration and works in serial sessions too.

Generating a command from plain language

Press Ctrl/Cmd+K in the input bar and describe what you want in plain language; the assistant writes a single command into the input bar for you to review and edit. AuraTerm never runs it for you — pressing Enter stays your decision.

Credential Security & Encryption

AuraTerm keeps your connection details and your sensitive credentials in separate places. Connection metadata such as host, port, username and serial parameters lives in connections.json, while the actual secrets — passwords, private keys and key passphrases — are encrypted on their own in credentials.enc. Even if someone obtained your connection list, none of the credentials in it would be readable.

How the encryption works

The credential file is sealed with AES-256-GCM authenticated encryption (providing both confidentiality and tamper protection). The key used for it is never written to disk directly; instead it is derived through Argon2id, a brute-force-resistant key derivation function. Secrets are zeroized in memory immediately after use, keeping their lifetime in RAM as short as possible.

Two key modes: master password vs. device-local key

Depending on whether you have set a master password, AuraTerm protects your credentials in one of two modes:

• Master-password mode (mode v2): the encryption key is derived from your master password via Argon2id. The secret stays in your head — the master password is never written to disk, and without it credentials.enc cannot be decrypted. This is the strongest level of protection.
• Device-local-key mode (mode v3): when no master password is set, AuraTerm generates a random key on this machine, stored as credentials.key, and encrypts credentials with it. This works without prompting you for a password each time — convenient, but its security rests entirely on the security of the device itself: anyone who can read both files can decrypt your credentials.

Setting, unlocking, changing and disabling the master password

• Set: once you set a master password for the first time, AuraTerm migrates your credentials from device-local-key mode to master-password mode (v3 → v2) and re-encrypts them with the newly derived key.
• Unlock: with a master password enabled, you are prompted to enter it to unlock the first time credentials are needed in a session; only after unlocking can saved passwords and keys be read.
• Change: you can replace the master password. AuraTerm decrypts everything with the old one and re-encrypts all credentials with the new one.
• Disable: turning the master password off reverts credentials to device-local-key mode (v2 → v3). After that they are usable without a password, but at a correspondingly lower level of protection.

Remembering the master password on this device (OS keychain)

If entering the master password on every unlock is tedious, you can choose "remember on this device". AuraTerm hands the master password to the operating system's keychain so it can unlock automatically next time. This option is available on macOS and Windows only.

SSH host-key trust (known-hosts)

The first time you connect to an SSH server, AuraTerm uses a trust-on-first-use (TOFU) policy: it records the host key's SHA-256 fingerprint for that host:port and saves it in ssh_known_hosts.json. Every later connection then verifies the server's identity against that fingerprint.

If a host's key ever differs from the recorded fingerprint, AuraTerm raises a mismatch prompt. This can mean the server was reinstalled — or it can be a sign of a man-in-the-middle attack. For safety the prompt defaults to rejecting the connection after 180 seconds, giving you time to verify while never letting a connection through silently when no one confirms it.

The audit log and managing trusted hosts

Whenever you override a mismatch prompt by accepting a new key, that decision is written to security_audit.log. This audit log lets you trace, after the fact, when and for which host a trust change was made.

You can manage trusted hosts in Settings: review recorded fingerprints, remove an individual host, or reset all known-hosts at once. After a reset, the affected hosts go through the trust-on-first-use flow again on the next connection.

Practical security advice

• On shared, portable or untrusted devices, always set a master password rather than relying on device-local-key mode.
• Choose a long, unique master password and keep a backup in a password manager — because it cannot be recovered.
• Use "remember on this device" only on a personal-only machine, paired with an OS login password and full-disk encryption.
• When first connecting to important servers, make a habit of verifying the host fingerprint; treat any mismatch prompt with caution and verify before deciding.
• Review security_audit.log periodically to confirm that every trust change it records was one you intentionally made.

Cloud Sync (AuraXLabs Account)

Cloud Sync keeps your bookmarks, a curated settings subset, and your SSH known-hosts consistent across multiple devices — for example aligning your home desktop with your work laptop. Signing in to an AuraXLabs account is all it takes: no third-party storage to maintain, and no separate sync passphrase to remember.

To open it: File > Preferences > Cloud Sync, or search for “Sync” in the command palette (Ctrl/Cmd+Shift+P). The Live Sync entry at the right of the status bar also shows the sync state and offers “Sync now”.

How Your Data Is Protected

Synced data is split into two tiers by sensitivity. Bookmarks, the settings subset and known-hosts travel over TLS and are stored encrypted on the AuraXLabs server; AuraXLabs can read them to provide the service, which is why they survive an email password reset intact.

Saved credentials (passwords, private keys, key passphrases) are the second tier: before they leave your device, AuraTerm seals them into a separate encrypted field under a key derived from your master password (Argon2id + HKDF + AES-256-GCM). AuraXLabs stores only that ciphertext and can never read a single credential.

• Every device taking part in credential sync must use the same master password; otherwise the credentials part is skipped on pull with a “different master password” notice.
• If the master password is lost, neither the local nor the synced credentials can be recovered — exactly the rule that already applies to the local credentials.enc; Cloud Sync adds no new risk.
• Devices without a master password (device-local key mode) can sync bookmarks, settings and known-hosts, but cannot take part in credential sync; the option is greyed out in the panel.

Signing In

• Sign in with an existing account from the Cloud Sync panel or the Account center, or self-register a new one (a verification code is emailed to you first).
• After signing in, AuraTerm keeps a sync-only, revocable credential; signing out revokes it immediately. Your account password is never stored on the device.
• Changing or resetting the account password invalidates the sync credential on every device; sign in again on each one to continue.

The “What to Sync” Toggles

You control which categories take part in syncing:

• Bookmarks — always synced.
• Settings subset — theme, fonts, quick buttons, and output rules. Device-specific items are excluded, including window bounds, workspace layout, serial history, and the master-password hash.
• SSH known-hosts — your host fingerprint trust records.
• Saved credentials (optional) — requires master-password mode with the master password unlocked. While it is locked the sync still runs; only the credentials part is skipped, and the result says why.

The Actions

• Save — saves your “what to sync” choices, the device label and the auto-sync switch.
• Test — verifies that the account credential and the server connection work.
• Pull (merge) — downloads the cloud data and merges it into your local data per the merge rules.
• Pull (replace) — overwrites your local data with the cloud copy.
• Push — uploads your local data to the cloud.
• Sync now — performs a two-way sync (merge, then upload).

Automatic Sync

With Sync automatically ticked, AuraTerm runs a two-way sync about 10 seconds after startup, 30 seconds after a bookmark change (a burst of edits becomes one run), and every 30 minutes. A failed automatic run only shows in the Live Sync status and never pops a dialog; credential changes do not trigger a run on their own but ride along with the next one.

Merge Rules

• Bookmarks merge by id; on a conflict, the most recently uploaded copy wins.
• Known-hosts merge as a union; where they disagree on the same host, the local trust wins.
• The settings subset is overwritten (not merged field by field).
• Credentials merge by connection id.
• The server numbers every upload; when two devices push almost at once, the later one gets a 409 conflict — pull first, then push.

Two-Device Walkthrough

• Device A: sign in to your AuraXLabs account, tick what to sync, and click Sync now to upload your local data.
• Device B: sign in to the same account and click Sync now (or Pull (merge)) to merge in Device A’s bookmarks, settings subset and known-hosts.
• To sync credentials: set the same master password on both devices and unlock it, then tick “Saved credentials”.
• From then on, tick Sync automatically or click Sync now on either device to keep them in two-way sync.

Upgrading from Older Versions

• The GitHub Gist, Gitee Gist and WebDAV providers have been retired. After upgrading, the Cloud Sync panel shows a one-time notice; nothing on the device changes, the old tokens are no longer stored, and signing in to an AuraXLabs account resumes syncing.
• A cloud copy uploaded by an older version under the sync passphrase triggers a one-time migration on the first sync: enter the old passphrase to merge and convert it, or — if you no longer have it — replace the cloud copy with this device’s data (the copy was only ever a mirror of some device’s local data).

Device Label

Each device has a label that identifies the machine in a multi-device setup, making it easy to tell your devices apart.

Troubleshooting

• Sign in again: the sync credential is no longer valid (the password was changed or reset, or the credential was revoked on the site). Sign in again; nothing in the cloud is lost.
• AuraXLabs 409 conflict: the server has newer data. Pull first, then push.
• Credentials skipped: the master password is locked (unlock and sync again), this device has no master password (device-local key mode cannot take part), or it differs from the uploading device’s (use the same master password on both, then sync again). Everything else has already synced.
• One-time migration needed: the cloud copy is still in the old passphrase-encrypted format; see “Upgrading from Older Versions” above.

Cloud Console (Cloud Monitoring)

Cloud Console lets you watch your own AuraTerm sessions from a browser: bind the device to your AuraXLabs account and AuraTerm bridges the current session's output to the cloud, where signing in to auraxlab.com/cloud/console from any computer or phone shows it. With explicit permission on the machine itself, you can also send input back from the web page. The difference from Live Share is who it is for: Cloud Console serves your own account, Live Share serves someone else.

Binding a device

Sign in to your AuraXLabs account under Cloud ▸ My Account. The sign-in form's “Also bind this device to Cloud Console” box is ticked by default, so one password entry both signs you in and registers the device. The device identity is an Ed25519 key pair, stored encrypted on the machine under the device-local key and restored automatically on the next launch.

Starting and stopping the bridge

Cloud ▸ Cloud Console is a checkbox: tick it to share the current session, and the bridge follows you as you switch tabs; untick it to stop. Next to it, “Allow Remote Send” is on by default and can be turned off on its own — with it off every share is clamped to read-only, any share already running is downgraded in place, and the Rust bridge drops remote input outright.

The cloud capsule in the status bar always shows the link's state: being controlled (someone is typing, with a pulsing red dot), being watched (N viewers), online, standby, reconnecting, or offline. Clicking it toggles Cloud Console. On an unbound device the capsule is hidden.

What the web page shows

/cloud/console has four panels: My AuraTerm devices (online state, last heartbeat, and unbinding), Active shared sessions (click one to open the cloud terminal), Live Share (in-progress Live Share sessions, which you can end from here), and Access history and notifications. The cloud terminal renders at the host's real cols and rows, so nothing is squeezed into an 80×24 layout.

Traffic accounting

Cloud ▸ My Account shows the traffic this account has used through Cloud Console — total, upstream, downstream, and session count — and refreshes on demand.

Live Share

Live Share shares the terminal session you are working in (serial, SSH, Telnet or a local shell) live with another person: they open a link in a browser, or type a 12-character share code into their own AuraTerm, and see exactly what your terminal shows; once you explicitly allow it, they can also type commands for you. Typical uses: let a colleague glance at a serial log, have support troubleshoot on your device, or run a live demo.

To open it: Cloud > Live Share…, or search for “Live Share” in the command palette (Ctrl/Cmd+Shift+P). The host must be signed in to an AuraXLabs account with this device bound (see the account part of the Cloud Sync chapter); guests need no account at all.

How the share code protects you

A code looks like BCDF-GHJK-LMNP. The first 4 characters are the route, which tells the server which host to connect the guest to; the last 8 are the secret, known only to you and the guest and never sent to the server. Both sides prove to each other that they know those 8 characters with a password-authenticated key exchange (SPAKE2) and derive an encryption key only the two ends hold — AuraXLabs and the relay merely forward ciphertext and cannot see any terminal content.

• After 3 wrong attempts at the secret, the code is locked and must be regenerated.
• A code has a join window (10 minutes by default): after it closes no new guest can join; guests already in are unaffected.
• The session fingerprint shown in the dialog (e.g. C7SG-XVWU) also appears on the guest's side; reading it out loud confirms you are talking to the right person with nobody in between.
• Codes are single-use by default: the code closes once the first guest is in. Tick “Allow multiple guests” to let up to 3 people join.

Generating a code (host)

• Pick the session to share in the dialog (the current tab by default), or tick “Follow the active tab” so the assist session moves with whichever tab you switch to.
• Choose a control policy: View only (guests can never type), Grant on request (a guest clicks “Request control” and you approve each time) or Auto grant (guests can type as soon as they join).
• Optionally tick “Approve each join”: a verified guest waits until you click “Allow view”, “Allow control” or “Deny”.
• Click “Generate code”. Send it with “Copy code”, or send a link such as https://auraxlab.com/s#BCDF-GHJK-LMNP with “Copy link” — the code sits after the #, which browsers never send to the server.
• While assisting, the status pill in the title bar shows the guest count; the session ends automatically after 4 hours, and the dialog's “Extend 1 hour” pushes that out at any time.

Joining (guest)

• Browser: open the link you were sent, or go to https://auraxlab.com/s and type the code; optionally enter a name so the host recognises you. The page can be switched between Chinese and English at the top right.
• AuraTerm: Cloud > Join Live Share…, paste the code or the whole link; the session opens in a new tab with a banner showing the host, the session fingerprint and the current state (view only / controlling / waiting for approval).
• You start view-only: you see everything but keystrokes go nowhere. Click “Request control” to ask the host; once granted the banner switches to “Controlling” and your input goes straight to the host terminal until the host revokes it or you click “Release control”.
• The guest terminal follows the host's grid, so line breaks and layout match the host exactly; a smaller window shows scrollbars instead of reflowing.

Control, kicking and ending

• The host can “Grant control”, “Revoke control” or “Kick” any guest at any time; Ctrl/Cmd+Shift+Esc revokes control from every guest at once.
• After a revoke, the guest's input stops within a second (each grant carries an increasing “fence”; keystrokes sent under an old grant are dropped).
• Clicking “End sharing”, closing the shared tab, quitting AuraTerm, or ending it from the “Live Share” panel at auraxlab.com/cloud/console disconnects every guest immediately and voids the code.
• The cloud console keeps metadata only (who joined when, control grants/revokes, failed attempts) for auditing; terminal content never passes the server in the clear and is never recorded.

Troubleshooting

• “This share code is invalid, expired, already used, or the host is offline”: check that the host's AuraTerm is still running and the join window in its dialog has not closed; a single-use code stops working after the first guest joins, so ask the host for a new one.
• “Share code mismatch”: the last 8 characters were mistyped (codes are case-insensitive and avoid look-alikes such as 0/O/1/I). Three wrong attempts lock the code on the host.
• The guest sees no output: that is normal when the host's shared session is quiet — a guest receives a snapshot of the current screen on joining, then only new output.

Keyboard Shortcuts

Below are the keyboard shortcuts you'll use most often in AuraTerm. A slash in a key combo indicates a platform difference: use Ctrl on Windows and Linux, and Cmd on macOS.

Command Palette

• Ctrl/Cmd+Shift+P — open the command palette, with fuzzy search to quickly find and run commands.

Find

• Ctrl/Cmd+F — open find in the terminal, with case-sensitive, whole-word, and regular-expression options.

Send and Input History

• Ctrl+Enter — send the current content from the input bar.
• PageUp — move back through the command history (older commands).
• PageDown — move forward through the command history (newer commands).

Font Zoom

• Ctrl++ — increase the terminal font size.
• Ctrl+- — decrease the terminal font size.
• Ctrl+0 — reset the font size to its default.

Fullscreen

• F11 — toggle fullscreen mode.

Reconnect

• R — press after an SSH disconnect to reconnect.

AI assistant

• Ctrl/Cmd+K — in the input bar, describe a command in plain language and have it written into the input bar for review (it is never run automatically).

Live Share

• Ctrl/Cmd+Shift+Esc — revoke control from every guest at once (the session continues; guests drop back to read-only).

Command Navigation

• Ctrl/Cmd+Shift+Up — jump to the previous command (based on OSC 133 shell-integration command marks).
• Ctrl/Cmd+Shift+Down — jump to the next command.