# DevAurora Code

> DevAurora Code is a browser-based programming terminal with persistent workspaces, multiple sessions, a nano-style editor, DevAurora Code chat, and an optional local runtime agent.

## Public pages

- App: /
- Documentation: /docs
- This file: /llms.txt

## What the app does

- Opens directly into the DevAurora terminal.
- Persists workspace files, command history, aliases, sessions, and terminal state for the anonymous workspace account.
- Provides a right-side sessions drawer where sessions can be created, selected, and permanently deleted after confirmation.
- Provides a right-side AI drawer for normal chat, file context, and authorized terminal tools.
- Supports attachments up to 30 MB per file. Attachments are treated as untrusted context and are never executed automatically.

## AI configuration

The visible assistant is named **DevAurora Code** and uses the model **DevAurora Pro V3**. Internal service details are private and are intentionally not published here.

- Backend secret variable: `DEVAURORA_AI_API_KEY`
- Visible assistant name: `DevAurora Code`
- Visible model name: `DevAurora Pro V3`

The private key must be configured in the project's server-side Keys/API keys settings. Never put the key in a web page, prompt, frontend bundle, public repository, or this file.

## AI usage limits

- Each AI session lasts **30 minutes**. The chat panel shows a countdown bar that starts yellow and gradually turns red as time runs out.
- When the 30 minutes end, the AI unlocks again after a **4-hour cooldown**. The sessions-left indicator shows `0/1` while a session is consumed.
- Limits are enforced per public IP, so switching devices on the same network does not reset them.
- VPN, proxy, Tor and datacenter connections are blocked; the AI refuses requests from those connections.

## Web search and sources

When the user asks for current information, internet research, documentation, or sources, DevAurora can search the web through a server-side action. The chat displays a compact activity card and a **Sources** button with the source title, domain, snippet, and URL.

- The search runs on the backend using free open-source engines (DuckDuckGo, with SearXNG instances as fallback) and requires no API key.
- Search results and citations are returned to the browser; no search secret is needed or exposed.

## Virtual terminal commands

Use `help` inside the app for the live list. Common commands include:

```text
help pwd ls cd mkdir touch cat nano cp mv rm rmdir grep find sort uniq cut tr wc base64 xxd strings
source-analyze lua-analyze lua-strings lua-deobfuscate lua-format lua-bytecode-info runtime toolbox
```

The browser terminal is a virtual workspace. A command that requires an operating-system binary must use the optional local runtime agent.

## Local runtime agent

Run the agent on the device that should own CPU, RAM, files, web servers, workers, or bots:

```bash
bun run runtime:agent -- \
  --endpoint https://<your-deployment>.convex.site \
  --token dv_live_<24-hour-control-token> \
  --cwd ./your-project
```

The 24-hour `dv_live_...` control token is generated from the AI drawer under Terminal y runtime and is shown once. Revoke it when it is no longer trusted.

## Control API

All control API requests require:

```text
Authorization: Bearer dv_live_<24-hour-control-token>
```

Queue a device command:

```bash
curl -X POST https://<your-deployment>.convex.site/api/terminal/commands \
  -H "Authorization: Bearer dv_live_<token>" \
  -H "Content-Type: application/json" \
  -d '{"target":"device","kind":"command","command":"bun run server.ts"}'
```

Other endpoints:

- `GET /api/terminal/commands` — list pending device commands.
- `POST /api/terminal/commands/claim` with `{"id":"<command-id>"}` — claim a command.
- `POST /api/terminal/commands/complete` with `{"id":"<command-id>","status":"completed","output":"...","exitCode":0}` — submit a result.

## Safety and privacy

- The private AI key is never public.
- The `dv_live_...` token is separate from the provider key, expires after 24 hours, and is stored only as a hash.
- Browser commands operate in the virtual workspace; real device commands require the explicitly started local agent.
- Only inspect or transform code and files that you own or are authorized to use.