Nix

Context intelligence for AI coding agents.

Nix is local-first repository intelligence infrastructure that provides verified, deterministic codebase context to external AI coding agents—including Google Antigravity, OpenAI Codex, Claude Code, Cursor, Windsurf, and Cline.

Nix is not an AI coding agent, chatbot, search utility, cloud service, or autonomous editor. The external coding agent performs reasoning, editing, code generation, and test execution; Nix provides the grounded repository topology, AST symbol graphs, caller hierarchies, git rationale, and verified code evidence necessary for the agent to work accurately without context dilution or hallucinations.

Proprietary Software Notice
Nix is proprietary software. All rights reserved. Unauthorized reproduction, modification, decompilation, distribution, or commercial deployment is strictly prohibited. See License for details.

Table of Contents

1. The Problem
2. The Solution
3. How Nix Works
4. Why Source Verification Matters
5. Installation
6. Quick Start
7. CLI Reference
8. AI Coding Agent Integration
9. Local-First Architecture
10. Supported Technologies
11. Search and Retrieval
12. Configuration
13. Real-World Example
14. Development
15. Security and Privacy
16. License
17. Status

The Problem

Modern AI coding agents fail or produce flawed code primarily because of context degradation:

1. Context Window Dilution: Dumping entire files or raw grep results into an agent's prompt wastes thousands of tokens, dilutes LLM attention, and slows down response latency.
2. Ungrounded Hallucinations: Agents guess function signatures, import paths, line boundaries, and internal dependencies when context is partial, corrupt, or unverified.
3. Lost Architectural Relationships: Brute-force lexical search cannot trace caller-callee hierarchies, interface implementations, or transitive dependency chains across modules.
4. Blind Edits and Blast-Radius Ignorance: Modifying a function without downstream impact awareness frequently breaks dependent files and invalidates external call sites.
5. Repetitive Rediscovery Loops: Agents repeatedly grep, list directories, and reread the same files across turns, burning token budgets on redundant discovery.
6. Cloud Privacy Exposure: Uploading proprietary enterprise repositories to third-party indexing clouds violates enterprise IP boundaries and compliance requirements.

The Solution

Nix operates locally as the deterministic intelligence layer between your repository and the AI coding agent. It converts raw repository files, AST syntax trees, dependency graphs, and git logs into structured, token-budgeted, source-verified context packages.

┌────────────────────────────────────────────────────────────────────────┐
│                        PHYSICAL REPOSITORY                             │
│   Source Files (.ts, .py, .go, .rs, .c, etc.)  ·  Git History  ·  AST  │
└───────────────────────────────────┬────────────────────────────────────┘
                                    │
                                    ▼
┌────────────────────────────────────────────────────────────────────────┐
│                          NIX CORE RUNTIME                              │
│                                                                        │
│  ┌───────────────────────┐  ┌───────────────────────────────────────┐  │
│  │   Local SQLite Store  │  │         Tree-sitter AST Engine        │  │
│  │  Chunks, Files, FTS   │  │   Symbols, Callers, Scope Trees       │  │
│  └───────────┬───────────┘  └───────────────────┬───────────────────┘  │
│              │                                  │                      │
│              ▼                                  ▼                      │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │                     Hybrid Retrieval Engine                      │  │
│  │         Lexical (FTS) + Semantic Embeddings + Path Weights       │  │
│  └──────────────────────────────────┬───────────────────────────────┘  │
│                                     │                                  │
│                                     ▼                                  │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │                     Source Verification Layer                    │  │
│  │      Physical Path Validation · AST Symbol & Export Check        │  │
│  │             Line-Clamping · Zero-Hallucination Gate              │  │
│  └──────────────────────────────────┬───────────────────────────────┘  │
│                                     │                                  │
│                                     ▼                                  │
│  ┌──────────────────────────────────────────────────────────────────┐  │
│  │                    Token Optimization Engine                     │  │
│  │          Context Packaging · 90%+ Token Window Savings           │  │
│  └──────────────────────────────────┬───────────────────────────────┘  │
└───────────────────────────────────┼────────────────────────────────────┘
                                    │
            ┌───────────────────────┴───────────────────────┐
            ▼                                               ▼
┌───────────────────────┐                       ┌───────────────────────┐
│   Universal Skill     │                       │   Universal CLI /     │
│   SKILL.md Engine     │                       │   HTTP Context API    │
└───────────┬───────────┘                       └───────────┬───────────┘
            │                                               │
            └───────────────────────┬───────────────────────┘
                                    │
                                    ▼
┌────────────────────────────────────────────────────────────────────────┐
│                        EXTERNAL CODING AGENTS                          │
│   Google Antigravity  ·  OpenAI Codex  ·  Claude Code  ·  Cursor       │
│                Windsurf  ·  Cline  ·  OpenCode                         │
└────────────────────────────────────────────────────────────────────────┘

How Nix Works

Nix executes a deterministic, multi-stage pipeline:

1. Incremental Indexing & Change Detection

Nix parses workspace files, computes SHA-256 hashes, and maintains an incremental index inside .nix/nix.db using SQLite. Subsequent indexing runs skip unchanged files, processing only modified or newly created source files in milliseconds.

2. AST Parsing via Tree-sitter

Nix embeds first-class Tree-sitter grammars to extract typed code abstractions rather than relying on unstructured text chunks. It parses:

• Function and method declarations
• Classes, interfaces, traits, and types
• Variable and constant bindings
• Module imports and exports
• Scope hierarchies and call sites

3. Hybrid Lexical and Semantic Retrieval

Queries are matched using a balanced retrieval model:

• Lexical Token Matching: SQLite Full-Text Search with stop-word filtering, query sanitization, and path-weight adjustments prioritizing implementation files over tests or tooling.
• Semantic Vector Search: Cosine similarity against vector embeddings generated locally (via Ollama, LM Studio, or local models) or via external embedding APIs.
• Configurable Weighting: Reciprocal Rank Fusion blending lexical, semantic, symbol, path, and graph distances.

4. Typed Code Graph & Blast-Radius Mapping

Nix maps directional relationships between modules:

• Upstream Dependencies: Which files and symbols does target file $X$ import and call?
• Downstream Dependents: Which files across the repository import and depend on file $X$?
• Shortest Relationship Paths: How are module $A$ and module $B$ connected?
• Blast Radius: If symbol $S$ is refactored, which transitive callers and modules are impacted?

5. Git Intelligence

Nix analyzes local git logs, recent commits, uncommitted working tree diffs, and line blames. When answering "why" questions, it correlates current code structures with actual commit history and developer rationale rather than guessing author intent.

6. Strict Source Verification

Before any context package is emitted to an agent, Nix runs every referenced file, symbol, and line boundary through a verification gate against the physical repository.

Why Source Verification Matters

Traditional retrieval systems and ungrounded LLMs suffer from severe reference corruption:

• Malformed Identifiers: Retrieval noise can mutate identifiers (e.g. Cyrillic homoglyphs or mangled tokens like zurk/spaмп instead of zurk/spawn).
• Hallucinated Symbols: LLMs frequently invent helper functions, non-existent methods, or unexported variables.
• Fabricated Line Numbers: Tools often cite line numbers that extend past EOF or map to unrelated code.
• Phantom Relationships: Assumptions that module $A$ imports module $B$ without verification.

Nix eliminates these corruptions at the infrastructure layer through three automated checks:

Unverified Context Candidate
            │
            ▼
┌───────────────────────────────┐
│     File Existence Check      │ ──[No]──► Exclude Candidate
└──────────────┬────────────────┘
               │ [Yes]
               ▼
┌───────────────────────────────┐
│    AST Symbol Verification    │ ──[No]──► Reject Symbol / Mark Unverified
└──────────────┬────────────────┘
               │ [Yes]
               ▼
┌───────────────────────────────┐
│    Line Boundary Clamping     │ ──► Clamp [start, end] to [1, maxLines]
└──────────────┬────────────────┘
               │
               ▼
   Verified Context Package

1. File Existence Validation: Every referenced file must exist on the physical filesystem. Missing or stale paths are discarded immediately.
2. AST Symbol & Export Validation: Symbols cited in answers are cross-checked against parsed AST declarations and exports. If an identifier does not physically exist in that file, it is rejected.
3. Line Boundary Clamping: Evidence line ranges are checked against the target file's actual line count. Out-of-bounds line numbers are clamped to valid file boundaries.
4. Token Sanitization: Cyrillic homoglyphs, invisible control characters, and truncated fragments are sanitized or rejected.

Installation

Nix is distributed as a standalone CLI and library package (nixai) on npm.

Prerequisites

• Node.js >= 18.0.0
• npm, pnpm, or yarn
• Git

Global Installation

Install the CLI binary globally:

npm install -g nixai

Verify the installation:

nix --version

Local Build from Source

If building from repository source:

git clone <repository-url> nix
cd nix
pnpm install
pnpm turbo run build
npm install -g ./apps/cli

Quick Start

Initialize, index, and query your repository in four steps:

1. Initialize Configuration

Navigate to your project root and initialize the local .nix directory:

nix init

Optionally run the interactive setup wizard:

nix setup

2. Index the Codebase

Index the repository files, extract AST symbols, and generate retrieval chunks:

nix index

3. Query Universal Context

Ask questions about the repository and receive verified, token-budgeted context:

nix ask "How does the authentication middleware validate tokens?"

4. Configure Universal Skill for Coding Agents

Install the native Universal Skill (SKILL.md) for your installed AI coding agents (Antigravity, Cursor, Claude Code, Windsurf, Cline, OpenCode):

nix setup

CLI Reference

All commands run against the current working directory by default, or accept an optional path argument.

Project Lifecycle & Indexing

nix init [path] [--name <name>]

Initializes a .nix/config.json configuration file in the specified directory.

nix init . --name backend-service

nix setup [path]

Runs an interactive configuration wizard to configure embeddings providers, file ignore patterns, and agent integrations.

nix setup

nix index [path] [--force]

Performs an incremental index of the workspace. Detects modified, added, and deleted files using SHA-256 hashes.

• --force, -f: Force reindexing of all discovered files regardless of modification state.

nix index
nix index ./packages/core --force

nix reindex [path]

Deletes existing chunks, files, and symbol tables from the database and rebuilds the index from scratch.

nix reindex

nix status [path] [--json]

Displays index metrics, total files, chunk counts, config version, and embedding provider.

• --json: Output raw JSON status.

nix status
nix status --json

nix clean [path]

Purges the local .nix/nix.db database and ephemeral cache files.

nix clean

Universal Context & Search

nix ask <question> [path] [--tokens N] [--json] [--save-capsule <name>]

Universal context resolution. Detects user intent, retrieves relevant files and symbols, runs source verification, and formats a token-optimized context package.

• --tokens <N>: Maximum token budget (default: 12,000).
• --json: Emit structured JSON context package.
• --save-capsule <name>: Persist resolved context package to a named capsule for reuse.

nix ask "How is user authentication handled?"
nix ask "Where are Stripe webhooks processed?" --tokens 4000 --json

nix search <query> [path] [--limit N] [--symbols]

Searches the codebase using hybrid lexical and semantic search.

• --limit <N>: Maximum number of results to return (default: 10).
• --symbols: Restrict search scope to symbols (functions, classes, interfaces).

nix search "ProcessPromise"
nix search "hashPassword" --symbols --limit 5

nix symbol <name> [path]

Retrieves declaration details, file path, line numbers, caller hierarchy, and references for a specific symbol.

nix symbol ProcessPromise

nix symbols <query> [path] [--kind <kind>]

Searches for symbols matching a pattern with optional kind filtering (function, class, interface, variable, etc.).

nix symbols "Token" --kind interface

Architecture, Dependencies & Impact

nix understand [path] [--force] [--json]

Constructs or retrieves the comprehensive codebase topology model, identifying entry points, core abstractions, hub modules, and execution flow.

• --force, -f: Force re-analysis even if the repository hash is unchanged.
• --json: Output full topology model as JSON.

nix understand

nix architecture [path] (alias: nix arch)

Displays a structured architectural overview of the system including entry points, primary modules, and detected layers.

nix architecture

nix dependencies <file> [path] (alias: nix deps)

Inspects upstream imports (dependencies) and downstream importers (dependents) for a specific source file.

nix dependencies src/core.ts

nix impact [symbol] [path] [--file <file>] [--depth <N>]

Computes the blast radius of modifying a symbol or file. Identifies direct and transitive callers that may require updates or regression testing.

nix impact ProcessPromise
nix impact --file src/core.ts --depth 3

Rationale & Health

nix why <query> [path]

Investigates why a module, configuration, or architectural pattern was created. Analyzes git commit logs, diffs, and comments to provide grounded rationale without intent fabrication.

nix why "Why did we switch to powershell.exe on win32?"

nix health [path]

Runs repository diagnostics, checks index freshness, audits dead code candidates, and highlights files lacking test coverage.

nix health

Context Capsules

nix capsule <action> [name] [query]

Manages reusable, portable context capsules for recurring agent workflows.

• nix capsule list: Lists saved capsules.
• nix capsule get <name>: Retrieves a saved context capsule.
• nix capsule save <name> <query>: Executes a query and stores the resulting context package.

nix capsule save auth-flow "How does OAuth2 token exchange work?"
nix capsule get auth-flow
nix capsule list

Agent Integration & System Diagnostics

nix setup [path] [--agents <agents>] [--remove]

Configures the Universal Skill (SKILL.md) for detected coding agents (Antigravity, Cursor, Claude Code, Windsurf, Cline, OpenCode) and removes legacy MCP registrations.

nix setup

nix login [options]

Authenticates with the Nix Context API using an API key (nx_...).

nix login --key nx_live_...

nix api [path] [--port <port>]

Starts the universal HTTP Context API server on localhost (default port: 3456).

nix api --port 3456

nix doctor [path]

Runs comprehensive diagnostics on the local environment, validating Node.js runtime, SQLite integrity, git access, Tree-sitter parsers, and file permissions.

nix doctor

AI Coding Agent Integration

AI Coding Agent Integration (Universal Skill Architecture)

Nix delivers context intelligence to AI coding agents via native Universal Skills (SKILL.md) and direct REST Context API requests (https://api.trynix.in/v1) using Bearer API Key authentication. Nix is NOT an MCP server.

Automatic Setup

Run nix setup to automatically detect your installed agents and provision native skills:

nix setup

Agent Skill Locations

| Agent | Skill File Location | Format | |:---|:---|:---| | Google Antigravity | ~/.gemini/config/skills/nix/SKILL.md | Universal Markdown Skill | | Cursor | .cursor/rules/nix.mdc | Cursor Rule (.mdc) | | Claude Code | ~/.claude/skills/nix/SKILL.md | Universal Markdown Skill | | Windsurf | .codeium/windsurf/memories/nix.md | Windsurf Memory rule | | Cline | ~/.cline/skills/nix/SKILL.md | Universal Markdown Skill | | OpenCode | ~/.config/opencode/skills/nix/SKILL.md | Universal Markdown Skill | | Continue | ~/.continue/rules/nix.md | Continue Rule |

REST API Endpoints (https://api.trynix.in/v1)

| Endpoint | Method | Purpose | |:---|:---:|:---| | /v1/context | POST | Comprehensive grounded context package with source line bounds & claim verification | | /v1/understand | POST | Deep architectural understanding, module boundaries, and entrypoints | | /v1/search | POST | Hybrid lexical and Tree-sitter AST semantic search | | /v1/symbol | POST | Exact symbol lookup, type signature, and citations | | /v1/symbols | POST | Multi-symbol listing and relationships | | /v1/architecture | POST | Structural component graph and interface contracts | | /v1/dependencies | POST | Callers, callees, and third-party dependencies | | /v1/impact | POST | Blast radius and affected callers before making edits | | /v1/oracle | POST | Deterministic multi-step research traces with verified evidence | | /v1/status | GET | API health and subscription verification |

Local-First Architecture

Nix is built from the ground up for strict local operation:

1. Zero External Code Transmission: Repository source code, AST graphs, chunk files, and database entries remain strictly on your local machine. No repository contents are ever transmitted to external cloud indexers.
2. Local SQLite Engine: All persistence is managed in a local SQLite file (.nix/nix.db) with zero external database dependencies.
3. Offline Operation: Nix operates completely offline when configured with the local embedding provider or when relying on lexical and AST retrieval.
4. Self-Contained Parsers: Native Tree-sitter binaries execute locally in-process without cloud API calls.
5. Zero Telemetry: No telemetry, tracking events, or usage metrics are recorded or sent over the network.

Supported Technologies

Nix includes built-in Tree-sitter AST parsers for the following languages:

| Language | Supported Extensions | Parser Engine | |:---|:---|:---| | TypeScript | .ts, .tsx, .mts, .cts | tree-sitter-typescript | | JavaScript | .js, .jsx, .mjs, .cjs | tree-sitter-typescript | | Python | .py, .pyi | tree-sitter-python | | Go | .go | tree-sitter-go | | Rust | .rs | tree-sitter-rust | | Java | .java | tree-sitter-java | | C | .c, .h | tree-sitter-c | | C++ | .cpp, .cc, .cxx, .hpp, .hxx | tree-sitter-cpp | | C# | .cs | tree-sitter-c-sharp | | PHP | .php | tree-sitter-php | | Ruby | .rb | tree-sitter-ruby |

Additional files (Markdown, JSON, YAML, TOML, SQL, HTML, CSS, Shell) are indexed using chunking and lexical token search.

Search and Retrieval

Nix combines lexical and semantic search methods using rank aggregation and token budgeting:

Hybrid Scoring Model

When a search query $q$ is executed, candidates are scored using a weighted multi-factor formula:

$$S(d, q) = w_{\text{lex}} \cdot S_{\text{lex}}(d, q) + w_{\text{sem}} \cdot S_{\text{sem}}(d, q) + w_{\text{sym}} \cdot S_{\text{sym}}(d, q) + w_{\text{path}} \cdot S_{\text{path}}(d, q)$$

• $S_{\text{lex}}$: Full-text lexical match score, calculated over tokenized terms with stop-word suppression.
• $S_{\text{sem}}$: Cosine similarity between query embedding and chunk vector.
• $S_{\text{sym}}$: Boost applied if the search term matches an exact AST symbol declaration.
• $S_{\text{path}}$: Boost applied based on directory relevance (e.g. src/ over test/ or .github/).

Token Efficiency Metric

Nix packages context to minimize prompt token consumption. The token efficiency is measured against a brute-force baseline:

$$\text{Baseline} = Q + \alpha R + \beta H + \gamma T$$

Where:

• $Q$: Query token cost.
• $R$: Raw file tokens across candidate files.
• $H$: Raw git history tokens.
• $T$: Symbol graph dump tokens.

Nix computes: $$\text{Tokens Saved} = \max(0, \text{Baseline} - \text{Packaged Tokens})$$ $$\text{Reduction Percentage} = \frac{\text{Tokens Saved}}{\text{Baseline}} \times 100$$

A typical query achieves 85% to 95% context reduction, ensuring the external agent receives maximum signal with minimal token expenditure.

Configuration

Project configuration resides in .nix/config.json. Below is an annotated configuration reference:

{
  "version": 1,
  "project": {
    "name": "my-project",
    "root": "."
  },
  "index": {
    "ignoredPaths": [
      "**/node_modules/**",
      "**/dist/**",
      "**/.git/**",
      "**/.turbo/**",
      "**/coverage/**"
    ],
    "maxFileSize": 1048576
  },
  "search": {
    "weights": {
      "lexicalWeight": 1.0,
      "semanticWeight": 1.0,
      "symbolWeight": 1.2,
      "pathWeight": 1.0,
      "graphWeight": 1.0,
      "recencyWeight": 0.8
    }
  },
  "embeddings": {
    "provider": "local",
    "model": "text-embedding-3-small",
    "dimensions": 1536,
    "batchSize": 32
  },
  "skill": {
    "enabled": true
  },
  "api": {
    "enabled": true,
    "port": 3456,
    "host": "localhost"
  },
  "universal": {
    "enabled": true,
    "maxContextTokens": 12000,
    "maxFiles": 20,
    "maxSymbols": 50,
    "maxEvidence": 30,
    "autoRefresh": true,
    "allowNetwork": false
  }
}

Configuration Options

• project.name: Name identifier for the workspace.
• project.root: Relative path to project root.
• index.ignoredPaths: Glob patterns to ignore during indexing.
• index.maxFileSize: Maximum file size in bytes to index (default: 1 MB).
• search.weights: Relative weights for the hybrid retrieval algorithm.
• embeddings.provider: Embedding provider (local, ollama, lmstudio, openai, custom).
• universal.maxContextTokens: Hard ceiling for tokens included in a single context package.
• universal.allowNetwork: Enforce strict offline execution (default: false).

Real-World Example

Below is an authentic execution trace of Nix resolving context on the google/zx repository:

nix ask "How does zx execute a shell command?" /path/to/zx

Output:

=== Nix Universal Context: "How does zx execute a shell command?" ===

Intents:     HOW
Freshness:   Index [CURRENT], Git [DIRTY]
Summary:     In zx, shell command execution follows a verified runtime pipeline:
1. Entry point: The `$` tagged template function in `src/core.ts` constructs command strings with auto-quoting (`$.quote`) and returns a `ProcessPromise`.
2. Execution trigger: Calling `.then()`, `await`, or inspecting the promise invokes `ProcessPromise.run()`.
3. Subprocess spawning: `ProcessPromise.run()` delegates execution to `exec()` (imported from `zurk/spawn` in `src/vendor-core.ts`), which calls Node.js `child_process.spawn`.
4. Output handling: Stdout and stderr streams are buffered and resolved as a `ProcessOutput` object (containing exit code, stdout, stderr). A non-zero exit code throws an error unless configured with `nothrow`.
5. Context & Environment: Execution settings (`preferLocal`, `cwd`, `env`) are managed via `AsyncLocalStorage` for per-async-context isolation.

Relevant Files (13):
  - src/core.ts (Matches terms in search query 'How does zx execute a shell command?')
  - src/cli.ts (Matches terms in search query 'How does zx execute a shell command?')
  - test/smoke/win32.test.js (Matches terms in search query 'How does zx execute a shell command?')
  - test/core.test.js (Matches terms in search query 'How does zx execute a shell command?')
  - test/cli.test.js (Matches terms in search query 'How does zx execute a shell command?')
  - man/zx.1 (Matches terms in search query 'How does zx execute a shell command?')
  - examples/npm-oidc-enable.mjs (Matches terms in search query 'How does zx execute a shell command?')
  - docs/.vitepress/config.mts (Matches terms in search query 'How does zx execute a shell command?')
  - test/it/build-npm.test.js (Matches terms in search query 'How does zx execute a shell command?')
  - docs/setup.md (Matches terms in search query 'How does zx execute a shell command?')

Symbols (50):
  - [identifier] minimist in src/cli.ts
  - [identifier] EXT in src/cli.ts
  - [identifier] EXT_RE in src/cli.ts
  - [identifier] argv in src/cli.ts
  - [identifier] string in src/cli.ts
  - [identifier] autorun in src/cli.ts
  - [identifier] printUsage in src/cli.ts
  - [identifier] main in src/cli.ts
  - [identifier] envfile in src/cli.ts
  - [identifier] rmrf in src/cli.ts

Evidence (22 items):
  ✓ [src/core.ts:src/core.ts:1011] export const usePowerShell = (): void => setShell('powershell.exe')
  ✓ [src/cli.ts:src/cli.ts:59] export function autorun(meta: ImportMeta): void {
  ✓ [src/core.ts:src/core.ts:137]   [SYNC]:         false,
  ✓ [src/core.ts:src/core.ts:946]       throw new Fail(
  ✓ [test/smoke/win32.test.js:test/smoke/win32.test.js:1] // Copyright 2021 Google LLC

⚡ ~24,457 estimated tokens saved · 93% less context

Analysis of the Verification Output:

• Zero Hallucinated Artifacts: The execution accurately identifies ProcessPromise.run(), exec() from zurk/spawn, and Node.js child_process.spawn. All corrupted tokens (e.g. Cyrillic misspellings or fabricated libraries) are rejected.
• Accurate Line Citations: Every cited line range exists physically in src/core.ts and src/cli.ts.
• Token Efficiency: Instead of sending 26,000+ tokens of raw file dumps, Nix delivers the verified synthesis, symbols, and evidence in ~1,700 tokens (a 93% reduction in context window overhead).

Development

Nix is structured as a monorepo managed with Turborepo and pnpm.

Repository Layout

├── apps/
│   └── cli/             # 'nix' command-line binary & command handlers
├── packages/
│   ├── config/          # Zod schema, loader, and configuration validators
│   ├── core/            # Core runtime: retrieval, AST graph, verification, universal context
│   ├── docs/            # Documentation discovery & subscription engine
│   ├── embeddings/      # Embedding provider adapters (local, ollama, openai)
│   ├── git/             # Git intelligence, commit analysis, diff parser
│   ├── hardening/       # Local privacy auditor, storage benchmark, permission gates
│   ├── skill/           # Universal Skill templates & agent integration
│   ├── memory/          # Project memory store & agent handoff packages
│   ├── oracle/          # Multi-source research oracle & trace replay engine
│   ├── parser/          # Tree-sitter bindings for 11 programming languages
│   ├── setup/           # Interactive setup wizard & agent auto-configuration
│   ├── shared/          # Common utilities, error hierarchy, hash helpers
│   ├── storage/         # SQLite schema, migrations, chunk storage, FTS indices
│   ├── verification/    # Codebase integrity verifier and repair commands
│   └── version/         # Shared semantic version constants
└── tests/               # End-to-end integration and CLI test suites

Build Instructions

1. Install dependencies:

   pnpm install

2. Build all packages:

   pnpm turbo run build

3. Run test suites:

   npx vitest run

All 43 test suites and 270 unit and integration tests must pass with 100% success rate:

Test Files  43 passed (43)
     Tests  270 passed (270)

Security and Privacy

Nix is designed under a local-first security model:

1. Local Sandbox Execution: Nix executes solely within the boundaries of your local filesystem and the target project directory.
2. Path Traversal Prevention: All file paths and arguments are strictly sanitized against directory traversal attacks (../ patterns outside the project root are rejected).
3. Zero Inbound Network Exposure: The HTTP Context API, if enabled locally, binds strictly to localhost. Cloud requests strictly use HTTPS Bearer API Key authentication.
4. Credential Isolation: Any optional API keys (e.g. for external embedding providers) are stored in .nix/config.json and excluded from version control via .gitignore.
5. Storage Footprint Management: Use nix data inspect and nix data purge-cache to audit and clean local storage footprints at any time.

License

Proprietary Software
Copyright (c) 2026 Nix Intelligence. All rights reserved.

This software and associated documentation files are proprietary and confidential. Unauthorized copying, distribution, modification, reverse engineering, decompilation, sublicensing, or commercial exploitation of this software, via any medium, is strictly prohibited without explicit written permission from the copyright holders.

Status

• Current Release: v0.2.5
• Quality: Production-grade developer infrastructure
• Test Coverage: 43 test files · 270 tests passing (100% pass rate)
• Status: Actively maintained