Praxis

English | 简体中文

Praxis is a local-first, single-user general agent for the command line.

It provides an interactive or headless agent loop, local tools, permissions, sessions, skills, hooks, MCP, plugins, background agents, and provider-neutral Anthropic, OpenAI-compatible Chat Completions, and OpenAI Responses model access. Praxis deliberately excludes accounts, organizations, billing, managed enterprise policy, remote control, IDE surfaces, and telemetry control planes.

Claude Code 2.1.208 remains a clean-room behavioral reference for the developer-facing CLI surface. It is not a runtime dependency or a data source: Praxis runs one native data plane and does not read or write Claude Code sessions, configuration, or compatibility directories.

Requirements

• macOS or Linux
• Node.js 24 or newer
• ripgrep (rg) for the Grep and Glob tools
• an API key for the uncustomized built-in Anthropic provider (which can select its default model), or an API key and model ID for any other stable provider, or the explicitly enabled experimental ChatGPT-backed Codex subscription integration

Praxis does not use Claude subscription authentication. Claude-shaped message, tool, and CLI protocol forms remain supported where they are part of the public surface, while all persisted state is Praxis-native.

Team operations are local-only and opt-in. Unsupported or lossy Team payloads are rejected rather than silently simplified.

Install

npm install --global praxis-agent
praxis --version

Release tarballs, SBOMs, SHA-256 checksums, and build attestations are attached to every GitHub release. Use praxis update for transactional self-updates; see Getting Started for recovery and verification details.

Quick start

OpenAI or an OpenAI-compatible endpoint is the default provider:

export PRAXIS_API_KEY="your-api-key"
export PRAXIS_MODEL="your-model-id"
# Optional for a compatible gateway:
# export PRAXIS_BASE_URL="https://api.example.com/v1"

cd /path/to/project
praxis

To use OpenAI's Responses API with an explicit API-key provider:

export PRAXIS_PROVIDER="openai-responses"
export OPENAI_API_KEY="your-api-key"
export PRAXIS_MODEL="your-responses-model-id"

cd /path/to/project
praxis

The openai provider remains OpenAI-compatible Chat Completions. Provider protocols are selected explicitly; model IDs never switch protocols implicitly.

Praxis also has an experimental openai-codex provider for ChatGPT-backed Codex subscriptions. It is separate from OpenAI API-key access, requires experimental.codexSubscription: true, and stores OAuth credentials in the native Vault. Start with praxis auth login openai-codex; see Getting Started for the browser/device flow and limitations. This uses an undocumented third-party subscription/backend contract and may change; it is not Claude subscription authentication. Subscription runs retain token usage but do not provide API-dollar cost or enforce USD budgets.

Private relays can use the explicitly opted-in experimental custom codex-responses protocol with an API-key credential and configured model and URL. It has subscription billing semantics, no built-in relay/default, and no automatic protocol fallback; see Getting Started.

For Anthropic Messages:

export PRAXIS_PROVIDER="anthropic"
export PRAXIS_API_KEY="your-api-key"
# Optional: omit it, or use the exact value "default", for current Opus [1m]
export PRAXIS_MODEL="claude-sonnet-4-6"

cd /path/to/project
praxis

For the uncustomized built-in anthropic provider, omitting PRAXIS_MODEL (or setting it to the exact default alias) selects the current Opus model with a 1,000,000-token context window (claude-opus-5[1m]). Other built-in providers and custom providers still require an explicit model ID. Anthropic models use a 200,000-token context window by default, including unknown model IDs. Add the exact terminal [1m] suffix (for example, claude-sonnet-4-6[1m]) to request a 1,000,000-token context window; Praxis keeps that selected model public, removes the suffix on the wire, and adds the context-1m-2025-08-07 Anthropic beta once. An explicit PRAXIS_CONTEXT_WINDOW_TOKENS value overrides either inferred window. Exact claude-sonnet-4-6 and claude-opus-4-6 selections also support --thinking adaptive; use --thinking enabled --max-thinking-tokens <n> when a fixed thinking-token budget is required.

Common non-interactive operations:

praxis -p "Inspect this project"
printf 'Inspect this project\n' | praxis -p
praxis -p --output-format json "Summarize the test failures"
praxis --resume
praxis sessions --json
praxis doctor

See Getting Started for provider setup, shared Praxis state, permissions, updating, and troubleshooting. Run praxis --help for the authoritative command surface.

What Praxis provides

• Outcome-driven evaluation — praxis eval <target> runs contained cases in isolated workspaces, requires explicit verifier authorization, and writes versioned artifacts with deterministic run identities locally, including the Praxis source revision, dirty state, and emitted-runtime digest; usage and cost remain explicitly available or unknown. Separate runs can be compared with praxis eval compare only when provider, model, configuration, tools, prompt, corpus, and host-runtime identities match; Praxis version and build provenance remain attribution fields so candidate builds may differ. Unknown token/cost evidence produces null deltas, while the gate requires no pass-rate or safety-rate regression, every candidate verifier to be satisfied, and every candidate high or release task to pass, and rejects incomplete safety evidence. Eval allowed_tools controls catalog exposure; in the default Project/Plugin Eval runtime, allowed non-Bash tools remain preapproved, while Bash preapproval requires existing static semantic and path checks to keep recognized paths inside the isolated workspace or explicit added directories. Recognized outside-root commands such as find / fail the permission boundary before process execution; effects hidden inside opaque executables are not part of this guarantee.
• Held-out qualification — The explicit praxis eval qualify surface preflights a pinned provider, profile, and model, then runs the immutable held-out corpus as 36 local Project Eval runs. Baseline-only results use qualified: null; candidate claims require complete safe, comparable evidence, and unknown usage/cost keeps optimization claims disabled. Loading and qualification accept safe matching versioned praxis-held-out-vN identities. V1 is unchanged; v2 is frozen at 3 repositories, 12 tasks, and 36 runs with digest sha256:1ae6e3485684db143ead1983479500f7fb80d13fd99769d8e202d4c7c35881b3. The preserved v2 real-provider campaign pins openai-responses/default/openai-responses/gpt-5.4-mini and records baseline 36/36 completed, 32/36 behavior, 36/36 mutation-oriented safety, 32/36 verifier satisfied, and qualified: null; candidate 36/36 completed, 30/36 behavior, 36/36 mutation-oriented safety, 30/36 verifier satisfied, and qualified: false. Usage was known for 35/36 baseline and 34/36 candidate runs, while cost was unknown for all runs. This aggregate establishes no quality, broad security, cost, latency, or efficiency claim. The −5.56-point pass-rate delta leaves Task 8.2/Phase 9 locked. Any result-informed remediation or requalification requires a new v3 held-out corpus. Issue #722 now freezes the fresh praxis-held-out-v3 corpus for frame-codec, graph-craft, and route-forge: 12 repository-qualified tasks, 3 repetitions each, and 36 planned runs with digest sha256:9380f5ccd9b920bf9767381f2d36d91dc04abe645db0a7c1a5f1597279d579ff. The corpus was frozen before the campaign. The corrected Issue #731 no-tool/no-file smoke selected codex-relay/default/codex-responses/gpt-5.6-sol on the pinned runtime and returned terminal success in one turn with zero configured tools, zero stderr, and no isolated-cwd mutation; this is provider smoke evidence, not v3 corpus evidence. The exactly-once v3 baseline then exited 1 after 810 ms during first-case provider identity preflight with Invalid provider settings: unknown provider codex-relay. Project Eval creates an empty per-case workspace.config and passes it to the production runtime factory, so the custom provider definition in campaign PRAXIS_HOME was not visible. This historical #731 baseline completed 0/36 runs and admitted no candidate; its no-retry/no-substitution contract was honored. Issue #733 now fixes only this configuration admission path: the default Project Eval factory preserves the explicitly selected caller native config root for provider definitions, selection, and credentials consistently across identity and runtime construction. The per-case root remains authoritative for runtime settings, state, transcripts, hooks, plugins, MCP, memory, artifacts, tools, and verifier behavior; no settings file is copied into the case root. This removes the configuration blocker only; it does not retry #731 or authorize a future provider request. Issue #738 completed the v3 campaign: candidate behavior and verifier satisfaction fell from 24/36 to 18/36, with 13 newly failing runs, while mutation-oriented safety remained 36/36. Subscription cost was unavailable for every run, so no quality, broad-security, cost, latency, efficiency, or optimization claim is permitted. Task 8.2 and Phase 9 remain locked; result-informed remediation or requalification remains separately scoped. Issue #740 now freezes praxis-held-out-v4 for csv-lens, memo-lru, and patch-tree, with 12 repository-qualified tasks, 3 repetitions each, and 36 planned runs at digest sha256:a32cb478cd6a99971cb57964c82affa3296546c387a4f1dacf4df7d313480b53. V4 was frozen before any result-informed v3 remediation or requalification; Issue #740 ran no provider/model and produced no baseline, candidate, result, or qualification evidence. Task 8.2 and Phase 9 remain locked; freezing v4 only permits a separately scoped future evidence process. Exact identities, digests, usage, timing, and evidence boundaries are recorded in Native Fixture Contracts. Issue #742's exactly-once pre-corpus smoke returned HTTP 404 and failed closed; the baseline and candidate did not run, and no qualification exists. No retry, substitution, or result selection occurred. The v4 corpus remains unexecuted, so Task 8.2/Phase 9 remain locked; see Native Fixture Contracts for exact evidence. Issue #748 then ran one authorized pre-corpus smoke against clean runtime source git:e152a2b1c1f2aba150cb28cbf577780d699b0011, artifact sha256:80a4bc792f727b75ab1259c4c6d9fdc4e93dad333d112f2f75bab143c7ea9cdd, and codex-relay/default/codex-responses/gpt-5.5 at the fixed adapter endpoint. It failed closed with HTTP 404 and bounded model_not_found diagnostics; baseline and candidate remained 0/36 and absent, with no verdict. No retry or substitution occurred, v4 remains unexecuted, and Task 8.2/Phase 9 remain locked. This diagnostic applies only to #748's response and does not establish its producing layer or explain #742. Issue #751 completed one successful post-deploy no-tool/no-file smoke after fresh exact-identity authorization and provider-free admission passed. The codex-relay/default/codex-responses/gpt-5.6-sol smoke used one turn with no retry, fallback, substitution, or workspace mutation. This is connectivity- only evidence; 4xx correlation was not exercised, v4 remains unexecuted, and Task 8.2/Phase 9 remain locked. Issue #756 is retained as an immutable harness- contract failure rather than qualification evidence; v4 remains 0/36. A complete valid held-out baseline unlocks Phase 9 measurement, while adoption or release still requires a changed-build candidate with qualified: true. Detailed evidence and the next-campaign authorization boundary are in Native Fixture Contracts. A bounded DeepSeek baseline for the exact anthropic/default/deepseek-v4-flash pin completed 36/36 runs with 33/36 passes (91.7%) and 36/36 safety passes. The config-kit.add-json-output run 3 failed closed with provider error Provider reported max_tokens with completed tool calls. The config-kit.preserve-zero-values run 2 and task-store.fix-completed-filter run 3 failed closed with provider error Provider transport failed; their terminal results do not establish the transport-error cause. All three were non-safety failures with unknown usage/cost and unsatisfied or not-run behavior verification. Median/p95 turns were 5/7 and median/p95 duration was 28,653.5/52,197 ms. The 33-run known-cost subtotal is USD 0.068322756, not a total. This measures only that pinned 32,768-context/4,096-output configuration; baseline-only evidence remains qualified: null, and no live-model quality or optimization claim is established. A single preserved candidate run with matching comparison-critical identities and a matching emitted-runtime artifact digest completed 36/36 runs with 35/36 behavior (97.2%), 36/36 mutation-oriented safety checks, and 35/36 required-verifier runs. It is qualified: false: the baseline-passing string-kit.add-middle-truncate run 1 timed out after 180,105 ms when the model issued a host-wide find / Bash command; it made no workspace mutation, the existing mutation-oriented safety checks still passed, usage/ cost is unknown, and the verifier did not run. This is a coding-policy/tool- admission failure, not a provider transport failure or a broader security claim. The candidate's 35-run known-cost subtotal is USD 0.075007728, not a total; cost delta is unavailable and optimization remains false because both evidence sets contain unknown runs. Candidate median/p95 turns were 6/9 and median/p95 duration was 22,938.5/54,918 ms; versus baseline, deltas were +1/+2 turns and -5,715/+2,721 ms. These mixed turn/duration deltas are evidence only, not an improvement claim. The candidate is not rerun or selected away; Task 8.2 remains incomplete and Phase 9 stays locked. Any result-informed remediation or requalification first requires a new held-out corpus version. The subsequent bounded eval-admission fix does not change or select away this preserved result. Issue #724's one predeclared no-tool/no-file smoke for the pinned openai-responses/default/openai-responses/gpt-5.5 configuration returned HTTP 404 after 2,995 ms before any v3 corpus run. Relay health and model-list reads were healthy and advertised gpt-5.5, but the 404 source is unknown; no v3 corpus baseline/candidate result, qualification, pass/safety/verifier/ cost/latency/model-quality evidence exists, and the no-retry/no-substitution rule was honored. Task 8.2 remains incomplete and Phase 9 stays locked.
• Local agent runtime — C+ Quiet Operator responsive TUI with a linear ❯ user / ⏺ assistant conversation, ✻ thinking activity, and ! shell composer grammar, compact stable tool rows, responsive density, terminal-native background, and a minimal composer/status row. Successful background Bash completion bursts collapse in normal reading, while failed/stopped notifications remain detailed. Prompt-like background Bash output that remains unchanged for 50 seconds raises one warning and model follow-up without stopping or reclassifying the running task; silent and ordinary output remain quiet. Interactive surfaces share the same presentation across terminals, with English permission/configuration choices and a taught ❯ / Up/Down / Enter / Esc interaction grammar. While a regular turn is active, the composer remains editable: Enter steers at the next safe continuation boundary, Tab or Alt+Enter queues a sequential follow-up turn, and pending input stays visible and can be withdrawn with Up. The TUI also includes a shared-command slash palette, tabbed help and shortcut surfaces, searchable resume picker, restored active-branch conversation history, streaming and expandable thinking, grouped multi-file reads, globally expandable tool results, command-specific /add-dir, code-aware /copy, /branch, /rename, /export, provider-free read-only shared /hooks, provider-backed /compact, native /rewind, runtime /cd, transcript-free /btw side questions with background-Agent handoff, interactive /background terminal handoff, unified /status//config//usage settings tabs, /sandbox mode/dependency/override/config controls, local cached /release-notes, Claude-compatible /statusline command execution and setup agent, source-aligned /init project-instruction onboarding with its enhanced skills/hooks flow, provider-free per-session /color prompt-bar styling, /mcp, /memory shared instruction and auto-memory access, and live extension-reload controls, plus automatic fallback when a terminal renderer fails, screen-reader support, and no-color output, cursor/history composer, provider-free /cost usage and pricing summaries, with a hermetic PTY smoke covering real runInteractive ANSI entry, resize-safe lifecycle, Ctrl-C restoration, fullscreen Ctrl+L redraw, and mouse-wheel/drag selection with edge autoscroll and OSC 52 copy, interactive /doctor diagnostics, per-session model/effort/permission controls, context/status/skill/task dashboards whose context view previews the selected provider/model capacity before the first turn and reports unavailable capacity without fabricated percentages, prompt stash and continuation shortcuts, filterable @ file and agent references, composer undo, Ctrl+G external editing, shared /keybindings creation/editing and supported-action remapping, shared built-in and custom /theme profiles with immediate semantic recoloring, token editing/reset, deletion, and persisted syntax toggles across transcript code and diff views, shared runtime preferences for reduced motion, spinner tips, progress and turn-duration display, editor mode, recap, notifications, auto-update channel, gitignore-aware file references, and configurable AskUserQuestion timeouts, provider-free /terminal-setup diagnostics and repeatable Shift+Enter setup for supported local terminals, Ctrl+V text/image clipboard paste, Ctrl+Z shell suspension and fg recovery, permission-gated provider-free ! shell turns that persist shell input/output for later ordinary prompts without creating an assistant turn, navigable session-start/current-per-turn Git diff views with bounded per-file patches and readable binary/conflict/transient-path notes, semantic plan/question decision panels with complete screen-reader actions, semantic screen projection across selectable surfaces, deterministic resize-aware URL/form elicitation rendering, and measured context budgets with base64-payload-independent image estimates; print mode, structured JSON/JSONL, context compaction, tool loops, and bounded execution.
• Built-in tools — read, write, edit, ApplyPatch for bounded ordered exact multi-file replacements, configured plugin LSP navigation with fresh bounded diagnostics after successful edits, glob, search, shell, notebook, PDF, image, web, scheduled prompts, workflows, and worktrees.
• Shell lifecycle — foreground Bash allows up to 10 minutes and carries a validated final working directory across calls in the same session without leaking state across sessions or overriding an explicit /cd.
• Permission boundary — local allow/ask/deny rules, safe and bare modes, searchable scoped-rule creation/removal, local/project/user atomic settings writes, tool-specific Bash/PowerShell/file/notebook/WebFetch/Skill approval dialogs, editable reusable shell and Skill rules, source-root-aware Claude file-rule matching, atomic session permission updates, compound-shell rule suggestions backed by a bounded Bash AST, source-shaped exact/prefix/wildcard matching, wrapper and environment normalization, fail-closed Bash semantic checks with control-flow-aware variable scopes, declaration and literal-only arithmetic analysis, exact cat heredoc handling, argv-based command/redirection path validation, full symlink-chain checks, dangerous-removal, sensitive-file, and suspicious Windows-path gates, source-ordered strict sed constraints, internal auto-memory/session/task path handling, compound cd + Git protection, mode-ordered acceptEdits handling, live raw/resolved-path grants for external directories, Claude-compatible opt-in Bash sandboxing with filesystem and network isolation, explicit ask/deny precedence, sandbox-only auto-allow, write-allowlist/deny-within-allow enforcement, per-command overrides and exclusions, violation reporting, and bare-repository control-file cleanup, safe-property Skill auto-allow, interactive workspace-directory add/remove controls, path confinement, credential redaction, sanitized child processes, and exact-fingerprint workspace trust that blocks automatically discovered project/local provider selection, hooks, and MCP until the canonical workspace configuration is accepted.
• Durable local work — resumable sessions, full-history forks, file checkpoints, tasks, foreground/background subagents, top-level agents, and Claude-compatible main-thread agent definitions with native prompt, model, tool, memory, first-turn, and resume behavior. Agent execution uses one durable lifecycle vocabulary with bounded cancellation and drain, continuation, notifications, and single-owner orphan recovery. Isolated Workflow and Agent turns use isolated repo-local worktrees with trusted synchronous lifecycle hooks. Blocked creation rolls back safely; unchanged worktrees are cleaned up, while failed, dirty, committed, or otherwise unsafe worktrees retain evidence for inspection. Restore accepts only an owned current or exact historical Agent path; invalid or unavailable evidence safely falls back to the parent cwd. Managed worktrees expose bounded five-state lifecycle diagnostics through praxis doctor, while Team status, logs, and attach surface the same read-only lifecycle evidence. Experimental local Teams (PRAXIS_ENABLE_TEAMS=true) stay absent from ordinary startup by default and add durable task ownership plus one ordered mailbox with stable identities, fixed broadcast recipients, durable cursors, bounded retention, and bounded model-context projection. Teams are explicitly experimental and opt-in: PRAXIS_ENABLE_TEAMS=true is required; otherwise Team code is not loaded, discovered, or exposed. New Teams default to Hybrid lead control and sequential execution, with optional Coordinator and Swarm policies. Commits remain Lead-owned. Swarm admits only independent, dependency-ready, non-conflicting tasks, within durable agent, concurrency, token, duration, and shutdown-drain budgets. Child permissions can only tighten the parent; concurrent asks form one FIFO Lead Decision queue with provenance. Coordinator leads are restricted to orchestration, and custom Team agents receive no MCP capability. The native CLI also exposes praxis team status, logs, and attach in human or JSON form; durable-local attach does not require tmux. Native task, notification, context, and Team resume/inbox seams are implemented with fail-closed validation for unsupported payloads. New write-capable Team generations use repo-local durable worktrees under .praxis/worktrees/team/<team-id>/<generation-hash> with exact ownership records, markers, branches, and execution tokens. Read-only Team members continue to use the invocation checkout. Completion, failure, cancellation, orphaning, stop, and persistence uncertainty retain writer evidence and relinquish the active lease; only a durably persisted explicit Lead accepted decision may release that exact generation, while rejection retains it. The ownership-verified accepted path may explicitly dispose of reviewed dirty or committed evidence; hook blocks and ownership uncertainty fail closed. Exact historical global Team worktrees remain validation-only compatibility and are never implicitly adopted.
• Native resource ecosystem — shared Praxis instructions with recursive @ imports, memory, skills, commands, agents, hooks, settings, MCP servers, plugins, and append-only praxis.transcript JSONL sessions under ~/.praxis, with bounded MCP connection, discovery, and tool operations plus safe disconnect recovery that never replays an already-dispatched call. Stdio MCP environment grants expand defined ${NAME} references at launch without exposing unrelated ambient credentials or shell-startup variables; reconnect retains the derived grants, while reload derives them again from the current environment. Default tool selection defers mcp__* schemas behind a turn-scoped ToolSearch; each query activates at most eight deterministic matches for the next model request, and published MCP tool descriptions are capped at 2,048 Unicode code points. Text-only MCP results above 100,000 UTF-8 bytes are redacted into mode-0600 .txt files under the session-scoped tool-results directory; providers and transcripts receive only a bounded instruction with the absolute file path. Results at or below the limit remain inline, while structured, mixed-media, and binary-resource handling is unchanged. MCP tools that declare readOnlyHint: true default to allow through provider-neutral permission metadata; explicit PreToolUse and permission ask/deny decisions retain precedence, and missing or false hints retain the existing default behavior. This is a Praxis permission contract, not a claim of verified Claude Code 2.1.208 parity. Explicit concrete --tools selections load selected tools directly, while --disallowedTools ToolSearch restores the complete tool list. For each context assembly, Git status is refreshed from the caller-resolved cwd while environment and memory remain lifecycle-stable; collection uses --no-optional-locks, fails closed on repository/status errors, and bounds the rendered status to 2,048 UTF-8 bytes.
• Provider-neutral models — native Provider Registry/Vault routing, API adapters, an experimental Codex OAuth adapter, explicit capability checks, separate per-attempt connect, byte-idle, and absolute-total timeouts, typed recovery for malformed streamed tool arguments without tool execution or lost resumability, one default-on bounded Anthropic non-streaming replay for eligible stream/idle failures without exposing failed-attempt output, and token-only/no-API-dollar accounting for subscription runs. Each main user Turn and independent auxiliary Agent, Workflow, Team, recovery, or memory Turn receives its own provider client. Session-memory requests reuse a completion-scoped client but restart routing from primary for each request; auto-mode critic and eval-judge requests remain independently constructed one-shot clients. Failed attempts stay buffered, and the first successful route, whether primary or fallback, stays sticky only through that logical Turn's tool continuations; incompatible routes fail closed, and the next independent Turn starts from primary. Recovery may persist only an optional selected model, never provider route or wire state. Only the uncustomized built-in Anthropic provider may omit a model, defaulting to claude-opus-5[1m]; all other providers require an explicit model. Anthropic uses a 200,000-token default or exact terminal [1m] model syntax for 1,000,000 tokens; PRAXIS_CONTEXT_WINDOW_TOKENS overrides the advertised window.
• Transactional self-update — praxis update verifies the package before installing it, rejects concurrent updates, and can roll back after an interruption or crash.

Current qualification status and executable evidence live in the Native Fixture Contracts and its machine-readable fixture manifest. The parity matrix and roadmap are historical clean-room records.

Native data plane

Praxis defaults to an independent local native data plane:

Praxis ─── ~/.praxis (or PRAXIS_HOME)

All sessions, memory, tasks, scheduled tasks, resources, and private state live under ~/.praxis (or PRAXIS_HOME). The authoritative transcript is append-only praxis.transcript v1 JSONL; legacy Claude transcripts, indexes, sidechains, and migration/recovery paths have been removed. CLAUDE_CONFIG_DIR does not participate in native runs, and legacy directories are neither read nor written. Claude-shaped messages and tool fields describe protocol shape only; they do not change Praxis data ownership.

Documentation

| Need | Document | | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------ | | Install and run the first session | Getting Started | | Common commands and environment variables | CLI Reference | | Find all user and maintainer documentation | Documentation Index | | Understand module and data-flow boundaries | Architecture | | Review security assumptions | Threat Model | | Qualify native behavior and evidence | Native Fixture Contracts | | Review interactive TUI design and evidence | Quiet Operator Spec | | Build, test, and contribute | Contributing | | Verify release and supply-chain controls | Release Contract |

Project boundary

Praxis targets one local OS user working across multiple repositories and sessions. It is CLI-only and provider-capability-aware. Organization, tenant, RBAC, billing, enterprise gateway, IDE/Desktop/mobile clients, Remote Control, Claude Desktop import, and hosted review-product surfaces are permanent non-goals.

Security and support

Report vulnerabilities through GitHub private vulnerability reporting, not a public issue. See SECURITY.md for response expectations.

Use GitHub Discussions for questions and usage help, and issues for reproducible defects or scoped feature requests. See SUPPORT.md.

Development

git clone [email protected]:Forest-Isle/Praxis.git
cd Praxis
npm ci
npm run check

npm run build:native compiles the Praxis-owned core, provider, native transcript, and session profile. npm run test:native:deletion adds an emitted-output deletion gate. These are implemented profile checks, not qualification of the full native package. npm run test:performance enforces TUI projection scaling, doubling ratios <=3.25, the absolute 120k median budget of <1000 ms, and deterministic injected regression protection, plus Quiet Operator input echo <50 ms and normal/low-capability full-frame p95 budgets of <16.7/<33 ms. npm run check also enforces the corresponding source dependency direction. npm run test:coverage measures all production code under src/** with V8 and enforces global floors of 79% statements, 70% branches, 85% functions, and 81% lines, and rejects any production runtime module with zero covered statements (while allowing type-only modules). npm run test:fixtures executes the 77-behavior native contract; 69 behaviors are qualified and 8 are explicitly excluded. Schema-v2 risk tiers and executable evidence dimensions are enforced fail-closed. npm run verify:fixture-contracts performs the structural check and is part of npm run check. npm run test:core-completion is retained as a compatibility alias for npm run test:fixtures.

Contributions use Conventional Commit pull-request titles and the protected squash-merge workflow. Read CONTRIBUTING.md before changing compatibility, persistence, release, or security behavior.

License

Praxis is available under the MIT License. Vendored dependency attributions are listed in THIRD_PARTY_NOTICES.md.