Prompt
Say what you want in plain language — single line, or a multi-line paragraph with pasted errors and @file mentions. Workspace context (shell, OS, git branch, project type, cwd) is gathered once per turn and injected into the prompt.
AI-native shell · alpha
Nyx.code
Your shell, aware of its intent.
ShellAI reborn as Nyx.code. Natural language to shell commands, streaming output, session memory that survives restarts — with explicit consent on every single execution. zsh, bash, fish. Go binary, MIT-licensed, no telemetry, keys in your keychain.
Shells
zsh · bash · fish
Runtime
Go 1.24
LLM providers
6
Session store
~/.shellai
Telemetry
None
Status
Alpha
Prompt. Plan. Confirm. Execute.
Most AI tools fire and forget. Nyx.code asks first.
Every loop has the same four beats. The model proposes; you dispose. There is no mode where it runs without you, because such a mode is not implemented in the binary — not a toggle, not a flag.
Plan
For complex requests a cheap planner model decomposes the task into numbered steps before the main stream starts. You see the plan first; the shell command comes after. Silent degradation if the planner times out — five seconds, then skip.
Confirm
The generated command is shown with a risk badge — [RO] read-only, [WR] writes, [DG] dangerous, plus [SU]/[NT] modifiers. For [DG] you type a confirmation word. For [WR] you see a pre-execution diff or glob expansion.
Execute
Only after you press Enter. Writes and dangerous commands snapshot affected files first to ~/.shellai/snapshots/ with SHA-256 hashes. One keystroke restores. Catastrophic patterns (rm /, dd /dev/sda) are blocked outright.
Press r at the confirmation screen to revise the generated command without restarting the loop.
What persists, what doesn't
Memory that survives the terminal closing. Nothing that leaves your machine.
Sessions are JSON files under ~/.shellai. Resume with `shellai --resume`, search with /search across every session you have ever run. There is no cloud, no account, no server round-trip for memory.
Persists
- Chat sessions — JSON in ~/.shellai/sessions/, 8-char hex IDs, auto-named from first message
- Per-session input history — pwd-scoped, recallable with arrow keys
- Command execution history — categorised (git, docker, k8s, files, network…)
- Undo snapshots — 50 entries, 24-hour TTL, SHA-256 hashed originals
- Macro templates — ~/.shellai/macros/, {{variable}} substitution, usage-tracked
Does not persist
- Nothing is sent to telemetry — there is no telemetry endpoint
- No analytics, no error reporting, no usage metrics — deliberate
- API keys live in your OS keychain via go-keyring, never on disk in plaintext
- Transcripts stay local — on your machine, under your home directory
- No cloud account required — no login, no session token, no sync
Backend: plain JSON on disk, 8-char hex IDs, trimmed to MaxHistory (default 100 messages). The legacy chat_history.json auto-migrates on startup.
Your shell, your blast radius
A shell is arbitrary code execution, by design. Treat every AI suggestion like an untrusted pull request.
Nemesis wrote this section. The convenient framing — 'just run my command' — is exactly how supply-chain exploits land. Nyx.code is built so the worst thing the model can produce is a suggestion you declined to run.
Never auto-run
This is the first principle of the codebase, not a feature flag. Every generated command waits on explicit keyboard consent. No --yes, no auto-approve, no agent loop that executes its own output.
Risk badges, post-generation
A pattern checker runs after the LLM returns, before you see the prompt. Badges — [RO]/[WR]/[DG] plus [SU] sudo and [NT] network — are assigned by local rules, not by the model's self-assessment.
Hardcoded denylist
Catastrophic patterns — rm -rf /, dd of=/dev/sda, mkfs on mounted volumes, :(){ :|:& };: — are rejected before the confirmation UI. The model cannot talk its way past them.
Preview before write
For [WR] commands the preview engine simulates sed edits as a unified diff, expands globs with file counts and sizes, and recognises --dry-run flags for rm, rsync, cp, mv, git, npm, yarn, docker.
Snapshot + restore
Before [WR]/[DG] execution, affected files are copied to ~/.shellai/snapshots/<id>/ with permissions and timestamps preserved. One undo call rolls back — including deleting files the command created.
Keys in the OS keychain
Provider credentials (OpenAI, Anthropic, Gemini, Groq, xAI) are stored via go-keyring — macOS Keychain, Linux Secret Service, Windows Credential Manager. Env-var fallback only if you opt in.
Prod-mode flag is available: environment: prod in ~/.shellai/config.yaml elevates every destructive pattern to [DG], forcing the typed-word confirmation. Use it on any machine with production credentials.
What a turn looks like
Plain English in. A labelled, reviewed shell command out.
This is the exact output format of `shellai ask` on the current alpha build. Badge, explanation, and confirmation prompt. Nothing runs until you press Enter.
$ shellai ask "find all Go files modified today, excluding vendor" ⠋ thinking… 1.2s [RO] find . -name "*.go" -mtime -1 -not -path "./vendor/*" Lists .go files modified in the last 24 hours. Read-only; the -not -path clause skips the vendor tree. Works on macOS + Linux. [Enter] run [e] edit [c] copy [x] explain [r] revise [q] quit $ shellai ask "delete old build artefacts in ./dist older than 7 days" [WR] find ./dist -type f -mtime +7 -delete Preview (dry-run simulated): ./dist/darwin-arm64/shellai-v0.3.1 4.2 MB ./dist/linux-amd64/shellai-v0.3.0 4.0 MB ./dist/checksums-v0.3.0.txt 284 B 3 files · 8.2 MB · snapshot before execute? [Y/n] $ shellai ask "wipe the database volume" [DG][SU] docker volume rm -f nyxcore_pgdata Irreversible. Volume contents are not recoverable after this. Type the word DELETE to confirm, anything else aborts: > _
Pipe-friendly equivalent: shellai ask "disk usage by folder" -q | sh — raw command to stdout, no TUI, still no auto-execute unless you pipe it yourself.
What this is not
The adversary’s disclosure. Read before you install.
Ipcha Mistabra wrote this section. Before Nyx.code replaces whatever you use today, know the three things it deliberately will not do.
Disclosure
Not autonomous.
Nyx.code is not an agent. It will never queue, batch, or execute without your keystroke. If you wanted a loop that spends your budget while you sleep, you want something else — and you should question what.
Disclosure
Not a copilot.
It does not ghostwrite into your shell. It does not intercept your typing. Ctrl+L opens a prompt; the result replaces the current input line only after you accept it. Your shell stays your shell.
Disclosure
Not a shell replacement — an overlay.
Nyx.code sits beside zsh, bash, or fish. Your prompt, your rc-files, your completion, your history all stay. Uninstall is a `brew uninstall` or a line removed from ~/.zshrc; it leaves nothing behind.
Quick start
One binary. Your shell stays your shell.
Go binary, shipped via npm, Homebrew, go install, or a curled script. Node is not required for the CLI itself (only for the optional FrugalRoute auto-router). Ollama works offline with no API key.
# npm (easiest) npm install -g @shellai/cli # Homebrew brew install shellai/tap/shellai # Go install (from source) go install github.com/shellai/shellai/cmd/shellai@latest # Curl (macOS / Linux) curl -sSL https://shellai.dev/install.sh | bash # Add a provider key (stored in your OS keychain) shellai config set-key anthropic sk-ant-... shellai # launches chat mode
zsh
shellai integrate adds a Ctrl+L widget to ~/.zshrc. Press Ctrl+L with any prompt text on the line — it replaces the input with the generated command, pending your Enter.
shellai integrate # writes zle widget to ~/.zshrc source ~/.zshrc
bash
Same integrate command, detects bash by $SHELL, installs a readline binding into ~/.bashrc. No framework dependency — works on stock bash 4+ on macOS and Linux.
shellai integrate # writes bind to ~/.bashrc source ~/.bashrc
fish
fish gets its own function in ~/.config/fish/functions/shellai_widget.fish plus a bind. Completions work the same; history stays in fish, generated commands come from Nyx.code.
shellai integrate # writes function + bind exec fish
Alpha status — what that actually means
The four safety invariants — never auto-run, risk badges, denylist, snapshot-before-write — are load-bearing and tested. The surrounding surface (chat UI polish, the nyxCore integration, macro authoring) is still being shaped. If you need a tool you can point at CI and leave, wait for beta. If you want a copilot you drive from a keyboard and that never surprises you, the alpha is already useful.
Metis says: alpha is a permission to ship, not a permission to mislead.