Install

One command, zero install scripts. The prebuilt binary for your platform ships as a per-platform optional dependency and is verified end-to-end.

npm install -g buildwithnexus
bwn                   # or the full name: buildwithnexus

Try it in a sandbox

Two ways to run buildwithnexus without touching your machine:

GitHub Codespaces — one click, in the browser. Open a codespace on the repo — the devcontainer preinstalls the binary, so when the terminal appears just run bwn. Add ANTHROPIC_API_KEY or OPENAI_API_KEY as a Codespaces secret (or export it in the terminal) to talk to a hosted model.

Docker — local and fully disposable. A scratch container deleted on exit, so nothing the agent does can reach your files:

docker run -it --rm -e BWN_ALLOW_BOOTSTRAP=1 -e ANTHROPIC_API_KEY \
  node:22-slim npx -y buildwithnexus

Drop --rm to keep the sandbox between runs, or add -v "$PWD":/work -w /work once you're ready to let it work on a real project.

Requirements

Auto-updates

By default buildwithnexus notifies, never installs: at most once a day a background check asks npm for the latest version, and the next launch prints a one-line notice when a newer one exists. Startup never waits on the network. Set the auto_update policy in ~/.buildwithnexus/settings.json:

{ "auto_update": "notify" }   // default — check daily, print a notice, never install
{ "auto_update": "install" }  // check daily and silently npm install -g the update
{ "auto_update": "off" }      // no checks, no notices

BWN_NO_AUTO_UPDATE=1 still works and caps "install" back to "notify". cargo and source installs are never auto-updated.

Package security

The npm package is built to come up clean on supply-chain scanners:

• No install scripts — nothing runs during npm install.
• No bundled sources or blobs — the main package is a few KB of readable JavaScript; binaries ship as per-platform packages (like esbuild) selected by os/cpu.
• Verified binaries — every release asset carries a build-provenance attestation tying it to the exact GitHub Actions run that built it (gh attestation verify — this is the primary integrity control), plus a SHA-256 checksum used to detect corruption in transit.
• No eval, no minification, nothing runs at install time — update checks run inside the CLI itself, not the npm package.
• Consent-gated first-run fallback — if the platform package is missing (e.g. it was skipped or isn't published yet), the launcher offers to download the checksum-verified binary from the GitHub release: [y/N] on a TTY, or bwn --bootstrap / BWN_ALLOW_BOOTSTRAP=1 non-interactively. Nothing downloads without explicit consent, and never during npm install.

cargo install

With a Rust toolchain, install straight from crates.io (API docs on docs.rs):

cargo install buildwithnexus --locked   # installs `buildwithnexus` + the `bwn` alias
cargo install bwn --locked              # short-name alias crate

--locked builds with the exact dependency versions the release was tested with (the lockfile ships in the crate).

Build from source

git clone https://github.com/Garretts-Apps/buildwithnexus
cd buildwithnexus
cargo build --release --manifest-path harness/Cargo.toml