Skip to content

🦋 Nika 0.67.0 — Architecture Cleanup

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Apr 15:28

🦋 Nika 0.67.0 — Architecture Cleanup

Inference as Code · April 4, 2026 · 12 commits

🧪 Tests 🔧 Builtins 📦 Transforms 🌐 Providers
9,938 61 50 9

✧ infer · ⎈ exec · ☄ fetch · ⊛ invoke · ❋ agent

✨ The engine got lighter. The errors got smarter. The vault got its own crate. Three surgical architecture changes that make Nika leaner, safer, and friendlier -- without touching a single workflow behavior. Secrets management is now a standalone library, the jq engine jumped two major versions, and typos in with: blocks now get gentle "did you mean?" nudges instead of cryptic errors.

🏗️ nika-vault: Secrets Get Their Own Home

The vault was trapped inside nika-daemon -- 1,243 lines of XChaCha20Poly1305 + Argon2i KDF cryptography that had no business being coupled to a background process. Now it's a standalone crate that any Nika component can depend on independently.

What moved:

  • vault.rs (1,243 lines, 36 tests) extracted from nika-daemon into nika-vault
  • nika-core is now pure zero-I/O -- orion, whoami, fs2, secrecy deps removed
  • nika-daemon and nika-cli import from nika-vault instead of owning the code

Tip

This is a crate boundary change only. The vault itself works exactly the same. Your encrypted secrets at ~/.nika/secrets/vault.enc are untouched.

⚡ jaq 1.5 to 3.0: A Generational Leap

The jq engine powering nika:jq and the | jq() transform got a major upgrade. Three old crates (jaq-interpret, jaq-parse) replaced by three new ones (jaq-core, jaq-std, jaq-json). The LRU cache now uses Arc<Filter> because filters are no longer Clone in 3.x. And the regex-on-null panic that could crash the engine? Gone.

Before (v0.66) After (v0.67)
jaq-interpret + jaq-parse (2 crates) jaq-core + jaq-std + jaq-json (3 crates)
Clone on filters for LRU cache Arc<Filter> (3.x dropped Clone)
Regex on null input = panic 💥 Regex on null input = graceful error ✅
HashMap for regex cache (unbounded) LruCache(128) (bounded memory)

💡 "Did You Mean?" Error Suggestions

Typos happen. Now Nika catches them with Jaro-Winkler similarity matching on the two most common binding errors:

NIKA-071 (Unknown Alias):

NIKA-071: Unknown alias 'tpoic' in with block
         Did you mean 'topic'?

NIKA-080 (Unknown Task Reference):

NIKA-080: Unknown task '$reserach' in with block
         Did you mean '$research'?

No more staring at error messages wondering what went wrong. The engine looks at every declared alias or task ID, scores them by string distance, and suggests the closest match.

🔧 Engine Decoupled from Init

nika-engine no longer pulls in nika-init. The init wizard logic now lives exclusively in nika-cli where it belongs. This shaves off unnecessary dependency weight from the embeddable engine -- important for the Rust SDK, nika serve subprocess model, and the upcoming nika-napi Node.js bindings.

The dead From<NikaInitError> impl was removed along with the dependency.

🐛 Fixes (8 items)
  • 🔒 InjectTool silent truncation -- Missing end_marker now returns an error instead of silently dropping all content after the last matched marker
  • 🧠 REGEX_CACHE unbounded growth -- HashMap replaced with LruCache(128) to cap memory from user-supplied regex patterns
  • ⚡ EnrichTool clone overhead -- extract_field_from_map() no longer clones the entire map per field extraction
  • 🖥️ TUI render safety -- write!().unwrap() in the render path replaced with let _ = write!() to prevent panics on broken pipes
  • 🔒 security.rs secret leak -- check_blocklist_with_intent now redacts API keys in BlockedCommand error messages
  • 📝 5 stale module comments -- Copy-paste leftovers from the v0.66 data_tools split cleaned up
  • 📚 AGENTS.md / CLAUDE.md -- Updated to reflect the new data/ module structure

⬆️ Upgrade Notes

Note

Zero breaking changes. All existing workflows, configs, and vault secrets work exactly as before. This release only changes internal crate boundaries and adds error UX.

If you use nika:jq or the | jq() transform with regex expressions, note that regex-on-null now returns an error instead of panicking. This is strictly safer behavior -- add | default("") before the regex if you expect nullable inputs.

📦 Install

curl -fsSL https://raw.githubusercontent.com/supernovae-st/nika/main/install.sh | sh
Method Command
🍺 Homebrew brew install supernovae-st/tap/nika
📦 npm npx @supernovae-st/nika
🦀 Cargo cargo install nika
🐳 Docker docker run --rm ghcr.io/supernovae-st/nika:0.67.0
💻 VS Code ext install supernovae.nika-lang
🪟 Scoop scoop install nika via supernovae-st/scoop-nika
🐧 AUR yay -S nika-bin

🔐 All binaries: SHA256 checksums · SLSA provenance · macOS notarization

Made with 💜 by SuperNovae Studio · Open Source, AGPL-3.0

Full Changelog: v0.66.0...v0.67.0

Assets 15
Loading