gh-nika

August 7, 2026 · View on GitHub

Nika · intent-as-code for AI workflows: author a reviewable DAG in YAML, audit cost/permits before running, keep tamper-evident traces after.

A GitHub CLI extension for the Nika workflow engine: the whole nika CLI behind gh, with zero separate install step.

gh extension install supernovae-st/gh-nika

gh nika check flow.nika.yaml   # static audit · DAG, cost floor, secret flows, permits
gh nika run   flow.nika.yaml   # execute · budget-cappable · hash-chained trace
gh nika trace verify .nika/traces/*.ndjson

gh extension install supernovae-st/gh-nika, then gh nika check runs the full static audit through the extension: plan waves, models, cost floor, energy, secrets, types, tools, args, schema, gates, writes, permits, the lethal-trifecta gate, and the task DAG · recorded against the released binary

How it resolves the binary

  1. A nika already on your PATH wins · the extension is a pass-through.
  2. Otherwise it downloads the latest release binary once (macOS/Linux · x64/arm64), verifies it against the release SHA256SUMS, caches it under ${XDG_DATA_HOME:-~/.local/share}/gh-nika/, and runs it from there. GH_NIKA_DIR overrides the cache location.

Handy where gh is already the tooling spine · Actions runners, Codespaces, locked-down laptops:

- run: |
    gh extension install supernovae-st/gh-nika
    gh nika check flows/report.nika.yaml
  env:
    GH_TOKEN: ${{ github.token }}

(For PR comments with the check verdict + DAG, the purpose-built nika-action is the richer lane.)

Upgrade

gh extension upgrade nika

That upgrades the wrapper. The cached engine binary stays where it is · GH_NIKA_REFRESH=1 gh nika --version discards it and re-fetches the latest release, checksum-verified like the first install.

Uninstall

gh extension remove nika
rm -rf "${XDG_DATA_HOME:-$HOME/.local/share}/gh-nika"

License

Apache-2.0 (this wrapper). The engine it fetches is AGPL-3.0-or-later; the language spec is Apache-2.0.

🦋 SuperNovae Studio · nika.sh · docs.nika.sh

The city · where this repo sits

📜 nika-spec ──── the civil code · the law tables, the corpus, the exam
    │ sync-pack: byte-gated mirror        │ projectors: drift-gated
    ▼                                     ▼
⚙️ nika ───────── the engine + the catalog (the yellow pages)
    │ the release train                  🖥️ nika.sh · 📖 nika-docs
    ▼                                     the showroom · the manual
📦 homebrew-tap · npm · Docker ── the docks
🔌 nika-client · 🎨 nika-vscode · 🤖 nika-plugins · ⚡ gh-nika ── the doors   ◀── you are here
🏭 nika-action · 🧪 nika-actions-starter ── the CI district
🏪 nika-registry ── the market · 🏛 nika-estate ── the land registry

This building · THE GH DOOR · gh nika check and gh nika run from any terminal that already has the GitHub CLI.

Root · neither · this building is a shim. It finds the ENGINE or fetches it, then gets out of the way · nothing authoritative is typed here.

Consumes · nika on PATH when present · otherwise the latest release asset, verified against the release SHA256SUMS before it is ever executed.

Serves · every gh user · CI runners that already carry the GitHub CLI.

Truth lives · the binary answers, this script only routes · an asset missing from SHA256SUMS makes the install refuse rather than guess.

All the buildings: nika-spec · nika · nika.sh · nika-docs · nika-client · nika-vscode · nika-plugins · gh-nika · homebrew-tap · nika-action · nika-actions-starter · nika-registry · nika-estate

Every fact has one home · everything else is a gated projection. The living map: nika.sh/map.