cablehead/xs

This system is a local-first, embeddable event stream store for Rust applications that manages time-sorted frames with optional content-addressed storage and hierarchical topic indexing. It provides a comprehensive interface for interacting with the store via a CLI and an embedded Nushell runtime, enabling users to append, query, and stream events using familiar shell commands. The architecture supports extensible logic through actors, services, and actions, while offering flexible connectivity options including HTTP, Unix sockets, and peer-to-peer networking.

11 changes.

This period established the foundational cross-stream library and its primary Nushell integration, defining the core event store API, CLI, and scripting engine. It expanded the project's reach by introducing decentralized client support, comprehensive integration tests, and practical examples like a Discord bot and macOS clipboard viewer.

8 changes.

The project migrated its binary build system to Dagger pipelines with multi-platform support and introduced a new action processor with unified lifecycle management. Concurrently, the actor and service processors were refactored to enforce consistent state threading and event handling, while a deprecated Datastar TodoMVC example was updated with new UI features and metrics.

This location introduces a new TodoMVC example built with the Datastar frontend and a Nushell/cross.stream backend. The example includes a server script (serve.nu) that exposes an SSE stream for real-time updates and REST endpoints for managing todos, alongside a projection module (projection.nu) that tracks interaction counts and time-to-first-view metrics. The entry also adds a test suite (projection\_test.nu) to verify the state projection logic and a README with a live demo link, though it is marked as deprecated for Datastar v1.0.0-RC.5 due to subsequent breaking changes in the SDK.

examples/datastar-todomvc · high confidence

Introduces a new SolidJS-based web interface for the \x-macos-pasteboard\ example, allowing users to view and explore clipboard history. The UI connects to the \xs\ service via Server-Sent Events to stream clipboard frames and fetches content through a Content-Addressable Storage (CAS) API, rendering text, JSON, and images in a card-based layout. The package includes a Nushell handler to map raw clipboard data to content types and is configured to run with Deno and Vite.

examples/x-macos-pasteboard/solid-ui · high confidence

This change introduces the foundational structure for the cross.stream project, including the MIT license, a comprehensive README with quick-start and feature highlights, and an AGENTS.md file defining commit and code quality standards. It adds a Nix flake (flake.nix/flake.lock) providing development shells for Rust and Nushell, and a Dagger configuration for build pipelines. Crucially, it adds the initial version of xs.nu, a Nushell module that exposes commands like .cat, .last, .append, .get, and .cas to interact with the cross.stream event store, establishing the primary interface for Nushell users.

(repo-wide) · high confidence

This change introduces the \cross-stream\ (\xs\) crate, an embeddable, local-first event stream store for Rust applications. It provides a core \Store\ API for appending and reading time-sorted frames (using scru128 IDs) with optional TTL and content-addressed storage (CAS). The library includes an HTTP/Unix-socket server (\api\ module) exposing endpoints for streaming events (\/\, \/last\), managing CAS content, and evaluating Nushell scripts (\/eval\). A CLI (\xs\) is provided to interact with the store, supporting commands like \cat\, \append\, \last\, \cas\, and \eval\. The implementation supports hierarchical topic indexing, wildcard queries, and Server-Sent Events (SSE) for streaming. It also includes a Nushell runtime (\nu\ module) for embedded scripting and a hierarchical tracing subscriber (\trace\ module) for structured logging.

src · high confidence

This change adds a new Nushell (nu) integration layer that allows the system to execute Nushell scripts as configuration and logic. It includes a new \Engine\ struct to manage the Nushell state, a \parse\_config\ function to evaluate scripts and extract closures, and a Virtual File System (VFS) mechanism that loads Nushell modules from the content-addressable store (CAS) so they can be imported by scripts. The implementation also includes a suite of tests for the engine, command handling, and module loading.

src/nu · high confidence

The client module has been rewritten to support multiple connection backends, including direct Unix sockets, standard TCP, TLS (HTTPS), and Iroh peer-to-peer networking via tickets. This enables the CLI to connect to stores behind HTTPS with basic authentication and to participate in decentralized networks. The client also implements new API behaviors such as direct CAS reads for local stores, an updated append route at POST /append/\<topic\>, and support for metadata base64 encoding to handle unicode characters.

src/client · high confidence

Added a new example in examples/discord-bot that demonstrates building a Discord bot using the xs framework. The example includes a README with setup instructions and ASCII diagrams, along with Nushell actor scripts: actor-heartbeat.nu manages the WebSocket connection lifecycle (including authentication and reconnection logic), actor-roller.nu handles text-based dice rolls (e.g., ./roll 1d4), actor-slash-dice.nu implements slash command support for dice rolls, and actor-bookmarklet.nu provides message bookmarking via emoji reactions. The example uses the Discord API v10 and requires websocat for the WebSocket connection.

examples/discord-bot · high confidence

This change introduces a new set of embedded Nushell commands in the \src/nu/commands\ module, providing a programmatic interface to the application's store and CAS. Users can now write data to the content-addressable store and append frames to topics using \.append\ (which supports metadata, TTL, and timestamp flags) and \.cas-post\. Reading is handled by \.cat\ (streaming or historical event logs with filtering, limits, and follow modes), \.last\ (retrieving the most recent frame(s) for a topic), and \.get\ (fetching a specific frame by ID). Content retrieval from the CAS is available via \.cas\, while \.remove\ allows frame deletion and \.import\ enables restoring frames verbatim. Additionally, \.id\ provides SCRU128 ID generation and unpacking/packing capabilities.

src/nu/commands · high confidence

The system now includes a new action processor located in src/processor/action that handles the definition, execution, and response routing of user-defined actions. This component manages the action lifecycle by emitting specific events (such as xs.action.\<name\>.active and xs.action.\<name\>.invalid) and routes action outputs to frame metadata or CAS storage based on return options. It relies on a shared two-slot compaction state machine (src/processor/lifecycle/slots.rs) to manage create, active, invalid, and term events for actors, services, and actions, ensuring consistent state transitions and fallback behavior during hot-replacements.

src/processor/action · high confidence

Actors must now define their closure to accept exactly two positional parameters: the incoming frame and the current state. Closures with a different number of arguments (such as the previous single-argument shape) are rejected at registration time with an error, ensuring consistent state threading across all actor instances.

src/processor/actor · high confidence

The store now allows users to control data durability against power loss via a new \Fsync\ policy (configurable as \always\, \never\, or an \interval:\<ms\>\ duration, defaulting to 1 second) exposed through \StoreOptions\. Additionally, the store supports hierarchical topic queries, enabling readers to filter by exact topics, prefix wildcards (e.g., \clip.\*\), or comma-separated patterns, with the underlying index optimized for lexicographical ordering and bloom filters.

src/store · high confidence

The Datastar TodoMVC example now displays interaction metrics, including an interaction count and time to first view, within the todo section footer. Additionally, the list of todos is now rendered in reverse order, showing the most recently added items at the top.

examples/datastar-todomvc/templates · high confidence

The Datastar TodoMVC example has been deprecated and pinned to Datastar v1.0.0-RC.5, with a visible notice in the interface warning users that the SDK has since shipped breaking changes. The demo now features a new dark-themed UI with interactive link cards and includes an embedded video player (via Mux) to demonstrate the tutorial. The entry point is now a standalone HTML file with local CSS assets, replacing previous structures.

examples/datastar-todomvc/www · high confidence

The build system has moved from previous CI scripts to Dagger pipelines, introducing native support for building binaries on macOS (aarch64), Linux (arm64 and amd64), and Windows (amd64). This change ensures that macOS builds fail loudly if the resulting binary is missing or if unexpected build errors occur, preventing the accidental shipping of empty tarballs. The pipelines also implement specific caching strategies for Cargo registry, git, and target directories to optimize build times across these platforms.

.dagger · high confidence

The service processor now manages services using a unified lifecycle model where output records are stored in frame metadata by default, and service events (such as active, finished, or error states) are emitted to specific xs.service.\<name\>.\<event\> topics. This change introduces a restart policy (defaulting to on-success) and ensures that service output suffixes are concatenated verbatim, aligning with actor and action behavior. Users will see service outputs and lifecycle changes reflected in the store's metadata and dedicated event frames, providing a more consistent and observable service execution model.

src/processor/service · high confidence

The new check.sh script ensures code quality by running cargo fmt, clippy, and tests, and now also validates the documentation build process by executing Astro checks and building the docs site to catch MDX errors early.

scripts · high confidence

Added integration tests for CLI commands and Nushell module; Added throughput benchmarks for store and actor operations.

The Rust crate is now published as cross-stream (v0.13.5-dev), featuring an upgrade to Nushell 0.115.1 and a minimum Rust version of 1.95.0. The build system now includes a new .dagger/go.mod module for Dagger pipelines, and the Cargo manifest enables LTO and single codegen units for release builds while adding binstall metadata for pre-built binaries.

(dependencies) · high confidence

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

• CAI 66 → 70 (+4.9)
• Rubric changed (rubric-2026.08.18 → rubric-2026.09.15) — scores are not directly comparable.

• Code Health 81 → 87 (+5.6)
• Architecture 100 → 97 (-2.7)
• Maturity 76 → 77 (+0.6)
• Readiness 71 → 74 (+3.0)
• Security 51 → 59 (+8.3)
• Domain Modelling 100 → 100 (+0.0)
• Event Sourcing 100 → 100 (+0.0)

• CatStreamCommand::run (cognitive 16) (src/nu/commands/cat_stream_command.rs)
• Coverage not included — suite not readable by the collector
• Critical CVE: [GHSA redacted] (.dagger/go.mod)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• High CVE: [GHSA redacted] (Cargo.lock)
• High CVE: [GHSA redacted] (.dagger/go.mod)
• High CVE: [GHSA redacted] (.dagger/go.mod)
• High CVE: [GHSA redacted] (Cargo.lock)
• High vulnerability: [GHSA redacted] (Cargo.lock)
• High vulnerability: [GHSA redacted] (Cargo.lock)
• High vulnerability: [GHSA redacted] (Cargo.lock)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• …and 35 more

• Ambiguous retrieval semantics: get retrieves a single item by ID, while read retrieves a stream/iterator of items based on complex filters (topic, limit, follow, etc.). However, the naming convention get vs read is inconsistent with common patterns where get implies single-item lookup and list/query implies multi-item. More critically, read and read_sync are clearly paired, but get has no sync/async variant exposed, implying it might be blocking or internal-only, which is confusing for a public API.
• CI installs an unverified third-party binary (.github/workflows/ci.yml)
• ClassTooLong: Store (src/store/mod.rs)
• Critical CVE: [GHSA redacted] (.dagger/go.mod)
• Duplicate constructor methods: parse and from_option both take a string spec and return a TopicFilter. The distinction between 'parse' and 'from_option' is unclear and likely redundant.
• Duplicate error checking logic: Both error.has_not_found_io_error and NotFound.is_not_found check if an error is a 'not found' error. This is a direct duplication of intent and likely implementation.
• Duplicate insertion methods: cas_insert and cas_insert_bytes both accept byte-like data. impl AsRef<[u8]> is more general than &[u8], so cas_insert_bytes is a strict subset of cas_insert. Having both is redundant.
• Duplicated block (10 lines × 2) (src/api.rs)
• Duplicated block (11 lines × 2) (src/processor/actor/serve.rs)
• Duplicated block (11–12 lines × 2) (src/trace.rs)
• Duplicated block (12 lines × 2) (src/nu/engine.rs)
• Duplicated block (12–13 lines × 2) (src/store/mod.rs)
• Duplicated block (12–13 lines × 2) (src/trace.rs)
• Duplicated block (17 lines × 2) (src/api.rs)
• Duplicated block (17 lines × 3) (src/nu/util.rs)
• Duplicated block (19–20 lines × 2) (src/processor/actor/serve.rs)
• Duplicated block (33–39 lines × 2) (src/nu/engine.rs)
• Duplicated block (5 lines × 2) (src/main.rs)
• Duplicated block (5 lines × 3) (src/listener.rs)
• Duplicated block (5 lines × 3) (src/processor/action/serve.rs)
• …and 86 more

• 30 commits — 20 feature/other, 10 fixes

• src/store — 12 commits
• (root) — 6 commits
• src/nu — 4 commits
• docs/src — 3 commits
• src/processor — 2 commits
• examples/discord-bot — 1 commit
• src/client — 1 commit
• src/main.rs — 1 commit

• fix: chore: cargo update, fix deprecated scru128 from_fields
• fix: fix: halt discord reconnect loop after failed identify; add std/random import
• fix: fix: keep following past a lagged broadcast receiver
• fix: fix: make read_sync forward iteration lazy
• fix: fix: raise fjall worker threads from 1 to 2
• fix: fix: round scru128 timestamp on pack to stop id roundtrip loss
• fix: fix: run xs.stopping on SIGTERM and Windows console-close, not just ctrl-c (#150)
• fix: fix: stop leaking a tokio runtime per .cat/.last, consolidate read commands (#146)
• fix: fix: strip an inherited XS_APPEND_META from a new engine, only xs sets it
• fix: fix: type .last's topic as any so it runs on nushell 0.115
• change: docs: describe ttl cleanup as asynchronous and batched
• change: docs: drop the pre-sweeper aside from the ttl page
• change: docs: prefer committing and pushing after each stable change
• change: feat!: sweep expired time ttl frames in the background
• change: feat: add a configurable fsync policy, default interval:1000
• change: feat: add a restart option to services, on-success by default, never to stop after one run
• change: feat: bump bon, console, webpki-roots, dirs, base64, nix, duct
• change: feat: bump iroh to 1.1.0, fix a connection-lifetime bug it exposed
• change: feat: bump nushell to 0.115.1, rust-version to 1.95.0
• change: feat: expose store and fjall keyspace counters at GET /metrics
• …and 10 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

cablehead/xs was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.