How it works · Getting started · Integrations · Privacy · Architecture · Documentation · Contributing
A local desktop app that turns the decisions your AI coding agents make into a versioned, evidence-backed project memory, and feeds that memory back to the agent as context.
Coding agents make dozens of decisions per session, and almost all of them get lost in the chat history. xemnas follows that work, proposes the decisions that showed up in it together with the evidence behind them, and keeps the ones you confirm as a versioned, searchable memory of the project. That memory flows back to the agent as context, so the next task starts from what the project already settled instead of deciding it again.
Status: early and built in the open. xemnas works end to end on Windows with OpenCode and Claude Code, but it is a young project and many pieces are still moving. Ideas, issues and pull requests are very welcome; see Contributing.
- Review with evidence. Each candidate comes with the suggested choice, the rationale and the conversation or diff excerpts it came from. Evidence is shown before the AI's reasoning. You confirm, adjust, defer or reject it, with undo. When a candidate contradicts another item, the review shows both sides of the conflict and lets you keep one or both.
- Automatic mode, when you want it. A Manual | Automatic switch, like an agent's permission mode. In automatic mode free local rules settle the obvious cases and the AI reviews the rest in small batches, with hard limits on calls. Everything it did lands in a "Done on its own" ledger, and anything it was unsure about stays in your queue, marked as such.
- Context back to the agent. This is the core: decisions and rules in force are injected into the agent's context inside a token budget, and a read-only MCP server answers when the agent asks. Rules are scoped: a rule reaches a task only when it matches the task, is tied to a component the task touches, or is marked global.
- Versioned decisions. Revising creates a new version and keeps the previous one; every decision is searchable, carries its provenance and exports to Markdown or JSON.
- Decisions that relate. Mark what supersedes, depends on or conflicts with what; a superseded decision leaves the agent's context but stays in history.
- Project map. Components and technologies of the project, the files each one covers and the decisions and rules tied to them, as a list, a graph, a file lens and a timeline. Links come from affirmative mentions and from signals checked in the repository (cited files, declared dependencies, defined symbols), and every link records who confirmed it.
- Overview, architecture and flows. The AI writes a short overview of the project from what you confirmed, every sentence citing its sources. One click turns the architecture and the main flows into a self-contained HTML page: a map you can explore and a guided, step-by-step walk through each flow.
- Plain language. Every text the AI writes for you follows a controlled style (about 80% of ASD-STE100): short sentences, one idea each, facts and doubts kept, nothing added.
- Honest operations. A connection test for the OpenCode integration and a diagnostics page with latency, losses and retryable jobs, exported without any content.
- Local by default. SQLite on your machine and an offline extractor. An external AI provider (any OpenAI-compatible API, including a local model, a ChatGPT account, OpenCode Zen/Go, or the local Claude Code CLI, experimental) only runs after a preview of what leaves the machine and your explicit consent.
- Ten languages. The interface ships in English (default), Portuguese, Spanish, French, German, Italian, Japanese, Chinese, Korean and Russian.
- Native app. Rust + GPUI, the UI framework behind Zed. No Electron, no browser.
flowchart LR
A["OpenCode / Claude Code session"] -->|"plugin or hooks: redacted capture"| B["xemnas (local)"]
B --> C["Candidates + evidence"]
C -->|"you confirm"| D[("Versioned decisions")]
D -->|"Context Pack · MCP"| A
- Capture. The OpenCode plugin or the Claude Code hooks send the session to the app's local API (loopback only), with secrets masked before anything is stored. If the app is closed, it waits in a file outbox.
- Extraction. A background job proposes candidates. A local filter, with no AI, only sends a capture on when it shows a durable choice. The default extractor is offline; an external AI provider is optional.
- Review. In manual mode nothing becomes a decision without you. In automatic mode the AI settles candidates and suggested links in batches, and every action is logged and reviewable.
- Context. Decisions in force go back to the agent through compact injection (Off, Measure or Inject, per project), through what the map ties to the files just edited (OpenCode), or through an MCP query.
 |
 |
| Decisions: document, history, evidence and index | AI & privacy: extractor, key vault and outgoing preview |
Screenshots show the Portuguese (pt-BR) interface; the app starts in English and the language can be changed in Settings.
Requirements: Windows and stable Rust.
git clone https://github.com/pablozr/xemnas
cd xemnas
# Explore with sample data (in-memory database, nothing is written)
cargo run --locked -p desktop-gpui --bin xemnas -- --demo
# Real use
cargo build --release --locked -p desktop-gpui --bin xemnas
.\target\release\xemnas.exeDistributable ZIP: .\tools\package.ps1. Demo flags, data locations and the cross build are
covered in docs/operacao/operacao-e-referencia.md (Portuguese).
Windows blocks a new build? See Smart App Control.
| OpenCode | Plugin in adapters/opencode: captures on idle, validates the envelope and sends it to the app or the outbox. No domain rules, never calls a model. Setup |
| Claude Code | Hooks served by xemnas-mcp: hook prompt injects context into each prompt, hook stop and hook session-end capture the session (with the outbox when the app is closed). A git worktree of a registered project counts as that project. How it works |
| MCP | xemnas-mcp (apps/mcp-server): read-only get_decision, search_context and file_context (what the project map ties to a file) over stdio. Works with OpenCode and Claude Code. Details |
| Context Pack | Decisions in force and rules valid at a date, with citations and a size budget. Details |
- Data lives in
%LOCALAPPDATA%\xemnas; the local API listens on loopback only, with a per-session token. - Secrets are redacted twice before anything is stored: in the adapter and in the Rust engine.
- External AI requires HTTPS (HTTP only on loopback), a preview of what leaves the machine and consent bound to that preview. The provider key lives in Windows Credential Manager, never in a file.
- Logs and exported diagnostics never carry conversation content, diffs or credentials.
- xemnas never commits or writes to your repository; exporting is always your action.
A modular Rust monolith whose layering is enforced by an architecture test.
| Path | Role |
|---|---|
crates/domain |
Domain rules and types, no I/O |
crates/application |
Use cases and ports (review, automatic mode, decisions, context, overview, export) |
crates/storage-sqlite |
SQLite + FTS5, forward-only migrations |
crates/local-api |
Local HTTP API for the adapter and for agents |
crates/ai-provider |
OpenAI-compatible provider and OS key vault |
crates/integration-contracts |
Versioned contracts shared with the adapter |
crates/telemetry |
Logging with content sanitized out |
apps/desktop-gpui |
Desktop app (GPUI) and composition root |
apps/mcp-server |
Read-only MCP server |
adapters/opencode |
TypeScript plugin for OpenCode |
tests/architecture |
Test that enforces the layering between crates |
Project documents are written in Portuguese.
- Current state of the product and domain vocabulary
- Roadmap · Dogfood metrics
- Stack and architecture · Context for agents · ADRs
- Visual identity and Quiet Glass design system
- Operations, local data and known limitations
- Research and future ideas · Full documentation map
xemnas is early, so there is room to shape it. Good places to start:
- Translations. The UI ships in ten languages with English as the default; native speakers reviewing the wording are very welcome (guide).
- More agents. Capture works with OpenCode and Claude Code; adapters for Codex or other agents are welcome.
- macOS and Linux. The app targets Windows first; GPUI runs elsewhere, the packaging and a few platform pieces do not yet.
- Better extraction and retrieval. Measuring what the agent actually receives and whether it helps.
Open an issue to discuss an idea before a large change. Before sending a PR:
cargo fmt --all -- --check
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo test --workspace --lockedCI runs the same checks plus cargo deny, cargo audit, the adapter tests and packaging.
Small commits, one topic each, in English; see AGENTS.md.
MIT © xemnas contributors