mohammedkhaledmahmoud/nexusshell repository overview

⁠NexusShell

The modern, accessible, AI-powered Windows terminal. PowerShell, CMD and WSL in one blind-first interface — real Win32 ConPTY sessions rendered as accessible HTML command blocks through WebView2 and xterm.js, with NVDA and JAWS spoken directly.

• Source: https://github.com/Mohammedkhaled96/NexusShell⁠
• Licence: BSL-1.0
• Platform: Windows 10 1903+ (x64)

⁠Read this first: NexusShell does not run in this container

NexusShell is a WPF desktop application. It creates pseudo-consoles with CreatePseudoConsole, hosts Chromium through the WebView2 runtime, encrypts your AI key with Windows DPAPI, and speaks through the NVDA and JAWS APIs. A container has no Win32 subsystem, no desktop session, no WebView2 runtime and no screen reader, so there is nothing here to start.

This image is a delivery mechanism, not a runtime. It carries a published, self-contained win-x64 build of NexusShell, with a SHA-256 checksum for every shipped file, so a release can be pulled and verified by tag from any machine that can reach a registry — pinnable by digest, usable from CI, and mirrorable into an air-gapped network.

If you just want to use NexusShell, you do not want this image:

winget install MF.NexusShell

⁠Get the build out

The image copies its payload into whatever you mount at /out.

Windows (PowerShell):

docker run --rm -v "${PWD}\out:/out" mohammedkhaledmahmoud/nexusshell:latest
.\out\NexusShell.App.exe

Windows (cmd):

docker run --rm -v "%CD%\out:/out" mohammedkhaledmahmoud/nexusshell:latest

Linux or macOS (to stage or mirror a Windows release — the binaries will not run there):

docker run --rm -v "$PWD/out:/out" mohammedkhaledmahmoud/nexusshell:latest

Running NexusShell needs Windows 10 1903+ (x64) and the WebView2 runtime⁠. The build is self-contained, so the .NET runtime does not need to be installed.

⁠Commands

docker run --rm mohammedkhaledmahmoud/nexusshell:latest verify

⁠Verify what you got

verify checks the payload inside the image. To check what landed on your disk, use the SHA256SUMS that was extracted alongside it:

# PowerShell
Get-Content .\out\SHA256SUMS | ForEach-Object {
    $expected, $relative = $_ -split '\s+', 2
    $actual = (Get-FileHash ".\out\$($relative.TrimStart('./'))" -Algorithm SHA256).Hash.ToLower()
    if ($actual -ne $expected) { "MISMATCH: $relative" }
}

# bash
cd out && sha256sum -c SHA256SUMS

For a build you intend to keep, pin the digest rather than the tag — a tag can be moved, a digest cannot:

docker pull mohammedkhaledmahmoud/nexusshell@sha256:<digest>

⁠Tags

The version tag always matches the <Version> in NexusShell.App.csproj, and org.opencontainers.image.version inside the image matches the tag — the publish script refuses to push otherwise.

⁠Labels

Standard OCI annotations are set, so docker inspect answers where a build came from:

docker inspect --format '{{json .Config.Labels}}' mohammedkhaledmahmoud/nexusshell:latest

org.opencontainers.image.revision carries the source commit; io.nexusshell.payload.os, .arch and .kind describe the payload (windows, x64, self-contained-publish).

⁠What is inside

/opt/nexusshell/
├── win-x64/                 the published app (~213 MB, self-contained)
│   ├── NexusShell.App.exe
│   ├── settings.json        default settings; your real settings live in
│   │                        %AppData%\NexusShell\settings.json
│   ├── WebTerminal/         terminal.html + xterm.js, the accessible renderer
│   ├── Audios/              sound cues
│   └── runtimes/            the bundled .NET runtime and native libraries
├── SHA256SUMS
├── VERSION
├── README.md
├── LICENSE
└── THIRD-PARTY-NOTICES.md

The image runs as uid 65534 (nobody), its payload is read-only, and it holds no secrets: your AI API key is never built in — NexusShell asks for it on first run and stores it DPAPI-encrypted under your Windows profile.

⁠Building it yourself

From a NexusShell checkout:

publish-docker.bat

That compiles, runs the image test suite and pushes only if every check passes. To compile inside a Windows container instead of on the host, switch Docker Desktop to Windows containers first; the script detects the engine and uses docker/Dockerfile.build.