DEV Community: Sumama-Jameel

Nexus Engine: One command to Set Up a Complete production Environment

Sumama-Jameel — Tue, 21 Jul 2026 06:50:11 +0000

I’m 14 and I got tired of spending hours (sometimes days) setting up new machines. Different distros, different package managers, fragile shell scripts, no rollback.

So I built Nexus — a cross-platform environment provisioning engine. One command turns a fresh OS into a fully productive development machine.

The Problem

Setting up a dev machine is painful:

Hundreds of Linux distros with different package managers (apt, pacman, dnf, apk).
Shell scripts break easily with no rollback or state management.
Tools like Ansible are overkill for laptops. Docker doesn’t configure your host. Dotfile managers don’t install dependencies.

Result: Developers lose dozens of hours per year on setup issues.

What Nexus Does

One static Go binary. Detects your OS, chooses the right package manager, applies declarative YAML profiles, and handles everything with security gates and rollback.

No scripts. No manual steps. Works on Linux and Windows (with WSL2 support).

Standout Features

Cross-distro support — apt, pacman, dnf, apk behind one interface.
7-step orchestrator with rollback — PreFlight → Refresh → Execute → Verify → Audit. Failed foundation packages trigger full rollback.
Security gate (SanitizeAndExecute) — Allowlist, metacharacter rejection, timeouts. No raw shell execution.
10 built-in profiles — Go dev, Rust dev, Frontend, Data Science, Ethical Hacking, etc.
WSL2 setup in ~60 seconds on Windows.
Dotfiles + age-encrypted vault + Distrobox containers.
Community profile registry.
Optional Tauri GUI dashboard.

Architecture

Nexus is organized in bounded contexts:

BRAIN — Cobra CLI + core engine (Go)
DNA — YAML profiles with JSON Schema + struct validation + SHA256 integrity
BRIDGE — WSL2 handling (cross-compiled)
CONTAINER — Distrobox management
VAULT — age encryption
REGISTRY — Community profiles

Every command goes through a strict security gate. State is crash-safe with atomic writes and append-only logs.

Quick Start

# Install
go install github.com/Sumama-Jameel/nexus-engine/cmd/nexus@latest

# Initialize
nexus init

On Windows:

nexus wsl setup    # Full WSL2 setup
nexus wsl enter

Competitor Comparison

Tool	Static Binary	Cross-Distro	Security Gate	Rollback	WSL2	One-Command Init
Nexus	Yes	Yes	Yes	Yes	Yes	Yes
Ansible	No	Yes	No	No	No	No
Nix	No	Yes	No	Partial	No	No
chezmoi	Yes	Yes	No	No	No	No

Nexus combines the best ideas into one tool.

Why I Built It

The Linux desktop (and Windows-to-Linux migration) should be accessible to everyone — not just people who’ve memorized package manager flags. Nexus makes reproducible, secure dev environments simple.

Get Involved

Add or improve profiles
Test on your distro and open issues
Contribute to WSL2 or container features

GitHub: https://github.com/Sumama-Jameel/nexus-engine

What’s the most painful part of setting up a new dev machine for you? Have you tried tools like Nix or Ansible? I’d love your feedback.

SubZero: Privacy-First Subscription Detector (Open Source Alternative to Rocket Money)

Sumama-Jameel — Tue, 21 Jul 2026 06:47:38 +0000

I’m 14 and I built an open-source tool that finds every subscription in your bank statement — without Plaid, without storing your data, and without selling your financial history.

SubZero is a Next.js web app where you upload a PDF or CSV bank statement. It scans everything in memory and returns a detailed report of recurring charges, price hikes, and cancellation options.

The Problem

People waste hundreds of dollars every year on forgotten subscriptions. Commercial tools like Rocket Money and Trim solve this by connecting directly to your bank via Plaid — which means giving a third party your login credentials and full financial data.

That’s a privacy nightmare.

SubZero’s Approach

Upload → Scan in memory → Delete. No accounts. No persistent storage. Your data never leaves the server except in the response.

It uses 8 detection methods running in parallel for high accuracy:

Keyword + fuzzy matching (Fuse.js)
Time-delta and amount clustering
500+ vendor database (including local services like JazzCash, Daraz, Foodpanda)
Trigram index + Double Metaphone phonetic matching
Business/SaaS usage-based detection
Cross-report comparison for price hikes and cancellations

Key Features

Privacy by design — Zero data persistence. PII scrubbing (SSNs, account numbers, etc.).
Multi-format support — CSV + PDF (using mupdf).
Smart heuristics — Detects truncated vendor names, variable SaaS charges, and single-occurrence subscriptions.
Optional LLM — Only anonymized hints sent. Cancel URLs restricted to safe whitelist.
5-layer upload security — Validation, sanitization, magic bytes, size limits.
Multi-upload mode — Compare statements across months automatically.
One-click Vercel deploy — No database required.

Architecture Deep Dive

The core is a 10-stage pipeline:

Rate limiting + Upload validation (5 layers)
Parsing (CSV via Papaparse, PDF via mupdf)
PII scrubbing + bank detection
Heuristics Engine (8 parallel methods)
Confidence scoring (0-100 based on 8 signals)
Merge + deduplication
Enrichment (actions, health score A-F)
Optional LLM normalization
Report generation
Response (JSON + optional PDF export)

The entire engine lives in lib/audit/. It’s designed to be easy to extend with new heuristics or vendor patterns.

Security Model

Per-IP rate limiting
Zod schema validation at every boundary
Strict PII regex scrubbing
CSP, HSTS, and other security headers
Body size limits (max 11MB)

Competitor Comparison

Tool	Bank Login	Cost	Open Source	Privacy
SubZero	No	Free	Yes	Zero persistence
Rocket Money	Yes (Plaid)	$6–12/month	No	Full data shared
Trim	Yes (Plaid)	% of savings	No	Full data shared
SubFind	No	One-time	No	Closed source

SubZero gives you comparable detection power with actual privacy.

Tech Stack

Next.js + TypeScript + Tailwind
Zod for validation
Fuse.js, Trigram, Double Metaphone for matching
mupdf for PDF extraction
Deployable on Vercel with zero config

Get Involved

This project needs help expanding the vendor database (especially for non-US banks) and improving detection accuracy.

Try it here: Upload a statement and see what it finds.

GitHub: https://github.com/Sumama-Jameel/subzero

What’s the most annoying subscription tracking problem you’ve faced? Or if you’ve tried it, what did it miss or get right?

Scam Intelligence Network: One API for Threat Intelligence (URL, Email, Phone & Crypto)

Sumama-Jameel — Tue, 21 Jul 2026 06:44:24 +0000

I’m a 14-year-old builder. My first big project using AI was trying to commercialize a threat intelligence tool. I failed to sell it. So I open-sourced it instead.

Scam Intelligence Network (SIN) is an open-source “OpenRouter for threat intelligence.” One unified API to check suspicious URLs, emails, phone numbers, and crypto addresses against 1.43 million local records + 10+ external sources + optional LLM analysis.

The Problem

Cybercrime is exploding, but checking threats is fragmented and painful:

You need 10–12 different APIs (VirusTotal, AbuseIPDB, HIBP, EmailRep, IPQualityScore, etc.).
Each has different keys, rate limits, response formats, and pricing.
Most solutions are either expensive, closed-source, or lack coverage for all four vectors (URL + Email + Phone + Crypto).

This is especially hard for indie developers, small security teams, and self-hosted setups.

What Scam Intelligence Network Solves

One POST request. One consistent response format. Parallel checks. Smart fallback. Local-first design.

Key Highlights:

1.43 million local threat records — Instant offline detection (under 10ms). Skips external calls on matches.
10+ external sources checked in parallel using asyncio.gather().
Unified verdict engine with weighted scoring + rule-based overrides.
Circuit breakers and caching for reliability.
Full Docker deployment + CLI tool.
Privacy-first and self-hostable.

Core Architecture

The system follows a clean vertical-slice + layered design:

REST/CLI Layer → Analyzer Layer → Service Layer → Infrastructure Layer → Local Threat Data

Analyzer Layer — One folder per type (URL, Email, Phone, Crypto). Easy to extend.
Service Layer — Parallel calls to VirusTotal, AbuseIPDB, URLhaus, HIBP, IPQS, Groq LLM, etc.
Infrastructure — SQLite caching (with HMAC integrity), circuit breakers, rate limiting, API key auth.
Verdict Engine — Combines signals into HIGH/MEDIUM/LOW/CRITICAL with confidence scores.

Local blacklist check happens first — massive speed win and cost saver.

Main Features

Four analyzers behind a single /analyze endpoint.
Local + external + optional LLM reasoning (anonymized data only).
Quality gates and tiered confidence scoring.
Prometheus metrics, security headers, correlation IDs.
Analytics database for tracking queries.
Ready for monetization (tiered plans) but fully open source.

Quick Start

Docker (recommended):

git clone https://github.com/Sumama-Jameel/scam-intelligence-network.git
cd scam-intelligence-network
cp .env.example .env
docker-compose up -d

Test it:

curl -X POST http://localhost:8000/analyze \
  -H "X-API-Key: your-key" \
  -d '{"input": "https://suspicious-site.com", "input_type": "URL"}'

Or use the CLI:

python main.py "suspicious@example.com"

Why I Open Sourced It

I tried selling it and failed. Couldn’t find customers or explain the value clearly. But the code is solid and catches real threats. If even one person uses it to block a phishing attempt, it was worth releasing.

Threat intelligence shouldn’t be locked behind enterprise budgets.

Competitor Comparison

Tool	URL	Email	Phone	Crypto	Local DB	Open Source	Self-Hosted
SIN	Yes	Yes	Yes	Yes	1.43M	Yes	Yes
IPQualityScore	Yes	Yes	Yes	No	No	No	No
AlienVault OTX	Yes	No	No	No	No	Partial	No

No other open tool covers all four vectors with this level of local + parallel + resilient design.

Tech Stack & Design Choices

FastAPI + Python
SQLite for cache + analytics + auth
Asyncio for parallel checks
Vertical slice architecture for easy extension
Heavy focus on resilience (circuit breakers, caching, quality gates)

Get Involved

Run it locally or deploy on a cheap VPS.
Add new data sources or blocklists.
Share feedback or issues.

GitHub: https://github.com/Sumama-Jameel/scam-intelligence-network

What’s the biggest pain point you face with threat intelligence today — fragmented APIs, cost, or lack of coverage for certain vectors? Let me know in the comments.

Whelmer: Full-Visibility Browser DevTools for AI Agents

Sumama-Jameel — Tue, 21 Jul 2026 06:40:30 +0000

I’m a 14-year-old builder from Pakistan. After struggling with existing browser automation tools while building AI agents, I decided to create something better.

Whelmer is a Rust-based CLI tool that gives you complete, unfiltered access to everything a browser emits — across multiple protocols and browsers.

The Problem with Existing Tools

When you connect to a browser via CDP (Chrome DevTools Protocol), the browser fires hundreds of event types across 53 domains: Network, DOM, Console, Storage, Fetch, Security, and more.

Most agent frameworks and tools do one (or more) of the following:

Filter events aggressively
Hide protocol differences behind high-level abstractions
Only support Chrome CDP
Drop events they consider “unimportant”

This creates blind spots. You miss critical signals — like how an SPA handles auth tokens in localStorage, or subtle network patterns that reveal rate limiting logic.

Multi-browser support makes it worse. Firefox uses BiDi or its own FDP. Safari has its own protocol. Most tools pretend these differences don’t exist.

What Whelmer Does Differently

Whelmer shows everything.

Native support for CDP, BiDi, FDP, and Foxbridge (CDP-to-Firefox proxy)
Works out of the box with Chrome, Brave, Edge, Opera, and Firefox
A central EventBus with a 10,000-event ring buffer — nothing is dropped
Raw NDJSON streaming for easy piping into other tools/agents
Runtime domain management (enable/disable any of the 53 CDP domains)
Structured JSON output for all commands
Pure Rust static binary (~7MB) — no Node.js, no Python, no heavy dependencies

Key Features

Multi-protocol support — One binary, consistent event model across browsers.
Raw event firehose — Every WebSocket message is available. Use events --json and pipe to jq.
History replay — Access the last 10k events with events --history N.
Powerful commands:
- dom, eval, cookies, storage, network, screenshot, perf, etc.
- All support --json output.
Pluggable architecture — Easy to extend with new protocols or handlers.

Architecture Overview

Whelmer uses a clean pipeline:

WsConnection — Manages persistent WebSocket connection with command/response routing and timeouts.
EventBus — Broadcast channel + ring buffer. Every event reaches every consumer.
Display Consumer — Formats known events for terminal output.
Agent Consumer — For raw streaming and history queries.

This decoupling means the tool never silently drops data. You decide what matters.

Why I Built It

Whelmer was created for a specific use case: reverse-engineering the web interfaces of AI model providers. When OpenAI, Google, xAI, or others update their UIs or internal APIs, agent integrations break. Whelmer lets you see exactly what changed in real time.

It is also the foundation for RynoVider — my upcoming OpenAI-compatible API wrapper that routes through actual model web UIs.

Competitor Comparison

Tool	Protocols	Raw Events	History Buffer	Domain Toggle	Runtime
Whelmer	CDP + BiDi + FDP	Yes	10k events	Yes (53)	Rust
agent-browser (Vercel)	CDP only	No	No	No	Rust+Node
Puppeteer	CDP only	No	No	No	Node

Quick Start

# Install
cargo install whelmer

# Or from source
git clone https://github.com/Sumama-Jameel/Whelmer
cd Whelmer
cargo build --release

Launch your browser with remote debugging:

google-chrome --remote-debugging-port=9222

Then run:

whelmer

Future Plans

Safari WebKit support
Better integration as a library
Enhanced agent-friendly features for RynoVider

Whelmer is open source under MIT. Feedback, issues, and contributions are welcome.

→ GitHub Repository

What’s the most painful hidden browser behavior you’ve encountered while building agents? I’d love to hear your experiences in the comments.

I Spent a Year Setting Up New Machines. So I Built a Tool That Does It in One Command.

Sumama-Jameel — Thu, 11 Jun 2026 08:03:22 +0000

Every time I get a new laptop, the same thing happens. Day one. Fresh install. Nothing works the way I want it. No git. No Docker. No Node. No Vim config. Nothing. So I spend the next three hours Googling. "How to install Docker on Ubuntu." "How to set up WSL2 on Windows." "Why is my pacman command not found." Copy, paste, hope. Break something. Start over.

By the end of the day I have a machine that sort of works, but I'm not sure what I installed or whether any of it is set up right. And I know I'll go through the exact same thing next time. If you've ever set up a new machine, you know this feeling. It's not hard. It's just tedious, repetitive, and easy to get wrong.

I got tired of it. So I built "nexus-engine"(https://github.com/Sumama-Jameel/nexus-engine).

What It Does

You write a simple file that describes what you want on your machine. Then you run one command and it sets everything up.

That's it.

Here is what a setup file looks like:

name: my-setup
packages:
  - name: git
    category: foundation
  - name: curl
    category: foundation
  - name: docker
    category: tool
  - name: nodejs
    category: language

Run this:

nexus init

And it does the rest. Detects your OS, figures out which package manager to use, installs everything in the right order, and gives you a report when it's done.

It Works The Same Everywhere

This was the big one for me. I switch between Ubuntu, Arch, and Fedora depending on what I'm doing. Every distro has its own package manager. Different commands, different syntax, different package names.

nexus-engine handles all four major Linux package managers through one interface:

apt (Ubuntu, Debian)
pacman (Arch, Manjaro)
dnf (Fedora, RHEL)
apk (Alpine)

You write your setup file once. It works everywhere. You don't need to know which command belongs to which distro.

Windows Gets Linux in About a Minute

If you're on Windows and you want a Linux environment, normally you have to:

Enable WSL
Pick a distro
Download it
Import it
Configure wsl.conf
Set up your packages inside it

That's a lot of steps and a lot of places to go wrong.

With nexus-engine:

nexus wsl setup

It checks if your system is ready, downloads a Linux rootfs, imports it into WSL2, configures it with secure defaults, and you're in. About sixty seconds.

Then you can drop into your Linux environment anytime:

nexus wsl enter

If Something Breaks, It Cleans Up

This is the part that always got me with manual setup. You're installing ten things. Number seven fails. Now you have six things installed, one broken, and three that never got attempted. What do you do? Uninstall manually? Start over? Just live with it?

nexus-engine handles this differently. It installs things in priority order. Foundation packages first, then languages, then tools. If a foundation package fails, it removes everything it already installed that run. You're never left with a half-working setup.

It also checks things before it starts. Disk space, network connectivity, whether you have the right permissions. It tells you upfront if something is going to be a problem instead of failing halfway through.

You Can Share and Reuse Setups

I have a base setup that I use on every machine. Git, curl, a few essentials. Then I have specific setups for different projects. One for web development. One for data science. One for a particular client's stack.

nexus-engine lets you layer these on top of each other. A data science setup can extend the base setup. You only define what's different. The rest is inherited.

name: data-science
extends: base-dev
packages:
  - name: python3
    category: language
  - name: jupyter
    category: tool
  - name: pandas
    category: tool

You can also share setups with other people. Your team can use the same setup file. New team member joins, they run one command, they have the same environment as everyone else.

You Should Be Able to Trust It

Here's the thing about a tool that installs stuff on your machine. You need to trust it.

I thought about this a lot. So I made some decisions early on.

It doesn't run whatever it wants. Every command goes through a strict allowlist. If it's not on the list, it doesn't run. No shell metacharacters, no arbitrary execution, no surprises.

It checks setup files for tampering. Every profile gets a SHA256 integrity check. If someone modifies your setup file, nexus-engine will notice and refuse to use it.

Downloads are verified. When it downloads a Linux rootfs or a remote profile, it checks that what it received is what it expected. No man-in-the-middle surprises.

Your state is tracked. It keeps a record of everything it installed, when, and why. You can always see what's on your machine and where it came from.

Getting Started

It's a single binary. No dependencies. Download it and run.

# Install with Go
go install github.com/Sumama-Jameel/nexus-engine/cmd/nexus@latest

# Or download a binary from the releases page
# https://github.com/Sumama-Jameel/nexus-engine/releases

# Initialize your environment
nexus init

On Windows, the fastest path to Linux:

nexus wsl setup
nexus wsl enter

What's Next

This is v1.0.0. It works for my use case and I've been using it daily. But I built it in the open because I want it to work for more people.

Things I'm thinking about:

More rootfs options for WSL2
A community directory of shared setups
Better Windows support beyond WSL
Package managers I haven't covered yet

If any of this sounds useful to you, check it out:

github.com/Sumama-Jameel/nexus-engine

Apache 2.0, fully open source. Read the code, open an issue, tell me what's missing. I want this to be something people actually trust to run on their machines. That bar is high and I want to clear it.