← All articles

No. 03X by Nexow

From a sentence to a live widget

In X by Nexow you describe a widget in plain words. The model writes a small program, and the canvas runs it in a box it cannot climb out of.

Alex Colls Outumuro

Co-founder and CTO · · 3 min read

Print 03, Feather. Drops and combs on a bath, pulled when the site is built.Point at it to drop ink.

X by Nexow turns a sentence into a widget on a canvas: a chart of a market, a table of a portfolio, a watchlist that ticks. People often assume the model fills in a template. It does not. It writes code.

The model writes a module

Each widget is a small file tree. Its entry, index.js, exports a single function:

export async function render(ctx) { … }

The model builds it the way a developer would, with tools to write, edit, read and list files. While it writes, it can look things up: the reference docs of each connector, a probe that calls a real endpoint to see what comes back, and a search of public APIs.

The file bodies stream in as the model writes them, so you watch the code appear instead of a spinner. Streaming a tool’s input has a catch: the API no longer validates it for you. Our loop parses every tool call again, strictly, and sends truncated input back so the model tries again.

Checked before it runs

Before a widget mounts, its code is cleaned of stray prose and markdown fences, then linted. A second agent works alongside the first and checks the endpoints the widget relies on again, with up to five probes and one round of repair in the same turn. Once it mounts, a smoke test looks for a blank render or a runaway loop.

If a widget breaks right after it is built, X repairs it once, within 45 seconds, and stops there. It will not keep spending your credits on its own fixes.

A box it cannot climb out of

Every widget runs in its own sandboxed iframe, with scripts allowed and nothing else, so it gets an opaque origin. A content security policy blocks calls to other hosts. Everything from outside, data or media, comes through ctx, which the app fetches on the widget’s behalf.

That is also how keys stay out of reach. The model never sees a credential: it only sees whether a source is connected, keyless or not connected. Keys stored in the cloud are encrypted with AES-GCM, and by default calls go through proxies that keep no state.

The model writes the code. It never holds the keys.

Live, without ten connections

A widget stays live through ctx: history, subscriptions, account data, queries. Behind it, a shared data hub opens each upstream feed once, however many widgets read it, and pauses feeds while the tab is in the background. Ten charts of the same market share one WebSocket.

There are 95 connectors today, from exchanges with their own WebSocket feeds to REST sources on a shared poll loop with backoff. Two are marked stable. The others still carry a beta badge in the app.

Alex