
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
nova-agent-framework
Advanced tools
Version: 0.0.5
Package: nova-agent-framework
Architecture: Cloudflare Workers (Edge AI)
Repository: godwinaustenlabs/NovaSystems
nova-agent-framework).wrangler.jsonc Configuration Bible.PipelineChatLLMContextManagerToolRegistryLoggerThe era of massive, monolithic AI frameworks running on heavy Python servers (LangChain, AutoGen) is ending. The future is Edge AI, agents that run milliseconds away from users, scale instantly to zero, and incur minimal cold-start latency.
Nova Agent Framework (nova-agent-framework) is built specifically for this future. It is not a general-purpose library ported to JavaScript; it is an Edge-Native framework designed for Cloudflare Workers.
zod schemas to enforce strict JSON output from LLMs. If an LLM hallucinates a parameter, Nova catches it before execution.ChatLLM layer includes a regex-based surgical repair engine that fixes these errors on the fly, saving up to 30% of failed requests invisibly.Logger that visualizes the "Thinking Loop" (🔄 LOOP 1 START ... TOOL EXECUTION ... 🔄 LOOP 1 END) directly in your terminal.ContextManager.fetch APIs).npm install -g wrangler).Install the core framework package into your Workers project.
# Initialize a new Cloudflare Worker project
npm create cloudflare@latest my-agent -- --type=hello-world
# Enter directory
cd my-agent
# Install Nova Framework
npm install nova-agent-framework zod
wrangler.jsonc BibleThe wrangler.jsonc file is the control center of your agent. It defines memory bindings, environment variables, and compute limits.
CRITICAL: Nova relies on specific Environment Variable names (
LLM_MODEL,VERBOSE).
{
"$schema": "node_modules/wrangler/config-schema.json",
"name": "my-nova-agent",
"main": "src/index.js",
"compatibility_date": "2026-01-31",
// 1. Observability
"observability": {
"enabled": true
},
// 2. Global Variables
"vars": {
// LLM Selection
"LLM_MODEL": "openai/gpt-4o",
// "LLM_MODEL": "groq/llama-3.3-70b-versatile",
// Logging Level (Set to 'false' in prod for speed)
"VERBOSE": "true",
// API Keys (It is safer to use `wrangler secret put` for these!)
// "OPENAI_API_KEY": "sk-...",
// Cloudflare AI Gateway (Optional but Recommended)
"CF_ACCOUNT_ID": "your-account-id",
"CF_GATEWAY_NAME": "nova-gateway",
"CF_AIG_TOKEN": "token-xyz"
},
// 3. Memory Bindings (Cloudflare KV)
"kv_namespaces": [
{
"binding": "KV_NAMESPACE", // Must match config passed to Pipeline
"id": "your-kv-namespace-id"
}
]
}
src/core/pipeline.js)The Pipeline is the state machine that drives the agent. It enforces a strict "Thinking Loop":
ChatLLM & Self-HealingNova treats all LLM providers (OpenAI, Groq, Gemini) as interchangeable commodities. The ChatLLM class abstracts the differences.
Self-Healing Logic:
One of Nova's most powerful features. When an LLM outputs malformed JSON (e.g., missing quotes, trailing commas), the ChatLLM catches the JSON.parse error. It then applies a series of Regex heuristics to "repair" the JSON string and retries the tool execution automatically. This makes agents using headers models (like Llama-70b) significantly more reliable.
ToolRegistryTools are the only way an agent interacts with the world. Nova mandates Zod Schemas for all tools.
Why Zod? LLMs are probabilistic. They make mistakes. Zod is deterministic. It enforces rules. By defining a Zod schema, you ensure that your tool function never executes with invalid data types, preventing crashes deep in your business logic.
ContextManagerMemory in Nova is multi-tiered:
SMS) to search all past conversations using vector embeddings to find relevant details ("What was the user's name mentioned 3 weeks ago?").Let's build a robust agent.
Create src/financial_agent.js.
import { Pipeline } from 'nova-agent-framework/core/pipeline';
import { z } from 'zod';
export default async function financialAgent(req, env) {
// ...
}
const stockTool = {
name: "get_stock_quote",
description: "Get real-time price data for a stock ticker symbol.",
schema: z.object({
symbol: z.string().describe("The stock ticker, e.g. AAPL, NVDA"),
market: z.enum(["US", "UK"]).optional().describe("Market region")
}),
func: async ({ symbol, market }) => {
// Fetch logic would go here
return JSON.stringify({ symbol, price: 145.20, currency: "USD" });
}
};
const agent = new Pipeline({
// Enable debug logging?
verbose: env.VERBOSE === 'true',
// Tools Array
tools: [stockTool],
// Memory Setup
ctxManagerConfig: {
clientId: "user_01",
agentId: "finance_bot_v1",
memory: {
memoryType: "buffer",
limitTurns: 15, // Keep plenty of context
kvNamespace: env.KV_NAMESPACE
}
},
// LLM Setup
llmConfig: {
model: env.LLM_MODEL, // "openai/gpt-4o"
api_keys: {
openai: env.OPENAI_API_KEY
}
}
});
try {
const input = await req.json();
const result = await agent.run(input.prompt);
return new Response(result);
} catch (err) {
return new Response(err.message, { status: 500 });
}
Pipelineconstructor(config: PipelineConfig)| Param | Type | Required | Description |
|---|---|---|---|
config.verbose | boolean | No | Enables detailed debug logging (payloads, timings). |
config.tools | Tool[] | No | Array of tool definitions. |
config.maxToolLoop | number | No | Max consecutive tool calls (default: 6). |
config.llmConfig | LLMConfig | Yes | Configuration for the model provider. |
config.ctxManagerConfig | CtxConfig | Yes | Configuration for memory and session IDs. |
run(prompt: string): Promise<string>Executes the main reasoning loop. Returns the final text response.
ChatLLMconstructor(config: LLMConfig)| Param | Type | Description |
|---|---|---|
config.model | string | The model ID string (e.g. gpt-4o, groq/llama...). |
config.api_keys | Object | Keys { openai, groq, gemini }. |
config.cloudflare | Object | { accountId, gatewayId, cfAIGToken }. |
chat(messages: Message[], options: ChatOptions): Promise<LLMResult>Low-level wrapper for model inference.
options.tools: Array of JSON-Schema tool definitions.options.toolChoice: usually 'auto'.ContextManagerconstructor(config: CtxConfig)| Param | Type | Description |
|---|---|---|
config.clientId | string | Unique ID for the User. |
config.agentId | string | Unique ID for the Agent. |
config.memory.kvNamespace | KVNamespace | The Cloudflare KV binding object. |
Nova uses a centralized logging system. To see logs in production, use:
npx wrangler tail
Look for the structured blocks:
🔄 LOOP START: Indicates a new reasoning cycle.🛠️ Tool Execution: Indicates a tool is running.✅ Self-Heal: Indicates the framework repaired a broken LLM response.wrangler secret put for API keys. Do not store them in wrangler.toml plain text.Maintained by: Godwin Austen Labs
Date: 2026-02-04
FAQs
NOVA AGENT FRAMEWORK
We found that nova-agent-framework demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.