NovaX documentation

Everything you need to get up and running with NovaX V2.6.1: attach effortlessly to Roblox, write code with virtual Luau LSP across every tab, explore the Velocity API, personalize your workspace with Custom CSS, and leverage seamless in-place updates.

Installation

You never download NovaX itself. You download the Bootstrapper, a small launcher that fetches the latest build (~11 MB), verifies the files, and puts everything in one folder.

Requirements

Steps

1. Download the Bootstrapper from the download section and run it. It installs NovaX into %LOCALAPPDATA%\NovaX (or runs portably next to itself in custom workspace folders).
2. Windows Start Menu & Desktop Integration: The Bootstrapper auto-registers shortcuts with instant Windows Search indexing ("NovaX") for one-click launching.
3. Allow it through SmartScreen. Windows will warn about an unrecognized app. Click More info, then Run anyway. This is expected for unsigned independent software.
4. Add the NovaX folder to antivirus exclusions. Any injector is flagged generically as GameHack. In Windows Security, open Virus & threat protection, then Manage settings, then Exclusions, then Add the NovaX folder. Do this for the folder, not just the .exe.
5. DLL Lock-Safety: The Bootstrapper features smart StreamsEqual checks and rename-aside (.old) handling, preventing sharing-violation errors even if WebView2 runtime DLLs are active.
6. Launch NovaX.exe as administrator. Right-click the file and pick Run as administrator. The UAC prompt is required, because attach cannot work without elevation.

First attach & execute

1. Open Roblox first in any supported client. NovaX detects running *roblox* processes live.
2. Hit Inject. One click attaches to every detected client through the in-process backend — each client is attached directly, with per-client results in Output. The status pill turns green with your client count.
3. Pick a target. The target selector runs on all clients by default, or pin it to a single session.
4. Execute. Paste a script (or open one from the Hub) and hit Execute. Output lands in the Output panel; problems land in Problems.
5. Automate repeats. Scripts flagged in Explorer under AutoExec run by themselves on every future attach.

Subsystem Startup (Real Async Boot)

Starting with V2.6.1, NovaX features a balanced, fully asynchronous Subsystem Startup Pipeline (5 to 7 seconds). While the laser-thin border beam neon splash screen plays, the app actively executes real background tasks in parallel before mounting the workspace:

• 15% — Native Bridge Handshake: Establishes inter-process communication between C# and WebView2, verifies version consistency (AppVersion vs NX.VERSION), and negotiates active build channels.
• 35% — Preferences & Theme Engine: Loads settings from disk, computes dynamic color token palettes, applies user Custom CSS styles, and restores window pinned-on-top preferences.
• 55% — Live Roblox Environment Discovery: Probes active RobloxPlayerBeta instances directly from the OS, checks installation paths for standard Roblox, Bloxstrap, Fishstrap, and Froststrap, and performs a silent release check.
• 75% — Luau Language Server Spin-Up: Launches luau-lsp.exe under BelowNormal CPU priority inside a Win32 Job Object (KILL_ON_JOB_CLOSE), compiling global Roblox definitions (roblox.d.luau) so diagnostics are instantly warm.
• 90% — Monaco Editor Pre-Warming: Injects the AMD loader, Luau grammars, themes, and autocomplete signatures into memory so the Editor opens instantaneously with zero micro-stutter.
• 100% — Workspace Mount & Ready: Restores your last active tab, starts Discord Rich Presence (if enabled), and transitions smoothly into the editor.

Updating & In-Place Self-Apply

With Auto update on (Settings → General, the default), new releases download themselves quietly at launch. NovaX uses a robust in-place self-apply engine that updates your install directory without requiring manual installer wizards:

1. Two-Phase Verification: The downloaded release archive is strictly verified against the website manifest's byte count and SHA-256 hash ahead of unpacking. Any mismatch deletes the download immediately.
2. Atomic Rename-Aside: Active executables (NovaX.exe) and locked DLLs are renamed aside to *.old backups first (which Windows allows freely), freeing their destination paths.
3. In-Place Extraction: The new release files are extracted directly over %LOCALAPPDATA%\NovaX\. The temporary *.old files are purged automatically on the next boot.
4. Direct Restart: NovaX restarts directly into the new version. Your settings, tabs, scripts, and workspace in %AppData%\NovaX\ are completely preserved.

Loop-Breaker Guard: NovaX tracks update attempts with a stateful counter, preventing infinite reboot loops if network conditions or disk permissions interrupt an update.

Bootstrapper Fallback: If in-place self-apply is ever blocked, the archive remains safely staged in %LOCALAPPDATA%\NovaX\pending-update\ and the Bootstrapper applies it automatically on its next run. The launcher also self-updates silently via HMAC-signed channels.

Editor & Hub

Editor. Monaco 0.52 with the NovaX Dark theme, full virtual-workspace Luau IntelliSense across all open tabs (no saving to disk required), Project Real and Velocity standard library definitions, multi-tabs with session restore, quick open, autosave modes, editable keybinds, and a Check action that runs luau-lsp diagnostics over any script before it ever executes.

Script Hub & Cloud Scripts. Live search across ScriptBlox and RobloxScripts with filters, pagination, and a light cache. Key, Verified, Universal and Patched badges come straight from the providers. Favorites sync directly into Explorer as Cloud Scripts; Auto-Execute scripts run automatically on attach.

Looks. Nine one-click themes, shareable .theme.json files, image and video backgrounds, and a validated Custom Styles editor — see Custom CSS.

Luau LSP & API Definitions

NovaX V2.6.1 features an optimized Virtual Workspace Language Server (LSP) that analyzes your scripts live across all open tabs simultaneously. Unlike basic text areas, you never have to save a tab to a .lua or .luau file on disk just to get autocomplete, syntax error highlights, or type checking — every scratch tab is mirrored in-memory directly to luau-lsp.

Performance & Kernel Isolation: The server process runs bound to a Windows Win32 Job Object with JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, guaranteeing that no zombie processes linger when NovaX closes. Process scheduling is set to BelowNormal priority with adaptive debouncing (260ms for small scripts, 550ms for massive scripts), keeping Monaco silky smooth and Roblox stutter-free.

Project Real & Velocity Standard APIs

NovaX bundles comprehensive global Luau definitions matching the Project Real and Velocity executor standards. All functions include autocomplete signatures, parameter types, and inline documentation in Monaco:

Workspace & Panels

NovaX V2.6.1 revamps the workspace hierarchy, tab navigation, and output logging for professional scripting workflows:

• Modern Bottom Panels: Clean TitleCase tabs for Problems (live diagnostics count), Output (runtime execution logs with log levels and timestamps), and Console (script interactive console with search and auto-scroll). Active tabs feature an accent underline indicator matching the main editor.
• Steady Navigation: Re-clicking the active sidebar item, page, mini-tab, or editor tab maintains steady focus without flickering or re-running entry animations.
• Cloud Scripts & Local Scripts: Favorite any script from the Script Hub to save it instantly to your Cloud Scripts in Explorer. Local scripts on disk update automatically.
• Auto-Execute: Any script marked with the Auto-Execute flag runs automatically the moment any client attaches.
• Welcome Screen: A modern, non-distracting Start screen with quick action cards, recent file memory, and instant access to new tabs.

Clients & sessions

The Roblox tab has three sections:

• Clients downloads, launches and detects Roblox Player, Fishstrap, Bloxstrap and Froststrap, including per-user installs via AppData, Program Files and the registry. Locate install… is only for custom locations.
• Instances gives you a live view of detected Roblox processes.
• Sessions lists active backend sessions you can target or kill.

Custom CSS

A live stylesheet for the whole app. Open Settings → Customization → Custom Styles, paste your CSS, then hit Preview to validate and apply it instantly — no restart. Flip on Enable Custom Styles to keep it applied. If NovaX ever renders wrong, hit Safe Mode: it suspends the stylesheet without deleting a line of it.

What gets blocked

Validation runs before anything applies. Rejected up front:

• Script tags — no <script> and no closing </style>.
• expression() — blocked outright.
• Remote @import — no http imports; keep CSS local.
• Unbalanced braces — the error tells you the open / closed count.

Tokens

Override any of these inside :root:

Setting --nx-accent is enough in most cases: its hover, pressed, soft-glow and line variants are derived from it automatically, so one token recolors the whole accent family. Also fair game: --nx-warning, --nx-info, --nx-hover, --nx-active, --nx-border-soft, --nx-border-strong, --nx-r-sm and --nx-r-lg.

Examples

Paste any block into Custom Styles and hit Preview. Hover a block and hit Copy, or click inline code to copy it.

/* Cooler accent, rounder corners */
:root {
  --nx-accent: #5b9cff;
  --nx-r-md: 12px;
}

/* Accent glow on primary buttons */
.nx-btn.primary {
  box-shadow: 0 0 18px rgba(139, 124, 255, 0.45);
}

/* Hide the status bar entirely */
#statusbar {
  display: none;
}

/* Rounder icon buttons */
.icon-btn {
  border-radius: 10px;
}

/* Different accents for dark and light themes */
:root[data-theme="light"] {
  --nx-accent: #2f6fed;
}
:root[data-theme="dark"] {
  --nx-accent: #8b7cff;
}

/* Matching selection and scrollbars */
::selection {
  background: rgba(139, 124, 255, 0.35);
}
::-webkit-scrollbar-thumb {
  background: #3a3a47;
}

It is not applying — checklist

• Enable Custom Styles is off. Valid code that does nothing shows a Not applied hint in the app.
• Safe Mode is on. It suspends everything — hit Preview to re-apply.
• Validation failed. Read the badge: unbalanced braces is the usual suspect.
• Specificity. :root tokens always win; plain selectors may need to be more specific than the built-in rule.

Your stylesheet is stored alongside the rest of your settings, so it survives updates and reinstalls. While it is applied, body carries a custom-css-on class — scope rules under it if you ever need to.

Security & Runtime Protection

NovaX V2.6.1 features an enterprise defense-in-depth security architecture designed to shield the client application, internal processes, and distribution gateways against unauthorized tampering, inspection hooks, abusive requests, and automated exploits:

• Gateway & Cloud Shield: Intelligent sliding-window traffic filtering safeguarding distribution gateways and release downloads. Protects infrastructure against abusive automated spikes with adaptive rate regulation and automated temporary IP mitigation.
• Automated Protocol & Probe Defense: Real-time filtering of automated scanners and suspicious request patterns, combined with strict request sanitation preventing directory traversals and unauthorized endpoint probing.
• Dynamic Secret Management: Sensitive authentication tokens and HMAC handshakes are derived dynamically in memory at runtime without plaintext storage, preventing static signature extraction.
• Proactive Process Integrity Verification: Proprietary runtime handle validation that detects unauthorized foreign process attachment, memory dumpers, and active inspection engines attempting to hook NovaX subsystems.
• Hardened Binary Protection: Production builds undergo multi-layered symbol encryption, string virtualization, and metadata stripping, preventing reverse engineering and decompilation.
• Kernel Job Object Subsystem Binding: The internal language server is permanently bound to a Win32 Job Object with automatic termination limits, ensuring child helper processes are cleanly reclaimed whenever NovaX exits.
• Multi-Vector Runtime Protection: Continuous background integrity routines monitoring process execution context and isolating critical execution threads from unauthorized external tampering.
• Local Host Containment & Web Headers: The local UI host strictly normalizes filesystem paths within secure sandbox bounds, while distribution endpoints enforce enterprise Content Security Policy (CSP), HSTS, and strict origin controls.

Troubleshooting

Before reporting that it doesn't work, check your versions

• Look at the version chip in the app status bar. If it isn't the latest release from the changelog, updates normally arrive on their own — otherwise hit Download update in Settings → General, or re-run the Bootstrapper once as the universal fallback.
• Check your Roblox client version too: NovaX targets the current Roblox release (see the latest changelog entry), and an outdated client can't attach — update Roblox itself.
• Always report both versions (NovaX + Roblox) when asking for help — most "it doesn't work" cases are a version mismatch.

Windows flags or deletes the files

Expected. Re-extract (or re-run the Bootstrapper), then add the whole NovaX folder to Defender exclusions before launching. Real-time protection may quarantine on first run otherwise.

Inject does nothing / "No process found"

• Roblox must be running before you Inject.
• NovaX must run as administrator, so relaunch it elevated.
• With several clients open, attach covers all of them — check the Output panel for per-client results instead of a single yes/no.
• Check the Output panel and %LOCALAPPDATA%\NovaX\logs\quorum-errors.log for the exact backend error.

A client isn't detected

Stock, bootstrapper and custom folders plus the registry are all scanned, so per-user installs are normally found on their own. If yours is truly exotic, open the Clients tab, click Locate install… and point at it once. It's remembered.

A Hub script fails

Check its badges first. Patched means the provider reports it broken. Run Check in the editor and luau-lsp diagnostics will point at API the script needs.

Reference