mirror of https://github.com/hanzoai/cli.git synced 2026-10-30 15:00:27 +00:00

Files

T

zeekay 7cdb9907bd npm: ship the CLI as @hanzo/cli

The CLI was GitHub-releases only. @hanzo/dev and @hanzo/mcp install with npm and
this did not, so "install the Hanzo tools" meant two different motions and the
sandbox image had to special-case one of them.

A DOWNLOADER, not five platform packages. @hanzo/dev uses optionalDependencies;
here the release matrix already publishes hanzo-<platform>.tar.gz, so pointing at
those means one artifact, built once. Five npm packages would be a second copy of
the same bytes under a second set of version numbers, and copies drift — that is
how a `latest` ends up serving last week's binary for one platform only.

VERIFIED against the .sha256 the release publishes beside each asset. This script
runs on every npm install and the thing it fetches is then executed: an
unverified download is arbitrary code execution on every machine that installs
us.

The publish job `needs: build`, which is the point. The postinstall fetches
assets for its own version, so publishing before they exist ships a package whose
install 404s. v1.9.41 is exactly that shape from the other side — four targets
uploaded, linux-amd64 did not, and the release read green while the only binary
our own amd64 cluster runs was missing.

The tag sets the version, not the file. package.json carrying a different number
is how a release publishes bytes under a version nobody built.

2026-08-06 20:35:52 -07:00

694 B

Raw Permalink Blame History

@hanzo/cli

The Hanzo CLI — manage Hanzo AI cloud resources from your terminal.

npm i -g @hanzo/cli
hanzo --help

postinstall downloads the binary for your platform from the GitHub release matching this package's version, and verifies it against the .sha256 published beside it. If you install with --ignore-scripts, run node node_modules/@hanzo/cli/install.js yourself — the wrapper will tell you so rather than failing with a confusing error.

Prebuilt for macOS (arm64, x64), Linux (arm64, x64) and Windows (x64). On any other platform the install is skipped with a warning rather than failing.

The binary is Rust and lives at https://github.com/hanzoai/cli.

694 B Raw Permalink Blame History

@hanzo/cli

694 B

Raw Permalink Blame History