cavet-install
Bootstrap skill. A cavet skill tried to run cavet and could not, or you were
asked to set cavet up. Your job is to get the binary installed with the
operator's explicit consent, then hand back to whichever skill triggered.
Do not run an install unasked, and do not treat a general "help me set up cavet"
as consent to pipe a remote script into a shell. cavet's argument is that
security actions are visible and confirmed rather than automatic, and the
install is the first one.
Sequence
- Diagnose. Run bare
cavet and read the failure; the table below maps the
usual failures to actions. If the binary answers at all, you were invoked by
mistake: say so and stop.
- Propose. Print the exact install command for the platform (below), what it
will do: download the release archive for the OS/arch from GitHub Releases,
verify it against the release
checksums.txt (and against the Sigstore
signature when cosign is on PATH), write one binary into ~/.local/bin
(macOS, Linux) or $HOME\.local\bin plus a user PATH entry (Windows).
Nothing else is written.
- Ask for an explicit yes, in that turn.
- Run only on a clear yes. On anything else, leave the command printed for
the operator and stop.
- Verify.
cavet describe --json must answer. Then cavet init in the
repository (offer --hooks for the advisory pre-commit hook); it scaffolds
.cavet/ and pulls the engine image, digest-pinned.
- Return to whichever skill originally triggered and resume it.
Diagnostics
| Symptom |
Cause |
Action |
cavet: command not found |
no binary |
offer the platform install command, confirm, run |
| daemon unreachable |
Docker not running |
ask the operator to start Docker, then cavet init |
no .cavet/ in the repo |
not initialised |
cavet init, --hooks for the advisory pre-commit hook |
| engine image absent |
first run |
cavet init pulls ghcr.io/chaoschild/cavet-engine, digest-pinned into .cavet/config.yaml |
| binary present but stale |
old install |
cavet update, --check to report only; it swaps at the real install location, so a Homebrew or Scoop copy is not left shadowing |
Install commands
# macOS / Linux, installs into ~/.local/bin
curl -fsSL https://raw.githubusercontent.com/ChaosChild/cavet/main/installers/binary.sh | bash
# Windows, two steps because a piped script cannot bind param()
irm https://raw.githubusercontent.com/ChaosChild/cavet/main/installers/binary.ps1 -OutFile binary.ps1
pwsh -NoProfile -File binary.ps1
Other channels (manual download, go install, Homebrew, Scoop) are in the repo
README; the two commands above are the ones the binary installers document.
1---2name: cavet-install3description: Install the cavet CLI when a cavet skill needs it and the binary is missing. Does nothing when cavet already works.4---56# cavet-install78Bootstrap skill. A cavet skill tried to run `cavet` and could not, or you were9asked to set cavet up. Your job is to get the binary installed with the10operator's explicit consent, then hand back to whichever skill triggered.1112Do not run an install unasked, and do not treat a general "help me set up cavet"13as consent to pipe a remote script into a shell. cavet's argument is that14security actions are visible and confirmed rather than automatic, and the15install is the first one.1617## Sequence18191. **Diagnose.** Run bare `cavet` and read the failure; the table below maps the20 usual failures to actions. If the binary answers at all, you were invoked by21 mistake: say so and stop.222. **Propose.** Print the exact install command for the platform (below), what it23 will do: download the release archive for the OS/arch from GitHub Releases,24 verify it against the release `checksums.txt` (and against the Sigstore25 signature when cosign is on PATH), write one binary into `~/.local/bin`26 (macOS, Linux) or `$HOME\.local\bin` plus a user `PATH` entry (Windows).27 Nothing else is written.283. **Ask** for an explicit yes, in that turn.294. **Run** only on a clear yes. On anything else, leave the command printed for30 the operator and stop.315. **Verify.** `cavet describe --json` must answer. Then `cavet init` in the32 repository (offer `--hooks` for the advisory pre-commit hook); it scaffolds33 `.cavet/` and pulls the engine image, digest-pinned.346. **Return** to whichever skill originally triggered and resume it.3536## Diagnostics3738| Symptom | Cause | Action |39|---|---|---|40| `cavet: command not found` | no binary | offer the platform install command, confirm, run |41| daemon unreachable | Docker not running | ask the operator to start Docker, then `cavet init` |42| no `.cavet/` in the repo | not initialised | `cavet init`, `--hooks` for the advisory pre-commit hook |43| engine image absent | first run | `cavet init` pulls `ghcr.io/chaoschild/cavet-engine`, digest-pinned into `.cavet/config.yaml` |44| binary present but stale | old install | `cavet update`, `--check` to report only; it swaps at the real install location, so a Homebrew or Scoop copy is not left shadowing |4546## Install commands4748```sh49# macOS / Linux, installs into ~/.local/bin50curl -fsSL https://raw.githubusercontent.com/ChaosChild/cavet/main/installers/binary.sh | bash51```5253```pwsh54# Windows, two steps because a piped script cannot bind param()55irm https://raw.githubusercontent.com/ChaosChild/cavet/main/installers/binary.ps1 -OutFile binary.ps156pwsh -NoProfile -File binary.ps157```5859Other channels (manual download, `go install`, Homebrew, Scoop) are in the repo60README; the two commands above are the ones the binary installers document.
ChaosChild