@aryaminus/controlkeel

@aryaminus/controlkeel

This package is a bootstrap installer for the native ControlKeel CLI.

The npm and GitHub Packages channels use the same bootstrap package when published. The native binary is downloaded from the matching versioned GitHub Release on first use, not during installation.

Install

npm i -g @aryaminus/controlkeel
# or: pnpm add -g @aryaminus/controlkeel
# or: yarn global add @aryaminus/controlkeel

# one-off run
npx @aryaminus/controlkeel@latest

The package installs the controlkeel command. The native binary is automatically downloaded on first use.

Companion package names used by supported host install paths:

• @aryaminus/controlkeel-opencode for OpenCode plugin installs
• @aryaminus/controlkeel-pi-extension for Pi extension installs

Main project docs:

• Repository README
• Getting started
• Agent integrations
• Support matrix

After the first run, complete the repo-local path with controlkeel setup, controlkeel attach <host>, controlkeel attach doctor, controlkeel provider doctor, controlkeel status, and controlkeel findings.

You can also install the same bootstrap package from GitHub Packages:

echo "@aryaminus:registry=https://npm.pkg.github.com" >> ~/.npmrc
echo "//npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN_WITH_READ_PACKAGES" >> ~/.npmrc
npm i -g @aryaminus/controlkeel --registry=https://npm.pkg.github.com

Security

This package uses a lazy download model for maximum security:

• No install scripts (removed postinstall)
• Fixed release repository and package version; environment flags cannot redirect the download source
• Plain GitHub Release URLs for transparent scanner and reviewer visibility
• SHA-256 checksum verification for all downloads

The native binary is downloaded on first use rather than during installation. For detailed information about security practices, see SECURITY.md.

For manual installation, download the matching binary and checksum from GitHub Releases. Release bundles or manifests may support local plugin installation, but they do not imply publication in a host's public marketplace.