ActraDeck bootstrap CLI — verify-and-fetch a signed release, diagnose your machine, and hand off to quickstart. A thin, dependency-free wrapper; the full product ships as a signed GitHub Release + GHCR image.
Bootstrap CLI for ActraDeck — a local-first control plane for coding agents (Claude Code, Codex, …): observe them, redact secrets before they're stored, gate high-risk actions behind approvals, and keep a tamper-evident audit trail.
This package is a thin, dependency-free bootstrapper. It does not contain the product — the full four-tier stack ships as a signed GitHub Release and a signed GHCR image. The CLI helps you get to a running cockpit and verify what you download.
npm install/npx never changes your machine. Only the explicit
actradeck install fetches anything, and only after verifying it.install checks the release's sha256 checksum and its
SLSA build provenance before extracting a single file.npx actradeck@latest doctor # diagnose: platform / Node / pnpm / git / Docker (offline-safe)
npx actradeck@latest install # verify + fetch the latest signed release, then quickstart
npx actradeck@latest up # print the Docker cockpit command (prints only; runs nothing)
npx actradeck@latest version # your CLI version + whether a newer stable release exists
Not published yet. The first npm publish is planned for v0.5 (see the project's ADR 0013). Until then the commands above describe the intended flow; the canonical, already-signed way to get ActraDeck is the GitHub Release / GHCR image or
scripts/install.shfrom the repo.
installResolves the latest stable GitHub Release (or --version vX.Y.Z), downloads the source
tarball + checksums.txt, verifies the sha256 digest (Node crypto) and the build
provenance (gh attestation verify), then extracts and hands off to the repo's own
scripts/quickstart.
npx actradeck@latest install --version v0.4.0 # a specific tag
npx actradeck@latest install --dry-run # resolve + verify only; change nothing
npx actradeck@latest install --skip-provenance # explicit opt-out (checksum still enforced)
Verification is fail-closed and never silently skipped: the checksum is always enforced,
and provenance is verified unless you pass --skip-provenance (which requires you to accept
the reduced guarantee). --skip-provenance exists only for machines that cannot install the
GitHub CLI.
| Variable | Default | Meaning |
|---|---|---|
ACTRADECK_REPO | actradeck/actradeck | owner/name (or git URL) to resolve releases from |
ACTRADECK_INSTALL_DIR | ~/actradeck | where install extracts the verified source |
FAQs
ActraDeck CLI — preview, install, and verify a local approval and audit cockpit for Claude Code and Codex.
The npm package actradeck receives a total of 11 weekly downloads. As such, actradeck popularity was classified as not popular.
We found that actradeck demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.
Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.