ActraDeck bootstrap CLI — verify-and-fetch a signed release, diagnose your machine, and hand off to quickstart. A thin, dependency-free wrapper; the full product ships as a signed GitHub Release + GHCR image.
Bootstrap CLI for ActraDeck — a local-first control plane for coding agents (Claude Code, Codex, …): observe them, redact secrets before they're stored, gate high-risk actions behind approvals, and keep a tamper-evident audit trail.
This package is a thin, dependency-free bootstrapper. It does not contain the product — the full four-tier stack ships as a signed GitHub Release and a signed GHCR image. The CLI helps you get to a running cockpit and verify what you download.
npm install/npx never changes your machine. Only the explicit
actradeck install fetches anything, and only after verifying it.install checks the release's sha256 checksum and its
SLSA build provenance before extracting a single file.npx actradeck@latest doctor # diagnose: platform / Node / pnpm / git / Docker (offline-safe)
npx actradeck@latest install # verify + fetch the latest signed release, then quickstart
npx actradeck@latest up # print the Docker cockpit command (prints only; runs nothing)
npx actradeck@latest version # your CLI version + whether a newer stable release exists
Not published yet. The first npm publish is planned for v0.5 (see the project's ADR 0013). Until then the commands above describe the intended flow; the canonical, already-signed way to get ActraDeck is the GitHub Release / GHCR image or
scripts/install.shfrom the repo.
installResolves the latest stable GitHub Release (or --version vX.Y.Z), downloads the source
tarball + checksums.txt, verifies the sha256 digest (Node crypto) and the build
provenance (gh attestation verify), then extracts and hands off to the repo's own
scripts/quickstart.
npx actradeck@latest install --version v0.4.0 # a specific tag
npx actradeck@latest install --dry-run # resolve + verify only; change nothing
npx actradeck@latest install --skip-provenance # explicit opt-out (checksum still enforced)
Verification is fail-closed and never silently skipped: the checksum is always enforced,
and provenance is verified unless you pass --skip-provenance (which requires you to accept
the reduced guarantee). --skip-provenance exists only for machines that cannot install the
GitHub CLI.
| Variable | Default | Meaning |
|---|---|---|
ACTRADECK_REPO | actradeck/actradeck | owner/name (or git URL) to resolve releases from |
ACTRADECK_INSTALL_DIR | ~/actradeck | where install extracts the verified source |
FAQs
ActraDeck CLI — preview, install, and verify a local approval and audit cockpit for Claude Code and Codex.
The npm package actradeck receives a total of 23 weekly downloads. As such, actradeck popularity was classified as not popular.
We found that actradeck demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
Security News
It has been one year since Shai-Hulud made its first appearance on npm.
Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.