1. default to compiled agent installs on macos and linux

[kevinjosethomas]

This is part of the PR stack migrating us to use Bun to compile Prime Agent for releases. This makes supported installations self-contained, removing the need to download and install Node.js and npm packages separately.

This PR changes the installer to use the compiled version by default, so new users on supported Macs and Linux machines get the self-contained Prime Agent. The installer checks the download and confirms it runs before making it active. Machines that can't run it automatically use the existing Node.js installation.

Tested fresh installs and failed or interrupted downloads across Debian 12, Ubuntu 18.04/20.04/22.04/24.04, and Alpine 3.24. CI also tested compiled packages on macOS 15 and Ubuntu 24.04, on x64 and ARM64. Actual macOS 13/14 execution remains untested.

ENG-6027 · Stack: #2140 → #2165 → #2166. Ship all three together.

---

Note

High Risk
This changes the default install and release distribution path for all supported macOS/Linux users, including download security rules and managed filesystem state, so regressions affect production installs directly.

Overview
Adds standalone release archives for four platforms and wires them through CI and the release pipeline. A new reusable workflow compiles with Bun, assembles tarballs, tests the extracted app without Node/npm/Bun on PATH, and uploads artifacts; CI and Release Prime Agent now depend on that job and pack/publish the verified archives alongside existing npm tarballs.

install.sh now defaults to a managed native install on macOS 13+ and glibc Linux (arm64/x64): HTTPS-only downloads (strict curl proto rules), checksum validation, safe archive extraction, executable probe, serialized .install-lock, and bin/previous rollback. It falls back to the Node/npm path in auto when the release is npm-only or the binary cannot run; binary mode does not fall back. Native installs can run prime-agent --prime-agent-bootstrap to prepare Python/tools.

Supporting changes include refactored build:binary scripts, release packing via --binary-dir, kernel runtime resolution for the flat executable layout, docs/README HTTPS install lines, and broad installer/artifact tests.

^{Reviewed by Cursor Bugbot for commit ccbc3c9. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Default install.sh to compiled agent installs on macOS and Linux

• install.sh now defaults to compiled prime-agent binaries on macOS 13+ and Linux glibc 2.17+, falling back to the Node installer only in auto mode.
• Added build scripts and CI workflows to compile, package, and test four standalone platform archives (darwin-arm64, darwin-x64, linux-arm64, linux-x64).
• Installer release downloads now enforce HTTPS for base URLs and redirects, with a narrowly scoped loopback exception for local tests.
• Added --prime-agent-bootstrap CLI command to prepare the Python kernel and tools; the kernel now checks the prime-agent-runtime sidecar first.
• Risk: install.sh in binary mode now exits when a native platform is not available, instead of falling back to Node.

^{Macroscope summarized ccbc3c9.}

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[github-actions]

Prime Agent performance — completed

PR ccbc3c91 compared with main a329e744.

Overall: 1 regressed · 4 improved · 12 no clear change.

Metric	Main	This PR	Change
Cold startup	2,849.6 ms	1,388.3 ms	$\textcolor{#428a5d}{\textsf{↓ -1,461.4 ms (-51.28\%)}}$
Warm startup	1,655.8 ms	836.8 ms	$\textcolor{#43895e}{\textsf{↓ -819.0 ms (-49.46\%)}}$
Installation	24.48 s	12.65 s	$\textcolor{#44895e}{\textsf{↓ -11.83 s (-48.32\%)}}$
Compressed release artifacts	11.18 MB	69.92 MB	$\textcolor{#e5484d}{\textsf{↑ +58.74 MB (+525.68\%)}}$
Installed footprint	597.76 MB	571.90 MB	$\textcolor{#63826c}{\textsf{↓ -25.86 MB (-4.33\%)}}$
Idle memory, summed RSS	1,041.66 MB	1,137.54 MB	≈ +95.88 MB (+9.20%)

Python runtime

Metric	Main	This PR	Change
Python kernel startup	123.1 ms	121.8 ms	≈ -1.3 ms (-1.08%)
Python cell round trip	0.504 ms	0.536 ms	≈ +0.032 ms (+6.42%)
Empty bash command	10.9 ms	10.7 ms	≈ -0.1 ms (-1.20%)
Bash git status	15.8 ms	15.4 ms	≈ -0.4 ms (-2.59%)
Bash 32 KiB output	11.2 ms	10.9 ms	≈ -0.3 ms (-2.34%)
35 cells / 9 shell calls	158.1 ms	155.4 ms	≈ -2.6 ms (-1.65%)
Python interrupt to done	1.508 ms	1.468 ms	≈ -0.040 ms (-2.67%)
Python state snapshot	25.2 ms	25.3 ms	≈ +0.053 ms (+0.21%)
Python state restore	364.1 ms	357.7 ms	≈ -6.4 ms (-1.76%)
Python idle RSS	36.51 MB	34.60 MB	≈ -1.91 MB (-5.23%)
Python RSS after pandas workload	98.58 MB	96.80 MB	≈ -1.78 MB (-1.81%)

Sandbox cost: ~$0.0775 — no inference calls.
Run, logs, and downloadable raw results

Methodology and samples

Main resolved at 2026-09-12T07:18:31.982017+00:00. Harness a329e744.
Linux x64, 4 vCPU, 8 GB RAM, 20 GB disk; region us.
Image: node:24-bookworm@sha256:be23f54a88d34e8824c741b19b91064094f92c1c97b194144bfc8b50d67258e2.
Stock tools, skills, daemon, and Python bootstrap enabled; fresh homes and a fixed Git fixture.
Onboarding is dismissed; the editor starts without a selected model or submitted prompt.
Medians shown. Arrows require a 20% timing/memory change plus absolute floors and IQR.
These practical noise floors are not a statistical significance test.
Cold means stopped Prime processes; OS filesystem caches are not flushed.
No model requests or credentials. Installation excludes build/setup time.
Installer tarballs use loopback; npm/Python downloads use the network with fresh caches.
Artifact size counts release tarballs; footprint after first use includes registry packages.
MB is decimal. Summed RSS can double-count shared pages; PSS is recorded when available.
Provisioning, setup, and build durations are recorded separately in the raw results.
Kernel probes use the installed JSONL runtime, outside the TUI/TypeScript host.
Per trial: 50 Python cells, 5 calls per shell case, and one 35-cell mix (9 git status calls).
Cell/shell values are batch means; other runtime timings are single operations.
State fixture: a 10,000-row × 8-column integer DataFrame and a 10,000-integer list.
Restore runs in a fresh kernel, including pandas imports; kernel startup is excluded.
Kernel RSS covers the isolated Python process; loaded RSS follows the pandas workload.
Costs estimate full sandbox lifetimes at configured rates, including setup and build.
Budget target: $1; not a billing cap. Checks are informational.

Metric	Main successful/attempted	PR successful/attempted	Main spread	PR spread
Cold startup	10/10	10/10	IQR 112.3 ms	IQR 93.1 ms
Warm startup	10/10	10/10	IQR 73.6 ms	IQR 34.2 ms
Installation	3/3	3/3	range 0.04 s	range 0.16 s
Compressed release artifacts	1/1	1/1	—	—
Installed footprint	1/1	1/1	—	—
Idle memory, summed RSS	10/10	10/10	IQR 22.84 MB	IQR 97.49 MB
Python kernel startup	10/10	10/10	IQR 9.4 ms	IQR 6.1 ms
Python cell round trip	10/10	10/10	IQR 0.054 ms	IQR 0.063 ms
Empty bash command	10/10	10/10	IQR 0.5 ms	IQR 0.7 ms
Bash git status	10/10	10/10	IQR 0.9 ms	IQR 1.6 ms
Bash 32 KiB output	10/10	10/10	IQR 0.5 ms	IQR 1.1 ms
35 cells / 9 shell calls	10/10	10/10	IQR 8.9 ms	IQR 16.9 ms
Python interrupt to done	10/10	10/10	IQR 0.147 ms	IQR 0.229 ms
Python state snapshot	10/10	10/10	IQR 1.7 ms	IQR 3.5 ms
Python state restore	10/10	10/10	IQR 44.4 ms	IQR 13.9 ms
Python idle RSS	10/10	10/10	IQR 3.39 MB	IQR 1.76 MB
Python RSS after pandas workload	10/10	10/10	IQR 3.44 MB	IQR 2.18 MB

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Stale Bugbot comment from a previous run.

[snimu]

darwin release binaries: A user who follows the new browser-download + manual-extract flow gets the binary killed by Gatekeeper on Apple Silicon — the darwin artifacts are unsigned and not notarized, and the browser download leaves the quarantine xattr in place. The curl-installer path keeps working only because it strips/avoids quarantine. The failure therefore appears exactly where the docs now send users who will not use the installer. Please sign + notarize the darwin artifacts; until then, remove the manual-download instructions from the docs and document only the installer path.

[written by prime-agent, checked by snimu]

[snimu]

checksum verification: Anyone who controls the download origin — or a MITM on an accepted http:// base URL — ships arbitrary code that passes a perfectly valid checksum: verification is same-origin SHA-256 only, there is no signature or pinning, and the pre-activation probe executes the downloaded binary. The docs calling these downloads 'verified' overstates what the check proves. #2166's update path already does dual-source verification (manifest checksum vs SHA256SUMS); aligning the install path to that standard, plus rejecting http:// base URLs, would close most of the gap.

[written by prime-agent, checked by snimu]

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit d91fc7f. Configure here.}

[fettpl]

The first beta produced from the merged commit has a separate failure from Gatekeeper quarantine: the published darwin-arm64 Mach-O has an invalid embedded ad-hoc signature and is killed even when executed from a local temp directory.

Verified on Apple Silicon, macOS 27.0 (26A428), using beta 0.9.4-beta.675.1.dd760d3:

• archive SHA-256 is f290be7e1e26eb319c8b9b96506669885f8c124238a10c329caeb0c5855d938c, matching beta.json;
• extracted prime-agent --version exits 137;
• codesign --verify --deep --strict --verbose=4 prime-agent reports invalid signature (code or signature have been modified) for arm64;
• copying the executable and applying a fresh ad-hoc signature makes strict verification pass, after which --version prints 0.9.4-beta.675.1.dd760d3 and --help exits 0.

This means the macOS auto installer falls back to Node and forced binary/browser-archive use fails before Gatekeeper notarization is considered. @kevinjosethomas, please add strict codesign verification against the final archived artifact and publish a valid final signature before promoting this path to stable. The evidence establishes signature invalidity after publication; it does not yet isolate which build or archive step changed the signed bytes.

[kevinjosethomas]

@fettpl thanks for reporting, nice to see people testing nightly! I'll get this fixed soon, sorry about the inconvenience!