1. default to compiled agent installs on macos and linux

.github/workflows/build-binaries.yml

@@ -115,9 +115,13 @@ jobs:
           echo "Production: $publish_production ${production_version:+v${production_version}}"
           echo "Beta: $publish_beta ${beta_version:+v${beta_version}}"
 
+  standalone:
+    needs: release-context
+    uses: ./.github/workflows/standalone-binaries.yml
+
   build:
     runs-on: ubuntu-latest
-    needs: release-context
+    needs: [release-context, standalone]
     permissions:
       contents: read
     env:
@@ -148,6 +152,22 @@ jobs:
       - name: Check
         run: npm run check
 
+      - name: Download tested standalone archives
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          pattern: standalone-*
+          path: standalone-artifacts
+
+      - name: Verify and stage standalone binaries
+        run: |
+          for platform in darwin-arm64 darwin-x64 linux-arm64 linux-x64; do
+            source_dir="standalone-artifacts/standalone-$platform"
+            (cd "$source_dir" && sha256sum --check SHA256SUMS)
+            destination="packages/coding-agent/binaries/$platform"
+            mkdir -p "$destination"
+            tar -xzf "$source_dir"/*.tar.gz -C "$destination"
+          done
+
       - name: Pack production release
         if: env.PUBLISH_PRODUCTION == 'true'
         env:
@@ -158,6 +178,7 @@ jobs:
             --channel stable \
             --version "$PRODUCTION_VERSION" \
             --base-url "$PRIME_AGENT_DOWNLOAD_BASE_URL" \
+            --binary-dir packages/coding-agent/binaries \
             --out-dir packages/coding-agent/release/production
 
       - name: Pack beta release
@@ -170,6 +191,7 @@ jobs:
             --channel beta \
             --version "$BETA_VERSION" \
             --base-url "$PRIME_AGENT_DOWNLOAD_BASE_URL" \
+            --binary-dir packages/coding-agent/binaries \
             --out-dir packages/coding-agent/release/beta
 
       - name: Smoke test installer with npm 12
@@ -202,7 +224,9 @@ jobs:
           curl -fsS --retry 5 --retry-connrefused "$SMOKE_BASE_URL/releases/v$SMOKE_VERSION/SHA256SUMS"
           export NPM_CONFIG_PREFIX="$SMOKE_ROOT/npm-prefix"
           PATH="$NPM_CONFIG_PREFIX/bin:$PATH" \
+            PRIME_AGENT_ALLOW_INSECURE_HTTP_FOR_TESTS=1 \
             PRIME_AGENT_BOOTSTRAP_KERNEL_ON_INSTALL=0 \
+            PRIME_AGENT_INSTALL_METHOD=node \
             PRIME_AGENT_INSTALLER_PLAIN=1 \
             sh /tmp/prime-agent-npm12-install.sh "$SMOKE_VERSION"
           test -x "$NPM_CONFIG_PREFIX/bin/prime-agent"
@@ -301,7 +325,8 @@ jobs:
           test -n "$R2_BUCKET"
           test -n "$R2_ENDPOINT_URL"
 
-          for artifact in "$PRODUCTION_DIR"/*.tgz; do
+          (cd "$PRODUCTION_DIR" && sha256sum --check SHA256SUMS)
+          for artifact in "$PRODUCTION_DIR"/*.tgz "$PRODUCTION_DIR"/*.tar.gz; do
             aws s3 cp "$artifact" "s3://${R2_BUCKET}/${RELEASE_PREFIX}/$(basename "$artifact")" \
               --endpoint-url "$R2_ENDPOINT_URL" \
               --content-type application/gzip \
@@ -369,7 +394,8 @@ jobs:
           test -n "$R2_BUCKET"
           test -n "$R2_ENDPOINT_URL"
 
-          for artifact in "$BETA_DIR"/*.tgz; do
+          (cd "$BETA_DIR" && sha256sum --check SHA256SUMS)
+          for artifact in "$BETA_DIR"/*.tgz "$BETA_DIR"/*.tar.gz; do
             aws s3 cp "$artifact" "s3://${R2_BUCKET}/${RELEASE_PREFIX}/$(basename "$artifact")" \
               --endpoint-url "$R2_ENDPOINT_URL" \
               --content-type application/gzip \

.github/workflows/ci.yml

@@ -157,16 +157,23 @@ jobs:
           uv run --locked ruff format --check .
           uv run --locked python -m unittest discover -s tests -v
 
+  standalone:
+    needs: trust
+    if: needs.trust.outputs.allowed == 'true'
+    uses: ./.github/workflows/standalone-binaries.yml
+
   build-check-test:
     name: build-check-test
     if: always() && needs.trust.outputs.allowed == 'true'
-    needs: [trust, build-check, test]
+    needs: [trust, build-check, test, standalone]
     runs-on: ubuntu-latest
     steps:
       - name: Verify CI results
         env:
           BUILD_CHECK_RESULT: ${{ needs.build-check.result }}
           TEST_RESULT: ${{ needs.test.result }}
+          STANDALONE_RESULT: ${{ needs.standalone.result }}
         run: |
           test "$BUILD_CHECK_RESULT" = success
           test "$TEST_RESULT" = success
+          test "$STANDALONE_RESULT" = success

.github/workflows/standalone-binaries.yml

@@ -0,0 +1,82 @@
+name: Standalone binaries
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Standalone (${{ matrix.platform }})
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: darwin-arm64
+            runner: macos-15
+          - platform: darwin-x64
+            runner: macos-15-intel
+          - platform: linux-arm64
+            runner: ubuntu-24.04-arm
+          - platform: linux-x64
+            runner: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          path: source
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '22'
+          package-manager-cache: false
+
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: '1.4.0'
+          no-cache: true
+
+      - uses: astral-sh/setup-uv@94527f2e458b27549849d47d273a16bec83a01e9 # v7
+        with:
+          version: '0.11.7'
+          enable-cache: false
+
+      - name: Install native development dependencies
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
+
+      - name: Install locked npm dependencies
+        working-directory: source
+        run: npm ci
+
+      - name: Compile standalone application
+        working-directory: source/packages/coding-agent
+        run: npm run build:binary
+
+      - name: Assemble native archive
+        working-directory: source
+        run: |
+          version=$(node -p "require('./package.json').version")
+          node scripts/assemble-release-archives.mjs packages/coding-agent/binaries "$RUNNER_TEMP/standalone" "$version"
+          echo "PRIME_AGENT_TEST_ARCHIVE=$RUNNER_TEMP/standalone/prime-agent-$version-${{ matrix.platform }}.tar.gz" >> "$GITHUB_ENV"
+          echo "PRIME_AGENT_TEST_UV=$(command -v uv)" >> "$GITHUB_ENV"
+
+      - name: Remove the build paths from the test machine
+        run: mv "$GITHUB_WORKSPACE/source" "$RUNNER_TEMP/standalone-source"
+
+      - name: Test extracted application without JavaScript runtimes on PATH
+        working-directory: ${{ runner.temp }}/standalone-source/packages/coding-agent
+        run: npx tsx ../../node_modules/vitest/dist/cli.js --run test/compiled-artifact.test.ts test/native-installer.test.ts
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: standalone-${{ matrix.platform }}
+          path: |
+            ${{ runner.temp }}/standalone/*.tar.gz
+            ${{ runner.temp }}/standalone/SHA256SUMS
+          if-no-files-found: error

.gitignore

@@ -34,6 +34,7 @@ out.jsonl
 pi-*.html
 out.html
 packages/coding-agent/binaries/
+packages/coding-agent/release/
 todo.md
 plans/
 .prime/agent/

README.md

@@ -56,10 +56,10 @@ Prime Agent combines a persistent Python control environment with durable harnes
 Install the latest stable release on macOS or Linux:
 
 ```bash
-curl -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh
+curl --proto '=https' --proto-redir '=https' -fsSL https://app.primeintellect.ai/prime-agent/install.sh | sh
 ```
 
-The installer downloads a versioned release, verifies its SHA-256 checksum, installs the `prime-agent` command, and can prepare the Python runtime used by the agent.
+The installer requires HTTPS for release downloads, checks the selected archive against the release origin's SHA-256 inventory, installs the `prime-agent` command, and can prepare the Python runtime used by the agent. The checksum detects corruption or an inconsistent transfer; because the inventory and archive come from the same origin, HTTPS is the authenticity boundary.
 
 Start Prime Agent from the repository or directory you want it to work in: