feat(install): standalone curl/irm one-liner installers#45
Merged
MasonStation merged 2 commits intomainfrom Apr 27, 2026
Merged
feat(install): standalone curl/irm one-liner installers#45MasonStation merged 2 commits intomainfrom
MasonStation merged 2 commits intomainfrom
Conversation
Adds scripts/install.sh and scripts/install.ps1 so users can install
phantom directly from a release artifact, without depending on
`bun add -g phantom-secrets` / `npm i -g phantom-secrets`.
Why this matters:
- The npm wrapper (npm/bin/cli.js) lazy-downloads on first run, so a
"successful" `npm i -g` still leaves the binary uninstalled until
`phantom` is invoked. That makes downstream tools (e.g. Stack)
unable to reliably detect or use phantom right after install.
- Bun-on-Windows in particular doesn't reliably materialize the
`phantom`/`phantom-secrets` shims from the npm package's `bin`
field, so even a clean `bun add -g phantom-secrets` exit-0 leaves
`~\.bun\bin` containing only `bun.exe`.
- The npm registry currently lags behind GitHub Releases (npm latest:
0.4.0; GitHub Releases latest: 0.5.1). Curl/irm hits the GitHub
release directly so users always get the latest.
What the installers do:
- Resolve latest release tag via `api.github.com/.../releases/latest`
(or honor `$PHANTOM_TAG` to pin a version)
- Download `phantom-<target>.{tar.gz|zip}` and the `.sha256` sidecar
- Verify SHA-256 (refuses to install on mismatch or missing sidecar)
- Extract to `~/.phantom-secrets/bin` (or `$PHANTOM_INSTALL_DIR`)
- install.sh: idempotently appends to the user's shell rc
(zsh/bash/fish) with a `# phantom-secrets PATH` marker so re-runs
are no-ops
- install.ps1: writes User-scope PATH via `SetEnvironmentVariable`,
also injects into `$env:Path` for the current session, and runs
`Unblock-File` on extracted binaries to clear MOTW for SmartScreen
Suggested next step (out of scope here): host these at
`https://phm.dev/install.{sh,ps1}` so users can run:
curl -fsSL https://phm.dev/install.sh | bash
irm https://phm.dev/install.ps1 | iex
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Mirrors scripts/install.{sh,ps1} into apps/web/public/ so they're
reachable as https://phm.dev/install.sh and https://phm.dev/install.ps1
once apps/web deploys to main.
Next.js 15 serves public/* as static assets at site root by default;
no rewrites or headers customization needed. curl/iex don't care about
Content-Type, so the default works for pipe-to-shell consumers.
This unblocks the matching ashlr-stack change that calls these URLs
to install Phantom (ashlr-stack#2).
Note: scripts/ and apps/web/public/ are now duplicate copies. A
future commit should either symlink one into the other or wire a
prebuild copy step in apps/web/package.json.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Contributor
Author
|
Added a follow-up commit (3e1d237) mirroring the installers into
This is what unblocks the matching ashlr-stack#2 change (which calls these URLs at install time). Suggested merge order:
Heads up: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
scripts/install.shandscripts/install.ps1so users can installphantomdirectly from a GitHub release, without depending onbun add -g phantom-secrets/npm i -g phantom-secrets.Why
Three real problems with the npm-wrapper-only path, surfaced while debugging a fresh-Windows-machine install of
ashlr-stack(which depends on phantom):Lazy download.
npm/bin/cli.jsonly downloads the real Rust binary on first invocation. So a successfulnpm i -g phantom-secretsleavesphantomuninstalled until someone actually runs it. Tools that detect-and-use phantom right after install (e.g. Stack's installer) can't rely on it.Bun-on-Windows shim non-generation. Verified by reproducing on a clean Win11 machine:
bun add -g phantom-secretsexits 0 and reports "installed phantom-secrets@0.4.0 with binaries: phantom, phantom-secrets" — but~\.bun\bin\afterwards contains onlybun.exe. The shims from the package'sbinfield never get written. Sophantomisn't on PATH even after a "successful" install.Registry/GitHub version skew. npm latest:
0.4.0. GitHub Releases latest:v0.5.1. Users onbun add -g phantom-secretsare getting an older release than people running curl one-liners. Worth publishing 0.5.1 to npm separately, but a direct-from-releases path keeps users current regardless.What the installers do
$PHANTOM_TAG)phantom-<target>.{tar.gz|zip}+ the.sha256sidecar~/.phantom-secrets/bin(or$PHANTOM_INSTALL_DIR)# phantom-secrets PATHmarker so re-runs are no-ops. Same helper pattern Stack uses.[Environment]::SetEnvironmentVariable, also injects into$env:Pathfor the current session sophantom --helpworks without opening a new shell. CallsUnblock-Fileon the extracted*.exeto clear MOTW before first run.Suggested follow-up (not in this PR)
https://phm.dev/install.{sh,ps1}so users can runcurl -fsSL https://phm.dev/install.sh | bash/irm https://phm.dev/install.ps1 | iex(matches Stack's pattern). Either an Astro/Cloudflare deploy of these files, or a redirect from the marketing site.An Application Control policy has blocked this fileon at least one Win11 install — hit during installer testing. Both v0.5.0 and v0.5.1 are unsigned, so it's not signing; likely Smart App Control reputation. Worth looking at from the build/release side.binfield shims not generating under bun on Windows is upstream — should be reported to oven-sh/bun.Test plan
scripts/install.shon a fresh Linux box, verifyphantom --helpworks in a new shellscripts/install.ps1on a fresh Windows VM with no prior phantom install — verify the binary runs in the same session via$env:Pathinjection# phantom-secrets PATHmarker prevents duplicate rc entriesPHANTOM_TAG=v0.4.0 ./scripts/install.sh(pin to older release)🤖 Generated with Claude Code