Skip to main content
This page describes the direction Genie’s distribution is moving toward, anchored by the aegis-distribution-sovereignty umbrella merged in PR #1425. Some of the install paths described below ship in 2026-Q2/Q3 — see the per-component status notes.

​
The threat we’re closing

In April 2026, the @automagik/genie npm package was weaponized as part of the CanisterWorm/TeamPCP compromise. The detection-and-response runbook ships through the same npm pipe that carried the malicious payload. As long as Genie is acquired through npm install -g @automagik/genie, three structural exposures remain:
  1. No cosign enforcement at install time. npm verifies a tarball checksum but knows nothing about Sigstore certificates. A compromised publish token bypasses every cryptographic control upstream of npm.
  2. Arbitrary postinstall scripts in transitive deps. A single compromised dependency anywhere in the resolved tree runs arbitrary code on the operator’s machine before Genie’s own code executes.
  3. Threat-intel cadence locked to npm publish. The signature packs Genie uses to detect new IOCs are tied to whatever release rhythm npm allows. Worms propagate in hours; signature updates need to arrive in minutes.
This page documents how Genie sidesteps all three.

​
The new install path

This single line is the canonical install. Internally it:
  1. Detects your platform (uname -s / uname -m, with Rosetta 2 awareness on Apple Silicon and libc detection on Linux). Mirrors Claude Code’s bootstrap pattern.
  2. Downloads the platform-appropriate static binary from cdn.automagik.dev/genie/<channel>/<version>/<platform>/genie. The binary is a single file produced by bun build --compile — no Node, no npm, no transitive dep tree.
  3. Verifies SHA256, cosign, and SLSA L3 provenance. Three independent gates. Tamper at any layer fails the install with a clear exit code.
  4. Hands off to the binary’s own install subcommand to wire shell integration, install completions, and create ~/.genie/.
Operators on networks that block cdn.automagik.dev can fall back to the GitHub Releases mirror — same artifacts, same signatures, different transport.

Linux x86_64

glibc + musl, both supported.

Linux ARM64

Native ARM64 binary, glibc.

macOS x86_64

Intel Macs.

macOS ARM64

Apple Silicon, with Rosetta detection so the right binary is picked even when running under emulation.
Native Windows is not yet on the matrix — WSL2 with the Linux x86_64 binary works today; native Windows distribution is a v2 deliverable.

​
The verification stack

Each release publishes: install.sh bundles tiny static portable verifiers (sigstore-rs + slsa-verifier, ≤2 MB each) so an operator with no preinstalled cryptographic tooling can still run the full chain. The verifiers are themselves cosign-signed by the same OIDC identity, with their SHA256 inlined in install.sh to defeat verifier-substitution attacks. The cosign certificate identity is pinned across four independent channels. Cross-check before you run.

​
What about npm?

@automagik/genie on npm is being soft-deprecated, not yanked. Existing operators on npm install -g @automagik/genie continue to work — but the package contents shrink to a ≤50-LOC postinstall.js shim that:
  1. Detects the platform (mirroring install.sh’s logic).
  2. Downloads install.sh from the CDN, verifying an inlined SHA256.
  3. Runs bash install.sh with platform pre-set.
  4. Prints a loud deprecation banner pointing at the canonical install path and the sunset date.
The shim’s own postinstall is what enforces the trust chain — even an operator who never updates their muscle memory ends up with a cosign-verified binary on disk. After the sunset window (90 days post-v1 GA), the npm package is npm deprecate-flagged with a stronger message; existing pinned versions continue to install via the shim, but the package itself is no longer the recommended path. We do not unpublish. Forensic tooling and dependency graphs benefit from the package’s continued existence; the shim’s loudness handles the rest.

​
What this does NOT solve (yet)

Distribution sovereignty closes the acquisition exposure. Three larger exposures remain in flight:
  • Build-time supply chain. Genie itself is built from bun install. A compromised dependency in our build environment defeats every downstream control. Tracked under a separate future umbrella (genie-build-sovereignty); not in scope here.
  • Runtime privilege boundary. Once Genie runs, it has full host permissions. The Aegis runtime sandbox (in flight) adds default-deny network egress and continuous workspace scanning. v1 is observe-only; v2 graduates to kernel-level enforcement.
  • Content inspection at the prompt boundary. Prompt-injection / PII / data-leak detection lives in our enterprise tier (@khal-os), not in the OSS distribution covered by this page.
The CanisterWorm response covers what to do if the current boundary is breached: see /genie/incident-response/canisterworm.

​
Status

The umbrella DESIGN.md sits at .genie/brainstorms/aegis-distribution-sovereignty/DESIGN.md on the genie repo.