codaid CLI

codaid is one binary with two jobs: a command-line client for your Kodwen account (chat, sessions, schedules, Resolve, keys, usage) and the daemon that turns a machine into a bring-your-own environment.

InstallCopy Anchor Link

curl -fsSL https://codai.ro/install-codaid.sh | sh

Both installers download the build for your system from the GitHub release. From release 0.5.0 on they first verify the release's SHA256SUMS against its signature SHA256SUMS.sig (ECDSA P-256, with the release key pinned in the installer — the same key is printed below), then check the build against that SHA256SUMS, all before installing anything. They fail closed: a missing or bad signature on a signed release, no published checksum, no SHA-256 tool, or a hash mismatch stops with an error and leaves nothing behind. Releases older than 0.5.0 predate signing and install with signature: none (release predates signing); set CODAID_REQUIRE_SIGNATURE=1 to refuse every unsigned release. When the GitHub CLI (gh) is installed they also check the build provenance; set CODAID_REQUIRE_ATTESTATION=1 to make that check mandatory.

The same scripts are attached to every release as install.sh and install.ps1.

Package managersCopy Anchor Link

From release 0.5.0 on, codaid is also published to:

Each package pins the SHA-256 of the same release asset listed in the release's signed SHA256SUMS, so the package manager refuses a file that differs from what was published.

macOSCopy Anchor Link

macOS builds (Apple silicon and Intel) are produced by the release workflow's macos-14 jobs. If a release has no darwin asset yet, the installer stops with a download error.

The binaries are not notarised yet. curl … | sh downloads with curl, which sets no com.apple.quarantine attribute, so Gatekeeper does not block the installed binary. A binary downloaded with a browser does get that attribute and is refused on first run; verify its checksum (below), then clear it:

xattr -d com.apple.quarantine ./codaid-darwin-aarch64

Verify a download by handCopy Anchor Link

Every release from 0.5.0 carries SHA256SUMS, SHA256SUMS.sig (ECDSA P-256 / SHA-256, DER) and SHA256SUMS.minisig (minisign). Save this public key as codaid-release-p256.pub.pem:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEkIw8+FrhXZ3E7Adus8DLbMEfqI12
yFPKFCsrQ2GB9bY4SOH8g2yMSkFvFud15ZZxxBaIs29PmPa3dFrijb/z3A==
-----END PUBLIC KEY-----

Then, in the folder with the downloaded assets:

openssl dgst -sha256 -verify codaid-release-p256.pub.pem -signature SHA256SUMS.sig SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS      # macOS: shasum -a 256 -c --ignore-missing SHA256SUMS

Verified OK from openssl means SHA256SUMS is the file we signed; OK from sha256sum means your download matches it. With minisign instead of openssl (key id BF3FB6DE209BA938):

minisign -Vm SHA256SUMS -P RWQ4qZsg3rY/vyrIP7UWfRJT7HAaHRNqXsXvecXksZcMlk/vL9sbAAdi

On Windows, compare the hash with PowerShell and run the openssl line from Git Bash or WSL (install.ps1 checks the signature itself):

$sum = (Select-String -Path SHA256SUMS -Pattern 'codaid-0.5.0-x86_64-pc-windows-msvc.zip').Line.Split(' ')[0]
(Get-FileHash .\codaid-0.5.0-x86_64-pc-windows-msvc.zip -Algorithm SHA256).Hash.ToLower() -eq $sum

gh attestation verify <file> --repo codai-ro/codaid additionally checks GitHub's build provenance. For the desktop app's files, see verify downloads.

Sign inCopy Anchor Link

codaid login        # device-code sign-in in the browser; stores a codai_ key
codaid whoami       # the account the stored key belongs to
codaid logout       # forget the stored key (revoke it in the hub to invalidate it)

login opens auth.codai.ro/device with the code filled in. On a server without a browser, open that address on any device and type the code shown in the terminal. Set CODAI_API_KEY=codai_… instead to skip the sign-in (CI, fleets).

UpdateCopy Anchor Link

codaid update                    # newest release; asks before replacing the binary
codaid update --check            # only report whether a newer release exists
codaid update --version 0.5.0    # this exact release (also re-installs or downgrades)
codaid update --yes              # no confirmation prompt

codaid update downloads the build for your system from the GitHub release and trusts it only after three checks, stopping at the first failure: the release's SHA256SUMS must carry a valid SHA256SUMS.sig from the release key compiled into codaid (an unsigned release is refused), the downloaded binary must match its line in SHA256SUMS, and the new binary must report the expected version from --version. Only then does it replace the running binary in one atomic rename (on Windows the old one is kept as codaid.exe.old). If the binary's folder is not writable it tells you how to rerun (sudo codaid update on Linux/macOS). On Linux, when a systemd unit for codaid exists, it reminds you to restart it (sudo systemctl restart codaid or systemctl --user restart codaid); the running daemon keeps the old version until then.

--check prints update available or up to date and always exits 0, so read its output, not its exit code.

codaid never updates itself. codaid version prints a one-line notice on stderr (codaid X.Y.Z is available - run `codaid update` ) when a newer release exists, and codaid status reports it in its JSON as update ({"latest": "…", "available": true|false}, or null when unknown). The check runs at most once a day with a 3-second timeout and is cached in ~/.codai/update-check.json; it is off when CODAID_NO_UPDATE_CHECK=1 or CI is set.

Re-running the installer still works too: it replaces the binary with the latest release (or the pinned VERSION). On Windows, stop a running codaid run first: an open codaid.exe cannot be replaced.

Everyday commandsCopy Anchor Link

Every command has --help. To run the machine as an environment, continue with install on your own server.