One verified line.
The ks client is public, MIT-licensed, and contains no engine: it is a key to a building we operate.
Latest release v0.1.26, built by public CI with SHA256SUMS and build-provenance attestations.
One line (macOS, Linux)
works todaycurl -fsSL keepstate.ai/install.sh | shDownloads the ks binary for your OS and architecture from the public release and verifies its SHA256 against the release SHA256SUMS before installing. A checksum mismatch aborts with nothing installed; the sabotage leg of the release gate proves the refusal.
Homebrew (macOS, Linux)
works todaybrew install keepstateai/tap/ksThe tap formula pins the same release artifacts. Measured at 12 seconds to a runnable ks on the release gate’s macOS leg.
npm
works todaynpm install -g @keepstateai/cliA shim that downloads and verifies the same checksum-verified release binary on install. Published at 0.1.26, rendered from the registry itself; the row you are reading cannot say "published" unless the registry answered.
Verify before you trust
- Every release ships SHA256SUMS and GitHub build-provenance attestations; the installer checks the sum before installing, and
ks updatere-verifies before replacing itself. - The release gate's sabotage leg feeds the installer a tampered binary and passes only when the installer refuses it. The record: record
- Prefer to read the installer first? keepstate.ai/install.sh is the exact script the one-liner pipes, vendored verbatim from the client repository.
Then
ks loginksSign in is a browser device flow; no password passes through the CLI. Signup is instant and your first kill-and-resume is on us: $10.00 of credit, no card. Then ks on its own opens the app, where n starts your first agent; the quickstart goes step by step. Measured on the release gate's fresh VM: 3 seconds to install, 11 from install to a running session.
Removal is one line: ks uninstall tells you the one line that removes everything. The full verb table is in the CLI reference.