Releases and signature verification

Install

curl -fsSL https://agi-labo.com/wings/install.sh | sh

The installer checks the signatures of the CLI and release information before installing. It uses the public key included in the installer. It also checks the latest version against information published by the Console over HTTPS. Windows is not supported.

This command trusts the HTTPS site that delivers the installer and its public key. It does not verify the installer's own signature before running it. Use the next procedure if you want to verify that signature first.

With curl | sh, a failed download is not reported to sh. However, a truncated download does not start the installation unless it reaches the final function call.

Verify the installer first (advanced)

Download a specific version and its signature. This procedure runs the installer only after verification with the pinned public key succeeds.

(
  set -eu
  tmp_dir=$(mktemp -d)
  trap 'rm -rf "$tmp_dir"' 0 HUP INT TERM
  curl -fsSLo "$tmp_dir/install.sh" https://releases.agi-labo.com/wings/v1.4.16/install.sh
  curl -fsSLo "$tmp_dir/install.sh.sshsig" https://releases.agi-labo.com/wings/v1.4.16/install.sh.sshsig
  printf '%s\n' 'agi-wings-release ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0F1UbSUyGSbSD6+Gb1TKPiWgokOw5fFW7bmdWaTdro' > "$tmp_dir/allowed-signers"
  ssh-keygen -Y verify -f "$tmp_dir/allowed-signers" -I agi-wings-release -n agi-wings-release -s "$tmp_dir/install.sh.sshsig" < "$tmp_dir/install.sh"
  sh "$tmp_dir/install.sh"
)

Update

wings update --check
wings update
wings version

Normal updates verify the signed latest-version information, file manifest, checksums, and binary. The signature on the latest-version information has a short expiry. If the CLI has no local update record yet, it also checks the Console's current-release information over HTTPS. A failed check leaves the installed CLI unchanged.

Choose a specific version

wings update --base-url https://releases.agi-labo.com/wings/vX.Y.Z

Specify --base-url explicitly to choose a version. The update command ignores AGI_WINGS_INSTALL_BASE_URL and AGI_WINGS_CURRENT_RELEASE_URL.

Ordinary downgrades are refused. The normal update process can roll back only with a short-lived, signed authorization from the operator.

macOS notarization and Gatekeeper acceptance are not guaranteed. If the OS blocks execution, check the signature verification result and contact support. Do not bypass the warning without checking it.

Uninstall

wings logout
wings skill uninstall --target all
rm "$HOME/.agi-tools/bin/wings"

If server-side sign-out fails, follow the instructions shown. Uninstalling does not remove cloud resources such as Handlers. Delete that data separately.