@gizai/cli 2.0.1 → 2.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Giz Systems Inc. and the Gizlang contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,184 +1,15 @@
-# Giz CLI
+# @gizai/cli
 
-The official command-line interface for [giz.ai](https://www.giz.ai). Run Giz text, image, video and audio models, manage Drive files, tables, Apps and Computers, and connect Claude Code, Codex and other AI agents to your Giz account, all from a terminal.
+GizStack 0.1.0-preview.20261022.1 from npm: a native language, web server and database in one stack. TypeScript syntax; PostgreSQL, Redis and S3 protocols. Docs: https://gizstack.com/docs/start
 
-[Documentation](https://www.giz.ai/mcp/) · [giz.ai](https://www.giz.ai) · [Sign up](https://www.giz.ai)
-
-## Install
-
-Requires Node.js 20.12 or later and a [giz.ai](https://www.giz.ai) account.
-
-```bash
+```sh
 npm install -g @gizai/cli
-giz --version
-```
-
-Update later with `giz update` (or `npm install -g @gizai/cli`).
-
-## Quick start
-
-```bash
-giz auth login                                   # opens your browser, one-time sign-in
-giz chat gpt-6-luna "Say hello in Korean"        # chat with a text model
-giz generate image "A paper observatory at blue hour"
-giz credits                                      # check your balance
-giz --help                                       # every command
-```
-
-## Run any model
-
-Discover a model's live inputs, upload local files, and run it:
-
-```bash
-giz model list --type video-generation
-giz model get ltx2-distilled
-giz model run ltx2-distilled \
-  --input '{"prompt":"A slow camera push through morning fog"}' \
-  --upload image=./first-frame.png
+npx @gizai/cli --version
+bunx @gizai/cli --version
 ```
 
-Media jobs run independently. Track them with `giz job get JOB` or block with `giz job wait JOB` (exit status 1 if the job failed or was cancelled). Add `--json` to any command for machine-readable output on stdout; progress goes to stderr.
-
-## Use Giz from Claude Code, Codex and other agents
-
-Register the Giz MCP server with your agent (install the client first):
-
-```bash
-giz auth login
-giz mcp add claude
-giz mcp add codex
-giz mcp check --json        # verifies the MCP handshake and lists tool names
-```
-
-This registers `giz mcp serve` over stdio. It forwards Giz's live MCP protocol and shares the CLI's credentials, so no token is copied into the client's configuration. For clients that run their own OAuth session, use `giz mcp add claude --transport http` (then sign in with `/mcp`) or `giz mcp add codex --transport http`. The remote endpoint is `https://www.giz.ai/api/mcp`; it supports OAuth discovery and scoped API keys.
-
-Install the Giz agent skill with `giz skill install`. The package root is also an [Agent Plugins](https://agent-plugins.org) 1.0 plugin (`plugin.json`, the `giz` skill and `mcp.json`), so a client that installs plugins gets the skill and the MCP server together.
-
-## Drive, Computers and Apps
-
-```bash
-giz drive ls
-giz drive read /notes/todo.md
-giz computer list
-giz computer exec --deadline-ms 120000 -- ls -la    # up to 15 minutes; the remote exit code is preserved
-giz app list
-```
-
-App changes are explicit: pass the `revision` shown by `giz app list` as `--expected-revision REVISION` to `run`, `publish` and `delete`, and as `expectedRevision` in the `--input` of `create` and `save` (use 0 for a new App). A concurrent change is rejected by the server instead of being overwritten.
-
-Free Computers have a runtime limit; check your plan before starting long workflows. Signing in does not extend that runtime.
-
-### Inside a Giz Computer
-
-`giz` is already installed in every Giz Computer, and no login is needed: the Computer signs in as itself and can reach only its own Drive, model discovery and inference, and jobs it started. API keys, billing, organization administration, destructive operations and external writes need a separate user sign-in with `giz auth login`. `giz auth status` shows who you are.
-
-## Plugins
-
-```bash
-giz plugin search QUERY [--origin skill|mcp]
-giz plugin install ID --query QUERY
-giz plugin list
-giz connection list       # connected apps
-```
-
-Also available: `plugin inspect`, `update`, `remove`, `enable`, `disable`, `publish` and `unpublish`.
-
-## Authentication and security
-
-- `giz auth login` uses browser OAuth with a loopback callback; the CLI never sees or stores your password.
-- Credentials are stored as JSON in `~/.config/giz/credentials.json` with mode `0600` (owner only), written atomically. `GIZ_CONFIG` overrides the path. `giz auth logout` revokes the token and removes the file.
-- `giz auth status --json` shows the granted scopes; a missing scope error names the permission it needs. After updating from 1.0.1, sign in again to grant `giz.inference`.
-- Create a scoped API key with `giz api-key create "My app"` (the secret is shown once). Set `GIZ_TOKEN` only for short-lived automation.
-- An OAuth access token copied by hand expires after one hour. Prefer `giz mcp add`, which refreshes it for you.
-
-## Configuration
-
-| Variable | Purpose |
-| --- | --- |
-| `GIZ_TOKEN` | Use this API key or token instead of the stored login |
-| `GIZ_CONFIG` | Path of the credentials file |
-| `GIZ_NO_UPDATE_CHECK=1` | Turn off the update notice (or set `updates.mode` to `off` in `credentials.json`) |
-
-The update check is cached for up to 24 hours and prints only in interactive terminals.
-
-## Upgrading from 1.x
-
-Version 2.0 removes `giz capability` with no alias. Skills, MCP servers and Agents now install as one plugin.
-
-| 1.x | 2.0 |
-| --- | --- |
-| `giz capability list` | `giz connection list` (connected apps), `giz plugin list` (installed plugins) |
-| `giz capability search skill\|mcp QUERY` | `giz plugin search QUERY [--origin skill\|mcp]` |
-| `giz capability install skill\|mcp ID --query QUERY` | `giz plugin install ID --query QUERY` |
-| `giz capability update\|remove ID` | `giz plugin update\|remove NAME` |
-
-New in 2.0: `plugin inspect`, `install --path`, `enable`, `disable`, `publish` and `unpublish`. A Giz server that supports plugins reports 2.0.0 as its minimum CLI, so 1.x prints an update warning there.
-
-## Command reference
-
-Generated from the CLI dispatcher and the Giz tool descriptors.
-
-<!-- cli-surface:start -->
-| Command | Tool ID | MCP tool | Required input | Scope | Agent discovery |
-| --- | --- | --- | --- | --- | --- |
-| model list | model.list | model_list | - | giz.read | model.list |
-| model get | model.get | model_get | model | giz.read | model.get |
-| model run | model.run | model_run | model, input | giz.inference | model.run |
-| generate image | generateImage | generateImage | prompt | giz.write | generateImage |
-| generate video | generateVideo | generateVideo | prompt | giz.write | generateVideo |
-| generate music | generateMusic | generateMusic | prompt | giz.write | generateMusic |
-| generate talking-head | generateTalkingHead | generateTalkingHead | prompt, references | giz.write | generateTalkingHead |
-| generate audio | generateAudio | generateAudio | purpose | giz.write | generateAudio |
-| job list | job.list | job_list | - | giz.read | server job |
-| job get | job.get | job_get | job | giz.read | server job |
-| job wait | job.get | job_get | job | giz.read | server job |
-| job cancel | job.cancel | job_cancel | job | giz.destructive | server job |
-| credits | account.credits | account_credits | - | giz.read | account.credits |
-| drive ls | drive.list | drive_list | - | giz.read | drive.list |
-| drive list | drive.list | drive_list | - | giz.read | drive.list |
-| drive search | drive.search | drive_search | query | giz.read | drive.search |
-| drive read | drive.readFile | drive_readFile | path | giz.read | drive.readFile |
-| drive write | drive.writeFile | drive_writeFile | path, content | giz.write | drive.writeFile |
-| drive mkdir | drive.makeDirectory | drive_makeDirectory | path | giz.write | drive.makeDirectory |
-| drive move | drive.movePath | drive_movePath | from, to | giz.write | drive.movePath |
-| drive delete | drive.deletePath | drive_deletePath | path | giz.destructive | drive.deletePath |
-| table list | workspace.objects | workspace_objects | - | giz.read | workspace.objects |
-| table get | workspace.objects | workspace_objects | - | giz.read | workspace.objects |
-| table read | table.readRows | table_readRows | table | giz.read | table.readRows |
-| table write | table.writeRows | table_writeRows | table | giz.write | table.writeRows |
-| table action | workspace.executeAction | workspace_executeAction | view, action | giz.execute | workspace.executeAction |
-| computer list | computer.list | computer_list | - | giz.read | computer.list |
-| computer get | computer.get | computer_get | - | giz.read | external only |
-| computer start | computer.start | computer_start | - | giz.execute | external only |
-| computer stop | computer.stop | computer_stop | - | giz.destructive | external only |
-| computer exec | computer.exec | giz_computer_exec | - | giz.execute | computer.exec |
-| app list | app.list | app_list | - | giz.read | app.list |
-| app create | app.save | app_save | id, expectedRevision | giz.execute | app.save |
-| app save | app.save | app_save | id, expectedRevision | giz.execute | app.save |
-| app run | app.run | app_run | id, expectedRevision | giz.execute | app.run |
-| app publish | app.publish | app_publish | id, expectedRevision, visibility | giz.write | app.publish |
-| app open | app.open | app_open | id | giz.read | app.open |
-| app delete | app.delete | app_delete | id, expectedRevision | giz.destructive | app.delete |
-| plugin list | plugin.catalog | plugin_catalog | - | giz.read | plugin.catalog |
-| plugin search | plugin.catalog | plugin_catalog | - | giz.read | plugin.catalog |
-| plugin inspect | plugin.catalog | plugin_catalog | - | giz.read | plugin.catalog |
-| plugin install | plugin.install | plugin_install | - | giz.execute | plugin.install |
-| plugin update | plugin.manage | plugin_manage | operation | giz.destructive | plugin.manage |
-| plugin enable | plugin.manage | plugin_manage | operation | giz.destructive | plugin.manage |
-| plugin disable | plugin.manage | plugin_manage | operation | giz.destructive | plugin.manage |
-| plugin remove | plugin.manage | plugin_manage | operation | giz.destructive | plugin.manage |
-| plugin publish | plugin.manage | plugin_manage | operation | giz.destructive | plugin.manage |
-| plugin unpublish | plugin.manage | plugin_manage | operation | giz.destructive | plugin.manage |
-| connection list | capability.status | capability_status | - | giz.read | capability.status |
-| agent start | agent.start | agent_start | agentId, prompt | giz.execute | external only |
-| agent status | agent.status | agent_status | turnId | giz.read | agent.status |
-| agent cancel | agent.cancel | agent_cancel | turnId | giz.execute | agent.cancel |
-<!-- cli-surface:end -->
-
-## Support
-
-Questions and bug reports: [support@giz.ai](mailto:support@giz.ai) or the Support Forum at [giz.ai](https://www.giz.ai).
-
-## License
+One package serves every platform and runs no install script. The first run installs GizStack into `~/.giz`
+(`GIZ_INSTALL`): `bin/install.sh` finds your platform, downloads its installer from the content address
+written in the script, checks its SHA-256, and the installer checks the release signature and every file.
 
-Proprietary. Copyright Giz Inc. All rights reserved. Use of the service is governed by the [Terms of Use](https://www.giz.ai/terms-of-use).
+GizStack is open source under the MIT license: https://github.com/gizai/gizlang

package/bin/giz.js

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+// The npm entry of GizStack 0.1.0-preview.20261022.1 (generated by tools/distribution/channels).
+// The giz.ai commands (auth api-key credits model models chat generate job drive table upload computer app connection plugin agent invoke mcp skill engine update __update-check), help and --version run the command line binary of this platform's package
+// (@gizai/cli-OS-CPU, an optional dependency), which needs no toolchain: giz.ai CLI 2.0's users keep working right after
+// `npm install`. Every other command needs the toolchain: the first such run installs this version with install.sh, which
+// finds the platform, downloads its installer from the content address, checks the SHA-256 against the table in this
+// package, and runs it; the installer checks the release signature and every file. Then each run executes the installed
+// giz, which selects the version (a project pin or the active one).
+"use strict";
+const { spawnSync } = require("child_process");
+const fs = require("fs");
+const os = require("os");
+const path = require("path");
+
+const VERSION = "0.1.0-preview.20261022.1";
+const ACCOUNT = new Set("auth api-key credits model models chat generate job drive table upload computer app connection plugin agent invoke mcp skill engine update __update-check".split(" ").filter(Boolean));
+// 2.0's flags that take no value: the command is the first word that is not a flag or a flag's value.
+const BOOLEANS = new Set(["help", "json", "no-open", "version", "device"]);
+
+function fail(message) {
+	process.stderr.write("giz: " + message + "\n");
+	process.exit(1);
+}
+function commandOf(argv) {
+	for (let i = 0; i < argv.length; i += 1) {
+		const word = argv[i];
+		if (word === "--") return argv[i + 1] || "";
+		if (!word.startsWith("--")) return word;
+		const name = word.slice(2).split("=")[0];
+		if (!word.includes("=") && !BOOLEANS.has(name) && argv[i + 1] && !argv[i + 1].startsWith("--")) i += 1;
+	}
+	return "";
+}
+// The package manager that installed this package, for `giz update`.
+function installer() {
+	const at = __dirname.toLowerCase();
+	if (at.includes(path.sep + ".pnpm" + path.sep) || /[\\/]pnpm[\\/]global[\\/]/.test(at)) return "pnpm";
+	if (at.includes(path.sep + ".bun" + path.sep)) return "bun";
+	if (at.includes(path.sep + ".yarn" + path.sep) || at.includes(path.sep + "yarn" + path.sep + "global" + path.sep)) return "yarn";
+	return "npm";
+}
+function bundled() {
+	const system = { linux: "linux", darwin: "darwin", win32: "win32" }[process.platform];
+	const cpu = { x64: "x64", arm64: "arm64" }[process.arch];
+	if (!system || !cpu || ACCOUNT.size === 0) return undefined;
+	try {
+		const file = path.join(path.dirname(require.resolve("@gizai/cli-" + system + "-" + cpu + "/package.json")), "bin", "giz" + (system === "win32" ? ".exe" : ""));
+		return fs.existsSync(file) ? file : undefined;
+	} catch { return undefined; }
+}
+function run(file, standalone) {
+	const env = { ...process.env, GIZ_INSTALLER: installer(), GIZ_SELF: process.argv[1],
+		GIZ_SKILLS: path.join(__dirname, "..", "skills") };
+	if (standalone) env.GIZ_STANDALONE = "1";
+	const ran = spawnSync(file, process.argv.slice(2), { stdio: "inherit", env });
+	if (ran.error) fail(ran.error.message);
+	if (ran.signal) process.kill(process.pid, ran.signal);
+	process.exit(ran.status === null ? 1 : ran.status);
+}
+
+const argv = process.argv.slice(2);
+const command = commandOf(argv);
+const own = bundled();
+if (process.platform === "win32") {
+	if (!own) fail("the Windows binary package was not installed; reinstall without --omit=optional");
+	run(own, true);
+}
+if (own && (ACCOUNT.has(command) || argv.length === 0 || command === "help" || command === "-h" || (command === "" && (argv.includes("--version") || argv.includes("--help"))))) {
+	run(own, true);
+}
+const root = process.env.GIZ_INSTALL || path.join(os.homedir(), ".giz");
+const bin = path.join(root, "bin", "giz");
+const installed = spawnSync("sh", [path.join(__dirname, "install.sh"), ..."".split(" ").filter(Boolean), "--if-missing", "--no-modify-path", "--version", VERSION],
+	{ stdio: ["inherit", process.stderr, "inherit"], env: { ...process.env, GIZ_INSTALL: root } });
+if (installed.error) fail("cannot run sh: " + installed.error.message + ". Supported platforms: https://gizstack.com/download");
+if (installed.status !== 0) process.exit(installed.status === null ? 1 : installed.status);
+run(bin, false);

package/bin/install.sh

@@ -0,0 +1,261 @@
+#!/bin/sh
+# Install GizStack: curl -fsSL https://gizstack.com/install | sh
+# Install the GizDB server alone: curl -fsSL https://gizstack.com/install | sh -s -- --only gizdb
+# While gizstack.com is in private preview, the command on your signed-in page adds
+# -H "Authorization: Bearer TOKEN": the script served for it carries that access token
+# and stores it in ~/.config/gizstack/access-token, where the installer and
+# `giz upgrade` read it.
+#
+# This script downloads the official installer for your platform from its
+# content address, checks its SHA-256 against that address and runs it. The
+# installer verifies the release signature and every file hash before it
+# activates the version. Nothing needs root. Docs: https://gizstack.com/docs/start
+#
+# Options (sh -s -- OPTION...):
+#   --only gizdb           install only the GizDB server (bin/gizdb): the same
+#                          signed release, without the compiler, into ~/.gizdb
+#   --version VERSION      install this published version (default: the newest)
+#   --no-modify-path       do not add the bin directory to shell profiles
+#   --installer FILE       use this downloaded installer (the npm and Homebrew
+#                          packages carry it); its SHA-256 is checked the same way
+#   --if-missing           do nothing when this version is installed already
+#                          (the package wrappers run it before each command)
+# Environment: GIZ_INSTALL (default ~/.giz; with --only gizdb,
+#   GIZDB_INSTALL, default ~/.gizdb), NO_MODIFY_PATH=1.
+#
+# Everything runs inside main(), called on the last line, so a download that
+# is cut off does nothing.
+
+set -u
+
+SITE="https://gizstack.com"
+# The access token this script was served for (the server writes it here), or empty.
+ACCESS=''
+
+# Published installers: product (toolchain, or gizdb for the server alone),
+# target, version, installer SHA-256.
+# Generated from $SITE/api/releases when this script was served.
+releases() {
+	cat <<'RELEASES'
+toolchain x86_64-unknown-linux-gnu 0.1.0-preview.20261022.1 e628a629819b7e9a4f965ca8038ec5d364644ee3c526316be2a577c5d300b506
+gizdb x86_64-unknown-linux-gnu 0.1.0-preview.20261015.5 cc102bb96abcbe04a98dbc697595310e28b7d997a716f979258ff2afaf4620c6
+RELEASES
+}
+
+say() { printf '%s\n' "$*"; }
+fail() { printf 'giz-install: %s\n' "$*" >&2; exit 1; }
+
+detect_target() {
+	os=$(uname -s)
+	arch=$(uname -m)
+	case "$arch" in
+		x86_64 | amd64) arch=x86_64 ;;
+		aarch64 | arm64) arch=aarch64 ;;
+		*) fail "unsupported CPU architecture: $arch. Supported platforms: $SITE/download" ;;
+	esac
+	case "$os" in
+		Linux)
+			libc=gnu
+			if ls /lib/ld-musl-* >/dev/null 2>&1 || (ldd --version 2>&1 | grep -qi musl); then libc=musl; fi
+			target="$arch-unknown-linux-$libc" ;;
+		Darwin)
+			# A shell under Rosetta reports x86_64 on Apple Silicon.
+			if [ "$arch" = x86_64 ] && [ "$(sysctl -n sysctl.proc_translated 2>/dev/null)" = 1 ]; then arch=aarch64; fi
+			target="$arch-apple-darwin" ;;
+		MINGW* | MSYS* | CYGWIN* | Windows_NT)
+			fail "on Windows, run in PowerShell: irm $SITE/install.ps1 | iex" ;;
+		*) fail "unsupported operating system: $os. Supported platforms: $SITE/download" ;;
+	esac
+}
+
+# Sets digest and version from the table, or explains what exists.
+select_release() {
+	digest=""
+	[ -n "$(releases)" ] || fail "no GizStack release supports this install script yet. Download an installer: $SITE/download"
+	found=$(releases | while read -r p t v d; do
+		if [ "$p" = "$product" ] && [ "$t" = "$target" ] && { [ -z "$wanted" ] || [ "$v" = "$wanted" ]; }; then say "$v $d"; break; fi
+	done)
+	if [ -n "$found" ]; then version=${found% *}; digest=${found#* }; return; fi
+	available=$(releases | while read -r p t v d; do if [ "$p" = "$product" ] && [ "$t" = "$target" ]; then printf ' %s' "$v"; fi; done)
+	if [ -n "$available" ]; then fail "$name $wanted is not published for $target. Published:$available"; fi
+	platforms=$(releases | while read -r p t v d; do if [ "$p" = "$product" ]; then printf '\n  %s' "$t"; fi; done)
+	[ -n "$platforms" ] || fail "no $name release supports this install script yet. Release status: $SITE/download"
+	fail "no $name release for $target yet. Published platforms:$platforms
+Use the browser Playground meanwhile: $SITE/play. Release status: $SITE/download"
+}
+
+download() { # URL FILE
+	if command -v curl >/dev/null 2>&1; then
+		if [ -n "$KEY" ]; then curl --proto '=https' --tlsv1.2 -fsSL --retry 3 -H "Authorization: Bearer $KEY" -o "$2" "$1"
+		else curl --proto '=https' --tlsv1.2 -fsSL --retry 3 -o "$2" "$1"; fi
+	elif command -v wget >/dev/null 2>&1; then
+		if [ -n "$KEY" ]; then wget --https-only -q --header="Authorization: Bearer $KEY" -O "$2" "$1"
+		else wget --https-only -q -O "$2" "$1"; fi
+	else
+		fail "curl or wget is required"
+	fi
+}
+
+sha256() {
+	if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d ' ' -f 1
+	elif command -v shasum >/dev/null 2>&1; then shasum -a 256 "$1" | cut -d ' ' -f 1
+	elif command -v openssl >/dev/null 2>&1; then openssl dgst -sha256 -r "$1" | cut -d ' ' -f 1
+	else fail "sha256sum, shasum or openssl is required to check the installer"
+	fi
+}
+
+add_line() { # FILE LINE: append LINE once
+	if [ -f "$1" ] && grep -qxF "$2" "$1"; then return; fi
+	printf '\n%s\n' "$2" >>"$1" && changed="$changed $1"
+}
+
+# One line in each profile sources $root/env, which adds bin to PATH once.
+modify_path() {
+	bin="$root/bin"
+	cat >"$root/env" <<ENV
+# Added by the $name installer.
+case ":\${PATH}:" in *":$bin:"*) ;; *) export PATH="$bin:\$PATH" ;; esac
+ENV
+	cat >"$root/env.fish" <<ENV
+# Added by the $name installer.
+if not contains -- "$bin" \$PATH; set -gx PATH "$bin" \$PATH; end
+ENV
+	line=". \"$root/env\""
+	zshrc="${ZDOTDIR:-$HOME}/.zshrc"
+	for profile in "$HOME/.profile" "$HOME/.bashrc" "$HOME/.bash_profile" "$zshrc"; do
+		case "$profile" in
+			"$HOME/.bash_profile") [ -f "$profile" ] || continue ;;
+			"$zshrc") [ -f "$profile" ] || command -v zsh >/dev/null 2>&1 || continue ;;
+		esac
+		add_line "$profile" "$line"
+	done
+	if command -v fish >/dev/null 2>&1 || [ -d "$HOME/.config/fish" ]; then
+		mkdir -p "$HOME/.config/fish/conf.d"
+		fishline="source \"$root/env.fish\""
+		fishrc="$HOME/.config/fish/conf.d/$command.fish"
+		add_line "$fishrc" "$fishline"
+	fi
+}
+
+# The installer, `giz upgrade` and package reads send this token to gizstack.com.
+store_access() {
+	[ -n "$ACCESS" ] || return 0
+	config="${XDG_CONFIG_HOME:-$HOME/.config}/gizstack"
+	(umask 077 && mkdir -p "$config" && printf '%s\n' "$ACCESS" >"$config/access-token.new" && mv "$config/access-token.new" "$config/access-token") || fail "cannot store the access token in $config"
+}
+
+# A script not served with a key (npm, or a rerun) takes the key the way access.giz does: GIZ_ACCESS_TOKEN, else the
+# file. Only the downloads below use it, and only from $SITE. A value outside the token alphabet is refused whole, as
+# access.giz refuses it, so a bad value is never sent.
+resolve_access() {
+	KEY=$ACCESS
+	if [ -z "$KEY" ]; then KEY=$(printf '%s' "${GIZ_ACCESS_TOKEN:-}" | tr -d ' \t\r\n'); fi
+	if [ -z "$KEY" ] && [ -n "${HOME:-}" ]; then
+		KEY=$(tr -d ' \t\r\n' 2>/dev/null <"${XDG_CONFIG_HOME:-$HOME/.config}/gizstack/access-token")
+	fi
+	case "$KEY" in *[!0-9a-z_]*) KEY='' ;; esac
+}
+
+main() {
+	wanted=""
+	local_installer=""
+	if_missing=0
+	product=toolchain
+	path_changes=1
+	if [ -n "${NO_MODIFY_PATH:-}" ]; then path_changes=0; fi
+	while [ $# -gt 0 ]; do
+		case "$1" in
+			--only) [ $# -ge 2 ] || fail "--only needs a value"; [ "$2" = gizdb ] || fail "--only takes gizdb (the GizDB server alone), not $2"; product=gizdb; shift 2 ;;
+			--version) [ $# -ge 2 ] || fail "--version needs a value"; wanted=$2; shift 2 ;;
+			--no-modify-path) path_changes=0; shift ;;
+			--if-missing) if_missing=1; shift ;;
+			--installer) [ $# -ge 2 ] || fail "--installer needs a value"; local_installer=$2; shift 2 ;;
+			-h | --help) say "Usage: curl -fsSL $SITE/install | sh -s -- [--only gizdb] [--version VERSION] [--no-modify-path]"; say "Docs: $SITE/docs/start"; exit 0 ;;
+			*) fail "unknown option: $1 (see $SITE/docs/start)" ;;
+		esac
+	done
+	# The GizDB server alone is its own installation, beside a toolchain's, never inside it.
+	if [ "$product" = gizdb ]; then
+		name=GizDB; command=gizdb; variable=GIZDB_INSTALL; root="${GIZDB_INSTALL:-}"; home=.gizdb
+	else
+		name=GizStack; command=giz; variable=GIZ_INSTALL; root="${GIZ_INSTALL:-}"; home=.giz
+	fi
+	if [ -z "$root" ]; then
+		[ -n "${HOME:-}" ] || fail "HOME is not set; set $variable to the installation directory"
+		root="$HOME/$home"
+		# An install from before the command was gizstack (~/.gizlang) is upgraded in place: the installer then removes
+		# its gizlang command, and no second command stays on PATH.
+		if [ "$product" != gizdb ] && [ ! -e "$root" ] && [ -f "$HOME/.gizlang/active-toolchain" ]; then root="$HOME/.gizlang"; fi
+	fi
+	if [ "$wanted" = latest ]; then wanted=""; fi
+	case "$root" in
+		/*) ;;
+		*) fail "$variable must be an absolute path: $root" ;;
+	esac
+	case "$root" in
+		*[\"\$\`\\]*) fail "$variable cannot contain quotes, \$, backquotes or backslashes: $root" ;;
+	esac
+
+	detect_target
+	select_release
+	if [ "$if_missing" = 1 ]; then
+		for installed in "$root/versions/$product-$target-$version-"*; do
+			if [ -f "$installed/release.json" ]; then exit 0; fi
+		done
+	fi
+
+	work=$(mktemp -d 2>/dev/null || mktemp -d -t giz) || fail "cannot create a temporary directory"
+	trap 'rm -rf "$work"' EXIT
+	installer="$work/$command-installer"
+	if [ -n "$local_installer" ]; then
+		cp "$local_installer" "$installer" || fail "cannot read the installer $local_installer"
+	else
+		say "Downloading the $name $version installer for $target"
+		resolve_access
+		if ! download "$SITE/objects/sha256/$digest" "$installer"; then
+			[ -n "$KEY" ] || fail "the installer download was refused: $name is in private preview. Signed in at $SITE, your install command on $SITE/download carries your access key (or set GIZ_ACCESS_TOKEN). No invitation yet: $SITE/access-request"
+			fail "the installer download failed: $SITE/objects/sha256/$digest"
+		fi
+	fi
+	actual=$(sha256 "$installer")
+	[ "$actual" = "$digest" ] || fail "the installer SHA-256 is $actual, not $digest; nothing was installed"
+	chmod u+x "$installer"
+	# A copy that came through a browser or an archive tool carries the macOS
+	# quarantine attribute, and Gatekeeper then refuses the ad-hoc signed program.
+	# The SHA-256 check above replaces what the attribute would have asked the user to trust.
+	if [ "$os" = Darwin ] && command -v xattr >/dev/null 2>&1; then xattr -d com.apple.quarantine "$installer" 2>/dev/null || :; fi
+
+	store_access
+	mkdir -p "$root" || fail "cannot create $root"
+	"$installer" --root "$root" || fail "the installer failed; the previous version, if any, stays active"
+
+	changed=""
+	if [ "$path_changes" = 1 ]; then modify_path; fi
+	say ""
+	if [ "$product" = gizdb ]; then
+		# gizdb has no --version; its usage proves the installed server runs here.
+		"$root/bin/gizdb" --help >/dev/null || fail "$root/bin/gizdb does not run on this computer"
+		say "GizDB $version for $target is installed: $root/bin/gizdb"
+	else
+		"$root/bin/giz" --version || fail "$root/bin/giz does not run on this computer"
+	fi
+	say ""
+	if [ -n "$changed" ]; then
+		say "Added $root/bin to PATH in:$changed"
+		say "Open a new terminal, or run:  . \"$root/env\""
+	elif [ "$path_changes" = 1 ]; then
+		say "$root/bin is already on PATH in your shell profiles."
+	else
+		say "Add $root/bin to PATH to run $command."
+	fi
+	say ""
+	if [ "$product" = gizdb ]; then
+		say "Next:  GIZDB_PASSWORD=... gizdb serve --dir ~/gizdb-data --port 5432"
+		say "Docs:  $SITE/docs/operations/gizdb-server (systemd unit, backups, upgrades)"
+	else
+		say "Next:  giz init hello && cd hello && giz run main.giz"
+		say "Docs:  $SITE/docs/start"
+	fi
+}
+
+main "$@"

package/package.json

@@ -1,58 +1,28 @@
 {
   "name": "@gizai/cli",
-  "version": "2.0.1",
-  "description": "The official command-line interface for giz.ai: run AI models, Drive, Computers and Apps, and connect Claude Code, Codex and other agents over MCP.",
-  "keywords": [
-    "giz",
-    "giz.ai",
-    "cli",
-    "mcp",
-    "model-context-protocol",
-    "ai",
-    "llm",
-    "agent",
-    "claude-code",
-    "codex",
-    "image-generation",
-    "video-generation"
-  ],
-  "homepage": "https://www.giz.ai/mcp/",
-  "bugs": {
-    "email": "support@giz.ai",
-    "url": "https://www.giz.ai/mcp/"
+  "version": "2.1.0",
+  "description": "GizStack: a native language, web server and database in one stack. TypeScript syntax; PostgreSQL, Redis and S3 protocols",
+  "homepage": "https://gizstack.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gizai/gizlang.git"
   },
-  "author": {
-    "name": "Giz Inc.",
-    "url": "https://www.giz.ai"
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
   },
-  "license": "UNLICENSED",
-  "type": "module",
   "bin": {
-    "giz": "cli/giz.mjs"
+    "giz": "bin/giz.js"
   },
   "files": [
-    "cli",
-    "skills",
-    "plugin.json",
-    "mcp.json",
-    "README.md"
+    "bin",
+    "skills"
   ],
   "engines": {
-    "node": ">=20.12"
-  },
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "proper-lockfile": "4.1.2"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/GizAI/giz.git",
-    "directory": "apps/giz/external"
-  },
-  "publishConfig": {
-    "access": "public"
+    "node": ">=16"
   },
-  "scripts": {
-    "check": "node --check cli/giz.mjs && node --test test/*.test.mjs"
+  "optionalDependencies": {
+    "@gizai/cli-linux-x64": "2.1.0",
+    "@gizai/cli-win32-x64": "2.1.0"
   }
 }