@mutagent/cli 0.1.345 → 0.1.346

package/dist/bin/cli.js

@@ -16189,7 +16189,7 @@ function runAgentProcess(options) {
     child.stderr.on("data", collect(stderr));
     child.once("error", (error3) => {
       cleanup();
-      reject(new MutagentError("AGENT_LOCAL_START_FAILED", error3.message, "Install Helix or set MUTAGENT_HELIX_BIN to the compatible executable."));
+      reject(new MutagentError("AGENT_LOCAL_START_FAILED", error3.message, "Install Helix with mutagent install helix, or set MUTAGENT_HELIX_BIN to the compatible executable."));
     });
     child.once("close", (code) => {
       cleanup();
@@ -17539,7 +17539,8 @@ agent in one Environment; --env names it, and no --env is the default slot.
 Run a managed agent with: mutagent helix agent @slug[:vN|:latest] [--env X] -p "<task>"
 
 The compiler needs Bun 1.3.14 (on PATH, or MUTAGENT_BUN_BIN). agent run needs a
-local Helix binary (MUTAGENT_HELIX_BIN selects one) and the LLM provider key for
+local Helix binary (mutagent install helix puts one at ~/.mutagent/bin/helix;
+MUTAGENT_HELIX_BIN selects another) and the LLM provider key for
 model on this machine.
 
 JSON: --json prints one result object on stdout. Revisions are numbers in JSON
@@ -18113,7 +18114,7 @@ function handleAgentParseError(error3, json) {
 
 // src/bin/cli.ts
 import chalk37 from "chalk";
-import { readFileSync as readFileSync15 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 import { join as join21, dirname as dirname7 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 
@@ -18166,22 +18167,225 @@ function scaffoldRcConfig(cwd = process.cwd(), deps = {}) {
 
 // src/lib/installer.ts
 init_errors();
-init_config();
 
 // src/lib/installer-helix.ts
 init_errors();
 import { spawn as spawn3 } from "child_process";
 import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync5, lstatSync, mkdirSync as mkdirSync2, renameSync, rmSync, symlinkSync } from "fs";
+import { chmod, open } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import { join as join10, posix as posixPath, win32 as win32Path, resolve as resolvePath } from "path";
-import {
-  existsSync as existsSync5,
-  mkdirSync as mkdirSync2,
-  readFileSync as readFileSync4,
-  renameSync,
-  rmSync,
-  writeFileSync as writeFileSync3
-} from "fs";
+import { delimiter as delimiter3, join as join10, resolve as resolve5 } from "path";
+var HELIX_CHANNELS = ["latest", "candidate"];
+var DEFAULT_INSTALL_HOST = "https://install.mutagent.io";
+var HELIX_BINARY_NAME = "helix";
+var HELIX_ALIAS_NAME = "mutagent-helix";
+var SUPPORTED_OS = { darwin: "darwin", linux: "linux" };
+var SUPPORTED_ARCH = { x64: "x64", arm64: "arm64" };
+var VERSION_TIMEOUT_MS = 60000;
+function resolveHelixAsset(platform, arch) {
+  const os = SUPPORTED_OS[platform];
+  const cpu = SUPPORTED_ARCH[arch];
+  if (os === undefined || cpu === undefined) {
+    throw new MutagentError("INSTALL_UNSUPPORTED_PLATFORM", `Helix has no build for ${platform}/${arch}.`, "Helix builds exist for macOS and Linux on x64 and arm64. On Windows, run mutagent install helix inside WSL.");
+  }
+  return `${HELIX_BINARY_NAME}-${os}-${cpu}`;
+}
+function resolveHelixChannel(option, envValue) {
+  const requested = option ?? (envValue !== undefined && envValue !== "" ? envValue : "latest");
+  if (!HELIX_CHANNELS.includes(requested)) {
+    const source2 = option !== undefined ? "--channel" : "MUTAGENT_HELIX_CHANNEL";
+    throw new MutagentError("INVALID_ARGUMENTS", `Unknown Helix channel "${requested}" (from ${source2}). Valid: ${HELIX_CHANNELS.join(", ")}`, "Use --channel latest or --channel candidate.");
+  }
+  return requested;
+}
+function findChecksum(checksums, asset) {
+  for (const line of checksums.split(`
+`)) {
+    const match = /^([0-9a-f]{64})\s+\*?(\S+)\s*$/i.exec(line.trim());
+    if (match?.[2] === asset)
+      return match[1]?.toLowerCase();
+  }
+  return;
+}
+function assertSecureHost(host) {
+  let url;
+  try {
+    url = new URL(host);
+  } catch {
+    throw new MutagentError("INVALID_ARGUMENTS", `MUTAGENT_INSTALL_HOST is not a URL: ${host}`, `Set MUTAGENT_INSTALL_HOST to an https:// URL, or unset it to use ${DEFAULT_INSTALL_HOST}.`);
+  }
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  if (url.protocol === "https:" || url.protocol === "http:" && loopback)
+    return;
+  throw new MutagentError("INVALID_ARGUMENTS", `Refusing to install from ${host}: plaintext HTTP to a non-loopback host.`, "checksums.txt and the binary come from the same origin, so an attacker who can rewrite one can rewrite the other. Use an https:// MUTAGENT_INSTALL_HOST.");
+}
+async function fetchOrFail(fetchImpl, url, what) {
+  let response;
+  try {
+    response = await fetchImpl(url);
+  } catch (error3) {
+    const reason = error3 instanceof Error ? error3.message : String(error3);
+    throw new MutagentError("INSTALL_DOWNLOAD_FAILED", `Could not fetch ${what} from ${url}: ${reason}`, "Check your network connection, then run mutagent install helix again.");
+  }
+  if (!response.ok) {
+    throw new MutagentError("INSTALL_DOWNLOAD_FAILED", `Could not fetch ${what} from ${url}: HTTP ${String(response.status)}`, "Check your network and the channel (--channel latest or candidate), then run mutagent install helix again.");
+  }
+  return response;
+}
+function writeFailed(path, error3) {
+  const reason = error3 instanceof Error ? error3.message : String(error3);
+  return new MutagentError("INSTALL_WRITE_FAILED", `Could not write ${path}: ${reason}`, "Set MUTAGENT_INSTALL_DIR to a writable directory, then run mutagent install helix again.");
+}
+async function streamToFile(response, partial3, what) {
+  const hash3 = createHash2("sha256");
+  let handle;
+  try {
+    handle = await open(partial3, "w", 384);
+  } catch (error3) {
+    throw writeFailed(partial3, error3);
+  }
+  try {
+    const reader = response.body?.getReader();
+    for (;; ) {
+      let read;
+      try {
+        read = await reader?.read();
+      } catch (error3) {
+        const reason = error3 instanceof Error ? error3.message : String(error3);
+        throw new MutagentError("INSTALL_DOWNLOAD_FAILED", `The download of ${what} broke off: ${reason}`, "Nothing was installed. Check your network connection, then run mutagent install helix again.");
+      }
+      if (read === undefined || read.done)
+        break;
+      hash3.update(read.value);
+      try {
+        await handle.write(read.value);
+      } catch (error3) {
+        throw writeFailed(partial3, error3);
+      }
+    }
+  } finally {
+    await handle.close();
+  }
+  return hash3.digest("hex");
+}
+function linkAlias(installDir, binaryPath) {
+  const aliasPath = join10(installDir, HELIX_ALIAS_NAME);
+  let existing;
+  try {
+    existing = lstatSync(aliasPath);
+  } catch {
+    existing = undefined;
+  }
+  if (existing !== undefined && !existing.isSymbolicLink())
+    return;
+  const staging = `${aliasPath}.${String(process.pid)}.link`;
+  try {
+    rmSync(staging, { force: true });
+    symlinkSync(binaryPath, staging);
+    renameSync(staging, aliasPath);
+  } catch (error3) {
+    const reason = error3 instanceof Error ? error3.message : String(error3);
+    throw new MutagentError("INSTALL_ALIAS_FAILED", `Installed ${binaryPath}, but could not point ${aliasPath} at it: ${reason}`, `helix itself is installed and runs as ${binaryPath}. Remove whatever is at ${staging} or ${aliasPath}, then run mutagent install helix again.`);
+  }
+  return aliasPath;
+}
+function runVersion(binaryPath) {
+  return new Promise((done) => {
+    const child = spawn3(binaryPath, ["--version"], { stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    const timer = setTimeout(() => child.kill("SIGKILL"), VERSION_TIMEOUT_MS);
+    child.stdout.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.once("error", (error3) => {
+      clearTimeout(timer);
+      done({ code: null, stdout, stderr, error: error3 });
+    });
+    child.once("close", (code) => {
+      clearTimeout(timer);
+      done({ code, stdout, stderr });
+    });
+  });
+}
+function parseHelixVersion(stdout) {
+  const first = stdout.split(`
+`).find((line) => line.trim() !== "")?.trim() ?? "";
+  const match = /^helix\s+(\S+)/.exec(first);
+  return match?.[1] ?? first;
+}
+async function verifyVersion(binaryPath) {
+  const run = await runVersion(binaryPath);
+  const version = run.code === 0 ? parseHelixVersion(run.stdout) : "";
+  if (version === "") {
+    const detail = run.error?.message ?? (run.stderr.trim().slice(-400) || `exit code ${String(run.code)}`);
+    throw new MutagentError("INSTALL_VERIFY_FAILED", `Installed ${binaryPath}, but \`${binaryPath} --version\` failed: ${detail}`, `Run ${binaryPath} doctor to see what is wrong, then run mutagent install helix again.`);
+  }
+  return version;
+}
+function isOnPath(installDir, pathValue) {
+  const target = resolve5(installDir);
+  return (pathValue ?? "").split(delimiter3).filter((entry) => entry !== "").some((entry) => resolve5(entry) === target);
+}
+async function installHelix(options, deps = {}) {
+  const env = deps.env ?? process.env;
+  const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+  const channel = resolveHelixChannel(options.channel, env.MUTAGENT_HELIX_CHANNEL);
+  const asset = resolveHelixAsset(deps.platform ?? process.platform, deps.arch ?? process.arch);
+  const rawHost = env.MUTAGENT_INSTALL_HOST !== undefined && env.MUTAGENT_INSTALL_HOST !== "" ? env.MUTAGENT_INSTALL_HOST : DEFAULT_INSTALL_HOST;
+  assertSecureHost(rawHost);
+  const host = rawHost.replace(/\/+$/, "");
+  const installDir = env.MUTAGENT_INSTALL_DIR !== undefined && env.MUTAGENT_INSTALL_DIR !== "" ? env.MUTAGENT_INSTALL_DIR : join10(deps.homeDir ?? homedir3(), ".mutagent", "bin");
+  const base = `${host}/${channel}`;
+  const checksumsUrl = `${base}/checksums.txt`;
+  const checksums = await (await fetchOrFail(fetchImpl, checksumsUrl, "checksums.txt")).text();
+  const expected = findChecksum(checksums, asset);
+  if (expected === undefined) {
+    throw new MutagentError("INSTALL_ASSET_MISSING", `${asset} is not listed in ${checksumsUrl}.`, `The ${channel} channel has no build for this machine. Try --channel ${channel === "latest" ? "candidate" : "latest"}.`);
+  }
+  const response = await fetchOrFail(fetchImpl, `${base}/${asset}`, asset);
+  try {
+    mkdirSync2(installDir, { recursive: true });
+  } catch (error3) {
+    throw writeFailed(installDir, error3);
+  }
+  const binaryPath = join10(installDir, HELIX_BINARY_NAME);
+  const partial3 = join10(installDir, `.${HELIX_BINARY_NAME}.${String(process.pid)}.partial`);
+  try {
+    const actual = await streamToFile(response, partial3, asset);
+    if (actual !== expected) {
+      throw new MutagentError("INTEGRITY_ERROR", `${asset} failed checksum verification: expected ${expected}, got ${actual}.`, "The download is corrupt or was altered in transit. Nothing was installed; run mutagent install helix again.");
+    }
+    try {
+      await chmod(partial3, 493);
+      renameSync(partial3, binaryPath);
+    } catch (error3) {
+      throw writeFailed(binaryPath, error3);
+    }
+  } finally {
+    if (existsSync5(partial3))
+      rmSync(partial3, { force: true });
+  }
+  const aliasPath = linkAlias(installDir, binaryPath);
+  const version = await verifyVersion(binaryPath);
+  const onPath = isOnPath(installDir, env.PATH);
+  return {
+    channel,
+    platform: asset.slice(`${HELIX_BINARY_NAME}-`.length),
+    version,
+    binaryPath,
+    ...aliasPath !== undefined ? { aliasPath } : {},
+    sha256: expected,
+    onPath,
+    ...onPath ? {} : { pathLine: `export PATH="${installDir}:$PATH"` },
+    installerUrl: `${host}/${HELIX_BINARY_NAME}`,
+    checksumsUrl
+  };
+}
 
 // src/lib/install-telemetry.ts
 init_config();
@@ -18197,208 +18401,25 @@ function resolveApiAuth() {
     headers["x-organization-id"] = config.defaultOrganization;
   return { apiBase, apiKey, headers };
 }
-function readCliVersion() {
-  return process.env.CLI_VERSION ?? "unknown";
-}
 async function reportInstall(event, deps = {}) {
   try {
     const auth = (deps.resolveAuth ?? resolveApiAuth)();
     if (!auth.apiKey)
-      return;
-    const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
+      return "skipped";
     const body = {
-      pkg: event.pkg,
-      version: event.version,
-      harness: event.harness,
-      cliVersion: deps.cliVersion ?? readCliVersion()
+      ...event,
+      cliVersion: deps.cliVersion ?? process.env.CLI_VERSION ?? "unknown"
     };
-    await fetchImpl(`${auth.apiBase}/api/helix/installs`, {
+    const response = await (deps.fetchImpl ?? globalThis.fetch)(`${auth.apiBase}/api/helix/installs`, {
       method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "x-api-key": auth.apiKey,
-        ...auth.headers
-      },
+      headers: { "Content-Type": "application/json", "x-api-key": auth.apiKey, ...auth.headers },
       body: JSON.stringify(body),
       signal: AbortSignal.timeout(deps.timeoutMs ?? TELEMETRY_TIMEOUT_MS)
     });
-  } catch {}
-}
-
-// src/lib/installer-helix.ts
-async function installHelix(opts, deps = {}) {
-  const auth = (deps.resolveAuth ?? resolveApiAuth)();
-  const fetchImpl = deps.fetchImpl ?? globalThis.fetch;
-  const descriptor = await fetchDescriptor(fetchImpl, auth, opts.version);
-  const baseDir = deps.homeDir ?? join10(homedir3(), ".mutagent", "helix");
-  const versionDir = join10(baseDir, descriptor.version);
-  mkdirSync2(versionDir, { recursive: true });
-  const tgzPath = join10(versionDir, `helix-plugin-${descriptor.version}.tgz`);
-  const tmpPath = `${tgzPath}.${String(process.pid)}.${String(Date.now())}.part`;
-  const download = deps.download ?? defaultDownload;
-  await download(descriptor.url, tmpPath);
-  const sha2562 = deps.sha256 ?? defaultSha256;
-  const actual = (await sha2562(tmpPath)).toLowerCase();
-  const expected = descriptor.sha256.toLowerCase();
-  if (actual !== expected) {
-    safeRm(tmpPath);
-    throw new MutagentError("INTEGRITY_ERROR", `Downloaded helix plugin failed sha256 verification (expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…).`, "The download may be corrupt or tampered with. Retry: mutagent install helix");
-  }
-  renameSync(tmpPath, tgzPath);
-  const extract3 = deps.extract ?? defaultExtract;
-  await extract3(tgzPath, versionDir);
-  const locateInitBin = deps.locateInitBin ?? defaultLocateInitBin;
-  const binPath = await locateInitBin(versionDir);
-  const initArgs = ["init", "--yes"];
-  const runInit = deps.runInit ?? defaultRunInit;
-  const code = await runInit(binPath, initArgs, process.cwd());
-  if (code !== 0) {
-    throw new MutagentError("INSTALL_FAILED", `helix plugin init exited with code ${String(code)}.`, "Re-run: mutagent install helix — or run the plugin init manually and report the error.");
-  }
-  return { version: descriptor.version };
-}
-async function fetchDescriptor(fetchImpl, auth, version) {
-  if (!auth.apiKey) {
-    throw new MutagentError("AUTH_REQUIRED", "Authentication required to install helix.", "Run: mutagent login");
-  }
-  const url = `${auth.apiBase}/api/helix/plugin/download?version=${encodeURIComponent(version)}`;
-  let res;
-  try {
-    res = await fetchImpl(url, {
-      method: "GET",
-      headers: { "x-api-key": auth.apiKey, ...auth.headers }
-    });
+    return response.ok ? "sent" : "failed";
   } catch {
-    throw new MutagentError("SERVER_UNAVAILABLE", "Could not reach the Mutagent plugin broker.", "Check your network connection or verify the endpoint with: mutagent config show");
+    return "failed";
   }
-  if (res.status === 401) {
-    throw new MutagentError("AUTH_REQUIRED", "The plugin broker rejected your credentials.", "Re-authenticate: mutagent login");
-  }
-  if (!res.ok) {
-    const detail = await readErrorMessage(res);
-    throw new MutagentError("INSTALL_FAILED", `Plugin broker returned ${String(res.status)}.${detail ? ` ${detail}` : ""}`, "Verify the requested version exists, then retry: mutagent install helix");
-  }
-  const raw = await res.json();
-  if (!isBrokerResponse(raw)) {
-    throw new MutagentError("INSTALL_FAILED", "Plugin broker returned a malformed response (missing version/sha256/url).", "Retry: mutagent install helix — if it persists, report it.");
-  }
-  return raw;
-}
-async function defaultDownload(url, destPath) {
-  let res;
-  try {
-    res = await globalThis.fetch(url);
-  } catch {
-    throw new MutagentError("SERVER_UNAVAILABLE", "Failed to download the helix plugin from storage.", "Check your network connection and retry: mutagent install helix");
-  }
-  if (!res.ok) {
-    throw new MutagentError("INSTALL_FAILED", `Plugin download failed with status ${String(res.status)}.`, "The signed URL may have expired — retry: mutagent install helix");
-  }
-  const bytes = Buffer.from(await res.arrayBuffer());
-  writeFileSync3(destPath, bytes);
-}
-async function defaultSha256(filePath) {
-  return Promise.resolve(createHash2("sha256").update(readFileSync4(filePath)).digest("hex"));
-}
-function buildTarExtractInvocation(tgzPath, destDir, platform = process.platform) {
-  const p = platform === "win32" ? win32Path : posixPath;
-  const cwd = p.dirname(tgzPath) || ".";
-  const archive = p.basename(tgzPath);
-  const dest = p.isAbsolute(destDir) ? destDir : resolvePath(destDir);
-  return { args: ["-xzf", archive, "-C", dest], cwd };
-}
-function defaultExtract(tgzPath, destDir) {
-  const invocation = buildTarExtractInvocation(tgzPath, destDir);
-  return new Promise((resolve5, reject) => {
-    const child = spawn3("tar", invocation.args, {
-      cwd: invocation.cwd,
-      stdio: ["ignore", "ignore", "pipe"]
-    });
-    let stderr = "";
-    child.stderr.on("data", (chunk) => {
-      stderr += chunk.toString("utf-8");
-    });
-    child.on("error", (err) => {
-      reject(new MutagentError("INSTALL_FAILED", `Failed to extract the helix plugin: ${err.message}`, 'Ensure "tar" is installed and available on your PATH.'));
-    });
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve5();
-      } else {
-        reject(new MutagentError("INSTALL_FAILED", `Extracting the helix plugin failed (tar exit ${String(code ?? 1)}).${stderr ? ` ${stderr.trim().slice(0, 200)}` : ""}`, "The downloaded archive may be corrupt — retry: mutagent install helix"));
-      }
-    });
-  });
-}
-function defaultLocateInitBin(extractedDir) {
-  const pkgDir = existsSync5(join10(extractedDir, "package", "package.json")) ? join10(extractedDir, "package") : extractedDir;
-  const pkgJsonPath = join10(pkgDir, "package.json");
-  if (!existsSync5(pkgJsonPath)) {
-    return Promise.reject(new MutagentError("INSTALL_FAILED", `Could not find package.json under ${pkgDir}.`, "The package layout is unexpected — retry the install, or report it."));
-  }
-  const raw = JSON.parse(readFileSync4(pkgJsonPath, "utf-8"));
-  const binRel = resolveBinField(raw);
-  if (!binRel) {
-    return Promise.reject(new MutagentError("INSTALL_FAILED", "The helix plugin package.json declares no runnable bin.", "The plugin package is malformed — report: mutagent install helix"));
-  }
-  const binPath = join10(pkgDir, binRel);
-  if (!existsSync5(binPath)) {
-    return Promise.reject(new MutagentError("INSTALL_FAILED", `The helix plugin bin was not found at ${binRel}.`, "The plugin package is incomplete — report: mutagent install helix"));
-  }
-  return Promise.resolve(binPath);
-}
-function defaultRunInit(binPath, args, cwd) {
-  return new Promise((resolve5, reject) => {
-    const child = spawn3("node", [binPath, ...args], { cwd, stdio: ["ignore", 2, 2] });
-    child.on("error", (err) => {
-      reject(new MutagentError("INSTALL_FAILED", `Failed to run the package init: ${err.message}`, 'Ensure "node" is installed and available on your PATH.'));
-    });
-    child.on("close", (code) => {
-      resolve5(code ?? 1);
-    });
-  });
-}
-function resolveBinField(pkg) {
-  if (!pkg || typeof pkg !== "object")
-    return;
-  const bin = pkg.bin;
-  if (typeof bin === "string")
-    return bin;
-  if (bin && typeof bin === "object") {
-    const entries = bin;
-    const preferred = entries["mutagent-helix"];
-    if (typeof preferred === "string")
-      return preferred;
-    for (const value2 of Object.values(entries)) {
-      if (typeof value2 === "string")
-        return value2;
-    }
-  }
-  return;
-}
-function isBrokerResponse(value2) {
-  if (!value2 || typeof value2 !== "object")
-    return false;
-  const v = value2;
-  return typeof v.version === "string" && typeof v.sha256 === "string" && typeof v.url === "string";
-}
-async function readErrorMessage(res) {
-  try {
-    const body = await res.json();
-    if (body && typeof body === "object") {
-      const b = body;
-      if (typeof b.message === "string")
-        return b.message;
-      if (typeof b.error === "string")
-        return b.error;
-    }
-  } catch {}
-  return;
-}
-function safeRm(path) {
-  try {
-    rmSync(path, { force: true });
-  } catch {}
 }
 
 // src/lib/installer.ts
@@ -18407,64 +18428,21 @@ var RETIRED_PACKAGES = {
   diagnostics: "@mutagent/diagnostics",
   evaluator: "@mutagent/evaluator"
 };
-var VALID_HARNESSES = ["claude-code", "codex", "omp"];
-var VERSION_MATRIX = {
-  helix: "latest"
-};
-function isValidPackage(pkg) {
-  return VALID_PACKAGES.includes(pkg);
-}
-function isValidHarness(harness) {
-  return VALID_HARNESSES.includes(harness);
-}
+var HELIX_NEXT_STEP = "run helix in a project";
 async function installPackage(pkg, opts, deps = {}) {
+  assertInstallTarget(pkg);
+  const helix = await installHelix({ channel: opts.channel }, deps.helix ?? {});
+  const telemetry = await reportInstall({ pkg: "helix", version: helix.version, channel: helix.channel, platform: helix.platform }, deps.telemetry ?? {});
+  return { package: "helix", ...helix, nextStep: HELIX_NEXT_STEP, telemetry };
+}
+function assertInstallTarget(pkg) {
   const retiredNpmName = RETIRED_PACKAGES[pkg];
   if (retiredNpmName !== undefined) {
     throw new MutagentError("INVALID_ARGUMENTS", `"${pkg}" is no longer an install target — ${retiredNpmName} is no longer published.`, `The ${pkg} skill now ships inside helix. Run: mutagent install helix`);
   }
-  const isAuthed = deps.isAuthed ?? hasCredentials;
-  if (!isAuthed()) {
-    throw new MutagentError("AUTH_REQUIRED", `Authentication required to install ${pkg}.`, "Run: mutagent login");
-  }
-  const projectPath = process.cwd();
-  if (opts.global === true) {
-    throw new MutagentError("INVALID_ARGUMENTS", "--global is no longer supported: install scope is no longer selectable.", [
-      "Every install is project-scoped now:",
-      `  the package resolves into ~/.mutagent/<pkg>/<version>, and its skill`,
-      `  is installed into the current project (${projectPath}).`,
-      "Nothing is installed globally. Re-run without --global."
-    ].join(`
-`));
-  }
-  if (!isValidPackage(pkg)) {
+  if (!VALID_PACKAGES.includes(pkg)) {
     throw new MutagentError("INVALID_ARGUMENTS", `Unknown package "${pkg}". Valid: ${VALID_PACKAGES.join(", ")}`, "Run: mutagent install --help");
   }
-  if (!isValidHarness(opts.harness)) {
-    throw new MutagentError("INVALID_ARGUMENTS", `Unknown harness "${opts.harness}". Valid: ${VALID_HARNESSES.join(", ")}`, "Run: mutagent install --help");
-  }
-  const version = opts.version ?? VERSION_MATRIX[pkg];
-  switch (pkg) {
-    case "helix": {
-      const { version: resolved } = await installHelix({ harness: opts.harness, version }, deps.helix ?? {});
-      return finish({
-        package: pkg,
-        version: resolved,
-        harness: opts.harness,
-        scope: "project",
-        projectPath,
-        skillInstalled: true
-      }, deps);
-    }
-    default:
-      return assertNoInstallPath(pkg);
-  }
-}
-function assertNoInstallPath(pkg) {
-  throw new MutagentError("INVALID_ARGUMENTS", `No install path is implemented for "${String(pkg)}".`, "Run: mutagent install --help");
-}
-async function finish(result, deps) {
-  await reportInstall({ pkg: result.package, version: result.version, harness: result.harness }, deps.telemetry ?? {});
-  return result;
 }
 
 // src/commands/onboarding.ts
@@ -18500,12 +18478,16 @@ async function runPostOnboarding(deps = {}) {
   console.log("");
   if (action === "helix") {
     console.log(chalk2.bold("  Installing Helix…"));
-    console.log(chalk2.dim("  Downloading + verifying the plugin, then writing .claude/ + .codex/"));
+    console.log(chalk2.dim("  Downloading the helix binary and verifying its checksum"));
     console.log("");
     try {
-      await install("helix", { harness: "claude-code", global: false });
-      console.log("");
-      console.log(`  ${chalk2.green("✓")} Helix ready — run ${chalk2.cyan("/help")} inside your agent`);
+      const result = await install("helix", {});
+      console.log(`  ${chalk2.green("✓")} Helix ${result.version} installed at ${result.binaryPath}`);
+      if (result.pathLine !== undefined) {
+        console.log(`  ${chalk2.yellow("⚠")} Not on your PATH yet. Add this line to your shell profile:`);
+        console.log(`    ${chalk2.cyan(result.pathLine)}`);
+      }
+      console.log(`  ${chalk2.blue("→")} Next: ${result.nextStep}`);
       console.log("");
     } catch (error3) {
       console.log("");
@@ -18572,14 +18554,14 @@ async function openBrowser(url) {
     return;
   }
   try {
-    const { default: open } = await import("open");
-    await open(url);
+    const { default: open2 } = await import("open");
+    await open2(url);
   } catch {
     throw new BrowserAuthError("BROWSER_OPEN_FAILED", `Could not open browser automatically. Please visit: ${url}`);
   }
 }
 function sleep(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
+  return new Promise((resolve6) => setTimeout(resolve6, ms));
 }
 async function performBrowserAuth(options, onStatusUpdate) {
   const {
@@ -20045,9 +20027,9 @@ init_known_secrets();
 init_secret_scrub();
 
 // src/lib/helix-local-store.ts
-import { existsSync as existsSync7, readFileSync as readFileSync5, statSync as statSync3 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync4, statSync as statSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join12, resolve as resolve5 } from "path";
+import { join as join12, resolve as resolve6 } from "path";
 
 // src/lib/harness-model-config.ts
 import { z as z2 } from "zod";
@@ -20213,13 +20195,13 @@ function harnessProviderOf(metadata) {
 
 // src/lib/helix-local-store.ts
 init_secret_scrub();
-var HELIX_CHANNELS = ["stable", "rc"];
+var HELIX_CHANNELS2 = ["stable", "rc"];
 function resolveAgentDir(channel, env = process.env, home = homedir4()) {
   const override2 = env.HELIX_CODING_AGENT_DIR;
   if (!override2)
     return join12(home, ".mutagent", channel === "rc" ? "agent-rc" : "agent");
   const expanded = override2 === "~" ? home : override2.startsWith("~/") ? join12(home, override2.slice(2)) : override2;
-  return resolve5(expanded);
+  return resolve6(expanded);
 }
 var credentialInventory = new WeakMap;
 function localCredentialSecrets(entries) {
@@ -20278,7 +20260,7 @@ function readJsonObject(path, notes, label) {
       notes.push(`${label} exceeds the 1 MiB mirror limit; ignored`);
       return null;
     }
-    const parsed = JSON.parse(readFileSync5(path, "utf-8"));
+    const parsed = JSON.parse(readFileSync4(path, "utf-8"));
     if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
       notes.push(`${label} is not a JSON object; ignored`);
       return null;
@@ -20686,7 +20668,7 @@ function statusGlyph(result) {
   }
 }
 function registerMirrorCommand(parent) {
-  parent.command("mirror").description("Copy the API keys from your local Helix login store into the workspace as LLM providers").option("-y, --yes", "Consent without prompting (required when non-interactive)").option("--no-overwrite", "Leave LLM providers the workspace already has untouched").option("--workspace <id>", "Target workspace for this run (default: the configured one)").option("--channel <channel>", `Helix channel whose store is read: ${HELIX_CHANNELS.join(" | ")}`, "stable").option("--provider <id>", "Only this local LLM provider id (repeatable)", (value2, prev = []) => [...prev, value2]).addHelpText("after", `
+  parent.command("mirror").description("Copy the API keys from your local Helix login store into the workspace as LLM providers").option("-y, --yes", "Consent without prompting (required when non-interactive)").option("--no-overwrite", "Leave LLM providers the workspace already has untouched").option("--workspace <id>", "Target workspace for this run (default: the configured one)").option("--channel <channel>", `Helix channel whose store is read: ${HELIX_CHANNELS2.join(" | ")}`, "stable").option("--provider <id>", "Only this local LLM provider id (repeatable)", (value2, prev = []) => [...prev, value2]).addHelpText("after", `
 Examples:
   ${chalk11.dim("$")} mutagent providers mirror
   ${chalk11.dim("$")} mutagent providers mirror --json                 ${chalk11.dim("Show the plan without sending anything")}
@@ -20741,8 +20723,8 @@ AI Agent Directive:
       if (options.workspace) {
         process.env.MUTAGENT_WORKSPACE_ID = options.workspace;
       }
-      if (!HELIX_CHANNELS.includes(options.channel)) {
-        throw new MutagentError("INVALID_OPTION", `Unknown channel '${options.channel}'.`, `Use --channel ${HELIX_CHANNELS.join(" or ")}`);
+      if (!HELIX_CHANNELS2.includes(options.channel)) {
+        throw new MutagentError("INVALID_OPTION", `Unknown channel '${options.channel}'.`, `Use --channel ${HELIX_CHANNELS2.join(" or ")}`);
       }
       const channel = options.channel;
       const agentDir = resolveAgentDir(channel);
@@ -21023,14 +21005,14 @@ Available Models:`));
 init_config();
 import { Command as Command8 } from "commander";
 import chalk14 from "chalk";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { join as join14 } from "path";
 init_errors();
 
 // src/commands/skills.ts
 import { Command as Command7 } from "commander";
 import chalk13 from "chalk";
-import { existsSync as existsSync8, mkdirSync as mkdirSync3, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
 import { dirname as dirname4, join as join13 } from "path";
 import { execSync } from "child_process";
 
@@ -21041,7 +21023,7 @@ name: mutagent-cli
 description: |
   Mutagent CLI - the command-line client for the Mutagent platform.
   Guides coding agents through setup (login, init, providers, workspaces),
-  installing Mutagent packages (helix), and sending
+  installing the standalone Helix binary, and sending
   product feedback, and deploying and running managed agents (agent.md folders).
   Triggers: "mutagent", "mutagent cli", "mutagent login", "set up mutagent",
   "install diagnostics", "install evaluator", "install helix", "mutagent install",
@@ -21148,7 +21130,7 @@ Parse \`_compat.cliVersion\` from the \`--version --json\` output and compare ag
 
 ## Login (RUN SECOND — most commands are login-gated)
 
-Install, feedback, usage, workspaces, and providers commands all require
+Feedback, usage, workspaces, and providers commands all require
 an authenticated session. Establish it early:
 
 - **CI / automated**: \`export MUTAGENT_API_KEY=mt_... && mutagent login --json\` -- no browser, no prompts.
@@ -21175,7 +21157,7 @@ skill never inlines flags. The active surface:
 | \`usage\` | Show usage + quota | [workflows/setup.md](./workflows/setup.md) |
 | \`skills install\` | Install this skill into a project | [workflows/setup.md](./workflows/setup.md) |
 | \`hooks install\` | Install Claude Code telemetry hooks | [workflows/setup.md](./workflows/setup.md) |
-| \`install <pkg>\` | Install helix (diagnostics / evaluator are retired) | [workflows/install.md](./workflows/install.md) |
+| \`install helix\` | Install the standalone Helix binary (diagnostics / evaluator are retired) | [workflows/install.md](./workflows/install.md) |
 | \`agent\` | Check, pack, run locally, deploy, activate, list, inspect and retire managed agents | [workflows/agent-deployment.md](./workflows/agent-deployment.md) |
 | \`feedback send\` | Send product feedback | [workflows/feedback.md](./workflows/feedback.md) |
 
@@ -21185,9 +21167,9 @@ skill never inlines flags. The active surface:
 
 1. **\`--json\` on EVERY command.** No exceptions. Agents use JSON mode exclusively.
 2. **\`<command> --help\` BEFORE first use of any command.** The CLI is the source of truth for flags -- this skill never inlines them.
-3. **Login before login-gated commands.** install, feedback, usage, workspaces, and providers require an authenticated session. Run \`mutagent login\` (or set \`MUTAGENT_API_KEY\`) first.
+3. **Login before login-gated commands.** feedback, usage, workspaces, and providers require an authenticated session. Run \`mutagent login\` (or set \`MUTAGENT_API_KEY\`) first.
 4. **Show command output to the user.** Command output appears in bash blocks the user may not see -- always present the key results in your chat reply.
-5. **Confirm before writing to the user's machine or spending.** \`install\`, \`skills install\`, and \`hooks install\` write files or install packages -- state what will happen and get confirmation first.
+5. **Confirm before writing to the user's machine or spending.** \`install\`, \`skills install\`, and \`hooks install\` write files or install a binary -- state what will happen and get confirmation first.
 
 ---
 
@@ -21198,7 +21180,7 @@ Match the user's first request. Load ONLY the matching subfile per the table. Do
 | User said / signal detected | Load subfile | Why |
 |---|---|---|
 | "log in", "authenticate", "set up mutagent", "init", "which workspace", "what models", "usage", "quota", "install the skill", "install hooks" | [workflows/setup.md](./workflows/setup.md) | Auth + project setup + discovery commands |
-| "install helix", "install diagnostics", "install evaluator", "add mutagent package" | [workflows/install.md](./workflows/install.md) | Login-gated meta-installer (diagnostics/evaluator are retired → helix) |
+| "install helix", "install diagnostics", "install evaluator", "add mutagent package" | [workflows/install.md](./workflows/install.md) | Standalone Helix binary installer, no login (diagnostics/evaluator are retired → helix) |
 | "agent.md", "deploy agent", "managed agent", "mutagent agent", "helix agent @slug" | [workflows/agent-deployment.md](./workflows/agent-deployment.md) | agent.md folder → check → deploy to a slot → run with \`helix agent @slug\` |
 | "send feedback", "report a bug", "file feedback", "the CLI crashed" | [workflows/feedback.md](./workflows/feedback.md) | Product feedback (+ optional transcript) |
 | Unclear / first time | run \`mutagent --help --json\` then reroute | Discover the surface before acting |
@@ -21210,7 +21192,7 @@ Match the user's first request. Load ONLY the matching subfile per the table. Do
 | File | WHEN to load | WHY |
 |---|---|---|
 | [workflows/setup.md](./workflows/setup.md) | User is onboarding: login, init, config, workspaces, providers, usage, skill/hooks install | Auth + configuration + discovery |
-| [workflows/install.md](./workflows/install.md) | User wants to install a Mutagent package | \`install helix\` meta-command |
+| [workflows/install.md](./workflows/install.md) | User wants to install Helix | \`install helix\`: the standalone binary into ~/.mutagent/bin |
 | [workflows/agent-deployment.md](./workflows/agent-deployment.md) | User wants to deploy or run a managed agent, or run an agent.md locally | Slots (\`--env\`), revisions (\`vN\`), \`@slug\` runs, rollback and retire |
 | [workflows/feedback.md](./workflows/feedback.md) | User wants to send feedback or report a bug | \`feedback send\` + \`--attach-transcript\` |
 
@@ -21434,9 +21416,9 @@ how they learn something sensitive was in the file at all.
   "workflows/install.md": `---
 name: mutagent-cli-workflows-install
 description: |
-  Meta-installer workflow. Installs helix into the user's environment via
-  \`mutagent install helix\`. Login-gated. helix is fetched from a private
-  registry via a login-brokered signed URL (no static secret ships in the CLI).
+  Install workflow. \`mutagent install helix\` installs the standalone Helix
+  binary into ~/.mutagent/bin, the same result as
+  \`curl -fsSL https://install.mutagent.io/helix | bash\`. No login needed.
   \`diagnostics\` and \`evaluator\` are RETIRED as install targets — both skills
   now ship inside helix.
 triggers:
@@ -21449,23 +21431,24 @@ triggers:
   - "set up evaluator"
 ---
 
-# Workflow — Install (Meta-Installer)
+# Workflow — Install Helix
 
-> **\`helix\` is the only install target.** It installs into the CURRENT project
-> directory (\`scope: "project"\`).
+> **\`helix\` is the only install target.** \`mutagent install helix\` installs the
+> standalone Helix binary at \`~/.mutagent/bin/helix\`, the same result as
+> \`curl -fsSL https://install.mutagent.io/helix | bash\`.
 >
 > \`diagnostics\` and \`evaluator\` are **retired** — their npm packages are no
-> longer published. Both skills ship *inside* the helix payload, so a user
-> asking for either one needs \`mutagent install helix\`. The CLI says so itself:
+> longer published. Both skills ship *inside* helix, so a user asking for either
+> one needs \`mutagent install helix\`. The CLI says so itself:
 > \`mutagent install diagnostics\` fails with \`INVALID_ARGUMENTS\` and names helix
 > as the route. Do not work around that error — follow it.
 >
-> This WRITES to the user's machine — confirm before running (Core Rule 5).
+> This WRITES a binary to the user's machine — confirm before running (Core Rule 5).
 
 Read the **Core Rules** in [SKILL.md](../SKILL.md) first. Key reminders:
 - \`--json\` on every command
 - \`<command> --help\` before first use
-- **Login-gated** — run \`mutagent login\` first
+- No login is needed for this command (when signed in, the CLI also records the install activation)
 - Confirm before installing (writes to the user's machine)
 
 ---
@@ -21475,53 +21458,61 @@ Read the **Core Rules** in [SKILL.md](../SKILL.md) first. Key reminders:
 \`\`\`bash
 mutagent install --help    # authoritative flags — read before first use
 
-mutagent install helix [--harness <claude-code|codex|omp>] \\
-                       [--version <v>] [--json]
+mutagent install helix [--channel <latest|candidate>] [--json]
 \`\`\`
 
-Where \`<package>\` is:
+What it does, in order:
 
-| Package | Source | Notes |
-|---|---|---|
-| \`helix\` | private registry via login-brokered signed URL | Ready to install — login-gated download, sha256-verified, then initialized into your project. Carries the diagnostics + evaluator skills and the \`helix-cli\` binary. |
+1. Maps the machine to its build, \`helix-<darwin|linux>-<x64|arm64>\`. Other
+   platforms (Windows included) fail with \`INSTALL_UNSUPPORTED_PLATFORM\`; on
+   Windows, run it inside WSL.
+2. Downloads \`checksums.txt\` and the build from \`https://install.mutagent.io/<channel>/\`.
+3. Verifies the build's sha256 against \`checksums.txt\`.
+4. Writes \`~/.mutagent/bin/helix\` (mode 755) and points the \`mutagent-helix\`
+   alias symlink at it.
+5. Runs \`helix --version\` and reports the version it prints.
+
+It never edits shell rc files. When \`~/.mutagent/bin\` is not on PATH, the
+response carries the line to add.
+
+After a successful install, and only when the user is signed in, the CLI posts
+the install activation (package, version, channel, platform) to the Platform.
+Signed out, nothing is sent. The post is best-effort: its outcome is reported in
+\`telemetry\` and never changes the install result.
 
-Retired — these are rejected by name, they do not fall through to a generic error:
+**Flags and environment** (verify against \`--help\`):
+- \`--channel <latest|candidate>\` — release channel (default \`latest\`).
+- \`--json\` — structured output (Rule 1).
+- \`MUTAGENT_HELIX_CHANNEL\` — channel when \`--channel\` is not passed.
+- \`MUTAGENT_INSTALL_HOST\` — install host (default \`https://install.mutagent.io\`; plain \`http://\` is refused except for loopback).
+- \`MUTAGENT_INSTALL_DIR\` — install directory (default \`~/.mutagent/bin\`).
+
+Retired — rejected by name, they do not fall through to a generic error:
 
 | Retired target | Was | Use instead |
 |---|---|---|
 | \`diagnostics\` | public npm \`@mutagent/diagnostics\` | \`mutagent install helix\` |
 | \`evaluator\` | public npm \`@mutagent/evaluator\` | \`mutagent install helix\` |
 
-**Flags** (verify against \`--help\`):
-- \`--harness <claude-code|codex|omp>\` -- target coding-agent harness (default \`claude-code\`). helix installs every harness itself, so this does not change what lands.
-- \`--version <v>\` -- pin a specific version (default: latest).
-- \`--json\` -- structured output (Rule 1).
-- Install scope is NOT selectable: helix installs into the current directory. \`--global\` is retired — passing it fails and explains what happens instead.
-
 ---
 
 ## Steps
 
 \`\`\`
-1. mutagent auth status --json
-   → confirm the user is logged in (install is login-gated)
-   → if not authenticated, run the login workflow first
+1. mutagent install --help
+   → read the current flags (Rule 2)
 
-2. mutagent install --help
-   → read the current packages + flags (Rule 2)
+2. Confirm with the user WHAT will be installed and WHERE
+   → "I'll install the Helix binary at ~/.mutagent/bin/helix. Proceed?"
 
-3. Confirm with the user WHAT will be installed and WHERE
-   → "I'll install helix into <current directory>. Proceed?"
+3. mutagent install helix --json
+   → add --channel candidate only if the user asked for the candidate build
 
-4. mutagent install helix [--harness <h>] [--version <v>] --json
-   → run the install
-   → show the output: package, version, harness, scope, and projectPath
+4. Report from the JSON: version, channel, binaryPath
+   → onPath === false → show the user pathLine and tell them to add it to their
+     shell profile. Do NOT edit their rc files yourself.
 
-5. CHECK \`skillInstalled\` in the JSON response — do NOT stop at \`success: true\`
-   → skillInstalled === true  → done; the skill is installed and usable
-   → skillInstalled === false → NOT done. Say so plainly and surface \`nextStep\`
-      as the command to run next. Confirm before running it — it writes to
-      their project (Core Rule 5).
+5. Tell the user the next step: nextStep ("run helix in a project")
 \`\`\`
 
 ---
@@ -21530,8 +21521,7 @@ Retired — these are rejected by name, they do not fall through to a generic er
 
 \`\`\`bash
 mutagent install helix --json
-mutagent install helix --harness codex --json
-mutagent install helix --version 1.2.3 --json
+mutagent install helix --channel candidate --json
 \`\`\`
 
 ---
@@ -21544,35 +21534,46 @@ Success shape:
 {
   "success": true,
   "package": "helix",
-  "version": "0.1.0-alpha.25",
-  "harness": "claude-code",
-  "scope": "project",
-  "projectPath": "/path/to/the/users/project",
-  "skillInstalled": true,
-  "_links": { "install": "...", "login": "..." }
+  "channel": "latest",
+  "version": "0.0.32-m0",
+  "binaryPath": "/Users/me/.mutagent/bin/helix",
+  "aliasPath": "/Users/me/.mutagent/bin/mutagent-helix",
+  "sha256": "95e0b562…",
+  "onPath": false,
+  "pathLine": "export PATH=\\"/Users/me/.mutagent/bin:$PATH\\"",
+  "nextStep": "run helix in a project",
+  "telemetry": "sent",
+  "_links": {
+    "installer": "https://install.mutagent.io/helix",
+    "checksums": "https://install.mutagent.io/latest/checksums.txt"
+  }
 }
 \`\`\`
 
-- **\`skillInstalled\` is the field to branch on — NOT \`success\`.** \`success: true\`
-  reports that the install step did its job, not that the user is ready.
-  \`nextStep\` is present only when work remains; on a completed helix install it
-  is absent.
-- \`skillInstalled: true\`: the CLI resolved a signed download URL from the login
-  broker, downloaded + sha256-verified the plugin, and ran its init into the
-  project. Nothing further is needed. An \`INTEGRITY_ERROR\` means the download
-  failed checksum verification — retry.
-- **\`scope\` tells you WHERE it went. Read it; do not assume.** It is \`"project"\`,
-  and \`projectPath\` is the directory. Surface it so the user can confirm the
-  location.
-- On an auth error (including a broker \`AUTH_REQUIRED\`): route to the login
-  workflow, then retry.
-- On \`INVALID_ARGUMENTS\` naming a retired target (\`diagnostics\`, \`evaluator\`):
-  the package is gone from npm and the skill ships inside helix. Tell the user
-  that, then offer \`mutagent install helix\`. Do NOT suggest \`npm install
-  @mutagent/diagnostics\` as a fallback — it will 404.
-- On \`INVALID_ARGUMENTS\` naming \`--global\`: the flag is retired. Re-run without
-  it, or \`cd\` to the intended project first — the error names the path that
-  would have been used.
+- \`version\` is what the installed binary printed for \`helix --version\`.
+- \`pathLine\` is present only when \`onPath\` is false.
+- \`telemetry\` is \`sent\`, \`skipped\` (not signed in) or \`failed\`; telemetry never
+  changes the install result, so do not retry the install over it.
+- \`aliasPath\` is absent when a regular file named \`mutagent-helix\` already
+  exists in the directory; the installer leaves that file alone.
+
+Errors (all carry \`suggestedAction\`; surface it):
+
+| Code | Meaning | What to do |
+|---|---|---|
+| \`INSTALL_UNSUPPORTED_PLATFORM\` | No build for this OS/arch | macOS or Linux on x64/arm64; on Windows use WSL |
+| \`INSTALL_ASSET_MISSING\` | The channel lists no build for this machine | Try the other channel |
+| \`INSTALL_DOWNLOAD_FAILED\` | \`checksums.txt\` or the build could not be fetched, or the download broke off; nothing was installed | Check the network, retry |
+| \`INTEGRITY_ERROR\` | sha256 mismatch; nothing was installed and an existing helix is left as it was | Retry |
+| \`INSTALL_WRITE_FAILED\` | The install directory is not writable, or the disk is full | Set \`MUTAGENT_INSTALL_DIR\` to a writable directory |
+| \`INSTALL_ALIAS_FAILED\` | helix is installed, but the \`mutagent-helix\` alias could not be written | Remove what the message names, retry; \`helix\` itself already works |
+| \`INSTALL_VERIFY_FAILED\` | The binary was written but \`--version\` failed | Run the \`helix doctor\` command it names |
+| \`INVALID_ARGUMENTS\` | Unknown channel, insecure host, unknown or retired package | Fix the input; for a retired target, offer \`mutagent install helix\` |
+
+On \`INVALID_ARGUMENTS\` naming a retired target (\`diagnostics\`, \`evaluator\`): the
+package is gone from npm and the skill ships inside helix. Tell the user that,
+then offer \`mutagent install helix\`. Do NOT suggest \`npm install
+@mutagent/diagnostics\` as a fallback — it will 404.
 
 ---
 
@@ -21581,21 +21582,17 @@ Success shape:
 - **Telling the user to \`npm install @mutagent/diagnostics\` or
   \`@mutagent/evaluator\`.** Both are unpublished; the install 404s. The skills
   are inside helix.
-- **Treating a retired-target error as a typo.** \`mutagent install diagnostics\`
-  is a command that used to work. The user is not confused about spelling —
-  they want diagnostics. Route them to helix, which has it.
-- **Treating \`success: true\` as "the user is ready".** Check \`skillInstalled\`.
-- Running before login → auth error (install is login-gated).
-- Assuming \`helix\` installs from public npm — it is fetched from a private registry via a login-brokered signed URL (the CLI holds no static secret).
+- **Treating a retired-target error as a typo.** The user wants diagnostics;
+  route them to helix, which has it.
+- **Editing the user's shell rc files.** Show \`pathLine\` and let the user add it.
 - Installing without confirming with the user first (Core Rule 5).
-- Passing \`--global\` — retired; scope is not selectable.
 
 ---
 
 ## Cross-references
 
 - [SKILL.md](../SKILL.md) → Core Rules + Task Router
-- [workflows/setup.md](./setup.md) → login (prerequisite for install)
+- [workflows/setup.md](./setup.md) → login and project setup
 `,
   "workflows/setup.md": `---
 name: mutagent-cli-workflows-setup
@@ -21743,7 +21740,7 @@ confirm before running (Core Rule 5).
 ## Cross-references
 
 - [SKILL.md](../SKILL.md) → Core Rules + Task Router
-- [workflows/install.md](./install.md) → install helix / diagnostics / evaluator packages
+- [workflows/install.md](./install.md) → install the standalone Helix binary (diagnostics / evaluator are retired)
 `
 };
 var SKILL_CONTENT = SKILL_FILES["SKILL.md"] ?? "";
@@ -21799,7 +21796,7 @@ function installCliSkill(targetRoot) {
     const finalContent = raw.endsWith(`
 `) ? raw : `${raw}
 `;
-    writeFileSync4(destPath, finalContent, "utf-8");
+    writeFileSync3(destPath, finalContent, "utf-8");
     writtenFiles.push({ relPath, destPath, bytes: finalContent.length });
     totalBytes += finalContent.length;
   }
@@ -21885,7 +21882,7 @@ It never prompts. Without a sign-in it prints what to run and exits.
       let rcConfig;
       if (rcExists) {
         try {
-          rcConfig = JSON.parse(readFileSync6(join14(cwd, ".mutagentrc.json"), "utf-8"));
+          rcConfig = JSON.parse(readFileSync5(join14(cwd, ".mutagentrc.json"), "utf-8"));
         } catch {
           rcConfig = {};
         }
@@ -21956,7 +21953,7 @@ It never prompts. Without a sign-in it prints what to run and exits.
       } else {
         console.log("");
         console.log(chalk14.bold(`  What's next:`));
-        console.log(`    ${chalk14.cyan("mutagent install helix".padEnd(30))}${chalk14.dim("# the ADL lifecycle conductor")}`);
+        console.log(`    ${chalk14.cyan("mutagent install helix".padEnd(30))}${chalk14.dim("# the standalone Helix binary")}`);
         console.log("");
         console.log(chalk14.dim("  Your coding agent now knows these workflows — restart it to pick up"));
         console.log(chalk14.dim('  the skill, then just say "set up Mutagent on this project".'));
@@ -22031,7 +22028,7 @@ Examples:
 }
 
 // src/commands/hooks/index.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { basename as basename4 } from "node:path";
 import { Command as Command10 } from "commander";
 import chalk16 from "chalk";
@@ -22180,7 +22177,7 @@ async function sendBatchTrace(traces) {
 import { randomUUID as randomUUID2 } from "crypto";
 
 // src/commands/hooks/state.ts
-import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, renameSync as renameSync2, unlinkSync, existsSync as existsSync9 } from "fs";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync4, renameSync as renameSync2, unlinkSync, existsSync as existsSync9 } from "fs";
 import { join as join15 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 function stateFilePath(sessionId) {
@@ -22191,7 +22188,7 @@ function readState(sessionId) {
   if (!existsSync9(path))
     return null;
   try {
-    const raw = JSON.parse(readFileSync7(path, "utf-8"));
+    const raw = JSON.parse(readFileSync6(path, "utf-8"));
     if (!Array.isArray(raw.parentStack)) {
       raw.parentStack = [];
     }
@@ -22206,7 +22203,7 @@ function readState(sessionId) {
 function writeState(sessionId, state) {
   const path = stateFilePath(sessionId);
   const tmpPath = `${path}.${process.pid.toString()}.tmp`;
-  writeFileSync5(tmpPath, JSON.stringify(state), "utf-8");
+  writeFileSync4(tmpPath, JSON.stringify(state), "utf-8");
   renameSync2(tmpPath, path);
 }
 function deleteState(sessionId) {
@@ -22819,7 +22816,7 @@ async function handlePostToolUseFailure() {
 }
 
 // src/commands/hooks/install.ts
-import { readFileSync as readFileSync8, writeFileSync as writeFileSync6, existsSync as existsSync10, mkdirSync as mkdirSync4 } from "fs";
+import { readFileSync as readFileSync7, writeFileSync as writeFileSync5, existsSync as existsSync10, mkdirSync as mkdirSync4 } from "fs";
 import { join as join16 } from "path";
 
 class SettingsParseError extends Error {
@@ -22887,12 +22884,12 @@ function installHooks(cwd) {
   const existed = existsSync10(settingsPath);
   let settings = {};
   if (existed) {
-    const raw = readFileSync8(settingsPath, "utf-8");
+    const raw = readFileSync7(settingsPath, "utf-8");
     try {
       settings = JSON.parse(raw);
     } catch (err) {
       const backupPath = `${settingsPath}.bak.${new Date().toISOString().replace(/:/g, "-")}`;
-      writeFileSync6(backupPath, raw, "utf-8");
+      writeFileSync5(backupPath, raw, "utf-8");
       throw new SettingsParseError(settingsPath, backupPath, err);
     }
   }
@@ -22925,7 +22922,7 @@ function installHooks(cwd) {
     if (!existsSync10(claudeDir)) {
       mkdirSync4(claudeDir, { recursive: true });
     }
-    writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + `
+    writeFileSync5(settingsPath, JSON.stringify(settings, null, 2) + `
 `, "utf-8");
   }
   if (added.length > 0) {
@@ -22991,7 +22988,7 @@ unparseable lines without sending anything.
     for (const file of files) {
       let raw;
       try {
-        raw = readFileSync9(file, "utf8");
+        raw = readFileSync8(file, "utf8");
       } catch (err) {
         const why = err instanceof Error ? err.message : String(err);
         report.push({ file: basename4(file), skipped: why });
@@ -23161,7 +23158,7 @@ Safe to run again.
 import { Command as Command11 } from "commander";
 import chalk19 from "chalk";
 import { type as osType, release as osRelease } from "os";
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { join as join18, dirname as dirname5 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 init_errors();
@@ -23174,7 +23171,7 @@ import { join as join17 } from "path";
 import {
   existsSync as fsExistsSync,
   statSync as fsStatSync,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync9,
   readdirSync,
   openSync,
   readSync,
@@ -23185,7 +23182,7 @@ var TAIL_BYTES = 200000;
 function defaultReadTail(path, tailBytes) {
   const { size } = fsStatSync(path);
   if (size <= tailBytes) {
-    return { content: readFileSync10(path, "utf-8"), truncated: false };
+    return { content: readFileSync9(path, "utf-8"), truncated: false };
   }
   const fd = openSync(path, "r");
   try {
@@ -23418,7 +23415,7 @@ var BY_DESIGN_ENTRIES = [
     id: "mutagent-helix-not-on-npm",
     title: "@mutagent/helix is not published to npm — on purpose",
     looksLike: pairPatterns(HELIX_PKG, NOT_FOUND),
-    reality: "Helix is not distributed through the public npm registry, so a 404 there is expected. It is delivered by the Mutagent CLI itself, which authenticates you, fetches a signed download from private storage, verifies its checksum, and initializes it into your project. Install it with: mutagent install helix"
+    reality: "Helix is not distributed through the public npm registry, so a 404 there is expected. It ships as a standalone binary from install.mutagent.io, verified against the checksums published beside it. Install it with: mutagent install helix"
   },
   {
     id: "trace-lives-in-a-different-binary",
@@ -23427,7 +23424,7 @@ var BY_DESIGN_ENTRIES = [
       ...pairPatterns(String.raw`mutagent\s+trace`, NOT_A_COMMAND),
       /\btrace\b[^\n]{0,40}?(?:not\s+a\s+(?:valid\s+)?(?:sub)?command|unknown\s+command)/i
     ],
-    reality: "trace is not a subcommand of mutagent. It lives in helix-cli — a different binary — which ships inside helix. Install it with: mutagent install helix, then run: helix-cli trace <args>"
+    reality: "trace is not a subcommand of mutagent. It lives in helix-cli — a different binary — which ships inside helix and is on the PATH of every helix session. Install helix with: mutagent install helix, then in a helix session run: helix-cli trace <args>"
   },
   {
     id: "two-separate-binaries",
@@ -23437,7 +23434,7 @@ var BY_DESIGN_ENTRIES = [
       /(?:helix-cli|mutagent-cli)\s+(?:binary|executable|command)[^\n]{0,60}?(?:missing|not\s+found|doesn'?t\s+exist|does\s+not\s+exist|not\s+installed)/i,
       new RegExp(String.raw`no\s+(?:helix-cli|mutagent-cli)[^\n]{0,40}?in\s+@mutagent\/cli`, "i")
     ],
-    reality: "mutagent and helix-cli are separate binaries that come from separate packages. @mutagent/cli provides the mutagent binary only — account, configuration, and installation commands. The helix-cli binary ships inside helix and carries the trace tooling. Having both installed is normal and expected."
+    reality: "mutagent and helix-cli are separate binaries that come from separate packages. @mutagent/cli provides the mutagent binary only — account, configuration, and installation commands. The helix-cli binary ships inside helix, is on the PATH of every helix session, and carries the trace tooling. Having both installed is normal and expected."
   }
 ];
 function matchByDesign(draft) {
@@ -23548,7 +23545,7 @@ function getCliVersion2() {
   try {
     const __dirname2 = dirname5(fileURLToPath3(import.meta.url));
     const pkgPath = join18(__dirname2, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync11(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync10(pkgPath, "utf-8"));
     return pkg.version ?? "0.1.1";
   } catch {
     return "0.1.1";
@@ -23747,45 +23744,73 @@ import { Command as Command12 } from "commander";
 import chalk20 from "chalk";
 init_errors();
 function createInstallCommand(deps) {
-  const install = new Command12("install").description("Install a Mutagent package on this machine (helix)").argument("<package>", `Package to install: ${VALID_PACKAGES.join(", ")}`).option("--harness <harness>", `Harness named in the output and the install report: ${VALID_HARNESSES.join(", ")}`, "claude-code").option("--global", "Refused: helix always installs into the current directory").option("--version <version>", "Package version to install (default: latest)").addHelpText("after", `
+  const install = new Command12("install").description("Install the standalone Helix binary on this machine").argument("<package>", `Package to install: ${VALID_PACKAGES.join(", ")}`).option("--channel <channel>", `Release channel: ${HELIX_CHANNELS.join(" or ")} (default: latest)`).addHelpText("after", `
 ${chalk20.bold("Examples:")}
   ${chalk20.dim("$")} mutagent install helix
-  ${chalk20.dim("$")} mutagent install helix --version <version>
+  ${chalk20.dim("$")} mutagent install helix --channel candidate
   ${chalk20.dim("$")} mutagent install helix --json
 
-${chalk20.bold("helix")}: the Helix agent-development toolkit, set up in the current directory for
-Claude Code and Codex (includes the diagnostics and evaluator skills and helix-cli).
-Requires \`mutagent login\`. This installs Helix locally; \`mutagent helix\` runs it in the cloud.
---harness does not change what is installed. --global exits with an error.
-    `).action(async (pkg, options) => {
+${chalk20.bold("helix")}: the standalone Helix binary, the same one
+\`curl -fsSL https://install.mutagent.io/helix | bash\` installs. It downloads
+helix-<os>-<arch> for macOS or Linux (x64, arm64), verifies it against
+checksums.txt from the same origin, writes ~/.mutagent/bin/helix and points the
+mutagent-helix alias at it, then runs helix --version. No login is needed; the
+CLI records the install activation when you are signed in, and never fails the
+install over it.
+Shell rc files are never changed: when the directory is not on PATH, the line to
+add is printed. This installs Helix on this machine; mutagent helix runs it in
+the cloud.
+
+${chalk20.bold("Environment:")}
+  MUTAGENT_HELIX_CHANNEL   latest or candidate; --channel wins
+  MUTAGENT_INSTALL_HOST    install host (default: https://install.mutagent.io)
+  MUTAGENT_INSTALL_DIR     install directory (default: ~/.mutagent/bin)
+
+AI Agent Directive:
+  This writes a binary to the user's machine: confirm with the user first.
+  Read binaryPath, version and onPath from --json. When onPath is false, show
+  the user pathLine; do not edit their shell rc files yourself.
+  telemetry in --json is sent, skipped (not signed in) or failed; it never
+  changes the install result.
+  Then tell the user to run helix in a project.
+`).action(async (pkg, options) => {
     const isJson = getJsonFlag(install);
     const output = new OutputFormatter(isJson ? "json" : "table");
     try {
-      const result = await installPackage(pkg, { harness: options.harness, global: options.global, version: options.version }, deps);
+      assertInstallTarget(pkg);
+      if (!isJson)
+        console.log(chalk20.dim(`Downloading and verifying ${pkg}…`));
+      const result = await installPackage(pkg, { channel: options.channel }, deps);
       if (isJson) {
         output.output({
           success: true,
           package: result.package,
+          channel: result.channel,
           version: result.version,
-          harness: result.harness,
-          scope: result.scope,
-          ...result.projectPath ? { projectPath: result.projectPath } : {},
-          skillInstalled: result.skillInstalled,
-          ...result.nextStep ? { nextStep: result.nextStep } : {},
+          binaryPath: result.binaryPath,
+          ...result.aliasPath !== undefined ? { aliasPath: result.aliasPath } : {},
+          sha256: result.sha256,
+          onPath: result.onPath,
+          ...result.pathLine !== undefined ? { pathLine: result.pathLine } : {},
+          nextStep: result.nextStep,
+          telemetry: result.telemetry,
           _links: {
-            install: "mutagent install <package> [--harness <h>] [--version <v>]",
-            login: "mutagent login"
+            installer: result.installerUrl,
+            checksums: result.checksumsUrl
           }
         });
-      } else if (result.skillInstalled) {
-        output.success(`Installed ${result.package}@${result.version} for ${result.harness} in ${result.projectPath ?? "this project"}`);
-      } else {
-        output.success(`Installed ${result.package}@${result.version}, but the skill is not in place yet`);
-        console.log(`${chalk20.yellow("⚠")} No skill was installed yet — a setup step still has to run.`);
-        if (result.nextStep) {
-          console.log(`${chalk20.blue("→")} Run next: ${chalk20.cyan(result.nextStep)}`);
-        }
+        return;
+      }
+      output.success(`Installed helix ${result.version} (${result.channel}) → ${result.binaryPath}`);
+      console.log(chalk20.dim(`  sha256 ${result.sha256}`));
+      if (result.aliasPath !== undefined) {
+        console.log(chalk20.dim(`  alias  ${result.aliasPath}`));
       }
+      if (result.pathLine !== undefined) {
+        console.log(`${chalk20.yellow("⚠")} The install directory is not on your PATH. Add this line to your shell profile:`);
+        console.log(`  ${chalk20.cyan(result.pathLine)}`);
+      }
+      console.log(`${chalk20.blue("→")} Next: ${result.nextStep}`);
     } catch (error3) {
       handleError(error3, isJson);
     }
@@ -23796,11 +23821,12 @@ Requires \`mutagent login\`. This installs Helix locally; \`mutagent helix\` run
 // src/commands/trace.ts
 import { Command as Command13 } from "commander";
 init_errors();
-var TRACE_RELOCATION_HINT = "trace lives in the `helix-cli` binary, which ships inside helix (install it with: mutagent install helix)";
+var TRACE_RELOCATION_HINT = "trace lives in the `helix-cli` binary, which ships inside helix and is on the PATH of every helix session (install helix with: mutagent install helix)";
 function createTraceCommand() {
   const trace = new Command13("trace").description("Not in this binary — trace lives in helix-cli").allowUnknownOption(true).allowExcessArguments(true).argument("[args...]", "Arguments intended for `helix-cli trace`").addHelpText("after", `
-mutagent does not run trace. trace is a command of helix-cli, which
-mutagent install helix installs. Run:
+mutagent does not run trace. trace is a command of helix-cli, which ships
+inside helix (mutagent install helix installs it) and is on the PATH of every
+helix session. In a helix session, run:
 
   helix-cli trace <args>
 
@@ -23808,8 +23834,8 @@ This command only prints where trace is and exits with an error.
 `).action((args) => {
     const isJson = getJsonFlag(trace);
     const forwarded = args.length > 0 ? ` ${args.join(" ")}` : " <args>";
-    handleError(new MutagentError("INVALID_ARGUMENTS", `\`mutagent trace\` is not a command — ${TRACE_RELOCATION_HINT}.`, `Run it with the other binary instead: helix-cli trace${forwarded}
-If helix-cli is not installed: mutagent install helix`), isJson);
+    handleError(new MutagentError("INVALID_ARGUMENTS", `\`mutagent trace\` is not a command — ${TRACE_RELOCATION_HINT}.`, `Run it with the other binary, in a helix session: helix-cli trace${forwarded}
+If helix is not installed: mutagent install helix`), isJson);
   });
   return trace;
 }
@@ -23824,8 +23850,8 @@ init_errors();
 // src/commands/helix/agent-argv.ts
 init_errors();
 import { homedir as homedir5 } from "os";
-import { basename as basename6, join as join19, isAbsolute as isAbsolute6, resolve as resolve7 } from "path";
-import { accessSync as accessSync3, constants as constants3, existsSync as existsSync11, readFileSync as readFileSync12, statSync as statSync4 } from "fs";
+import { basename as basename6, join as join19, isAbsolute as isAbsolute6, resolve as resolve8 } from "path";
+import { accessSync as accessSync3, constants as constants3, existsSync as existsSync11, readFileSync as readFileSync11, statSync as statSync4 } from "fs";
 
 // src/commands/helix/argv-transport.ts
 var HOST_PATH = "it names a path on THIS machine, and the sandbox is a different machine";
@@ -24137,7 +24163,7 @@ function redactCommanderError(text) {
 
 // src/commands/helix/planned-flags.ts
 init_errors();
-import { basename as basename5, isAbsolute as isAbsolute5, resolve as resolve6 } from "path";
+import { basename as basename5, isAbsolute as isAbsolute5, resolve as resolve7 } from "path";
 var OWN_FLAGS = {
   "--sandbox": true,
   "--preset": true,
@@ -24184,7 +24210,7 @@ function unreadableNotice(flag, name) {
   return `${flag}: ${name} could not be read, so the value is sent as literal text, as helix does locally.`;
 }
 function inlinePromptFile(flag, value2, deps) {
-  const path = isAbsolute5(value2) ? value2 : resolve6(deps.cwd, value2);
+  const path = isAbsolute5(value2) ? value2 : resolve7(deps.cwd, value2);
   const name = basename5(path);
   if (deps.fileExists(path)) {
     let text;
@@ -24228,7 +24254,7 @@ function defaultPlanDeps() {
   return {
     cwd: process.cwd(),
     env: process.env,
-    readTextFile: (path) => readFileSync12(path, "utf8"),
+    readTextFile: (path) => readFileSync11(path, "utf8"),
     fileExists: (path) => isRegularFile(path) && canRead(path),
     unreadable: (path) => isRegularFile(path) && !canRead(path)
   };
@@ -24393,7 +24419,7 @@ function resolveDefinition(source2, deps) {
     return { prompt, origin: "--prompt (inline)" };
   }
   if (source2.kind === "file") {
-    const path2 = isAbsolute6(source2.value) ? source2.value : resolve7(deps.cwd, source2.value);
+    const path2 = isAbsolute6(source2.value) ? source2.value : resolve8(deps.cwd, source2.value);
     if (deps.unreadable?.(path2) === true) {
       throw new MutagentError("INVALID_ARGUMENTS", `agent file is not readable: ${basename6(path2)}`, "Check its permissions. The file is read on THIS machine, and its contents travel.", 2);
     }
@@ -24518,7 +24544,7 @@ init_errors();
 init_secure_file();
 init_errors();
 init_known_secrets();
-import { existsSync as existsSync12, readFileSync as readFileSync13, mkdirSync as mkdirSync5, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync12, mkdirSync as mkdirSync5, rmSync as rmSync2 } from "fs";
 import { homedir as homedir6 } from "os";
 import { join as join20, dirname as dirname6 } from "path";
 function sandboxTokenFile() {
@@ -24538,7 +24564,7 @@ function createFileTokenStore(path) {
       if (!existsSync12(path))
         return null;
       try {
-        const parsed = JSON.parse(readFileSync13(path, "utf-8"));
+        const parsed = JSON.parse(readFileSync12(path, "utf-8"));
         return isCacheShape(parsed) ? parsed : null;
       } catch {
         return null;
@@ -24665,7 +24691,7 @@ async function stoppingRetryDelayMs(response) {
   const seconds = Number.isFinite(header) && header >= 0 ? header : 5;
   return Math.min(seconds * 1000, MAX_STOPPING_RETRY_MS);
 }
-async function withStoppingRetry(send, sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms))) {
+async function withStoppingRetry(send, sleep2 = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms))) {
   const first = await send();
   const delayMs = await stoppingRetryDelayMs(first);
   if (delayMs === null)
@@ -25390,18 +25416,18 @@ function isGapError(payload) {
   return payload.code === "gap";
 }
 function delay(ms, signal) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     if (signal.aborted) {
-      resolve8();
+      resolve9();
       return;
     }
     const timer = setTimeout(() => {
       signal.removeEventListener("abort", onAbort);
-      resolve8();
+      resolve9();
     }, ms);
     function onAbort() {
       clearTimeout(timer);
-      resolve8();
+      resolve9();
     }
     signal.addEventListener("abort", onAbort, { once: true });
   });
@@ -27410,7 +27436,7 @@ function createHelixCommand() {
     "  Choose -p, --mode json or --mode rpc explicitly.",
     "  Without --prime the full Helix orchestrator runs; --prime runs the lean Prime agent.",
     "  Keep the session reference (hs1_...) printed on stderr; attach, send, signal and checkpoint take it.",
-    "  mutagent install helix installs Helix on this machine; this command runs it in the cloud."
+    "  mutagent install helix installs the standalone Helix binary on this machine; this command runs it in the cloud."
   ].join(`
 `)).action(async (argv, _options, command) => {
     try {
@@ -28168,7 +28194,7 @@ Requires a workspace: mutagent config set workspace <workspace-id>
 // src/commands/env/index.ts
 import { Command as Command17 } from "commander";
 import chalk36 from "chalk";
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 init_errors();
 
 // src/lib/environment-api.ts
@@ -28482,7 +28508,7 @@ function readOptionalFile(path) {
   if (path === undefined)
     return;
   try {
-    return readFileSync14(path, "utf8");
+    return readFileSync13(path, "utf8");
   } catch {
     throw new MutagentError("FILE_NOT_FOUND", `Could not read env file: ${path}`, "Check the path. The file is read on THIS machine and its entries are sent; it is never uploaded as-is.", 2);
   }
@@ -29072,7 +29098,7 @@ if (process.env.CLI_VERSION) {
   try {
     const __dirname2 = dirname7(fileURLToPath4(import.meta.url));
     const pkgPath = join21(__dirname2, "..", "..", "package.json");
-    const pkg = JSON.parse(readFileSync15(pkgPath, "utf-8"));
+    const pkg = JSON.parse(readFileSync14(pkgPath, "utf-8"));
     cliVersion = pkg.version ?? cliVersion;
   } catch {}
 }
@@ -29091,7 +29117,7 @@ ${chalk37.yellow("Get started:")}
   mutagent login                          ${chalk37.dim("Sign in (browser or API key)")}
   mutagent providers mirror               ${chalk37.dim("Copy local Helix LLM provider keys into the workspace")}
   mutagent helix -p "<task>"              ${chalk37.dim("Run Helix in the cloud")}
-  mutagent install helix                  ${chalk37.dim("Install Helix on this machine")}
+  mutagent install helix                  ${chalk37.dim("Install the standalone Helix binary on this machine")}
 
 ${chalk37.yellow("Managed agents:")}
   mutagent agent deploy <agent.md>        ${chalk37.dim("Check, upload and activate an agent.md folder (--env names the slot)")}
@@ -29215,4 +29241,4 @@ if (isAgentInvocation(rawArgs)) {
   program.parse(argvForCommander, { from: "user" });
 }
 
-//# debugId=9E0A0E4D9358B89864756E2164756E21
+//# debugId=093DD78045AEB58864756E2164756E21