Why
Agent sandboxes allow package-manager traffic by default and treat most other downloads as exceptions. npm is on every default allowlist we've checked (Claude Code cloud, Codex cloud, Copilot's agent firewall, Cowork); GitHub release downloads are blocked in some — Claude Code cloud sessions return 403 for release assets from repos not attached to the session (observed 2–3 Sept 2026). The skill-directory security scanners pass skills that install their tool through a package manager and flag direct binary downloads and piped installs.
The Autonomi agent skill's first step is getting ant onto the machine. An npm package makes that one line that works wherever agents run and passes the auditors — now a common distribution channel for agent tooling.
This is packaging only: the same signed Rust binary from GitHub Releases, delivered a second way. install.sh and the release page stay as they are.
Precedent
Using npm — traditionally a JavaScript package manager — to ship a native binary looks odd, but it's now commonplace, for exactly the reason above: it's the one channel every developer machine and every agent sandbox already has. Rust tools distributed this way include Biome, Turborepo, swc, Deno, Lightning CSS, Rspack, oxlint and the Tauri CLI. The mechanism is the one esbuild established: a small meta package with one optionalDependencies entry per platform (os/cpu fields), so npm install fetches only the binary for the machine it's on.
Stripe is the clearest example of doing this for agents. Its CLI is a Go binary, distributed as @stripe/cli on npm, and its whole agent onboarding rests on that: npm install -g @stripe/cli && stripe agent setup — the CLI then detects the harness (Claude Code, Codex, Cursor) and installs Stripe's skill, plugin and MCP server into it. The knowledge ships with the tool, so the two never drift apart. That's the path ant could take later — an ant agent setup that installs the Autonomi skill — and npm distribution is its first step.
Proposal
- Name: scoped, e.g.
@withautonomi/ant. (antd on npm is Ant Design; never ours.)
- Packages: one per release target (the five in
SHA256SUMS.txt), each holding the archive contents, verified against the checksums and .sig in CI before publishing.
- Publishing: from the existing release workflow on each
ant-cli-v* tag, same version as the tag, with npm provenance via GitHub OIDC. A beta dist-tag mirrors the beta channel.
- Behaviour: identical to an
install.sh install — bootstrap_peers.toml lands in the same config directory. ant update recognises an npm-managed install and defers to npm update.
Acceptance
npm install -g @withautonomi/ant gives a working ant --version on all five targets with registry access only.- Published binaries are byte-identical to the release assets.
npm uninstall -g @withautonomi/ant removes everything except the config directory.
Related, separate
Unversioned release-asset aliases (so releases/latest/download/… doesn't go stale per release); checksum verification inside install.sh/install.ps1; a secrets mechanism so agents can pay without a raw key in SECRET_KEY.
Why
Agent sandboxes allow package-manager traffic by default and treat most other downloads as exceptions. npm is on every default allowlist we've checked (Claude Code cloud, Codex cloud, Copilot's agent firewall, Cowork); GitHub release downloads are blocked in some — Claude Code cloud sessions return 403 for release assets from repos not attached to the session (observed 2–3 Sept 2026). The skill-directory security scanners pass skills that install their tool through a package manager and flag direct binary downloads and piped installs.
The Autonomi agent skill's first step is getting
antonto the machine. An npm package makes that one line that works wherever agents run and passes the auditors — now a common distribution channel for agent tooling.This is packaging only: the same signed Rust binary from GitHub Releases, delivered a second way.
install.shand the release page stay as they are.Precedent
Using npm — traditionally a JavaScript package manager — to ship a native binary looks odd, but it's now commonplace, for exactly the reason above: it's the one channel every developer machine and every agent sandbox already has. Rust tools distributed this way include Biome, Turborepo, swc, Deno, Lightning CSS, Rspack, oxlint and the Tauri CLI. The mechanism is the one esbuild established: a small meta package with one
optionalDependenciesentry per platform (os/cpufields), sonpm installfetches only the binary for the machine it's on.Stripe is the clearest example of doing this for agents. Its CLI is a Go binary, distributed as
@stripe/clion npm, and its whole agent onboarding rests on that:npm install -g @stripe/cli && stripe agent setup— the CLI then detects the harness (Claude Code, Codex, Cursor) and installs Stripe's skill, plugin and MCP server into it. The knowledge ships with the tool, so the two never drift apart. That's the pathantcould take later — anant agent setupthat installs the Autonomi skill — and npm distribution is its first step.Proposal
@withautonomi/ant. (antdon npm is Ant Design; never ours.)SHA256SUMS.txt), each holding the archive contents, verified against the checksums and.sigin CI before publishing.ant-cli-v*tag, same version as the tag, with npm provenance via GitHub OIDC. Abetadist-tag mirrors the beta channel.install.shinstall —bootstrap_peers.tomllands in the same config directory.ant updaterecognises an npm-managed install and defers tonpm update.Acceptance
npm install -g @withautonomi/antgives a workingant --versionon all five targets with registry access only.npm uninstall -g @withautonomi/antremoves everything except the config directory.Related, separate
Unversioned release-asset aliases (so
releases/latest/download/…doesn't go stale per release); checksum verification insideinstall.sh/install.ps1; a secrets mechanism so agents can pay without a raw key inSECRET_KEY.