Releases and verification
Choose a version
Use the npm package and clibox GitHub releases to select a published version. GitHub release tags use clibox@v<version>. The main npm package and its selected native package must have the same exact version.
For example, pin the published 0.1.6 version with either package manager:
Run clibox --version through that project's package manager and commit the manifest and lockfile. Review Migration when upgrading scripts using older names. Version 0.1.6 includes env run, port list, and hash compute. The next release renames environment execution to run env and adds the five run with-* execution wrappers; neither change is present in the published 0.1.6 artifacts. Use the version-specific examples in Getting started.
Distribution and verification
npm distributes prebuilt executables for macOS/Windows x64 and arm64 and Linux x64/arm64 with glibc or musl. Keep optional dependencies enabled. Installation needs no Rust compiler, installation script, or runtime binary download. Registry integrity and the lockfile bind the selected package bytes; npm publication provides provenance.
GNU Linux GitHub releases contain clibox-linux-amd64.tar.gz, clibox-linux-arm64.tar.gz, SHA256SUMS, and Sigstore bundles. Download assets from the same release. Before running a binary, verify the archive and checksum-file bundles using a trusted installation of Cosign, the exact signing identity below, and the GitHub Actions OIDC issuer. This example uses version 0.1.6 and the x64 archive:
The identity accepts the release tag or the official main-branch signer, always bound to the exact release source commit. For another version, use its tag and independently resolve its full commit from the official repository before replacing the SHA above; do not take the expected commit from the downloaded bundle. Use the arm64 asset name when appropriate. Compare the archive's SHA-256 digest with its entry in the authenticated SHA256SUMS; on Linux, sha256sum --ignore-missing --check SHA256SUMS checks the archives downloaded into that directory. Require a successful verification of the selected archive. Do not treat a checksum alone as publisher authentication, and do not use an unverified downloaded executable to verify itself.
Native package availability
APT/DNF integration uses the stable channel, but native packages are not published yet. Follow Linux package setup only after the package's first public installation verification. GNU archives require glibc 2.34 or newer; Alpine uses npm musl packages. Homebrew and crates.io installation are not supported.
Use an earlier version
Replace the version in the exact npm/pnpm installation command with the earlier published version you intend to use, then commit the updated lockfile. Except for run with-lock and run with-rate-limit, clibox stores no application state to migrate. Those wrappers retain private local coordination state, which can affect later invocations or reject an incompatible rate configuration after reinstall. Stop every affected invocation before deciding to remove that state; clibox provides no cleanup command. Downgrading changes command behavior; it cannot restore overwritten files, clipboard contents, terminated processes, or other completed effects. Keep your own backups when replacing files.