Install the CLI

The public CLI beta supports Apple Silicon macOS and offers an Ubuntu x86_64 preview. The macOS binary is checksum-verified and Developer ID-signed, but it is not a notarized app bundle or a universal binary. Linux releases authenticate checksums with a pinned publisher SSH key. Source repositories remain private; reviewed binary releases are distributed through the public c6shq/tap boundary.

macOS prerequisites

• an Apple Silicon Mac;
• Homebrew for the recommended Formula path, or curl and sh for the standalone path.

Install on macOS with Homebrew

Use the fully qualified Formula name. Homebrew adds the public tap and trusts only the selected Formula:

brew install c6shq/tap/c6s-cli

The Formula uses an immutable versioned URL and exact SHA-256 checksum.

Install on macOS without Homebrew

The standalone installer downloads the latest public binary mirror, verifies it against checksums.txt, checks the one-file archive layout, and atomically installs to ~/.local/bin/c6s:

curl -fsSL https://c6s.whitekiwi.link/install.sh | sh

If ~/.local/bin is not already on PATH, add it using the normal configuration for your shell. The installer does not edit shell startup files. To pin a release or choose another directory:

curl -fsSL https://c6s.whitekiwi.link/install.sh | \
  C6S_VERSION=v0.11.4 C6S_INSTALL_DIR="$HOME/.local/bin" sh

Install on Ubuntu x86_64 (preview)

Use your normal Ubuntu GNOME desktop login with an already unlocked persistent default keyring. The CLI requires the existing user's D-Bus session and Secret Service. Headless SSH or containers without that service cannot store credentials.

sudo apt install curl ca-certificates python3 openssh-client
curl -fsSL https://github.com/c6shq/homebrew-tap/releases/download/c6s-linux-latest/install-linux.sh | sh
export PATH="$HOME/.local/bin:$PATH"
c6s version
c6s channel
c6s protocol verify
c6s doctor --json

The installer verifies the publisher signature, archive SHA-256, Linux x86_64 executable and version/channel before atomically replacing ~/.local/bin/c6s. It refuses symlink destinations. It does not edit shell startup, account or vault configuration. Add the PATH line to your shell configuration if needed. License notices are installed under ${XDG_DATA_HOME:-$HOME/.local/share}/c6s/c6s.

For a fixed version:

curl -fsSL https://github.com/c6shq/homebrew-tap/releases/download/c6s-linux-v0.11.5/install-linux.sh -o install-linux.sh
C6S_VERSION=v0.11.5 sh install-linux.sh

Linux preview binaries use the existing stable CLI channel and production server. The platform preview does not establish support for every Ubuntu version or complete live-account and approval/replay acceptance. Linux ARM64 packages are not published. The public release includes signed checksums, SBOM and publisher-signed provenance. The publisher key fingerprint is SHA256:Esv3OhmqQzqPeWRzSiHlnxmaq/3KWXMtjzte/2n2TIs.

Linux uses exportable software keys stored by your existing Secret Service; it does not offer hardware or biometric protection. A successful doctor reads session metadata and does not verify account access. If it reports secret_service_locked, unlock the existing keyring in that desktop session, then retry. The CLI does not create or unlock a keyring or use plaintext fallback.

Verify

c6s version
c6s protocol verify

Sign in and enroll this CLI device

Production builds do not include an account-free demo. Sign in with an invited account, enroll this CLI device, then connect its device-wrapped Personal vault key:

c6s login --provider google
c6s whoami
c6s device enroll
c6s device remote-status
c6s vault connect
c6s item list --remote

The first trusted iPhone or another accepted recovery path must approve a new CLI device. These commands never print a private device key, vault key, or secret value.

Initialize local device keys

c6s device setup
c6s device status

On macOS, setup stores independent encryption and signing key material in login Keychain using a device-only, when-unlocked accessibility class. The command prints only public fingerprints and a local display identifier.

On Linux, setup uses the existing unlocked default Secret Service collection. The service controls at-rest protection; software keys enter CLI memory during use. Same-user processes and administrators are outside that protection boundary.

Use the encrypted local vault

Initialize a local Personal vault and create an item:

c6s vault init
c6s item create --kind api_credential --title "Build service" --json

Copy the returned item ID. Secret values enter through standard input so they do not appear in the process argument list:

printf %s "$TOKEN" | \
  c6s item set ITEM_ID --field Token --value-stdin
c6s item list
c6s item inspect ITEM_ID

On macOS, Keychain stores the random root key with device-only, when-unlocked protection. On Linux, the existing Secret Service collection stores that root key under the software-key protection described above. The local file stores independently authenticated metadata and secret ciphertext; titles, labels, and values are not plaintext. List, inspect, mutation, and MCP output never includes a value. If you explicitly need raw output, use c6s item reveal ITEM_ID --field Token --show and treat stdout as secret material.

The stable CLI can authenticate multiple account profiles, enroll a CLI device, connect to its device-wrapped Personal vault key, inspect encrypted remote item metadata, and request one approved execution. Continue with the CLI reference after installation. The local-only vault commands remain separate and do not silently merge with a hosted Personal vault.

Update

For Homebrew installs, run brew upgrade c6s-cli. For standalone installs, repeat the installer for your platform; it verifies and atomically replaces the executable.