feat(install): add get.xagent.co one-line installer - #760
Conversation
Add scripts/install.sh — the installer served at https://get.xagent.co: curl -fsSL https://get.xagent.co | sh It installs the published `xagent-ai` package via `uv tool install` (isolated, no system-Python/PEP 668), bootstrapping uv if missing, and prints how to start the server. Supports XAGENT_VERSION pinning; POSIX sh; Linux/macOS. Also add: - scripts/get.xagent.co/: a Cloudflare Worker (+ wrangler.toml, README) that serves the script pinned to the latest release tag (falls back to main). - .github/workflows/install-script.yml: ShellCheck plus an end-to-end smoke test that runs the installer on Linux and macOS and asserts `xagent --help`, so the one-liner can't silently rot.
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a Cloudflare Worker and an installation script (scripts/install.sh) to allow users to install xagent-ai via a simple curl one-liner. The worker fetches the installer script from the latest GitHub release tag, falling back to main if necessary. The review feedback suggests several robustness improvements: saving and using the original PATH in the installer script to accurately warn users if the command is not on their path, wrapping GitHub API and worker fetch handlers in try/catch blocks to prevent unhandled exceptions, and restricting the worker to only serve requests on the root path.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
- install.sh: capture ORIG_PATH before mutating PATH and use it for the final 'not on PATH' warning, so the warning reflects the user's real shell env rather than the PATH the script temporarily extended. - worker.js: wrap the GitHub release lookup and the whole request handler in try/catch so an API outage or unexpected error degrades to the main fallback / a clean 502 text response instead of a Cloudflare HTML 500; only serve the installer at the root path.
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request introduces a Cloudflare Worker and an installation script to support a one-liner installation of Xagent via curl -fsSL https://get.xagent.co | sh. The Cloudflare Worker resolves and serves the installer script from the latest GitHub release tag, falling back to main if necessary. The installer script bootstraps uv if it is missing and installs the xagent-ai package. The review feedback highlights three improvement opportunities: stripping a leading 'v' from XAGENT_VERSION for PyPI compatibility, refining the PATH warning in the installer script when uv is newly installed, and ensuring the Cloudflare Worker's x-xagent-install-ref header accurately reflects the fallback reference if the release tag fetch fails.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
- install.sh: strip a leading 'v' from XAGENT_VERSION (v0.6.0 -> 0.6.0) so a git-tag-style value installs; when uv was just installed and isn't on the parent shell's PATH, tell the user to open a new terminal / export PATH rather than run 'uv tool update-shell' (which wouldn't be found). - worker.js: report the actually-served ref in x-xagent-install-ref when the release tag is missing the script and it falls back to main.
A public curl | sh installer must not serve unreleased code. Drop the main fallback: resolve the latest release tag and serve scripts/install.sh at that immutable tag; on any lookup/fetch failure (API outage, rate-limit, tag missing the script) return 502 instead of falling back to the floating main ref. The endpoint therefore requires a release that includes the script to exist; noted in the README.
The installer workflow only triggered on scripts/install.sh and had no check for the hosted worker. Add scripts/get.xagent.co/** to the path filters and a Node syntax check of worker.js (fed via stdin so --input-type=module applies).
rogercloud
left a comment
rogercloud
left a comment
There was a problem hiding this comment.
A few non-blocking minor suggestions from review (all prior findings on this PR are already fixed — nice work on the fail-closed release resolution).
…tests - worker.js: add AbortSignal.timeout to both outbound fetches so a stuck upstream fails closed (502) fast instead of hanging the curl | sh client. - install.sh: reject an XAGENT_VERSION that is empty after stripping a leading 'v' (e.g. 'v') with a clear message; simplify the uv PATH-prepend (drop the redundant dedup — first match wins and PATH isn't printed). - get.xagent.co: add functional tests (Node built-in runner, no deps) covering fail-closed 502, non-root 404, and serving from the resolved release tag; package.json marks the dir ESM so 'node --check'/imports work directly. CI runs 'node --test' for the worker.
rogercloud
left a comment
rogercloud
left a comment
There was a problem hiding this comment.
Summary: This PR adds a public curl -fsSL https://get.xagent.co | sh installer for xagent-ai: a POSIX install.sh that bootstraps uv and installs the package, a Cloudflare Worker that serves the script pinned to the latest GitHub release (failing closed with 502 rather than falling back to a floating ref), and CI covering both. This follow-up commit addresses all 4 minor findings from the previous review round: fetch timeouts on the Worker, a guard against a degenerate XAGENT_VERSION value, a PATH-dedup simplification, and new functional tests for the Worker's fail-closed/routing logic.
Verdict: Approve. All prior findings (this round and the prior one) are fixed and verified against the current code. No blocking issues.
A few optional nits for a future follow-up (not blocking, not requested for this PR):
- The PATH-dedup removal can produce a duplicate PATH entry if
~/.local/binis already present — harmless (doesn't affect resolution, PATH is never printed to the user). - The
XAGENT_VERSIONguard still lets a whitespace-only value (e.g. a single space) through, since stripping a leadingvfrom it stays non-empty — would surface as a less friendlyuverror rather than this script's own message. Low priority. - The new
worker.test.mjstests cover the!res.okearly-return branches (500/404) but not thetry/catchexception branches — anAbortSignal.timeoutabort or ares.json()parse failure never actually executes in any test, even though both end up calling the sameUNAVAILABLE()helper. Worth a follow-up test that makesfetchreject. - No
actions/setup-nodepin in the workflow; relying on the runner's default Node is consistent with the file's existing style (e.g. relying on preinstalledshellcheck) and low risk in practice, but pinning would be more future-proof.
- worker.test.mjs: add two tests where fetch rejects (release lookup, and raw script fetch), exercising the try/catch paths an AbortSignal.timeout abort or malformed JSON would hit — previously only the !res.ok branches were covered. - install-script workflow: add actions/setup-node (pin 22) so node --test and AbortSignal.timeout don't rely on the runner's default Node version. (Two other nits left as-is per the reviewer: the dropped PATH dedup is harmless and was requested in a prior round; an all-whitespace XAGENT_VERSION still surfaces uv's own error — out of scope.)
3 participants
Adds the
curl | shinstall path for the single-machine (pip/uvx) deployment.curl -fsSL https://get.xagent.co | shWhat's here
scripts/install.sh— POSIXshinstaller. Bootstrapsuvif missing, thenuv tool install --upgrade xagent-ai(isolated env — no system Python, no PEP 668), and prints how to start the server. Linux/macOS; Windows users are pointed atpip. SupportsXAGENT_VERSIONto pin. Documents theuv tool install xagent-aimanual equivalent for those who don't want to pipe curl into sh.scripts/get.xagent.co/— a Cloudflare Worker (+wrangler.toml, README) that serves the script pinned to the latest release tag (falls back tomain), so the public one-liner always serves a shipped, reviewed version..github/workflows/install-script.yml— ShellCheck + an end-to-end smoke test that actually runs the installer on Linux and macOS and assertsxagent --help, so the one-liner can't silently rot. Gated to when the script changes.Verified
Ran
scripts/install.shlocally end to end (isolatedUV_TOOL_DIR/UV_TOOL_BIN_DIR): it installsxagent-ai, drops thexagent/xagent-webentry points, andxagent --helpworks.sh -n, workflow YAML, and worker ESM all validate.Deploy note (outside this PR)
get.xagent.coneeds a one-timewrangler deployfrom the Cloudflare account that owns thexagent.cozone (seescripts/get.xagent.co/README.md).