# Install tanomis

Install the tanomis CLI on macOS, Linux, or Windows with one command, verify the download, pin a version in CI, and upgrade.

The `tanomis` CLI is how you author, deploy, roll out, and inspect agents from a terminal or a
pipeline. It is a single static binary with no dependencies.

- macOS and Linux: `curl -fsSL https://get.tanomis.com/install.sh | sh`
- Windows: `irm https://get.tanomis.com/install.ps1 | iex`
- Every release ships with `SHA256SUMS` and a keyless cosign signature; the installer verifies
  the checksum before it installs anything.
- Pin a version in CI with `TANOMIS_VERSION=v0.2.0`.

## macOS and Linux

```bash
curl -fsSL https://get.tanomis.com/install.sh | sh
```

The installer detects your operating system and architecture (amd64 or arm64), downloads the
release archive and its checksums, verifies the SHA-256, and installs `tanomis` to `/usr/local/bin`
when that is writable, otherwise to `~/.local/bin`. It tells you if that directory is not on your
`PATH`.

```text title="Output"
Installing tanomis v0.2.0 for darwin/arm64 from https://get.tanomis.com/tanomis/v0.2.0
Installed: tanomis v0.2.0 (commit <commit>, built <date>) -> /usr/local/bin/tanomis
Next: tanomis login --console https://api.tanomis.com --name saas
```

| Variable | Effect |
|---|---|
| `TANOMIS_VERSION` | Install this release instead of the latest, for example `v0.2.0`. |
| `TANOMIS_INSTALL_DIR` | Install into this directory instead of the default. |
| `TANOMIS_ARCH` | Override the detected architecture, `amd64` or `arm64`. |

The former `COG_VERSION`, `COG_INSTALL_DIR`, and `COG_ARCH` settings remain fallbacks when their
`TANOMIS_*` counterparts are unset. The installer also writes a `tanomis` compatibility shim that
prints `cog: deprecated, use tanomis` to stderr and forwards arguments to `tanomis`. An unrelated
existing `tanomis` executable is left in place.

## Windows

```powershell
irm https://get.tanomis.com/install.ps1 | iex
```

The script installs `tanomis.exe` to `%LOCALAPPDATA%\Programs\tanomis`, adds that directory to your user
`PATH`, and verifies the zip's SHA-256 the same way. Open a new terminal afterwards. The same
`TANOMIS_VERSION` and `TANOMIS_INSTALL_DIR` variables apply.

## Verify a download by hand

Every release directory carries `SHA256SUMS`, signed keyless with cosign by the release
workflow. To verify a download yourself:

```bash
base=https://get.tanomis.com/tanomis/v0.2.0
curl -fsSLO "$base/SHA256SUMS"
curl -fsSLO "$base/SHA256SUMS.sig"
curl -fsSLO "$base/SHA256SUMS.pem"
cosign verify-blob --signature SHA256SUMS.sig --certificate SHA256SUMS.pem \
  --certificate-identity-regexp '^https://github.com/anyfind/agent-platform/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
curl -fsSLO "$base/tanomis_v0.2.0_linux_amd64.tar.gz"
sha256sum --check --ignore-missing SHA256SUMS
```

## Pin a version in CI

Installing in a job is the same one-liner with the version pinned, so a release never changes a
pipeline under you:

```yaml title=".github/workflows/agent.yml"
      - run: curl -fsSL https://get.tanomis.com/install.sh | sh
        env:
          TANOMIS_VERSION: v0.2.0
          TANOMIS_INSTALL_DIR: /usr/local/bin
```

See [Deploy from CI](/guides/deploy/deploy-from-ci) for the rest of the job and
[Automation credentials](/guides/deploy/automation-credentials) for its login.

## Upgrade

Run the installer again. It replaces the binary in place, and `TANOMIS_VERSION` unset means the
latest release. `tanomis version` prints the installed version, commit, and build date.

## Shell completion

```bash
tanomis completion zsh > "${fpath[1]}/_tanomis"     # zsh
tanomis completion bash > /etc/bash_completion.d/tanomis
tanomis completion fish > ~/.config/fish/completions/tanomis.fish
```

## Where to go next

- [Get access](/getting-started/get-access): a workspace to sign in to.
- [Authenticate and select a workspace](/getting-started/authenticate-and-select-workspace):
  the first login.
- [Quickstart](/getting-started/quickstart): deploy and run your first agent.