Command reference
oko-cli install
Puts the running build where the launch agents and the operator’s shell find it, signed with a stable identity, and restarts the control loop when it runs the executable that was replaced.
Invocation#
oko-cli install [--into PATH] [--identity NAME]Inputs and options#
- --into selects the executable to write; ~/.stado/bin/oko-cli is the default and the path the control loop’s launch agent runs.
- --identity names the codesigning identity; the default is the keychain’s Developer ID Application identity, else its Apple Development one.
Output and state effect#
- Copies this executable next to the destination, signs the copy as ai.wisent.oko.oko-cli — the identifier macOS keys the CLI’s Documents and Full Disk Access grants on — and moves it over the destination in one step, so a loop reading the old file keeps its inode until restarted.
- When the ai.wisent.oko.tasks-control launch agent’s plist names the replaced executable and the agent is loaded, kickstarts it so the loop runs the new build and says so; an install elsewhere prints that the loop was left alone.
Refusals and safe exits#
- Refuses to install a build over itself (`is already the installed build`), refuses without a stable identity because ad-hoc signing changes the TCC identity and makes macOS ask for Documents access again, and when codesign refuses the named identity removes the staged copy and prints codesign’s sentence; nothing is written on refusal.