Install and update

Quick install

The installer detects macOS/Linux and CPU architecture, downloads the raw binary and its SHA-256 sidecar from the public RustFS release feed, verifies the digest, and installs to ~/.athena/bin/athena:

curl -fsS https://fs-service.leanscale.com/athena-cli/cli/install.sh | sh
export PATH="$HOME/.athena/bin:$PATH" # add to .zshrc or .bashrc
athena --version

Re-running the installer replaces only the executable. Existing config.toml and credentials.toml files remain byte-for-byte untouched.

Pin a release using either the crate version or canonical tag form:

curl -fsS https://fs-service.leanscale.com/athena-cli/cli/install.sh | sh -s -- --version 1.10.0
curl -fsS https://fs-service.leanscale.com/athena-cli/cli/install.sh | sh -s -- --version cli-v1.10.0

Direct verified download

The public release origin is https://fs-service.leanscale.com/athena-cli. Stable aliases live under cli/latest/; immutable versioned binaries live under cli/releases/<version>/.

macOS (Apple Silicon)

base=https://fs-service.leanscale.com/athena-cli/cli/latest
name=athena-aarch64-apple-darwin
curl -fsSo athena "$base/$name"
curl -fsSo athena.sha256 "$base/$name.sha256"
test "$(shasum -a 256 athena | awk '{print $1}')" = "$(awk '{print $1}' athena.sha256)"
chmod +x athena
mkdir -p ~/.athena/bin && mv athena ~/.athena/bin/athena

macOS (Intel)

base=https://fs-service.leanscale.com/athena-cli/cli/latest
name=athena-x86_64-apple-darwin
curl -fsSo athena "$base/$name"
curl -fsSo athena.sha256 "$base/$name.sha256"
test "$(shasum -a 256 athena | awk '{print $1}')" = "$(awk '{print $1}' athena.sha256)"
chmod +x athena
mkdir -p ~/.athena/bin && mv athena ~/.athena/bin/athena

Linux (x86_64)

base=https://fs-service.leanscale.com/athena-cli/cli/latest
name=athena-x86_64-unknown-linux-gnu
curl -fsSo athena "$base/$name"
curl -fsSo athena.sha256 "$base/$name.sha256"
test "$(sha256sum athena | awk '{print $1}')" = "$(awk '{print $1}' athena.sha256)"
chmod +x athena
mkdir -p ~/.athena/bin && mv athena ~/.athena/bin/athena

Windows (x86_64)

$base = "https://fs-service.leanscale.com/athena-cli/cli/latest"
$name = "athena-x86_64-pc-windows-msvc.exe"
Invoke-WebRequest "$base/$name" -MaximumRedirection 0 -OutFile athena.exe
Invoke-WebRequest "$base/$name.sha256" -MaximumRedirection 0 -OutFile athena.exe.sha256
$expected = (Get-Content athena.exe.sha256) -split '\s+' | Select-Object -First 1
$actual = (Get-FileHash athena.exe -Algorithm SHA256).Hash.ToLowerInvariant()
if ($actual -ne $expected) { throw "SHA-256 mismatch" }

Move athena.exe to a permanent directory and add that directory to the user PATH.

Caution

SHA-256 detects corruption between the published checksum and downloaded binary. It does not prove authenticity if the RustFS storage account is compromised, because an attacker could replace both. Artifact signing is explicitly out of scope for this release.

Verify the installer itself

The pipe-installer pattern trusts whatever its URL serves. Download the script first, verify the SHA-256 pinned here, inspect it if desired, then run it:

curl -fsS https://fs-service.leanscale.com/athena-cli/cli/releases/1.10.0/install.sh -o install.sh
echo "b0fd747d792120c7ac542c8c6b7408d7019e7f2e4610e608cc60356d98773ff8  install.sh" | shasum -a 256 -c -
sh install.sh

Pinned SHA-256 (matches the immutable 1.10.0 installer):

b0fd747d792120c7ac542c8c6b7408d7019e7f2e4610e608cc60356d98773ff8

Note

CI keeps this SHA in lockstep with install.sh. A mismatch means the script and docs are from different revisions; do not run it until they match.

Update

Starting with CLI 1.8.0, update explicitly at any time:

athena update

The command checks the same public RustFS feed, verifies the selected binary, and replaces the running executable. Invoking it is consent; there is no interactive prompt. It needs no Athena API URL, selected profile, workspace, login, or token.

One-time 1.7.1 bootstrap

CLI 1.7.1 has no athena update command. To move from 1.7.1 to 1.8.0, re-run the installer once. Future releases can use athena update.

Starter configuration

On a new install only, the installer writes:

default_profile = "dev"

[profile.dev]
api_url = "https://athena-dev-api.leanscale.com"

[profile.beta]
api_url = "https://athena-beta-api.leanscale.com"

[profile.prod]
api_url = "https://athena-api.leanscale.com"

Existing config is never rewritten because doing so would lose comments and formatting. If your config predates the beta profile, add this block manually:

[profile.beta]
api_url = "https://athena-beta-api.leanscale.com"

default_profile selects the profile used when no flag or environment override is present. There is no active_profile setting.

~/.athena/ layout

After install + first login:

~/.athena/
  bin/
    athena             executable
  config.toml          editable profiles and workspace selection
  credentials.toml     chmod 600, written by athena login; never edit
  cache/               schema cache

Tip

config.toml is safe to commit to personal dotfiles after scrubbing active_workspace. credentials.toml contains refresh tokens; never commit it.

ATHENA_INSTALL_DIR changes the installer’s root directory. ATHENA_CONFIG_DIR changes where the CLI reads config and credentials. Set both to the same directory when moving the complete tree.

Next steps

• Quickstart → — login, pick a workspace, run an agent
• Authentication → — profiles, overrides, and refresh tokens