Rename release assets: phantom-agent-install.sh, phantom-cli-admin (PHANTOM-5)

The installer asset gains the phantom- prefix so it reads unambiguously
outside the repo's context, and the admin CLI sorts next to phantom-cli.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: wddwycc

.github/workflows/release.yml

@@ -187,7 +187,7 @@ jobs:
           mkdir release
           cp dist-agent           release/phantom-agent
           cp dist-phantom         release/phantom-cli
-          cp dist-phantom-admin   release/phantom-admin-cli
+          cp dist-phantom-admin   release/phantom-cli-admin
           cp dist-phantom-app.zip release/phantom-daemon.zip
           phantom-agent/make-install-script.sh dist-agent \
             "https://github.com/${{ github.repository }}/releases/download/${{ needs.cut.outputs.tag }}/phantom-agent" \

CLAUDE.md

@@ -80,7 +80,7 @@ cd phantom-cli
 bun run src/main.ts health
 ```
 
-**Deploy guest agent**: VMs bootstrap it from the published `agent-install.sh`
+**Deploy guest agent**: VMs bootstrap it from the published `phantom-agent-install.sh`
 release asset; see [phantom-agent/README.md](phantom-agent/README.md) for the
 dev override.
 

docs/authoring-images.md

@@ -41,7 +41,7 @@ Setup Assistant is driven with no guest-side software: the daemon serves the VM'
 framebuffer from the host via `_VZVNCServer` (a private API, invoked by
 reflection) and a Swift VNC client injects keystrokes and clicks on-screen text
 located with Vision.framework OCR. The agent is bootstrapped by one VNC-typed
-Terminal command that fetches the published `agent-install.sh` release asset
+Terminal command that fetches the published `phantom-agent-install.sh` release asset
 over the guest's NAT network and runs it as root — the installer verifies the
 binary against a SHA-256 pinned into it at release time. Everything after that
 runs through `vm.exec` over vsock — no SSH. To build with an unreleased agent,
@@ -135,9 +135,9 @@ changed wording.
 5. **Install the agent** — in the guest's Terminal:
 
    ```bash
-   curl -fsSL https://github.com/phantom-vm/phantom/releases/latest/download/agent-install.sh \
-     -o /tmp/agent-install.sh
-   sudo sh /tmp/agent-install.sh
+   curl -fsSL https://github.com/phantom-vm/phantom/releases/latest/download/phantom-agent-install.sh \
+     -o /tmp/phantom-agent-install.sh
+   sudo sh /tmp/phantom-agent-install.sh
    ```
 
    It downloads `/usr/local/bin/phantom-agent`, verifies its pinned SHA-256,

docs/design.md

@@ -282,7 +282,7 @@ Daemon                    Guest Agent           Shell
 - `HardwareModel` - CPU/hardware configuration
 
 VMs get no host directory share: everything the guest needs arrives over the
-network (the agent bootstrap fetches the published `agent-install.sh` release
+network (the agent bootstrap fetches the published `phantom-agent-install.sh` release
 asset; a local `--xcode` .xip is served over an ephemeral HTTP server) or over
 vsock. A VirtioFS share would expose a host directory read-write to CI VMs
 running untrusted code.
@@ -598,7 +598,7 @@ The OCI config blob is: `{"architecture":"arm64","os":"darwin"}`
 
 1. **Resolve IPSW** — `ipsw.list`; use `--ipsw` or the single downloaded IPSW
 2. **Install** — `vm.create` (returns `vmId` immediately), poll `vm.list` until `running`
-3. **Setup Assistant** — `vm.bootScript` with `provision/setup-tahoe.txt`, poll `vm.bootScript.status` until `completed`; this also bootstraps the agent inside the guest via one VNC-typed Terminal command that fetches the published `agent-install.sh` release asset and runs it as root (the installer checks the binary against a SHA-256 pinned at release time). `--agent-url` rewrites that fetch to a dev-served installer, so agent development doesn't require cutting a release
+3. **Setup Assistant** — `vm.bootScript` with `provision/setup-tahoe.txt`, poll `vm.bootScript.status` until `completed`; this also bootstraps the agent inside the guest via one VNC-typed Terminal command that fetches the published `phantom-agent-install.sh` release asset and runs it as root (the installer checks the binary against a SHA-256 pinned at release time). `--agent-url` rewrites that fetch to a dev-served installer, so agent development doesn't require cutting a release
 4. **Provision** — `vm.exec` runs `provision/provision.sh` over vsock (passwordless sudo, auto-login, no sleep)
 5. **Install gitlab-runner** (unless `--no-gitlab-runner`) — see below
 6. **Install Xcode** (optional `--xcode <url|path>`) — see below

docs/releasing.md

@@ -25,8 +25,9 @@ never fire.
 | Asset | What |
 | --- | --- |
 | `phantom-cli` | user CLI (arm64, `bun --compile`) |
-| `phantom-admin-cli` | admin CLI — adds image authoring/publishing commands |
+| `phantom-cli-admin` | admin CLI — adds image authoring/publishing commands |
 | `phantom-agent` | guest agent (arm64), what the guest bootstrap fetches |
+| `phantom-agent-install.sh` | guest bootstrap installer — fetches `phantom-agent` from this release's versioned URL and verifies its pinned SHA-256 |
 | `phantom-daemon.zip` | the daemon app, Developer ID signed and notarized |
 
 Each asset's SHA-256 is computed by GitHub at upload and served as

phantom-agent/README.md

@@ -9,9 +9,9 @@ asset that downloads the binary, verifies it against a SHA-256 pinned at
 release time, and loads the launchd daemon. Inside the guest:
 
 ```bash
-curl -fsSL https://github.com/phantom-vm/phantom/releases/latest/download/agent-install.sh \
-  -o /tmp/agent-install.sh
-sudo sh /tmp/agent-install.sh
+curl -fsSL https://github.com/phantom-vm/phantom/releases/latest/download/phantom-agent-install.sh \
+  -o /tmp/phantom-agent-install.sh
+sudo sh /tmp/phantom-agent-install.sh
 ```
 
 This is exactly what `provision/setup-tahoe.txt` types into the guest during
@@ -38,7 +38,7 @@ release publishes can be generated locally:
 
 ```bash
 swift build -c release
-./make-install-script.sh .build/release/phantom-agent <url-you-will-serve-the-binary-at> > agent-install.sh
+./make-install-script.sh .build/release/phantom-agent <url-you-will-serve-the-binary-at> > phantom-agent-install.sh
 ```
 
 To get a dev build into a VM:
@@ -66,10 +66,10 @@ To get a dev build into a VM:
   mkdir -p /tmp/agent-serve
   cp .build/release/phantom-agent /tmp/agent-serve/
   ./make-install-script.sh /tmp/agent-serve/phantom-agent \
-    http://192.168.64.1:8642/phantom-agent > /tmp/agent-serve/agent-install.sh
+    http://192.168.64.1:8642/phantom-agent > /tmp/agent-serve/phantom-agent-install.sh
   python3 -m http.server 8642 --directory /tmp/agent-serve &
 
-  phantom image build my-base --agent-url http://192.168.64.1:8642/agent-install.sh
+  phantom image build my-base --agent-url http://192.168.64.1:8642/phantom-agent-install.sh
   ```
 
 ## Management

phantom-agent/make-install-script.sh

@@ -1,16 +1,16 @@
 #!/bin/sh
 # Emits a self-contained phantom-agent installer to stdout.
 #
-#   make-install-script.sh <binary> <binary-url> > agent-install.sh
+#   make-install-script.sh <binary> <binary-url> > phantom-agent-install.sh
 #
-# The emitted script is what ships as the `agent-install.sh` release asset:
+# The emitted script is what ships as the `phantom-agent-install.sh` release asset:
 # it downloads <binary-url>, verifies it against the SHA-256 of <binary>
 # (pinned here at generation time — the installer runs as root from a network
 # download, so it must not take the bytes on faith), installs it to
 # /usr/local/bin and loads the launchd daemon. Inside the guest:
 #
-#   curl -fsSL <url-to>/agent-install.sh -o /tmp/agent-install.sh
-#   sudo sh /tmp/agent-install.sh
+#   curl -fsSL <url-to>/phantom-agent-install.sh -o /tmp/phantom-agent-install.sh
+#   sudo sh /tmp/phantom-agent-install.sh
 #
 # The release workflow generates the published asset; for local agent
 # development, generate one against a binary you serve yourself and point

phantom-cli/src/commands/build.ts

@@ -5,7 +5,7 @@ import { waitForVMRunning } from "../lib/wait";
 //
 // Two ways in, one way out. From scratch:
 //   ipsw → vm.create → boot-script (Setup Assistant + agent bootstrap via
-//        curl | sudo sh of the published agent-install.sh) → provision (vsock)
+//        curl | sudo sh of the published phantom-agent-install.sh) → provision (vsock)
 //        → gitlab-runner → [install Xcode] → vm.stop → image.save
 //
 // Or on top of an image built that way — the fast path for layering a toolchain
@@ -68,7 +68,7 @@ const isURL = (s: string) => /^https?:\/\//.test(s);
 
 // The installer URL setup-tahoe.txt fetches; --agent-url rewrites it in place.
 const RELEASE_AGENT_INSTALL_URL =
-  "https://github.com/phantom-vm/phantom/releases/latest/download/agent-install.sh";
+  "https://github.com/phantom-vm/phantom/releases/latest/download/phantom-agent-install.sh";
 
 const sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));
 
@@ -96,7 +96,7 @@ export async function imageBuild(...args: string[]) {
     console.error("                         (skips Setup Assistant and provisioning)");
     console.error("  --boot-script <path>   Setup Assistant script (default: provision/setup-tahoe.txt)");
     console.error("  --provision <path>     Provision script (default: provision/provision.sh)");
-    console.error("  --agent-url <url>      agent-install.sh for the boot script to fetch, instead of");
+    console.error("  --agent-url <url>      phantom-agent-install.sh for the boot script to fetch, instead of");
     console.error("                         the latest GitHub release asset (for agent development)");
     console.error("  --xcode <url|path>     Install Xcode from this .xip (URL fetched inside the guest,");
     console.error("                         local path served to the guest over HTTP)");
@@ -133,7 +133,7 @@ async function run(opts: BuildOptions) {
   let bootCommands = opts.fromImage ? [] : await readScriptLines(opts.bootScript);
 
   // Agent development override: retarget the boot script's installer fetch
-  // from the published release asset to a dev-served agent-install.sh.
+  // from the published release asset to a dev-served phantom-agent-install.sh.
   if (opts.agentUrl && !opts.fromImage) {
     const before = bootCommands;
     bootCommands = bootCommands.map((l) =>

provision/README.md

@@ -13,7 +13,7 @@ IPSW ─▶ vm.create (headless install) ─▶ setup-tahoe.txt (VNC) ─▶ pro
 2. **Setup Assistant** — `phantom vm boot-script <vm-id> --file provision/setup-tahoe.txt`
    drives Setup Assistant over VNC (keystrokes + OCR clicks): creates a local
    admin account `admin`/`admin`, skips every online step, reaches the
-   desktop, and installs the agent by fetching the published `agent-install.sh`
+   desktop, and installs the agent by fetching the published `phantom-agent-install.sh`
    release asset over the guest's NAT network (the installer checks the
    binary against a SHA-256 pinned at release time). After this the agent
    answers on vsock. For a dev agent, see `image build --agent-url` in

provision/setup-tahoe.txt

@@ -8,7 +8,7 @@
 #   phantom vm boot-script <vm-id> --file provision/setup-tahoe.txt
 #
 # No host-side prerequisite: the agent is installed by fetching the published
-# agent-install.sh release asset over the guest's NAT network (the installer
+# phantom-agent-install.sh release asset over the guest's NAT network (the installer
 # verifies the binary against a SHA-256 pinned inside it at release time).
 # When iterating on the agent locally, point the fetch at a dev-served
 # installer instead with `image build --agent-url` (see phantom-agent/README.md).
@@ -83,7 +83,7 @@
 # binary, checks the pinned SHA-256, and loads the launchd daemon. sudo reads
 # the password from stdin. The retries wait out a NAT link that is still
 # settling on first use.
-curl -fsSL --retry 5 --retry-connrefused --retry-all-errors -o /tmp/agent-install.sh https://github.com/phantom-vm/phantom/releases/latest/download/agent-install.sh && echo admin | sudo -S sh /tmp/agent-install.sh<enter><wait20s>
+curl -fsSL --retry 5 --retry-connrefused --retry-all-errors -o /tmp/phantom-agent-install.sh https://github.com/phantom-vm/phantom/releases/latest/download/phantom-agent-install.sh && echo admin | sudo -S sh /tmp/phantom-agent-install.sh<enter><wait20s>
 
 # Quit Terminal so the saved image boots to a clean desktop (Alt = Command in
 # the guest). The shell is idle now, so Cmd+Q closes it without a prompt.