Homebrew on macOS

Install the CLI, Python SDK, Claude Code plugin and Console from the private fclimited/atfgraph-dist repository. Apple Silicon and Intel Macs are supported. The first Homebrew release is macOS-only; Linux users can use npm or the shell installer.

First install

Install Homebrew and GitHub CLI first. Your GitHub account needs read access only to atfgraph-dist; implementation repositories are not needed. On Apple Silicon, Homebrew installs Python 3.12 as a dependency. On Intel, install Python 3.11 or newer first and ensure it and gh are on PATH; the formula uses that interpreter instead of requiring unavailable dependency bottles.

gh auth login
gh auth setup-git
brew tap fclimited/atfgraph https://github.com/fclimited/atfgraph-dist.git
export HOMEBREW_GITHUB_API_TOKEN="$(gh auth token --hostname github.com)"
brew install --cask fclimited/atfgraph/atfgraph-console --appdir="$HOME/Applications"

The cask depends on the CLI formula, which installs the managed SDK/build tools and registers the local atfgraph-local marketplace if Claude Code is present. Install Claude Code first to receive the plugin automatically. No model calls or ATFGraph sign-in are performed during installation. Restart Claude afterward.

To install just the CLI, SDK and plugin:

brew install fclimited/atfgraph/atfgraph

If your Homebrew version requests trust, authorize these two specific packages:

brew trust --formula fclimited/atfgraph/atfgraph
brew trust --cask fclimited/atfgraph/atfgraph-console

"$(brew --prefix)/opt/atfgraph/bin/atfg" login
open "$HOME/Applications/ATFGraph Console.app"

Choose your team and environment in Console. Nodes execute on the graph service; the Mac app displays their deployments and runs. A Linux guest has its own session. If a guest occupies port8020, stop it during Mac sign-in and restart it afterward. This release is not yet notarized by Apple; Homebrew does not bypass Gatekeeper.

Private authentication

Git authentication allows tapping/updating the private repository. Release downloads use GitHub CLI's authenticated release API and are checked against pinned SHA256 checksums. There is no unauthenticated mirror fallback in the Brew installation. The HOMEBREW_GITHUB_API_TOKEN variable makes the credential available in Brew's restricted download environment. Keep it in the current shell, not in the recipes, a committed file or a token-bearing URL. Do not print/share its value. Organization access, SSO and token-expiry policies still apply. After installation:

unset HOMEBREW_GITHUB_API_TOKEN

The Brew route uses GitHub Releases, so npm registry credentials and read:packages are unnecessary. GitHub repository read access remains required.

Upgrades and repair

export HOMEBREW_GITHUB_API_TOKEN="$(gh auth token --hostname github.com)"
brew update
brew upgrade fclimited/atfgraph/atfgraph
brew upgrade --cask fclimited/atfgraph/atfgraph-console
unset HOMEBREW_GITHUB_API_TOKEN

Close Console before upgrading. If SDK/plugin setup fails, or Claude Code was installed afterward, rerun brew postinstall fclimited/atfgraph/atfgraph, then run the Homebrew binary's doctor --local. SDK/plugin assets are already staged in the Cellar; this repair does not need private GitHub credentials. Brew can report a post-install warning while retaining the formula, so a successful doctor --local and plugin registration are the setup completion checks.

Homebrew owns its Cellar CLI and the installed app. SDK and plugin data use ~/.atfgraph; existing standalone CLI binaries and shell profiles are not replaced. If an older executable takes precedence, use the absolute Homebrew path above or adjust your PATH yourself. The CLI and Console use the usual shared Mac sign-in.

brew uninstall --cask fclimited/atfgraph/atfgraph-console
brew uninstall fclimited/atfgraph/atfgraph

Uninstall preserves sign-in, SDK/plugin data and node files. It does not revoke cloud access or delete cloud resources. No broad zap cleanup is provided.

Release maintenance and verification

go run ./cmd/release brew renders recipes from the selected, checksum-pinned native manifest and installer version. After distribution publication succeeds, CI tests authenticated downloads, denial with invalid credentials, the real cask installation with its CLI dependency, managed Python builds and actual Claude plugin registration on Apple Silicon and Intel runners. It then advances the tap. If verification fails, the previous recipes remain in place.

All test/orchestration code is Go; only Homebrew's required recipes/downloader are Ruby. go run ./cmd/check-brew --fetch-only checks downloads on a developer Mac without installing software. Full installation verification requires a disposable CI runner. Tests use temporary SDK, Claude, trust, cache and app directories and perform no sign-in, deployment or inference.