fix: bun.lock update

* feat(cli): add install scripts for macOS, Linux, and Windows

Bash script (install.sh) for macOS/Linux and PowerShell script
(install.ps1) for Windows. Both download the correct platform binary
from GitHub Releases with checksum verification, version resolution,
and PATH setup.

* fix(cli): address PR review comments for install scripts

- Add checksum verification to install.ps1 using Get-FileHash
- Add warnings on all checksum skip paths in install.sh
- Use grep -F (fixed-string) instead of regex for filename matching
- Add ?per_page=100 to GitHub API call in install.ps1
- Use random temp directory name in install.ps1 to avoid collisions

* fix(cli): address installer review feedback

.github/workflows/release-cli.yml

@@ -1,16 +1,24 @@
 name: Release CLI
 
 on:
-  push:
-    tags:
-      - "cli/v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Release version (e.g. 0.1.0)"
+        required: true
+        type: string
 
-permissions:
-  contents: write
+concurrency:
+  group: release-cli
+  cancel-in-progress: false
 
 jobs:
   release:
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     defaults:
       run:
         working-directory: packages/browseros-agent/apps/cli
@@ -30,10 +38,85 @@ jobs:
       - name: Run vet
         run: go vet ./...
 
-      - uses: goreleaser/goreleaser-action@v6
-        with:
-          version: "~> v2"
-          args: release --clean
-          workdir: packages/browseros-agent/apps/cli
+      - name: Build all platforms
+        run: |
+          VERSION="${{ inputs.version }}"
+          LDFLAGS="-s -w -X main.version=${VERSION}"
+          DIST="dist"
+          mkdir -p "$DIST"
+
+          for pair in darwin/amd64 darwin/arm64 linux/amd64 linux/arm64 windows/amd64 windows/arm64; do
+            OS="${pair%/*}"
+            ARCH="${pair#*/}"
+            BIN="browseros-cli"
+            EXT=""
+            if [ "$OS" = "windows" ]; then EXT=".exe"; fi
+
+            echo "Building ${OS}/${ARCH}..."
+            GOOS=$OS GOARCH=$ARCH CGO_ENABLED=0 go build -trimpath -ldflags "$LDFLAGS" -o "${DIST}/${BIN}${EXT}" .
+
+            ARCHIVE="browseros-cli_${VERSION}_${OS}_${ARCH}"
+            if [ "$OS" = "windows" ]; then
+              (cd "$DIST" && zip "${ARCHIVE}.zip" "${BIN}${EXT}")
+            else
+              (cd "$DIST" && tar czf "${ARCHIVE}.tar.gz" "${BIN}")
+            fi
+            rm "${DIST}/${BIN}${EXT}"
+          done
+
+          (cd "$DIST" && sha256sum *.tar.gz *.zip > checksums.txt)
+          echo "=== Built artifacts ==="
+          ls -lh "$DIST"
+
+      - name: Generate release notes
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          CLI_PATH="packages/browseros-agent/apps/cli"
+          TAG="browseros-cli-v${{ inputs.version }}"
+          PREV_TAG=$(git tag -l "browseros-cli-v*" --sort=-v:refname | grep -v "^${TAG}$" | head -n 1)
+
+          if [ -z "$PREV_TAG" ]; then
+            echo "Initial release of browseros-cli." > /tmp/release-notes.md
+          else
+            COMMITS=$(git log "$PREV_TAG"..HEAD --pretty=format:"%H" -- "$CLI_PATH")
+
+            if [ -z "$COMMITS" ]; then
+              echo "No notable changes." > /tmp/release-notes.md
+            else
+              echo "## What's Changed" > /tmp/release-notes.md
+              echo "" >> /tmp/release-notes.md
+
+              while IFS= read -r SHA; do
+                SUBJECT=$(git log -1 --pretty=format:"%s" "$SHA")
+                PR_NUM=$(gh api "/repos/${{ github.repository }}/commits/${SHA}/pulls" --jq '.[0].number // empty' 2>/dev/null)
+
+                if [ -n "$PR_NUM" ] && ! echo "$SUBJECT" | grep -qF "(#${PR_NUM})"; then
+                  echo "- ${SUBJECT} (#${PR_NUM})" >> /tmp/release-notes.md
+                else
+                  echo "- ${SUBJECT}" >> /tmp/release-notes.md
+                fi
+              done <<< "$COMMITS"
+            fi
+          fi
+        working-directory: ${{ github.workspace }}
+
+      - name: Create tag and release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          TAG="browseros-cli-v${{ inputs.version }}"
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+          if ! git rev-parse "$TAG" >/dev/null 2>&1; then
+            git tag -a "$TAG" -m "browseros-cli v${{ inputs.version }}"
+            git push origin "$TAG"
+          fi
+
+          CLI_DIST="packages/browseros-agent/apps/cli/dist"
+          gh release create "$TAG" \
+            --title "browseros-cli v${{ inputs.version }}" \
+            --notes-file /tmp/release-notes.md \
+            ${CLI_DIST}/*
+        working-directory: ${{ github.workspace }}

README.md

@@ -43,6 +43,24 @@
 
 4. Start automating!
 
+## Install `browseros-cli`
+
+Use `browseros-cli` when you want to control BrowserOS from the terminal or scripts via the BrowserOS MCP server.
+
+### macOS / Linux
+
+```bash
+curl -fsSL https://cdn.browseros.com/cli/install.sh | bash
+```
+
+### Windows
+
+```powershell
+irm https://cdn.browseros.com/cli/install.ps1 | iex
+```
+
+After install, run `browseros-cli init` to point the CLI at your BrowserOS MCP server.
+
 ## What makes BrowserOS special
 - 🏠 Feels like home — same Chrome interface, all your extensions just work
 - 🤖 AI agents that run on YOUR browser, not in the cloud
@@ -164,4 +182,3 @@ Thank you to all our supporters!
 Built with ❤️ from San Francisco
 </p>
 
-

packages/browseros-agent/apps/agent/CHANGELOG.md

@@ -1 +1,6 @@
 # BrowserOS Agent Extension
+
+## v0.0.52 (2026-03-26)
+
+Initial release
+

packages/browseros-agent/apps/agent/entrypoints/app/ai-settings/McpPromoBanner.tsx

@@ -17,7 +17,7 @@ export const McpPromoBanner: FC = () => {
   }
 
   return (
-    <div className="relative flex items-center gap-4 rounded-xl border border-border bg-card p-4 shadow-sm transition-all hover:shadow-md">
+    <div className="flex items-center gap-4 rounded-xl border border-border bg-card p-4 shadow-sm transition-all hover:shadow-md">
       <div className="flex h-10 w-10 shrink-0 items-center justify-center rounded-lg bg-[var(--accent-orange)]/10">
         <Server className="h-5 w-5 text-[var(--accent-orange)]" />
       </div>
@@ -48,7 +48,7 @@ export const McpPromoBanner: FC = () => {
       <button
         type="button"
         onClick={() => setDismissed(true)}
-        className="absolute top-2 right-2 rounded-sm p-1 text-muted-foreground opacity-50 transition-opacity hover:opacity-100"
+        className="shrink-0 rounded-sm p-1 text-muted-foreground opacity-50 transition-opacity hover:opacity-100"
       >
         <X className="h-3.5 w-3.5" />
       </button>

packages/browseros-agent/apps/cli/.env.production.example

@@ -0,0 +1,7 @@
+# Production upload env for CLI installer scripts
+
+R2_ACCOUNT_ID=
+R2_ACCESS_KEY_ID=
+R2_SECRET_ACCESS_KEY=
+R2_BUCKET=browseros
+R2_UPLOAD_PREFIX=cli

packages/browseros-agent/apps/cli/.goreleaser.yml

@@ -2,6 +2,9 @@ version: 2
 
 project_name: browseros-cli
 
+monorepo:
+  tag_prefix: browseros-cli-
+
 builds:
   - main: .
     binary: browseros-cli

packages/browseros-agent/apps/cli/CHANGELOG.md

@@ -0,0 +1 @@
+# BrowserOS CLI

packages/browseros-agent/apps/cli/scripts/install.ps1

@@ -0,0 +1,147 @@
+#
+# Install browseros-cli for Windows — downloads the latest release binary.
+#
+# Usage (PowerShell — save and run):
+#   Invoke-WebRequest -Uri "https://cdn.browseros.com/cli/install.ps1" -OutFile install.ps1
+#   .\install.ps1
+#   .\install.ps1 -Version "0.1.0" -Dir "C:\tools\browseros"
+#
+# Usage (one-liner, uses env vars for options):
+#   & { $env:BROWSEROS_VERSION="0.1.0"; irm https://cdn.browseros.com/cli/install.ps1 | iex }
+#
+
+param(
+    [string]$Version = "",
+    [string]$Dir = ""
+)
+
+$ErrorActionPreference = "Stop"
+
+# TLS 1.2 — required for GitHub, older PS 5.1 defaults to TLS 1.0
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+$Repo = "browseros-ai/BrowserOS"
+$Binary = "browseros-cli"
+
+# When piped via irm | iex, param() is ignored — fall back to env vars
+if (-not $Version) { $Version = $env:BROWSEROS_VERSION }
+if (-not $Dir) { $Dir = if ($env:BROWSEROS_DIR) { $env:BROWSEROS_DIR } else { "$env:LOCALAPPDATA\browseros-cli\bin" } }
+
+# ── Resolve latest version ───────────────────────────────────────────────────
+
+if (-not $Version) {
+    Write-Host "Fetching latest version..."
+    $releases = Invoke-RestMethod "https://api.github.com/repos/$Repo/releases?per_page=100"
+    $tag = ($releases `
+        | Where-Object { $_.tag_name -match "^browseros-cli-v" -and $_.tag_name -notmatch "-rc" } `
+        | Select-Object -First 1).tag_name
+    if (-not $tag) {
+        Write-Error "Could not determine latest version. Try: -Version 0.1.0"
+        exit 1
+    }
+    $Version = $tag -replace "^browseros-cli-v", ""
+}
+
+Write-Host "Installing browseros-cli v$Version..."
+
+# ── Detect architecture ──────────────────────────────────────────────────────
+
+# $env:PROCESSOR_ARCHITECTURE lies under x64 emulation on ARM64 Windows.
+# Use .NET RuntimeInformation when available, fall back to PROCESSOR_ARCHITEW6432.
+$Arch = "amd64"
+try {
+    $osArch = [System.Runtime.InteropServices.RuntimeInformation]::OSArchitecture
+    if ($osArch -eq [System.Runtime.InteropServices.Architecture]::Arm64) { $Arch = "arm64" }
+} catch {
+    if ($env:PROCESSOR_ARCHITEW6432 -eq "ARM64" -or $env:PROCESSOR_ARCHITECTURE -eq "ARM64") {
+        $Arch = "arm64"
+    }
+}
+
+if (-not [Environment]::Is64BitOperatingSystem) {
+    Write-Error "32-bit Windows is not supported."
+    exit 1
+}
+
+# ── Download and extract ─────────────────────────────────────────────────────
+
+$Tag = "browseros-cli-v$Version"
+$Filename = "${Binary}_${Version}_windows_${Arch}.zip"
+$Url = "https://github.com/$Repo/releases/download/$Tag/$Filename"
+$ChecksumUrl = "https://github.com/$Repo/releases/download/$Tag/checksums.txt"
+$TmpDir = Join-Path ([System.IO.Path]::GetTempPath()) ("browseros-cli-install-" + [System.IO.Path]::GetRandomFileName())
+
+try {
+    New-Item -ItemType Directory -Path $TmpDir | Out-Null
+
+    $ZipPath = Join-Path $TmpDir $Filename
+
+    Write-Host "Downloading $Url..."
+    Invoke-WebRequest -Uri $Url -OutFile $ZipPath -UseBasicParsing
+
+    $ChecksumPath = Join-Path $TmpDir "checksums.txt"
+    $ChecksumAvailable = $true
+    try {
+        Invoke-WebRequest -Uri $ChecksumUrl -OutFile $ChecksumPath -UseBasicParsing
+    } catch {
+        $ChecksumAvailable = $false
+        Write-Warning "Could not fetch checksums.txt; skipping checksum verification. $($_.Exception.Message)"
+    }
+
+    if ($ChecksumAvailable) {
+        $ExpectedChecksum = $null
+        foreach ($line in Get-Content $ChecksumPath) {
+            $parts = $line -split '\s+', 2
+            if ($parts.Length -eq 2 -and $parts[1] -eq $Filename) {
+                $ExpectedChecksum = $parts[0].ToLowerInvariant()
+                break
+            }
+        }
+
+        if ($ExpectedChecksum) {
+            $ActualChecksum = (Get-FileHash -Path $ZipPath -Algorithm SHA256).Hash.ToLowerInvariant()
+            if ($ActualChecksum -ne $ExpectedChecksum) {
+                Write-Error "Checksum mismatch (expected $ExpectedChecksum, got $ActualChecksum)"
+                exit 1
+            }
+            Write-Host "Checksum verified."
+        } else {
+            Write-Warning "Checksum not found in checksums.txt; skipping checksum verification."
+        }
+    }
+
+    Expand-Archive -Path $ZipPath -DestinationPath $TmpDir -Force
+
+    $Exe = Get-ChildItem -Path $TmpDir -Filter "$Binary.exe" -File -Recurse | Select-Object -First 1
+    if (-not $Exe) {
+        Write-Error "Binary not found in archive."
+        exit 1
+    }
+
+    # ── Install ──────────────────────────────────────────────────────────────
+
+    if (-not (Test-Path $Dir)) {
+        New-Item -ItemType Directory -Path $Dir -Force | Out-Null
+    }
+
+    Move-Item -Force $Exe.FullName (Join-Path $Dir "$Binary.exe")
+
+    Write-Host "Installed $Binary.exe to $Dir"
+} finally {
+    if (Test-Path $TmpDir) { Remove-Item -Recurse -Force $TmpDir -ErrorAction SilentlyContinue }
+}
+
+# ── PATH ─────────────────────────────────────────────────────────────────────
+
+$UserPath = [Environment]::GetEnvironmentVariable("Path", "User")
+$PathEntries = $UserPath -split ";" | Where-Object { $_ -ne "" }
+if ($Dir -notin $PathEntries) {
+    Write-Host ""
+    Write-Host "Adding $Dir to your user PATH..."
+    [Environment]::SetEnvironmentVariable("Path", "$Dir;$UserPath", "User")
+    $env:Path = "$Dir;$env:Path"
+    Write-Host "Done. Restart your terminal for PATH changes to take effect."
+}
+
+Write-Host ""
+Write-Host "Run 'browseros-cli --help' to get started."

packages/browseros-agent/apps/cli/scripts/install.sh

@@ -0,0 +1,153 @@
+#!/usr/bin/env bash
+#
+# Install browseros-cli — downloads the latest release binary for your platform.
+#
+# Usage:
+#   curl -fsSL https://cdn.browseros.com/cli/install.sh | bash
+#
+#   # Or with options:
+#   curl -fsSL https://cdn.browseros.com/cli/install.sh | bash -s -- --version 0.1.0 --dir /usr/local/bin
+
+set -euo pipefail
+
+REPO="browseros-ai/BrowserOS"
+BINARY="browseros-cli"
+INSTALL_DIR="${HOME}/.browseros/bin"
+
+# ── Parse arguments ──────────────────────────────────────────────────────────
+
+VERSION=""
+CUSTOM_DIR=""
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --version)
+      [[ $# -lt 2 ]] && { echo "Error: --version requires a value" >&2; exit 1; }
+      VERSION="$2"; shift 2 ;;
+    --dir)
+      [[ $# -lt 2 ]] && { echo "Error: --dir requires a value" >&2; exit 1; }
+      CUSTOM_DIR="$2"; shift 2 ;;
+    --help)
+      echo "Usage: install.sh [--version VERSION] [--dir INSTALL_DIR]"
+      echo ""
+      echo "  --version   Install a specific version (default: latest)"
+      echo "  --dir       Install directory (default: ~/.browseros/bin)"
+      exit 0
+      ;;
+    *) echo "Unknown option: $1" >&2; exit 1 ;;
+  esac
+done
+
+[[ -n "$CUSTOM_DIR" ]] && INSTALL_DIR="$CUSTOM_DIR"
+
+# ── Resolve latest version ───────────────────────────────────────────────────
+
+if [[ -z "$VERSION" ]]; then
+  # Use per_page=1 with a tag name filter via the releases endpoint.
+  # The tags all start with "browseros-cli-v" so we grab page 1 of those.
+  VERSION=$(curl -fsSL "https://api.github.com/repos/${REPO}/releases?per_page=100" \
+    | grep -o '"tag_name": *"browseros-cli-v[^"]*"' \
+    | grep -v -- "-rc" \
+    | head -1 \
+    | sed 's/.*browseros-cli-v//; s/"//')
+
+  if [[ -z "$VERSION" ]]; then
+    echo "Error: could not determine latest version." >&2
+    echo "  Try: install.sh --version 0.1.0" >&2
+    exit 1
+  fi
+fi
+
+echo "Installing browseros-cli v${VERSION}..."
+
+# ── Detect platform ──────────────────────────────────────────────────────────
+
+OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+ARCH=$(uname -m)
+
+case "$OS" in
+  darwin) OS="darwin" ;;
+  linux)  OS="linux" ;;
+  *)      echo "Error: unsupported OS: $OS" >&2; exit 1 ;;
+esac
+
+case "$ARCH" in
+  x86_64|amd64) ARCH="amd64" ;;
+  arm64|aarch64) ARCH="arm64" ;;
+  *)             echo "Error: unsupported architecture: $ARCH" >&2; exit 1 ;;
+esac
+
+# ── Download and extract ─────────────────────────────────────────────────────
+
+FILENAME="${BINARY}_${VERSION}_${OS}_${ARCH}.tar.gz"
+TAG="browseros-cli-v${VERSION}"
+URL="https://github.com/${REPO}/releases/download/${TAG}/${FILENAME}"
+CHECKSUM_URL="https://github.com/${REPO}/releases/download/${TAG}/checksums.txt"
+
+TMPDIR_DL=$(mktemp -d)
+trap 'rm -rf "$TMPDIR_DL"' EXIT
+
+echo "Downloading ${URL}..."
+curl -fSL --progress-bar -o "${TMPDIR_DL}/${FILENAME}" "$URL"
+
+# Verify checksum if sha256sum/shasum is available
+if curl -fsSL -o "${TMPDIR_DL}/checksums.txt" "$CHECKSUM_URL" 2>/dev/null; then
+  expected=$(awk -v filename="$FILENAME" '$2 == filename { print $1; exit }' "${TMPDIR_DL}/checksums.txt")
+  if [[ -n "$expected" ]]; then
+    if command -v sha256sum >/dev/null 2>&1; then
+      actual=$(sha256sum "${TMPDIR_DL}/${FILENAME}" | awk '{print $1}')
+    elif command -v shasum >/dev/null 2>&1; then
+      actual=$(shasum -a 256 "${TMPDIR_DL}/${FILENAME}" | awk '{print $1}')
+    else
+      actual=""
+      echo "Warning: no sha256sum/shasum found; skipping checksum verification." >&2
+    fi
+    if [[ -n "$actual" && "$actual" != "$expected" ]]; then
+      echo "Error: checksum mismatch (expected ${expected}, got ${actual})" >&2
+      exit 1
+    fi
+    [[ -n "$actual" ]] && echo "Checksum verified."
+  else
+    echo "Warning: checksum not found in checksums.txt; skipping verification." >&2
+  fi
+else
+  echo "Warning: could not fetch checksums.txt; skipping checksum verification." >&2
+fi
+
+tar -xzf "${TMPDIR_DL}/${FILENAME}" -C "$TMPDIR_DL"
+
+BINARY_PATH="${TMPDIR_DL}/${BINARY}"
+if [[ ! -f "$BINARY_PATH" ]]; then
+  BINARY_PATH=$(find "$TMPDIR_DL" -type f -name "$BINARY" -print -quit)
+fi
+
+if [[ -z "$BINARY_PATH" || ! -f "$BINARY_PATH" ]]; then
+  echo "Error: binary not found in archive." >&2
+  exit 1
+fi
+
+# ── Install ──────────────────────────────────────────────────────────────────
+
+mkdir -p "$INSTALL_DIR"
+mv "$BINARY_PATH" "${INSTALL_DIR}/${BINARY}"
+chmod +x "${INSTALL_DIR}/${BINARY}"
+
+echo "Installed ${BINARY} to ${INSTALL_DIR}/${BINARY}"
+
+# ── PATH hint ────────────────────────────────────────────────────────────────
+
+if ! echo "$PATH" | tr ':' '\n' | grep -qx "$INSTALL_DIR"; then
+  echo ""
+  echo "Add browseros-cli to your PATH:"
+  echo ""
+
+  SHELL_NAME=$(basename "${SHELL:-/bin/bash}")
+  case "$SHELL_NAME" in
+    zsh)  echo "  echo 'export PATH=\"${INSTALL_DIR}:\$PATH\"' >> ~/.zshrc && source ~/.zshrc" ;;
+    fish) echo "  fish_add_path ${INSTALL_DIR}" ;;
+    *)    echo "  echo 'export PATH=\"${INSTALL_DIR}:\$PATH\"' >> ~/.bashrc && source ~/.bashrc" ;;
+  esac
+fi
+
+echo ""
+echo "Run 'browseros-cli --help' to get started."

packages/browseros-agent/bun.lock

@@ -231,7 +231,7 @@
     },
     "packages/agent-sdk": {
       "name": "@browseros-ai/agent-sdk",
-      "version": "0.0.5",
+      "version": "0.0.7",
       "dependencies": {
         "eventsource-parser": "^3.0.6",
         "zod-to-json-schema": "^3.24.1",

packages/browseros-agent/package.json

@@ -21,6 +21,7 @@
     "build:server": "FORCE_COLOR=1 bun scripts/build/server.ts --target=all",
     "build:server:ci": "FORCE_COLOR=1 bun scripts/build/server.ts --target=all --compile-only",
     "build:server:test": "FORCE_COLOR=1 bun scripts/build/server.ts --target=darwin-arm64 --no-upload",
+    "upload:cli-installers": "bun scripts/build/cli.ts",
     "start:server:test": "bun run build:server:test && set -a && . apps/server/.env.development && set +a && dist/prod/server/.tmp/binaries/browseros-server-darwin-arm64",
     "build:agent:dev": "FORCE_COLOR=1 bun run --filter @browseros/agent --elide-lines=0 build:dev",
     "build:agent": "bun run codegen:agent && bun run --filter @browseros/agent build",

packages/browseros-agent/scripts/build/cli.ts

@@ -0,0 +1,9 @@
+#!/usr/bin/env bun
+
+import { runCliInstallerUpload } from './cli/upload'
+
+runCliInstallerUpload().catch((error) => {
+  const message = error instanceof Error ? error.message : String(error)
+  console.error(`\n✗ ${message}\n`)
+  process.exit(1)
+})

packages/browseros-agent/scripts/build/cli/config.ts

@@ -0,0 +1,52 @@
+import { existsSync, readFileSync } from 'node:fs'
+import { join } from 'node:path'
+
+import { parse } from 'dotenv'
+
+import type { R2Config } from '../server/types'
+
+const PROD_ENV_PATH = join('apps', 'cli', '.env.production')
+const PROD_ENV_TEMPLATE_PATH = join('apps', 'cli', '.env.production.example')
+
+function pickEnv(name: string, fileEnv: Record<string, string>): string {
+  const value = process.env[name] ?? fileEnv[name]
+  if (!value || value.trim().length === 0) {
+    throw new Error(`Missing required environment variable: ${name}`)
+  }
+  return value
+}
+
+function loadProdEnv(rootDir: string): Record<string, string> {
+  const prodEnvPath = join(rootDir, PROD_ENV_PATH)
+  if (!existsSync(prodEnvPath)) {
+    const templatePath = join(rootDir, PROD_ENV_TEMPLATE_PATH)
+    if (existsSync(templatePath)) {
+      throw new Error(
+        `Missing ${PROD_ENV_PATH}. Create it from ${PROD_ENV_TEMPLATE_PATH} before running upload:cli-installers.`,
+      )
+    }
+    throw new Error(
+      `Missing ${PROD_ENV_PATH}. The template file ${PROD_ENV_TEMPLATE_PATH} was not found.`,
+    )
+  }
+  return parse(readFileSync(prodEnvPath, 'utf-8'))
+}
+
+export interface CliUploadConfig {
+  r2: R2Config
+}
+
+export function loadCliUploadConfig(rootDir: string): CliUploadConfig {
+  const fileEnv = loadProdEnv(rootDir)
+  return {
+    r2: {
+      accountId: pickEnv('R2_ACCOUNT_ID', fileEnv),
+      accessKeyId: pickEnv('R2_ACCESS_KEY_ID', fileEnv),
+      secretAccessKey: pickEnv('R2_SECRET_ACCESS_KEY', fileEnv),
+      bucket: pickEnv('R2_BUCKET', fileEnv),
+      downloadPrefix: '',
+      uploadPrefix:
+        process.env.R2_UPLOAD_PREFIX ?? fileEnv.R2_UPLOAD_PREFIX ?? 'cli',
+    },
+  }
+}

packages/browseros-agent/scripts/build/cli/upload.ts

@@ -0,0 +1,56 @@
+import { existsSync } from 'node:fs'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { log } from '../log'
+import { createR2Client, joinObjectKey, uploadFileToObject } from '../server/r2'
+import { loadCliUploadConfig } from './config'
+
+const CDN_BASE_URL = 'https://cdn.browseros.com'
+
+const INSTALLERS = [
+  {
+    filePath: join('apps', 'cli', 'scripts', 'install.sh'),
+    objectName: 'install.sh',
+    contentType: 'text/x-shellscript; charset=utf-8',
+  },
+  {
+    filePath: join('apps', 'cli', 'scripts', 'install.ps1'),
+    objectName: 'install.ps1',
+    contentType: 'text/plain; charset=utf-8',
+  },
+] as const
+
+export async function runCliInstallerUpload(): Promise<void> {
+  const rootDir = resolve(dirname(fileURLToPath(import.meta.url)), '../../..')
+  process.chdir(rootDir)
+  await uploadCliInstallers(rootDir)
+}
+
+export async function uploadCliInstallers(rootDir: string): Promise<void> {
+  const { r2 } = loadCliUploadConfig(rootDir)
+  const client = createR2Client(r2)
+
+  log.header('Uploading BrowserOS CLI installer scripts')
+
+  try {
+    for (const installer of INSTALLERS) {
+      const absolutePath = join(rootDir, installer.filePath)
+      if (!existsSync(absolutePath)) {
+        throw new Error(`Installer script not found: ${installer.filePath}`)
+      }
+
+      const objectKey = joinObjectKey(r2.uploadPrefix, installer.objectName)
+      log.step(`Uploading ${installer.filePath}`)
+      await uploadFileToObject(client, r2, objectKey, absolutePath, {
+        contentType: installer.contentType,
+      })
+      log.success(`Uploaded ${objectKey}`)
+      log.info(`${CDN_BASE_URL}/${objectKey}`)
+    }
+
+    log.done('CLI installer upload completed')
+  } finally {
+    client.destroy()
+  }
+}

packages/browseros-agent/scripts/build/server/r2.ts

@@ -10,6 +10,10 @@ import {
 
 import type { R2Config } from './types'
 
+export interface UploadFileOptions {
+  contentType?: string
+}
+
 function createClientConfig(r2: R2Config): S3ClientConfig {
   return {
     region: 'auto',
@@ -81,6 +85,7 @@ export async function uploadFileToObject(
   r2: R2Config,
   key: string,
   filePath: string,
+  options: UploadFileOptions = {},
 ): Promise<void> {
   const data = await readFile(filePath)
   await client.send(
@@ -88,7 +93,7 @@ export async function uploadFileToObject(
       Bucket: r2.bucket,
       Key: key,
       Body: data,
-      ContentType: 'application/zip',
+      ContentType: options.contentType ?? 'application/zip',
     }),
   )
 }