v1.1.1: First-run welcome + branded install
A small, polish-focused release. Bare `beekeeper` now greets you with a branded welcome banner, and the site ships branded install scripts (curl | sh and irm | iex) that download the signed binary with a progress bar and verify its checksum. Carries the install-posture threat-model docs accuracy pass. No enforcement behavior changed; same signed supply chain as every release.
Overview
Beekeeper v1.1.1 is a small, polish-focused release. It changes no enforcement
behavior and needs no migration. It improves the first thing you see after
installing Beekeeper, and gives the silent go install a branded alternative.
Highlights
1. First-run welcome banner
Running bare beekeeper (no subcommand) now greets you with a branded banner: a
honeycomb mark, the build version, and the one-line purpose, followed by the usual
command help.
__
/ \ BEEKEEPER 1.1.1
\__/ Real-time safety harness for autonomous coding agentsIt is plain ASCII (no ANSI), so it stays legible in pipes and logs, and every subcommand path is unchanged.
2. Branded install scripts
go install is silent by design: its download output is the Go toolchain's, with
no hook for branding or a progress bar. So the site now serves a branded install
path that downloads the signed prebuilt binary instead:
- macOS / Linux:
curl -fsSL https://beekeeper-web-web.vercel.app/install.sh | sh - Windows:
irm https://beekeeper-web-web.vercel.app/install.ps1 | iex
Each prints a Beekeeper banner, shows a real download progress bar, verifies the
SHA-256 against checksums.txt, installs the binary (and adds it to your PATH on
Windows), and points you at the signature-verification commands below. go install
remains supported as the from-source path.
3. Install-posture docs accuracy
The threat model and docs were reconciled with the shipped install posture: the retired package-manager nudge replaced by the tool-agnostic posture checked at the hook, and the SENTRY-009 install-observation rule.
Download and verify
Like every release, v1.1.1 is reproducibly built, cosign-signed (keyless, via GitHub Actions OIDC), and ships SLSA Level 3 provenance and a CycloneDX SBOM.
Release assets include signed binaries, checksums, SLSA L3 provenance, and a CycloneDX SBOM.
Verification
gh -R home-beekeeper/beekeeper release download v1.1.1 --pattern "checksums.txt" --pattern "checksums.txt.sigstore.json" --pattern "multiple.intoto.jsonl" --pattern "beekeeper_1.1.1_linux_amd64.tar.gz*"cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json --certificate-identity-regexp '^https://github\.com/home-beekeeper/beekeeper/' --certificate-oidc-issuer 'https://token.actions.githubusercontent.com'slsa-verifier verify-artifact beekeeper_1.1.1_linux_amd64.tar.gz --provenance-path multiple.intoto.jsonl --source-uri github.com/home-beekeeper/beekeeper --source-tag v1.1.1Examples use the linux_amd64 archive; swap _linux_amd64.tar.gz for your platform (_darwin_arm64.tar.gz, _windows_amd64.zip, and so on). A CycloneDX SBOM (*.cdx.json) is also attached for dependency auditing. See Installation for per-OS verification.
Notes
No enforcement behavior changed and there is nothing to migrate. The install scripts download the same signed artifacts you can verify above.
v1.1.2: Hook fail-close fix + self-catalog key rotation
A reliability and security release. Agent-harness hooks now embed the absolute beekeeper binary path so a hook cannot silently fail open when beekeeper is off the PATH, and the embedded self-catalog signing key was rotated off a key whose private half lived in the test suite. No enforcement behavior changed; same signed supply chain as every release.
v1.1.0: Install Posture
The package-manager nudge is retired and replaced by install posture: a default, tool-agnostic posture checked at the agent hook. Three rules (release age, lifecycle scripts, git or remote-URL dependencies) warn by default and fail soft. A read-only beekeeper posture view, scoped audited overrides, per-rule opt-up to block, and a new Sentry install-observation rule (SENTRY-009) round out the release, alongside an honest enforcement boundary.