Install

$ curl -fsSL https://partyline.sh/install.sh | sh   # macOS + Linux
brew install partyline-sh/tap/partyline          # macOS

Then open the session manager:

$ ptln

No Partyline account is required. Install and authenticate the agents you want to use separately.

Requirements

Choose an installation method

The binary is partyline, with ptln symlinked beside it. The docs use ptln.

The script and the cask verify the signature for you and fail closed. dpkg, rpm and a direct download do not — verify those yourself before installing.

You do not need cosign first. With none on your PATH the script fetches a copy pinned by SHA-256 in the script itself, uses it, and discards it. No flag and no variable skips verification.

A release can reach Linux before macOS: when Apple notarization fails, the release is published for Linux and macOS is added to the same release later. On a Mac in that period the script says so and installs the newest release that has a macOS build, and Homebrew stays on that release.

The script installs into the first writable directory already on your PATH out of /usr/local/bin and /opt/homebrew/bin, else ~/.local/bin. To read it first: curl -fsSL https://partyline.sh/install.sh | less.

Script variables

None of them weakens verification: whatever a mirror serves must carry a signature from partyline's release workflow, or the install aborts. The signing identity cannot be overridden.

Check it worked

$ ptln version
ptln memory hooks

ptln version prints the version and whether a newer one exists. ptln memory hooks lists the engines installed here, which refresh repository facts during a session, and which need a trust grant first. Both only read.

ptln help lists every command; man ptln works after install.

Verify a manual download

The install script and the Homebrew cask both do this automatically. Do it by hand if you took a .deb, .rpm or direct download — or to check it yourself.

A release is verified one way: a cosign signature over checksums.txt, made by partyline's release workflow. checksums.txt covers every archive, so trusting that one file transfers to the tarball.

tag=vX.Y.Z
base=https://github.com/partyline-sh/cli/releases/download/$tag

curl -fLO $base/partyline_${tag#v}_darwin_arm64.tar.gz
curl -fLO $base/checksums.txt
curl -fLO $base/checksums.txt.sigstore.json

cosign verify-blob checksums.txt \
--bundle checksums.txt.sigstore.json \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity https://github.com/partyline-sh/partyline/.github/workflows/release.yml@refs/tags/$tag

You want Verified OK. Then check the archive against the now-trusted file:

shasum -a 256 -c checksums.txt --ignore-missing   # macOS
sha256sum -c checksums.txt --ignore-missing      # Linux

Two flags in that command do the checking:

• --certificate-identity names release.yml in partyline-sh/partyline at your tag: the source repository, not partyline-sh/cli where the files are published. A signature from any other repository, workflow or tag is a valid signature over a different release.
• --certificate-oidc-issuer must be GitHub's; otherwise a certificate from any issuer Sigstore trusts would pass.

Signing is keyless: there is no private key to protect. Fulcio issues a short-lived certificate for the release workflow run, the signature is recorded in the Rekor transparency log, and the key material is discarded. The check establishes that the file came from partyline's release workflow at that tag.

Older cosign: 2.4 to 2.x needs --new-bundle-format; 2.3 and earlier has no bundle support, so fetch checksums.txt.sig and checksums.txt.pem and pass --signature and --certificate.

A SHA-256 check alone is not enough. It detects a corrupt download, not a replaced one: anyone who could replace the archive could replace checksums.txt too.

Is your cosign actually checking?

A verifier that approves everything gives the same output on a valid file. Append a line and it must fail:

cp checksums.txt tampered.txt
echo "0000000000000000000000000000000000000000000000000000000000000000  evil.tar.gz" >> tampered.txt
cosign verify-blob tampered.txt --bundle checksums.txt.sigstore.json \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity https://github.com/partyline-sh/partyline/.github/workflows/release.yml@refs/tags/$tag

If that prints Verified OK, the check above proved nothing. Both install paths run this control automatically.

macOS code signing

Separately from cosign, the macOS binaries are Developer ID signed and notarized:

codesign --verify --strict --verbose=2 ./partyline

A bare executable is not an app bundle, so stapler validate reports "does not have a ticket stapled" and spctl -a -t exec reports "does not seem to be an app". Neither is a failure; codesign --verify is the check that applies.

Build from source

git clone https://github.com/partyline-sh/cli.git
cd cli
go build -o partyline .
./partyline version    # prints "dev"

Any binary not built by the release workflow reports dev, and a dev build never runs the update check.

ptln is a symlink you make yourself from a source build: ln -s "$PWD/partyline" ~/.local/bin/ptln.

The source is MIT-licensed and published to partyline-sh/cli with every release.

Staying up to date

$ ptln upgrade

It upgrades the way partyline was installed: brew upgrade for Homebrew, otherwise the install script, so an upgrade is verified the same way as the first install. ptln update is an alias.

At most once a day partyline checks GitHub for a newer release and prints a one-line notice. Set PARTYLINE_NO_UPDATE_CHECK=1 to turn the check off.

If an engine update requires its running instances to stop, run ptln tmux --quit first. ptln --resume reopens the sessions afterwards.