CLI release home: agentic to cli
Candle CLI releases moved from candledottv/agentic to candledottv/cli. Every release through 0.12.0 was published and signed in candledottv/agentic, and stays there. Every later release, starting with 0.13.5, is published and signed in candledottv/cli. No version is published from both. Package names did not change.
What to do
Section titled “What to do”| You installed with | Do this | What happens |
|---|---|---|
curl -fsSL https://candle.tv/install.sh | bash | candle update, and run it once more if you were below 0.12.0 | Below 0.12.0, the first run reaches 0.12.0, the final release from candledottv/agentic. From 0.12.0 on, candle update reads candledottv/cli. A fresh install comes from candledottv/cli. |
| Homebrew | brew upgrade candle | The formula points at whichever repository published the release. Nothing else to do. |
| npm | npm i -g @candledottv/cli@latest | Same package name. Its repository and issue links point at candledottv/cli. |
bunx github:candledottv/agentic | Keep using it, or move to bunx github:candledottv/cli, npm or the installer | Both repositories carry the current CLI build. For signed, checked updates, use the installer, Homebrew or npm. |
| A coding-agent plugin or marketplace entry | Nothing yet | Plugin sources stay in candledottv/agentic for now. |
If 0.12.0 ever finds no release in candledottv/cli (the 404 bridge path), it says so and leaves itself installed:
candle 0.12.0 is the final release from candledottv/agentic. Later releases come from candledottv/cli, which has not published one yet. Nothing was changed.That message’s “has not published one yet” describes that bridge moment only. As of 2026-11-11, candledottv/cli has published cli-v0.13.5 through cli-v0.13.20, so a 0.12.0 binary running candle update today reads its manifest from candledottv/cli and updates normally.
Which signature a release must carry
Section titled “Which signature a release must carry”The version decides the repository, and the repository decides the only signing identity that is accepted. The CLI and the installer both apply this rule, and a downloaded manifest cannot change it.
| Version | Repository | Exact signing identity |
|---|---|---|
| 0.12.0 and earlier | candledottv/agentic | https://github.com/candledottv/agentic/.github/workflows/release.yaml@refs/tags/cli-v<version> |
| after 0.12.0 | candledottv/cli | https://github.com/candledottv/cli/.github/workflows/release.yaml@refs/tags/cli-v<version> |
The issuer is always https://token.actions.githubusercontent.com. The commands for checking a download by hand are on Verify a Candle release. Or let the CLI do it: candle verify <file> --bundle <file>.sigstore.json takes the version from the latest.json beside the bundle and applies the table above.
Installing an older release
Section titled “Installing an older release”candle update --to cli-v<version> and install.sh --to cli-v<version> look the tag up in its own version’s repository: --to cli-v0.11.39 reads candledottv/agentic, --to cli-v0.13.5 reads candledottv/cli. They take only a release tag of that form. Old tags, assets and URLs stay where they are. Nothing downgrades you automatically.
What is refused
Section titled “What is refused”Each of these stops before anything is installed:
- a manifest from one repository naming a version released from the other (
MANIFEST_INVALID) - a pinned manifest that describes a different tag than the one asked for (
MANIFEST_INVALID) - a version that is not three numbers (
MANIFEST_INVALID) - a signature from the other repository, another workflow or another tag (
UPDATE_VERIFY_FAILED) - a checksum that disagrees with
SHA256SUMSorlatest.json, or a file swapped for another platform’s (UPDATE_VERIFY_FAILED) - a security key helper that fails any check: neither the binary nor the helper is replaced
A signature mismatch is never a reason to try the other repository.