@pipobscure/bundle
The packager everything below ships with. A Node.js app and its whole dependency tree become one self-contained archive that installs as a single executable — nothing else left on the machine to reconcile.
One file in, one command to install
Every archive carries a per-file digest, installs as a single launcher on your
PATH, and is kept current with bundle update. Trust is checked
at install time through atproto attestations — the first install of a tool asks
you to accept its publisher, and every install after that verifies against the record.
- Installs on macOS, Linux and Windows
- Needs Node.js 26.11.1 or newer — the launcher finds a suitable node itself,
from your
PATHor from a version manager (nvm, fnm, volta, asdf, mise, n), and refuses to run an app on one that is too old
Install the bundle tool
# with Node.js 26.11.1+ already present
npx -y @pipobscure/bundle install
# without npm — straight from the GitHub release
curl -LO https://github.com/pipobscure/bundles/releases/latest/download/bundle.nzip
node --experimental-vfs --vfs-load ./bundle.nzip installThe command-line tools
Each tool installs with the bundle tool above. Every command answers
--json with stable exit codes, secrets live in the operating system's own
credential store, and each tool's generated reference states which commands read and which
write — so an agent can check before it acts.
atcli
Bluesky and the wider atproto network, from the command line, for people and for agents. Timelines, threads, search, posting, likes and reposts, notifications and DMs — signed in through OAuth in your browser.
Ships as a single signed file; every release on tangled carries one, and
bundle update keeps it current.
dns
Query DNS, and manage records and zones at hosting providers, from the shell. The app speaks records and zones; every provider is a plugin — install only the ones you use, starting with deSEC.
Nothing on npm: the app and its plugins ship as bundles.
tangled.org/pipobscure.com/dns ↗tangled
A command-line client for tangled.org, in the
spirit of GitHub's gh: repositories, issues, pull requests, CI and release
files. Pushes to knots over HTTPS with your atproto account — no SSH keys.
A client for the parts of LinkedIn a member can officially do today — publish a post, comment, react, and know who you are. The atcli architecture applied to LinkedIn's member surface, and a working demonstration of what a member-grade API could look like.
tangled.org/emma.ordner.fyi/linkedin ↗What an install means
One model for all of them — chosen deliberately, and the same on every machine these run on.
One file per tool
The archive carries the app and all of its dependencies. Nothing is installed outside the launcher and its own state.
Kept current, not re-installed
bundle update moves an installed
tool to its newest published version; the trust decision travels with it.
Attested, and checked
Publishers vouch for archives through atproto records; installs verify the digest and the attestation before anything runs.
Write-marked for agents
The generated reference classifies every command as read or write, and refuses to generate while anything is unmarked — an agent can read the boundary before it crosses one.
All of it is open source.
Read the code, file issues, or build a tool of your own on the same pattern.