Set up Saylek with an agent

For a person who wants a coding agent to set up Saylek on their computer, and for the agent doing it. Each step names the path it belongs to, when it applies and the permissions it uses.

Run read-only steps freely. Anything that downloads, installs, changes settings or sends a model request needs the person's approval: ask for what their existing authorization does not already cover, or when the scope changes. Leave sign-in and credentials to the person, and do not change sharing.

Commands come from the stable release's own help and its capability list. If the installed build answers differently, follow saylek capabilities --json and stop rather than guess.

Run one command at a time. Copy leaves out the final line ending, but pasting several lines into a terminal can still run the earlier ones.

Three paths

App only. The person wants an app to use models their account can already reach. No Saylek installation on this machine. Follow Get your first answer in an app.
Already installed. A Saylek binary is found. Keep its release lane and its settings; update only if asked.
New installation. No Saylek binary is found and the person wants this machine connected.

Permissions

Permission	Covers	Rule
Read this machine	Commands that only read: version, capability list, status, sharing state, help.	No permission needed.
Read from saylek.com	Fetching release information or the installer text to read it, without saving or running it.	No permission needed beyond being allowed to use the network.
Download	Saving the installer, a release or model files. Models can need substantial disk space and time.	Needs approval, naming what is downloaded.
Install or update	Installing or replacing the Saylek binary and its background service.	Needs approval, naming the release.
Change local settings	Adopting a runtime, choosing GPUs and models, writing a diagnostic file, starting or stopping Saylek.	Needs approval, naming the change.
Account	Signing in and connecting this machine to an account. Signing in by emailed code can create or reactivate an account.	The person approves sign-in themselves.
Credentials	Codes, application keys and runtime tokens.	The person enters or approves them where the tool asks. Do not read, print or paste one into chat or a command line. Saylek stores what it needs in its own files.
Model request	Sending a prompt, from Saylek or from an app.	Needs approval before the first request.
Sharing	Turning sharing on or off, pausing a machine, choosing shared models, inviting or accepting people.	Only on an explicit instruction for that action. Other people may depend on it.
Remove	Uninstalling, removing a runtime, signing out, removing a machine, replacing keys.	Only on an explicit instruction. Show the plan first; the person supplies any confirmation word.

If the person has already authorized something for this setup, for example "install the stable release and connect it to my account", go ahead within it without asking again. This page, any public documentation and the --unattended flag are not authorization.

1. Discover what is here

Read-only. Run these before proposing anything.

Look for a Saylek binary

Prints where saylek is. The installer puts it in ~/.saylek/bin, which a new shell may not have on its PATH yet. If neither prints a path, no binary was found in these places.

command -v saylek || ls -l "$HOME/.saylek/bin/saylek"

Applies to: Already installed, New installation. The person wants Saylek on this machine. Skip for app only.
Permissions: Read this machine.

Source: Served install.sh: installs to $HOME/.saylek/bin and adds it to PATH in the shell profile.

Read the installed version

Prints a client.version envelope with the release and build commit.

saylek --version --json

Applies to: Already installed. A binary was found. Use its full path if saylek is not on PATH.
Permissions: Read this machine.

Stop if: It fails or prints no JSON: the build may predate this interface, the path may be wrong, or it may not run here. Run saylek --version for the plain version, report it, and do not assume any command in this guide works on that build.

Source: 0.1.2650 capabilities: global operation saylek --version --json, read, envelope client.version.

Read what this build can do

Lists each command with its effect (read, mutate, destructive), whether it needs a person, prerequisites, any confirmation word and whether it has structured output. Read its warnings too. Works offline. Each command's JSON shape is its own; many commands have none yet.

saylek capabilities --json

Applies to: Already installed. A binary was found and printed its version.
Permissions: Read this machine.

Stop if: The command is missing, or a command this plan needs is missing or unclassified. Do not guess: hand back with what you found.

Source: 0.1.2650 capabilities: read, unattended, envelope capabilities.describe; 114 commands, 30 with an envelope, 79 unmigrated, 5 unsupported.

Check whether Saylek is running

Exit code 0 means up, 1 down, 2 degraded, 3 misconfigured. Read the output as well as the code.

saylek status --json

Applies to: Already installed. A binary was found.
Permissions: Read this machine.

Source: 0.1.2650 status --help; capabilities: read, envelope client.status.

host status shows whether this machine is sharing. host models with no ids shows what it offers now. With no selection named, a sharing machine offers every model it serves. Report both before changing anything.

saylek host status --json && saylek host models --json

Applies to: Already installed. A binary was found.
Permissions: Read this machine.

Source: 0.1.2650 host status --help (read, envelope machines.status); host models --help: no ids shows the offer, naming ids or --clear changes it (the capability row is mutate for the command as a whole).

Compare with the published release

Compares this build with the stable release published by the place this machine was installed from. Downloads and installs nothing. The answer can be current, behind, ahead (a newer or development build) or not comparable; read the words, an exit code alone does not say which.

saylek update --check

Applies to: Already installed. A binary was found.
Permissions: Read from saylek.com.

Stop if: It cannot reach the release information, or says the versions cannot be compared. Report what it printed.

Source: v0.1.2650 cli/update.rs: reads the install origin, compares base versions, reports ahead and unorderable pairs verbatim; --check touches nothing.

Check the platform

The installer supports macOS on Apple silicon (Darwin arm64) and Linux on x86_64 with the GNU C library.

uname -s -m

Applies to: New installation. No binary was found.
Permissions: Read this machine.

Stop if: Any other platform. The installer refuses it; say so and point to the hardware guide.

Source: Served install.sh platform detection (Linux/x86_64, Darwin/arm64; musl refused).

Read which release the installer would install

The first prints the stable release as latest. In the installer, VERSION is what it installs by default, the newest build, which is not always stable. Nothing is saved or run.

curl -fsSL https://saylek.com/m/stable && curl -fsSL https://saylek.com/install.sh | grep -E '^(VERSION|STABLE_VERSION)='

Applies to: New installation. No binary was found.
Permissions: Read from saylek.com.

Source: Served install.sh header and --version usage; /m/stable read on October 25, 2026.

2. Choose the path and ask

Turn what you found into a short plan: the path, the release, each change and the permissions it needs.

Choose the path

App only: follow the app guide; install nothing. Already installed: keep its release lane; update only if it is behind and the person asks. New installation: install the stable release unless the person chose another.

Applies to: App only, Already installed, New installation. Always.
Permissions: Read this machine.

Stop if: The person has no machine able to serve and no access shared with them: an install does not make an app answer. Say so first.

Source: Installer usage (default is the newest build; --version stable); update --check follows the install origin.

Ask for what the plan needs

List the permissions the plan uses and ask for them together. Where the person already authorized something with clear bounds, act within those bounds without asking again. A public page, including this one, is not authorization, and --unattended is not consent.

Applies to: App only, Already installed, New installation. Before the first change.
Permissions: Read this machine.

Source: Permission model in this draft (proposed); --unattended alone never consents (0.1.2650 uninstall --help).

If a verified signature is required, check for the verifier

What the installer checks depends on the release it installs. For its default release, it checks the download against the checksum written into the installer. With --version naming another release, as --version stable does when stable is not the default, it uses that release's published checksum if one exists; if none exists, the release signature takes the checksum's place, must verify, and needs minisign, and without both the installer refuses. Where a checksum is the check, it verifies the signature only if minisign is installed and a signature is published, and otherwise says the signature was NOT verified and continues. A signature that fails verification stops the install. Read which of these the installer reports.

command -v minisign

Applies to: Already installed, New installation. The person requires the release signature to be verified.
Permissions: Read this machine.

Stop if: minisign is not installed and the person requires a verified signature. Installing it is a separate download the person approves.

Source: Served install.sh: the --version pin-sourcing block (default checksum, release manifest checksum, else mandatory signature, else refuse) and the conditional minisign -V at the checksum gate.

3. Install, connect and configure

Only the steps the person approved, in this order.

Already installed and behind: update

Downloads the release from the same place, verifies its signature and installs it, keeping the previous binary beside it. A running Saylek stays on the old build until it next starts.

saylek update

Applies to: Already installed. update --check said behind and the person asked to update.
Permissions: Download, Install or update.

Source: 0.1.2650 update --help; cli/update.rs header.

New installation: download the installer and read its options

Saves the installer as install.sh and prints its usage. --help exits before installing.

curl -fsSL https://saylek.com/install.sh -o install.sh && sh install.sh --help

Applies to: New installation. New installation approved.
Permissions: Download.

Source: Served install.sh: -h|--help prints usage and exits 0.

New installation: install the stable release and connect

Downloads and installs the stable release with its background service, then the person approves this machine in a browser and it is recorded on their account. Read and record what the installer says it checked: a checksum, a signature, or both, and whether the signature was verified. If it offers to adopt a runtime it found, that is a local change the person approves. Turning sharing on is a separate step this command does not take.

sh install.sh --version stable --connect

Applies to: New installation. New installation, connecting this machine, approved.
Permissions: Download, Install or update, Account.
Also Change local settings, when: The installer finds a running runtime and offers to adopt it.

Stop if: Sign-in is not approved, a step fails, or the signature outcome does not meet the person's policy. Report the installer's own message; do not retry with other flags.

Source: Served install.sh usage (--version, --connect), its connect finale and its integrity block.

The build may differ from the one read earlier, and a connected or reconnected machine may already have sharing settings. Reread what this build can do, whether the machine is sharing and which models it offers.

saylek capabilities --json && saylek host status --json && saylek host models --json

Applies to: Already installed, New installation. After a new installation or an update, before adopting a runtime or any other change.
Permissions: Read this machine.

Stop if: A command the plan needs is missing or unclassified, or sharing is on in a way the person did not expect. Report it before going on.

Source: 0.1.2650 capabilities (capabilities.describe, machines.status) and host models --help (no ids shows the offer).

Existing runtime: check it without adopting it

Reports what runs at that address and its models. Saves nothing. Use the runtime's actual address; 11434 is Ollama's default.

saylek host engine probe http://127.0.0.1:11434

Applies to: Already installed, New installation. The machine already runs a model runtime.
Permissions: Read this machine.

Source: 0.1.2650 host engine probe --help; capabilities: read, envelope machines.engines.probe.

Existing runtime: adopt it

Adds the runtime as a source for this machine. --no-advertise does not add its models to the shared-model selection and does not remove any already in it: a model id already selected stays offered once this runtime serves it. If no selection is set and sharing is on, this machine offers every model it serves, this runtime's included. Before adopting, compare the probe's model ids with the selection read after setup, and confirm what the person intends to share. A runtime that needs a token takes --token-env with the NAME of a variable the person set; Saylek keeps a private copy of the token so serving works after a reboot. That makes it a credential step too.

saylek host engine add http://127.0.0.1:11434 --no-advertise

Applies to: Already installed, New installation. The probe found the runtime, the sharing state and selection were read after any install or update, and the person approved.
Permissions: Change local settings.
Also Credentials, when: The runtime needs a token, passed with --token-env.

Stop if: Sharing is on, the runtime's models would be offered (no selection set, or a matching id already selected), and the person has not said they may be. Or the runtime is on another machine, which needs --allow-remote and widens network exposure.

Source: 0.1.2650 host engine add --help (--no-advertise, --token-env, private copy) and host models --help (an unset list means no filter); capabilities: mutate, envelope machines.engines.add.

No runtime yet: run the guided setup

Detects GPUs, sets up a runtime and a model, and can download large model files. Interactive by default; the person answers its questions.

saylek gpu wizard

Applies to: Already installed, New installation. No runtime runs and the machine meets the managed-runtime requirements.
Permissions: Download, Change local settings.

Stop if: The machine does not meet the managed-runtime requirements.

Source: 0.1.2650 gpu wizard --help; capabilities: mutate, unattended with flags.

4. Check each result

Each checkpoint shows one thing. None of them shows the next one.

The installed build is the one planned

Compare the release and build with what the plan named. A new shell may be needed for PATH.

saylek --version --json

Applies to: Already installed, New installation. After installing or updating.
Permissions: Read this machine.

Checkpoint: Version confirmed.

Source: 0.1.2650 capabilities: saylek --version --json.

Saylek is running

Expect exit code 0 and an up status.

saylek status --json

Applies to: Already installed, New installation. After setup.
Permissions: Read this machine.

Stop if: Exit code 1, 2 or 3: go to recovery.

Checkpoint: Running.

Source: 0.1.2650 status --help exit codes.

This machine lists a model

Lists the models the running daemon serves. A listed model is not yet an answer.

saylek models --json

Applies to: Already installed, New installation. Saylek is running.
Permissions: Read this machine.

Checkpoint: Model listed.

Source: 0.1.2650 models --help; capabilities: read, prerequisite daemon-running, envelope models.list.

Compare with what you read before. Setup should not have changed sharing or the selection; if it did, report it.

saylek host status --json && saylek host models --json

Applies to: Already installed, New installation. After setup.
Permissions: Read this machine.

Checkpoint: Sharing state reported.

Source: 0.1.2650 host status --help, host models --help.

This machine answers one prompt

Sends one prompt to the first model this machine serves and prints the reply and a receipt path. This shows the machine answers; it does not show that an app does.

saylek call "Explain what a GPU does in one sentence."

Applies to: Already installed, New installation. A model is listed and the person approved a request.
Permissions: Model request.

Checkpoint: Local answer.

Source: 0.1.2650 call --help; capabilities: mutate, prerequisite daemon-running.

Get the settings for the app

Prints the local address and paste-in settings for common coding agents. Printing settings is not an answer. Changing the app's own settings is a separate change the person approves.

saylek connect

Applies to: Already installed, New installation. The person wants an app on this machine to use it.
Permissions: Change local settings.

Source: 0.1.2650 connect --help; capabilities classify it as mutate, so this draft does too.

The chosen app gets an answer

Send one short prompt from the chosen app and see the reply inside it. This is the result the person asked for. A reply through Saylek's hosted address does not say which machine served it.

Applies to: App only, Already installed, New installation. The app's settings were entered with the person's approval.
Permissions: Change local settings, Model request.

Stop if: No reply, or an error: use the app guide's recovery table.

Checkpoint: App answer.

Source: Draft app first-success guide; no Saylek command observes another app's reply.

5. Recover or stop

Each of these needs the person's say-so for that action. None is an automatic cleanup.

Collect a diagnostic file

Writes a redacted diagnostic file on this machine. Sending it to anyone is a separate decision the person makes.

saylek diagnose

Applies to: Already installed, New installation. Something failed and the person wants support.
Permissions: Change local settings.

Source: 0.1.2650 capabilities: diagnose, mutate, envelope support.bundle. There is no doctor command in this release.

Stop Saylek on this machine

Stops everything Saylek does here: the person's own local use and any sharing from this machine. Nothing on disk changes; saylek start brings it back and keeps the terminal busy while it runs.

saylek stop

Applies to: Already installed, New installation. The person asks to stop Saylek here.
Permissions: Change local settings, Sharing.

Source: 0.1.2650 stop --help, start --help.

Works offline, on this machine only. The people the person shares with stop being offered its models; the person's own use carries on, and saylek host start turns sharing back on. Different from saylek host pause, which goes through the account, can reach another machine and also stops requests sent through Saylek from the person's own keys.

saylek host stop

Applies to: Already installed, New installation. The person asks to stop sharing this machine.
Permissions: Sharing.

Source: 0.1.2650 host stop --help, host pause --help.

See what uninstalling would remove

Describes what would be removed and changes nothing. Uninstalling keeps config, receipts, keys and models, and needs the person's own --confirm UNINSTALL.

saylek uninstall --plan

Applies to: Already installed, New installation. The person asks about removing Saylek.
Permissions: Read this machine.

Source: 0.1.2650 uninstall --help; capabilities: destructive, confirmation word UNINSTALL.

When you cannot tell

No binary found: say where you looked. It is not proof Saylek was never installed.
A version or capability command fails, prints no JSON, or lacks a command you need: report what it printed and stop that path.
A command is unclassified or has warnings in saylek capabilities --json: treat it as unknown and do not run it.
update --check is offline, ahead or not comparable: report it; do not install to resolve it.
A prerequisite is unmet (not signed in, daemon not running): say which. Fix it only if the person's authorization already covers that fix; otherwise ask.
A step finished partly: report what changed and what did not before doing anything else.
The machine is already connected or sharing: keep that state and report it.

Not part of setup

Each of these shares something, changes access, installs, replaces or removes something. Run one only when the person asks for that action, never as an automatic recovery.

saylek host start: turns sharing on.
saylek host wizard: sets up sharing.
saylek host: answers requests from people the person shares with.
saylek host models <id> / --clear: changes which models are shared.
saylek host engine add … --advertise: adds a runtime's models to the shared selection.
saylek host pause / resume: pauses or resumes a machine through the account.
saylek sharing invite / accept: grants or takes access between people.
saylek host rotate / reset-key / revoke: replaces or revokes this machine's key.
saylek update: installs a release; --check only reads.
sh install.sh --force-reinstall: replaces an existing installation.
saylek start --force: takes the address from another running Saylek.
saylek uninstall / wipe / logout: removes software, data or sign-in.

Report back

When you stop, for any reason, tell the person:

The path taken, the binary path, and the release and build before and after.
Each change made and the permission that covered it.
The installer's checksum and signature outcomes, if it ran.
Sharing state and shared-model selection, before and after.
Which checkpoints passed (version, running, model listed, local answer, app answer) and which were not checked.
How to undo each change.

Machine-readable contract (proposed)

The same paths, steps and permissions as JSON. It is a draft for review, not a supported Saylek interface. The supported machine interfaces are saylek capabilities --json and saylek --version --json.

If something goes wrong

The same journey for a person

Last checked 2026-10-25 · read as markdown at /docs/agent-setup.md