PAI installer

One-shot, idempotent bootstrapper for PAI (Personal AI Infrastructure). Closes the bespoke-install gap that today blocks team onboarding and disaster recovery.

PAI itself is a scaffolding framework around AI — turning a model into something more useful by giving it structure (algorithm, memory, hooks, skills, observability) and an identity (your TELOS, your DA). See the upstream PAI project for full doctrine.

This repo ships the installer only. The PAI source itself lives in a separate repo that you (or your team) own — typically a private fork-style mirror sanitized of personal data.

Quick start

# Direct
curl -fsSL https://raw.githubusercontent.com/Luo0oo/pai-installer/main/install.sh | \
  bash -s -- --source git@github.com:<your-org>/<your-pai-source>.git

# Local clone first (if you want to read it before running)
git clone https://github.com/Luo0oo/pai-installer.git
cd pai-installer
./install.sh --source git@github.com:<your-org>/<your-pai-source>.git

# Dry-run (no writes, prints every command)
./install.sh --source <url> --prefix /tmp/pai-test --dry-run

Flags

Flag	Required	Default	Purpose
--source <url>	yes	—	git URL to clone PAI from (a private or public PAI source repo)
--prefix <dir>	no	~/.claude	install prefix (PAI lands at $PREFIX/PAI/)
--branch <name>	no	main	git branch
--dry-run	no	off	print every command without executing
--yes, -y	no	off	skip confirmations (stash local changes on re-run, etc)
--help, -h	no	—	print usage

What it does

1. OS detection — linux / macos / wsl. Anything else exits with error.
2. bun install — skips if already on PATH. Otherwise pulls the official bun installer.
3. PAI clone or update — clones if missing; git pull --ff-only if present + clean; skips with warning if dirty (unless --yes).
4. USER scaffold — only if USER/TELOS/ is empty. Creates empty TELOS files + PRINCIPAL_IDENTITY.md and DA_IDENTITY.md pointer stubs. Never touches a populated USER/.
5. settings.json scaffold — only if absent. If present, writes a timestamped .bak and leaves the original. The template is intentionally minimal — PAI's CLAUDE.md @-imports do the real work at runtime.
6. Post-install message — points to /interview as the next user action.

What it does NOT do

• Install MCP servers, codex CLI, ffmpeg, whisper, or any optional binaries
• Generate API keys or run any OAuth flow
• Run /interview (prints reminder instead)
• Touch existing personal content under USER/ if any TELOS file is already present
• Overwrite settings.json without a timestamped backup

Safety guards

• Refuses --prefix /, $HOME, or empty string — explicit "you probably don't mean this" check
• Refuses to overwrite a non-git directory at the target PAI path
• Never auto-confirms destructive ops without --yes
• set -eu + set -o pipefail — fails loud, not silent

Idempotency

Each step is "already done?" → skip OR "need to do" → do. Re-running on a fully-installed box does nothing destructive. Re-running with --branch develop fetches that branch into the same prefix.

After install

1. Open Claude Code in ~/.claude/PAI/ (or wherever your prefix lands)
2. Run /interview — populates USER/PRINCIPAL_IDENTITY, USER/DA_IDENTITY, and USER/TELOS/*
3. Read DOCUMENTATION/PAISystemArchitecture.md — orientation to the framework
4. Customize USER/DA_IDENTITY.md — give your DA a name and voice that's yours

Team onboarding flow

The intended pattern: one person on the team owns a private sanitized PAI source repo, invites teammates as collaborators, and shares this installer URL. Each teammate runs the installer pointing at the shared source — they get the framework, then populate their own personal USER/ via /interview.

Personal USER/ and MEMORY/ stay personal — they're in .gitignore upstream, never committed to the shared source.

v1 gaps (tracked, not blocking)

• POSIX-strict rewrite (currently uses bash-isms)
• Optional-CLI installer (codex, ffmpeg, whisper, etc.)
• Per-OS bun-install fallback (currently uses bun's own installer; no apt/brew path)
• shellcheck CI pass

License

Public installer code. The PAI source you point it at is your own repo with whatever license you've chosen.