{"slug": "how-a-3-kb-npm-package-installs-a-330-mb-terminal-app", "title": "How a 3 kB npm package installs a 330 MB terminal app", "summary": "A developer released elpis-cli, a 3 kB npm launcher that installs Elpis, a 330 MB Rust-based agent harness built on OpenAI's Codex, without bundling the binary in the package. Instead of per-platform binary packages, the launcher downloads the binary from a GitHub release on first run, verifying each file against a published SHA-256 checksum and deleting any mismatch before execution, with curl handling proxies and resuming interrupted downloads. Three tests run on every push against a stand-in release server, covering first-run download, cached second run, and checksum rejection; the package is Linux x86_64 only and Elpis remains in alpha.", "body_md": "Elpis is an agent harness for Linux, built on OpenAI's Codex. Until today it installed with a shell script. Now it also installs with npm:\n\n```\nnpm install -g elpis-cli\nelpis\n```\n\nThis post explains one decision: the npm package holds no binary.\n\nThe Elpis terminal app is a Rust binary of about 330 MB, with a code-mode host and a sandbox helper beside it. There are two common ways to put such a program on npm.\n\nThe first way puts the binary in the package, one package for each platform, and lets npm choose. Codex and esbuild do this. It works without a network after the install, but every release uploads hundreds of megabytes to npm for each platform.\n\nThe second way publishes a launcher. The launcher is a small script that downloads the binary when it first runs. I chose this one. Elpis already publishes its binaries on a GitHub release with a SHA-256 file beside each of them, and the install script already reads them from there. The npm package now uses the same three files, so there is one place where a release lives.\n\nA launcher has two costs. The first run needs a network, and you must trust what it downloads.\n\nFor trust, the launcher checks each file against the SHA-256 published beside it. A file that does not match is deleted and is never run. The launcher downloads each file beside its final place and renames it only after the check. A stopped download cannot leave a half file that runs later.\n\nFor the network, the launcher uses curl when curl is present. curl follows your proxy settings, and a cut connection carries on from where it stopped. I added that after my own first try: the connection was cut at 32 MB of the largest file. The next run finished the same file.\n\nThree tests run on every push against a stand-in release server. A first run downloads the files, checks them, runs the app, and passes its arguments and exit status through. A second run downloads nothing. A file with a wrong checksum is refused.\n\nI also packed the package, installed the packed file into an empty folder, and ran it against the real release. It downloaded 0.5.1 and printed `elpis 0.5.1`.\n\nThe package runs on Linux x86_64 only, because Elpis publishes a binary for that platform only. It installs the terminal app; the desktop app still installs with the script in the README. Elpis is alpha.\n\nThe code is in `packaging/npm` of [https://github.com/MasihMoafi/Elpis](https://github.com/MasihMoafi/Elpis).", "url": "https://wpnews.pro/news/how-a-3-kb-npm-package-installs-a-330-mb-terminal-app", "canonical_source": "https://dev.to/masihmoafi/how-a-3-kb-npm-package-installs-a-330-mb-terminal-app-21a2", "published_at": "2026-11-12 06:07:13+00:00", "updated_at": "2026-11-12 06:21:19.225547+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-products"], "entities": ["Elpis", "OpenAI", "Codex", "npm", "GitHub", "MasihMoafi", "curl"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-a-3-kb-npm-package-installs-a-330-mb-terminal-app", "markdown": "https://wpnews.pro/news/how-a-3-kb-npm-package-installs-a-330-mb-terminal-app.md", "text": "https://wpnews.pro/news/how-a-3-kb-npm-package-installs-a-330-mb-terminal-app.txt", "jsonld": "https://wpnews.pro/news/how-a-3-kb-npm-package-installs-a-330-mb-terminal-app.jsonld"}}