Installation via curl

One of the primary goals of ZSM is to provide a safe alternative to the dangerous curl | bash pattern. With ZSM, you get the convenience of one-liner installations with the security of a supervised sandbox.

The Pattern

To install software from a remote ZSM script, use the following command:

curl -fsSL https://example.com/install.zsm | zsm

How it Works

When you pipe a script into ZSM, the tool performs the following steps:

1. Source Identification: ZSM reads the # :: url header from the piped input to identify the script source.
2. Security Audit: ZSM parses the declarative headers and displays a summary of all requested permissions (Network, Filesystem, External Tools).
3. Unique Approval: ZSM checks its local cache (~/.cache/zsm) for a previous approval of this specific script and version.
4. Interactive TTY Prompt: If not cached, ZSM opens /dev/tty to ask for your permission. This ensures you can interact with the prompt even though stdin is busy reading the script.
5. Supervised Execution: Once approved, ZSM executes the script logic while enforcing the approved sandbox.

Advantages over curl | bash

| Feature | curl | bash | curl | zsm | | :--- | :--- | :--- | | Trust Model | Blind Trust | Capability-Based | | Auditability | Read 100s of lines of code | Review simple headers | | Persistence | Re-runs code every time | Remembers your approval | | Supervision | Full system access | Blocked unless approved |

Using with Dry-Run

You can safely test a remote installation script before committing to it by adding the --dry-run flag:

curl -fsSL https://example.com/install.zsm | zsm --dry-run

ZSM will show you exactly what it would have done without touching your system.